{"id":528,"date":"2026-09-26T18:27:32","date_gmt":"2026-09-26T16:27:32","guid":{"rendered":"https:\/\/servflix.com\/data-processing-agreement\/"},"modified":"2026-09-29T14:55:16","modified_gmt":"2026-09-29T12:55:16","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/servflix.com\/en\/data-processing-agreement\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"528\" class=\"elementor elementor-528 elementor-302\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-16bccb96 e-con e-atomic-element e-flexbox-base e-default-div wps-page \" data-id=\"16bccb96\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"16bccb96\" data-e-type=\"e-flexbox\" data-id=\"16bccb96\">\n    <section class=\"elementor-element elementor-element-3002a102 e-con e-atomic-element e-flexbox-base e-default-section wps-page-hero-glow-center \" data-id=\"3002a102\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"3002a102\" data-e-type=\"e-flexbox\" data-id=\"3002a102\">\n    <div class=\"elementor-element elementor-element-3404f5b6 e-con e-atomic-element e-flexbox-base e-default-div wps-page-hero-inner-legal \" data-id=\"3404f5b6\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"3404f5b6\" data-e-type=\"e-flexbox\" data-id=\"3404f5b6\">\n    <nav class=\"elementor-element elementor-element-509e4f9b e-con e-atomic-element e-flexbox-base e-default-nav wps-breadcrumb \" data-id=\"509e4f9b\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"509e4f9b\" data-e-type=\"e-flexbox\" data-id=\"509e4f9b\">\n    \t\t\t<span class=\"wps-crumb-link e-paragraph-base e-default-span\" data-interaction-id=\"2ccb1eca\" data-e-type=\"widget\" data-id=\"2ccb1eca\"><a href=\"https:\/\/servflix.com\/en\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tHome\n\t<\/a><\/span>\n\t\t\t\t\t<span class=\"wps-crumb-sep e-paragraph-base e-default-span\" data-interaction-id=\"794c101f\" data-e-type=\"widget\" data-id=\"794c101f\">\/<\/span>\n\t\t\t\t\t<span class=\"wps-crumb-current e-paragraph-base e-default-span\" data-interaction-id=\"3f01bcfb\" data-e-type=\"widget\" data-id=\"3f01bcfb\">Legal<\/span>\n\t\t\n<\/nav>\n\t\t\t<h1 data-interaction-id=\"160528a8\" class=\"wps-h1-legal e-heading-base e-default-h1\" data-e-type=\"widget\" data-id=\"160528a8\">Data Processing Agreement<\/h1>\n\t\t\t\t\t<p class=\"wps-lead-legal e-paragraph-base e-default-p\" data-interaction-id=\"365595cd\" data-e-type=\"widget\" data-id=\"365595cd\">Data Processing Agreement pursuant to Art. 28 GDPR<\/p>\n\t\t<nav class=\"elementor-element elementor-element-e07ce8b e-con e-atomic-element e-flexbox-base e-default-nav wps-tab-row \" data-id=\"e07ce8b\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"e07ce8b\" data-e-type=\"e-flexbox\" data-id=\"e07ce8b\">\n    \t\t\t<span class=\"wps-tab e-paragraph-base e-default-span\" data-interaction-id=\"248535d5\" data-e-type=\"widget\" data-id=\"248535d5\"><a href=\"https:\/\/servflix.com\/en\/legal-notice\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tLegal Notice\n\t<\/a><\/span>\n\t\t\t\t\t<span class=\"wps-tab e-paragraph-base e-default-span\" data-interaction-id=\"3b624167\" data-e-type=\"widget\" data-id=\"3b624167\"><a href=\"https:\/\/servflix.com\/en\/privacy-policy\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tPrivacy Policy\n\t<\/a><\/span>\n\t\t\t\t\t<span class=\"wps-tab e-paragraph-base e-default-span\" data-interaction-id=\"4f2f5a59\" data-e-type=\"widget\" data-id=\"4f2f5a59\"><a href=\"https:\/\/servflix.com\/en\/terms-and-conditions\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tTerms &amp; Conditions\n\t<\/a><\/span>\n\t\t\t\t\t<span class=\"wps-tab e-paragraph-base e-default-span\" data-interaction-id=\"1abd5daa\" data-e-type=\"widget\" data-id=\"1abd5daa\"><a href=\"https:\/\/servflix.com\/en\/right-of-withdrawal\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tRight of Withdrawal\n\t<\/a><\/span>\n\t\t\t\t\t<span class=\"wps-tab-active e-paragraph-base e-default-span\" data-interaction-id=\"4989d5d8\" data-e-type=\"widget\" data-id=\"4989d5d8\"><a href=\"https:\/\/servflix.com\/en\/data-processing-agreement\/\" target=\"_self\" class=\"e-paragraph-link-base e-default-a\">\n\t\tData Processing Agreement\n\t<\/a><\/span>\n\t\t\n<\/nav>\n\n<\/div>\n\n<\/section>\n<article class=\"elementor-element elementor-element-57740b43 e-con e-atomic-element e-flexbox-base e-default-article wps-legal-article \" data-id=\"57740b43\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"57740b43\" data-e-type=\"e-flexbox\" data-id=\"57740b43\">\n    <div class=\"elementor-element elementor-element-77880072 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-card \" data-id=\"77880072\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"77880072\" data-e-type=\"e-flexbox\" data-id=\"77880072\">\n    <div class=\"elementor-element elementor-element-8238ad13 e-con e-atomic-element e-flexbox-base e-default-div wps-block-short \" data-id=\"8238ad13\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"8238ad13\" data-e-type=\"e-flexbox\" data-id=\"8238ad13\">\n    <div class=\"elementor-element elementor-element-cc4cbc10 e-con e-atomic-element e-flexbox-base e-default-div wps-notice \" data-id=\"cc4cbc10\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"cc4cbc10\" data-e-type=\"e-flexbox\" data-id=\"cc4cbc10\">\n    \t\t\t<p class=\"wps-notice-strong e-paragraph-base e-default-p\" data-interaction-id=\"9ea23d79\" data-e-type=\"widget\" data-id=\"9ea23d79\">Please note<\/p>\n\t\t\t\t\t<p class=\"wps-notice-text e-paragraph-base e-default-p\" data-interaction-id=\"e61df77d\" data-e-type=\"widget\" data-id=\"e61df77d\">This English translation is provided for your convenience only. In the event of any discrepancy, the <a href=\"https:\/\/servflix.com\/auftragsverarbeitung\/\">German version<\/a> is legally binding.