Data processing agreement

1. We process personal data on behalf of the customer to the extent necessary for the services under the main contract. The subject matter, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.
2. This agreement applies for as long as we process the customer's data on its behalf, including beyond the end of the main contract until deletion in accordance with the section End of processing.
3. This agreement does not apply to data we process as a controller in our own right (in particular users' account data, contract and invoice data); our privacy policy applies to such data.

1. We process the data only on documented instructions from the customer, including with regard to transfers to a third country, unless we are required to do so by Union or German law; in that case, we inform the customer of that legal requirement beforehand, unless the law prohibits this.
2. The instructions are conclusively laid down in this agreement, in the main contract and in the settings the customer makes in its portal (for example, publishing a catalog, switching measurement on or off, forwarding inquiries to its own systems). The customer gives further instructions in text form to info@cablecreations.de.
3. If we consider an instruction to be unlawful, we inform the customer without undue delay and may suspend its execution until it is confirmed or changed.

1. We commit all persons who have access to the data to confidentiality, unless they are subject to a statutory obligation of confidentiality.
2. We take the technical and organizational measures under Art. 32 GDPR described in Annex 2. We may develop them further as long as the level of protection does not decrease.
3. We assist the customer with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts us, we forward their request to the customer without undue delay.
4. Taking into account the nature of the processing and the information available to us, we assist the customer with the security of processing, with notifications and communications following personal data breaches, with data protection impact assessments and with prior consultation of the supervisory authority (Art. 32 to 36 GDPR).
5. We inform the customer without undue delay, and no later than 48 hours, after becoming aware of a breach of the protection of its data, with the information under Art. 33(3) GDPR to the extent available to us, and supplement it as soon as we know more.
6. We inform the customer without undue delay of inspections and measures by a supervisory authority insofar as they concern its data.
7. We maintain a record of processing activities carried out on behalf of controllers (Art. 30(2) GDPR).

The customer is responsible for the lawfulness of the processing, in particular for the legal basis, for informing the data subjects (for example, in the privacy policy of its website and its catalog) and, where necessary, for their consent. It informs us without undue delay if it detects errors or irregularities in the processing.

1. The customer approves the use of the sub-processors named in Annex 3. We conclude a contract with each of them that imposes on it the same data protection obligations as this agreement imposes on us, and remain responsible to the customer for their compliance.
2. We notify the customer in text form of a new or different sub-processor at least four weeks before engaging it. The customer may object within this period for an important reason under data protection law. If we cannot resolve the objection through a reasonable change, the customer may terminate the main contract with effect from the date of engagement.
3. Ancillary services that we obtain from third parties without them gaining access to the customer's data, such as telecommunications and computing power for generating images from cable data without personal data, do not constitute sub-processing.

We process the data in the European Union or the European Economic Area. A transfer to a third country takes place only if the requirements of Art. 44 et seq. GDPR are met, and only through the sub-processors named for this purpose in Annex 3.

On request, we provide the customer with the information necessary to demonstrate compliance with our obligations. The customer, or an auditor commissioned by it who is bound to confidentiality and is not our competitor, may audit compliance after giving reasonable notice, usually four weeks, during business hours and without disrupting operations. Current evidence such as certificates of our data centers or information in text form is primarily sufficient. An on-site audit is provided for no more than once per calendar year unless there is a specific reason. Each party may bear its own costs for audits that go beyond the provision of documents; we may charge reasonably for our effort if the audit does not reveal a breach.

1. Until the end of the main contract, the customer can export its content itself at any time.
2. After the end of the paid period, we keep the customer's data for 90 days so that it can still download it, and delete it afterwards unless we are required to retain it under Union or German law. On the customer's instruction, we delete it earlier.
3. Database backups are overwritten after 14 days; deleted files leave the backups 30 days after their deletion. Until then, they are protected against access and are no longer processed.
4. On request, we confirm the deletion in text form.

1. Liability is governed by Art. 82 GDPR; otherwise, the provisions of the main contract apply.
2. In the event of contradictions, this agreement takes precedence over the main contract in matters of data protection.
3. Amendments require text form. The provisions of the main contract apply to the place of jurisdiction and the applicable law.

The purpose is the provision of the platform and the performance of the agreed services. Special categories of personal data (Art. 9 GDPR) are not subject to the processing; the customer does not transfer any such data.