<\/p>\n\t\t\n<\/div>\n\n<\/div>\n\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"b676b4f\" data-e-type=\"widget\" data-id=\"b676b4f\">This agreement specifies the data protection obligations of the contracting parties arising from the contract concluded between them for hosting, domain, email and related services (hereinafter the \u201cMain Agreement\u201d). It applies to all activities in which employees of the Contractor or sub-processors engaged by the Contractor process personal data that the Client provides in the course of using the services or that arise on the systems provided by the Contractor.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3a09e130\" data-e-type=\"widget\" data-id=\"3a09e130\">The legal basis is Art. 28(3) GDPR in conjunction with Section 14 of our Terms and Conditions. The agreement becomes part of the contractual relationship upon conclusion of the Main Agreement. We will provide a separately signed copy upon request at support@servflix.com.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"346f7cc0\" data-e-type=\"widget\" data-id=\"346f7cc0\">Version date: September 23, 2026<br>\nScope: all hosting, managed WordPress, WooCommerce, domain and email services provided by servflix.com<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"32d86ff3\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"32d86ff3\">Client (Controller)<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3df00870\" data-e-type=\"widget\" data-id=\"3df00870\">The Client within the meaning of this agreement is the customer named in the Main Agreement, with the master data stored in their customer account \u2013 company name, address, authorized representative and contact details.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"23ee2b1b\" data-e-type=\"widget\" data-id=\"23ee2b1b\">The Client is the controller within the meaning of Art. 4(7) GDPR for the personal data it processes via the Contractor's services. The Client alone decides on the purposes and means of this processing and assesses its lawfulness. The Client remains responsible for safeguarding the rights of data subjects.<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"5434e641\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"5434e641\">Contractor (Processor)<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"2889130f\" data-e-type=\"widget\" data-id=\"2889130f\">servflix.com<br>\na business unit of Wpress Group LTD<br>\nPiccadilly Business Centre<br>\nAldow Enterprise Park<br>\nManchester, M12 6AE<br>\nUnited Kingdom<\/p>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"7da18138\" data-e-type=\"widget\" data-id=\"7da18138\">Registered in England and Wales<br>\nCompany number: 16682136<br>\nEmail: support@servflix.com<\/p>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"2d49bda9\" data-e-type=\"widget\" data-id=\"2d49bda9\">Data Protection Officer<br>\nJasmine Calvez<br>\nWPress Group LTD, 20 Wenlock Road<br>\nLondon, England, N1 7GU<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"166322c6\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"166322c6\">Section 1 Subject Matter, Term and Termination<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"37818bc4\" data-e-type=\"widget\" data-id=\"37818bc4\">(1) The subject matter of the processing is the provision of the services agreed in the Main Agreement, in particular the provision and operation of server capacity, storage, databases, email mailboxes and domains, as well as the associated maintenance, backup and support services. In doing so, the Contractor processes personal data exclusively on behalf of and in accordance with the instructions of the Client.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"9fcfc26\" data-e-type=\"widget\" data-id=\"9fcfc26\">(2) The term of this agreement corresponds to the term of the Main Agreement. It ends automatically upon termination of the Main Agreement without the need for separate cancellation.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"512c14b6\" data-e-type=\"widget\" data-id=\"512c14b6\">(3) The Client may terminate this agreement at any time without notice if there is a serious breach by the Contractor of data protection regulations or of obligations under this agreement, if an instruction cannot be carried out, or if the Contractor refuses the Client's inspection rights in breach of contract.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"517905e1\" data-e-type=\"widget\" data-id=\"517905e1\">(4) Obligations which by their nature extend beyond the end of the contract \u2013 in particular confidentiality, deletion and return \u2013 remain unaffected by termination.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"7ff2af6e\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"7ff2af6e\">Section 2 Nature, Scope and Purpose of the Processing<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"9647f8d\" data-e-type=\"widget\" data-id=\"9647f8d\">(1) The Contractor processes personal data exclusively for the purpose of providing the contractually owed services. No processing for the Contractor's own purposes takes place.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"1e45da04\" data-e-type=\"widget\" data-id=\"1e45da04\">(2) The processing includes in particular the storage, retention, backup, transfer within the systems used, restoration and deletion of data, as well as read access in the course of support, maintenance and security measures.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5389af90\" data-e-type=\"widget\" data-id=\"5389af90\">(3) The processing takes place in member states of the European Union, in the European Economic Area or in third countries in accordance with Section 11 of this agreement.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"64975c1f\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"64975c1f\">Section 3 Data Categories and Data Subjects<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"6873a644\" data-e-type=\"widget\" data-id=\"6873a644\">(1) Categories of personal data (depending on the Client's specific use):<\/p>\n\t\t<div class=\"elementor-element elementor-element-28e58e65 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"28e58e65\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"28e58e65\" data-e-type=\"e-flexbox\" data-id=\"28e58e65\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"2774d707\" data-e-type=\"widget\" data-id=\"2774d707\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"594ed281\" data-e-type=\"widget\" data-id=\"594ed281\">Master and contact data (name, address, email, phone)<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-54948 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"54948\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"54948\" data-e-type=\"e-flexbox\" data-id=\"54948\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"72cd61db\" data-e-type=\"widget\" data-id=\"72cd61db\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"7029b1a6\" data-e-type=\"widget\" data-id=\"7029b1a6\">Contract and order data, billing and payment data<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-eda5b9d e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"eda5b9d\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"eda5b9d\" data-e-type=\"e-flexbox\" data-id=\"eda5b9d\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"4288532\" data-e-type=\"widget\" data-id=\"4288532\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"4d24bd26\" data-e-type=\"widget\" data-id=\"4d24bd26\">Access and usage data (user accounts, password hashes, log data, IP addresses)<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-45e3deac e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"45e3deac\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"45e3deac\" data-e-type=\"e-flexbox\" data-id=\"45e3deac\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"3f19a69\" data-e-type=\"widget\" data-id=\"3f19a69\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"4124ead6\" data-e-type=\"widget\" data-id=\"4124ead6\">Content data from websites, forms, shops and email mailboxes<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-42ad623c e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"42ad623c\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"42ad623c\" data-e-type=\"e-flexbox\" data-id=\"42ad623c\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"878236b\" data-e-type=\"widget\" data-id=\"878236b\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"7b4f6bf3\" data-e-type=\"widget\" data-id=\"7b4f6bf3\">Communication data and metadata of email traffic<\/span>\n\t\t\n<\/div>\n\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"545ff46f\" data-e-type=\"widget\" data-id=\"545ff46f\">(2) Categories of data subjects:<\/p>\n\t\t<div class=\"elementor-element elementor-element-51677302 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"51677302\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"51677302\" data-e-type=\"e-flexbox\" data-id=\"51677302\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"59ee4e55\" data-e-type=\"widget\" data-id=\"59ee4e55\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"588077d5\" data-e-type=\"widget\" data-id=\"588077d5\">Visitors to the Client's websites and shops<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-23a52a7f e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"23a52a7f\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"23a52a7f\" data-e-type=\"e-flexbox\" data-id=\"23a52a7f\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"346ac778\" data-e-type=\"widget\" data-id=\"346ac778\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"48d5cccd\" data-e-type=\"widget\" data-id=\"48d5cccd\">Customers and prospective customers of the Client<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-1ac14f0c e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"1ac14f0c\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"1ac14f0c\" data-e-type=\"e-flexbox\" data-id=\"1ac14f0c\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"150e2c2e\" data-e-type=\"widget\" data-id=\"150e2c2e\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"26e296fb\" data-e-type=\"widget\" data-id=\"26e296fb\">Employees and contact persons of the Client<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-6a2a0b60 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"6a2a0b60\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"6a2a0b60\" data-e-type=\"e-flexbox\" data-id=\"6a2a0b60\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"63e65919\" data-e-type=\"widget\" data-id=\"63e65919\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"43a5fc44\" data-e-type=\"widget\" data-id=\"43a5fc44\">Suppliers and other business partners of the Client<\/span>\n\t\t\n<\/div>\n\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4ee54066\" data-e-type=\"widget\" data-id=\"4ee54066\">(3) The Client decides on its own responsibility whether to process special categories of personal data pursuant to Art. 9 GDPR on the Contractor's systems and takes the necessary additional protective measures for this.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"7217251a\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"7217251a\">Section 4 Client's Right to Issue Instructions<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"288b09ad\" data-e-type=\"widget\" data-id=\"288b09ad\">(1) The Contractor processes personal data exclusively on documented instructions from the Client, unless it is required to do so by Union or Member State law. In such a case, the Contractor informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5d6e073a\" data-e-type=\"widget\" data-id=\"5d6e073a\">(2) Instructions must generally be given in text form, primarily via the customer account or by email to support@servflix.com. The Client confirms verbal instructions in text form without undue delay.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4d10d2a6\" data-e-type=\"widget\" data-id=\"4d10d2a6\">(3) The processing specified in the Main Agreement, in the service description and in this agreement constitutes the Client's initial instruction. The Client's own configuration of the services via the customer account also constitutes an instruction.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3a301de\" data-e-type=\"widget\" data-id=\"3a301de\">(4) If the Contractor believes that an instruction violates data protection regulations, it informs the Client without undue delay. The Contractor is entitled to suspend execution of the instruction in question until it is confirmed or amended.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"74bdcc88\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"74bdcc88\">Section 5 Obligations of the Contractor<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4e80bd0b\" data-e-type=\"widget\" data-id=\"4e80bd0b\">The Contractor undertakes in particular:<\/p>\n\t\t<div class=\"elementor-element elementor-element-35c66a81 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"35c66a81\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"35c66a81\" data-e-type=\"e-flexbox\" data-id=\"35c66a81\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"4a8000b0\" data-e-type=\"widget\" data-id=\"4a8000b0\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"10fd6ed5\" data-e-type=\"widget\" data-id=\"10fd6ed5\">to process personal data exclusively within the framework of this agreement and in accordance with the Client's instructions;<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-65647059 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"65647059\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"65647059\" data-e-type=\"e-flexbox\" data-id=\"65647059\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"62f67d84\" data-e-type=\"widget\" data-id=\"62f67d84\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"123b99a0\" data-e-type=\"widget\" data-id=\"123b99a0\">to commit all persons authorized to process the data to confidentiality, insofar as they are not already subject to an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR);<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-5181a85 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"5181a85\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"5181a85\" data-e-type=\"e-flexbox\" data-id=\"5181a85\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"78bec96c\" data-e-type=\"widget\" data-id=\"78bec96c\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"6d29a09e\" data-e-type=\"widget\" data-id=\"6d29a09e\">to implement and maintain the technical and organizational measures pursuant to Art. 32 GDPR (Annex 1);<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-38adc57b e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"38adc57b\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"38adc57b\" data-e-type=\"e-flexbox\" data-id=\"38adc57b\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"704ddee3\" data-e-type=\"widget\" data-id=\"704ddee3\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"23c074c1\" data-e-type=\"widget\" data-id=\"23c074c1\">to assist the Client in fulfilling its obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations;<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-e27647f e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"e27647f\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"e27647f\" data-e-type=\"e-flexbox\" data-id=\"e27647f\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"1e3958b1\" data-e-type=\"widget\" data-id=\"1e3958b1\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"5fb9de0e\" data-e-type=\"widget\" data-id=\"5fb9de0e\">to make available to the Client all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR;<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-3c8fddc3 e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"3c8fddc3\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"3c8fddc3\" data-e-type=\"e-flexbox\" data-id=\"3c8fddc3\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"3ed29ea1\" data-e-type=\"widget\" data-id=\"3ed29ea1\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"10071d46\" data-e-type=\"widget\" data-id=\"10071d46\">to maintain a record of all categories of processing activities carried out on behalf of the Client pursuant to Art. 30(2) GDPR;<\/span>\n\t\t\n<\/div>\n<div class=\"elementor-element elementor-element-7ee9256c e-con e-atomic-element e-flexbox-base e-default-div wps-legal-li \" data-id=\"7ee9256c\" data-element_type=\"e-flexbox\" data-e-type=\"e-flexbox\" data-interaction-id=\"7ee9256c\" data-e-type=\"e-flexbox\" data-id=\"7ee9256c\">\n    \t\t\t<span class=\"wps-legal-bullet e-paragraph-base e-default-span\" data-interaction-id=\"4a0003cd\" data-e-type=\"widget\" data-id=\"4a0003cd\">\u2022<\/span>\n\t\t\t\t\t<span class=\"wps-legal-li-text e-paragraph-base e-default-span\" data-interaction-id=\"1337dfd2\" data-e-type=\"widget\" data-id=\"1337dfd2\">to inform the Client without undue delay if a supervisory authority takes measures against it that concern the processing on behalf of the Client.<\/span>\n\t\t\n<\/div>\n\t\t\t<h2 data-interaction-id=\"58649130\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"58649130\">Section 6 Sub-processors<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"43a54d6f\" data-e-type=\"widget\" data-id=\"43a54d6f\">(1) The Client grants the Contractor general authorization to engage further processors (sub-processors). The sub-processors engaged at the time the contract is concluded are listed in Annex 2 and are deemed approved.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"2387de01\" data-e-type=\"widget\" data-id=\"2387de01\">(2) The Contractor informs the Client in text form of any intended change concerning the addition or replacement of sub-processors, generally with four weeks' advance notice. The Client may object to the change within two weeks of receiving the information for an important reason based on data protection law.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"72a75874\" data-e-type=\"widget\" data-id=\"72a75874\">(3) If the Client objects and the affected service cannot be provided without the sub-processor, or only with disproportionate effort, both parties have a special right of termination with regard to the affected service.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"306dfe24\" data-e-type=\"widget\" data-id=\"306dfe24\">(4) The Contractor selects sub-processors carefully, taking particular account of the suitability of the technical and organizational measures they have taken. It contractually imposes on them the same data protection obligations as set out in this agreement (Art. 28(4) GDPR) and is liable for their conduct as for its own.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4df7702d\" data-e-type=\"widget\" data-id=\"4df7702d\">(5) Ancillary services that the Contractor uses from third parties \u2013 such as telecommunications services, postal services, maintenance and user service, cleaning staff, auditors or the disposal of data carriers \u2013 do not constitute sub-processing. The Contractor also takes appropriate precautions to protect the data in this respect.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"66073965\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"66073965\">Section 7 Rights of Data Subjects<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"c3798dd\" data-e-type=\"widget\" data-id=\"c3798dd\">(1) The Contractor assists the Client with appropriate technical and organizational measures in fulfilling its obligation to respond to requests from data subjects under Chapter III of the GDPR (Art. 28(3)(e) GDPR).<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"790ed908\" data-e-type=\"widget\" data-id=\"790ed908\">(2) If a data subject contacts the Contractor directly, the Contractor forwards the request to the Client without undue delay and does not respond to it itself.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"7741ea1d\" data-e-type=\"widget\" data-id=\"7741ea1d\">(3) The Contractor carries out rectification, erasure and restriction of processing only on documented instructions from the Client, insofar as the Client cannot do this itself via the administrative functions provided.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"74bf7a3d\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"74bf7a3d\">Section 8 Notification of Personal Data Breaches<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5b03c3d4\" data-e-type=\"widget\" data-id=\"5b03c3d4\">(1) The Contractor informs the Client without undue delay after becoming aware of a personal data breach (Art. 33(2) GDPR). The notification is sent to the contact address stored in the customer account.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"44d9868d\" data-e-type=\"widget\" data-id=\"44d9868d\">(2) The notification contains, where available: a description of the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences, and the measures taken or proposed to address it.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"1bef9115\" data-e-type=\"widget\" data-id=\"1bef9115\">(3) The Contractor assists the Client with its notification and communication obligations under Art. 33 and 34 GDPR and takes the necessary measures without undue delay to secure the data and mitigate possible adverse consequences.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"1a13f72\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"1a13f72\">Section 9 Verification and Inspection Rights<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3eea1232\" data-e-type=\"widget\" data-id=\"3eea1232\">(1) The Contractor demonstrates compliance with the obligations under this agreement to the Client by appropriate means, in particular through self-disclosure, documentation of the technical and organizational measures, or by presenting current certificates, attestations or reports from independent bodies.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"44e0c4b2\" data-e-type=\"widget\" data-id=\"44e0c4b2\">(2) If this evidence is insufficient in an individual case, the Contractor allows the Client, or an auditor commissioned by the Client and bound to confidentiality, to conduct audits including inspections (Art. 28(3)(h) GDPR).<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"25ff8b31\" data-e-type=\"widget\" data-id=\"25ff8b31\">(3) Inspections take place after timely notice \u2013 generally two weeks \u2013 during normal business hours and without avoidable disruption to operations. The auditor may not be a competitor of the Contractor. The Contractor's trade and business secrets and the data of other customers must be protected.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"16c1fcf\" data-e-type=\"widget\" data-id=\"16c1fcf\">(4) For inspections that go beyond the cooperation required by law or are caused by the Client's fault, the Contractor may demand reasonable remuneration.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"20b1bae1\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"20b1bae1\">Section 10 Deletion and Return of Data<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5b4620a1\" data-e-type=\"widget\" data-id=\"5b4620a1\">(1) After the end of the provision of processing services, the Contractor deletes all personal data or, at the Client's choice, returns it and deletes existing copies, unless Union or Member State law requires storage of the data (Art. 28(3)(g) GDPR).<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"630dacba\" data-e-type=\"widget\" data-id=\"630dacba\">(2) The Client must request the return or deletion of the data in text form no later than the date on which termination of the contract takes effect. If the Client makes no choice, the data will be permanently deleted after a reasonable grace period.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"c27e155\" data-e-type=\"widget\" data-id=\"c27e155\">(3) Backup copies are automatically overwritten and deleted in accordance with the agreed retention cycles. Until final deletion, they remain protected in the same way as production data.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"2083401f\" data-e-type=\"widget\" data-id=\"2083401f\">(4) The Contractor may retain documentation that serves as evidence of proper data processing beyond the end of the contract in accordance with the statutory retention periods.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"b8611fe\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"b8611fe\">Section 11 Processing in Third Countries<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"7ab1875e\" data-e-type=\"widget\" data-id=\"7ab1875e\">(1) Personal data is generally processed in the European Union or the European Economic Area.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"43282aa7\" data-e-type=\"widget\" data-id=\"43282aa7\">(2) The Contractor has its registered office in the United Kingdom. The transfer of personal data to the United Kingdom is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"23492ae3\" data-e-type=\"widget\" data-id=\"23492ae3\">(3) If an adequacy decision does not exist or no longer exists for a recipient country, a transfer will only take place on the basis of appropriate safeguards pursuant to Art. 46 GDPR \u2013 in particular the European Commission's Standard Contractual Clauses \u2013 supplemented by the additional measures required following a transfer impact assessment.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5a58dd98\" data-e-type=\"widget\" data-id=\"5a58dd98\">(4) The Contractor informs the Client of any intended relocation of processing to a third country in accordance with the procedure set out in Section 6 of this agreement.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"44372263\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"44372263\">Section 12 Liability and Final Provisions<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4fd07ed6\" data-e-type=\"widget\" data-id=\"4fd07ed6\">(1) The liability of the parties is governed by Art. 82 GDPR. Otherwise, the liability provisions of the Main Agreement apply, insofar as they are compatible with mandatory data protection law.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"44bb3954\" data-e-type=\"widget\" data-id=\"44bb3954\">(2) Amendments and additions to this agreement must be made in text form. This also applies to any amendment of this form requirement.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"7bf53dc7\" data-e-type=\"widget\" data-id=\"7bf53dc7\">(3) In the event of conflicts between this agreement and the Main Agreement, the provisions of this agreement take precedence insofar as they concern the processing of personal data on behalf of the Client.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"60e9d87a\" data-e-type=\"widget\" data-id=\"60e9d87a\">(4) Should any provision of this agreement be or become invalid, the validity of the remaining provisions remains unaffected. The parties will replace the invalid provision with a valid provision that comes closest economically to the intended purpose.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3c2b1119\" data-e-type=\"widget\" data-id=\"3c2b1119\">(5) Annexes 1 and 2 form part of this agreement.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"13c32572\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"13c32572\">Annex 1 \u2013 Technical and Organizational Measures (Art. 32 GDPR)<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"5af1c730\" data-e-type=\"widget\" data-id=\"5af1c730\">Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, the Contractor takes the following measures to ensure a level of security appropriate to the risk.<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"58df7a9d\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"58df7a9d\">1. Confidentiality<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"3746b575\" data-e-type=\"widget\" data-id=\"3746b575\">Physical access control \u2013 The server systems are operated in data centers with secured buildings, access control systems with logging, video surveillance of security-relevant areas and a visitor policy requiring escort. Only authorized persons are granted access.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"73b0dd36\" data-e-type=\"widget\" data-id=\"73b0dd36\">System access control \u2013 Administrative access takes place via personal, non-shared user accounts. Measures include password policies with minimum complexity, two-factor authentication for administrative access, SSH access via key pairs, automatic lockout after failed attempts and a web application firewall with brute-force protection.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"34eb5e19\" data-e-type=\"widget\" data-id=\"34eb5e19\">Data access control \u2013 Permissions are granted according to the principle of least privilege and based on roles, and are reviewed regularly. Administrative access to customer data only takes place when required in the course of support, maintenance and security measures, and is logged.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4449e1ec\" data-e-type=\"widget\" data-id=\"4449e1ec\">Separation control \u2013 The data of different customers is processed separately. Each customer is managed in their own isolated system environment with separate file system areas, databases and access credentials. Production, test and development environments are separated.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"8c44095\" data-e-type=\"widget\" data-id=\"8c44095\">Pseudonymization \u2013 Where the purpose of processing allows, data is pseudonymized or anonymized, for example by truncating IP addresses in log data.<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"2602eec2\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"2602eec2\">2. Integrity<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"1a3921c5\" data-e-type=\"widget\" data-id=\"1a3921c5\">Transfer control \u2013 Data is transmitted exclusively in encrypted form: TLS for website, panel and email access, SFTP or SSH for file transfers, and encrypted connections for administrative access. Data carriers are securely erased or destroyed before decommissioning.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"7f7d55e8\" data-e-type=\"widget\" data-id=\"7f7d55e8\">Input control \u2013 System access, administrative activities and security-relevant events are logged. The logs are protected against subsequent alteration and retained for a defined period, so that it remains traceable who entered, changed or removed which data and when.<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"7980e0ad\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"7980e0ad\">3. Availability and Resilience<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"dd7672a\" data-e-type=\"widget\" data-id=\"dd7672a\">Availability control \u2013 Redundant power supply with uninterruptible power supply and backup generators, redundant network connectivity, air conditioning, and early fire detection and extinguishing systems in the data centers. The storage systems are designed with redundancy.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4df77803\" data-e-type=\"widget\" data-id=\"4df77803\">Data backup \u2013 Regular, automated backup of customer data according to the cycles agreed in the Main Agreement. Backups are stored separately from the production system; recoverability is tested regularly.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"27ccacb5\" data-e-type=\"widget\" data-id=\"27ccacb5\">Resilience \u2013 Continuous monitoring of system status, load and availability, protective measures against overload and DDoS attacks, and a defined process for security updates to the operating system, server services and applications.<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"60af6948\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"60af6948\">4. Procedures for Regular Testing and Evaluation<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"52812c58\" data-e-type=\"widget\" data-id=\"52812c58\">Data protection management \u2013 Appointed Data Protection Officer, commitment of all employees to confidentiality, regular awareness training and a record of processing activities pursuant to Art. 30(2) GDPR.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"48e3df37\" data-e-type=\"widget\" data-id=\"48e3df37\">Incident response management \u2013 Defined process for the detection, assessment, containment and reporting of security incidents, including the notification obligations under Section 8 of this agreement.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"7883be5\" data-e-type=\"widget\" data-id=\"7883be5\">Data protection by design and by default \u2013 Data-minimizing configuration of systems, secure default settings and review of data protection-relevant changes before going live (Art. 25 GDPR).<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"4aadab62\" data-e-type=\"widget\" data-id=\"4aadab62\">Order control \u2013 Careful selection of sub-processors, written agreements pursuant to Art. 28 GDPR, ongoing monitoring of the agreed protective measures and regular review of the effectiveness of our own measures.<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"ad420d4\" class=\"wps-legal-h2 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"ad420d4\">Annex 2 \u2013 Approved Sub-processors<\/h2>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"66ea7f75\" data-e-type=\"widget\" data-id=\"66ea7f75\">The Contractor uses the following sub-processors as of this version. They are deemed approved pursuant to Section 6(1) of this agreement.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"2539d59f\" data-e-type=\"widget\" data-id=\"2539d59f\">Data center and server infrastructure<br>\nServflix \u00b7 Server system srv72.servflix.com<br>\nProvision and operation of the physical server, network and storage infrastructure, including data backup<\/p>\n\t\t\t\t\t<p class=\"wps-legal-addr e-paragraph-base e-default-p\" data-interaction-id=\"7075898b\" data-e-type=\"widget\" data-id=\"7075898b\">Payment processing<br>\nStripe Payments Europe, Ltd. \u00b7 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland<br>\nProcessing of card and SEPA direct debit payments for paid services<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"78749404\" data-e-type=\"widget\" data-id=\"78749404\">We will provide the complete and current list of sub-processors used, including company name, registered office, place of processing and purpose of processing, upon request at support@servflix.com. We will inform you of changes in accordance with the procedure set out in Section 6(2).<\/p>\n\t\t\t\t\t<h3 data-interaction-id=\"4c801dd7\" class=\"wps-legal-h3 e-heading-base e-default-h3\" data-e-type=\"widget\" data-id=\"4c801dd7\">Request a signed copy<\/h3>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"cf28826\" data-e-type=\"widget\" data-id=\"cf28826\">If you need this Data Processing Agreement as a signed copy for your data protection documentation, send us a short message with your customer number and full company details to support@servflix.com. You will usually receive the signed copy within two business days.<\/p>\n\t\t\t\t\t<p class=\"wps-legal-p e-paragraph-base e-default-p\" data-interaction-id=\"436d4750\" data-e-type=\"widget\" data-id=\"436d4750\">Please direct any data protection questions to our Data Protection Officer Jasmine Calvez, WPress Group LTD, 20 Wenlock Road, London, England, N1 7GU.<\/p>\n\t\t\n<\/div>\n\n<\/article>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"page-builder","ast-site-content-layout":"full-width-container","site-content-style":"unboxed","site-sidebar-style":"unboxed","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-528","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/pages\/528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/comments?post=528"}],"version-history":[{"count":1,"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/pages\/528\/revisions"}],"predecessor-version":[{"id":566,"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/pages\/528\/revisions\/566"}],"wp:attachment":[{"href":"https:\/\/servflix.com\/en\/wp-json\/wp\/v2\/media?parent=528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}