SaaS agreement on Order Processing

§ 1 Subject matter, Duration and Specification of Order Processing

• 1.1

  It is possible for Weiss AG to process personal data for the customer based on the SaaS Service in accordance with the EU Data Protection Basic Regulation (Art. 4 No. 2 and Art. 28 DSGVO) based on this agreement.
• 1.2

  The term of this agreement shall depend on the booking period of the SaaS Service unless obligations beyond this arise from the provisions of this agreement.
• 1.3

  The subject and duration of the order as well as the type and purpose of the processing result from the contract.
• 1.4

  The processing potentially includes any personal data. It is at the sole discretion of the customer whether and which personal data is stored in the VAM2 database. Only the collection and storage of the following personal data is mandatory for the provision of the SaaS Service for a fee: name, e-mail account, age and depending on the payment method used, the respective money transaction data.
• 1.5

  Data processing may potentially affect any group of persons. The customer exclusively determines the data subjects. As a service for storing all data of end users, all data of the end user are stored and are therefore subject to data processing as defined.

§ 2 Obligations of Weiss AG

• 2.1

  Weiss AG processes personal data exclusively as contractually agreed or as instructed by the customer unless Weiss AG is legally obliged to specific processing. If such an obligation exists for Weiss AG, the customer will be informed by Weiss AG before processing, unless notification is prohibited by law. The data provided for processing will under no circumstances be used for purposes beyond this.
• 2.2

  Weiss AG shall take the technical and organizational measures to ensure adequate protection of the customer’s personal data. These measures shall ensure the long-term confidentiality, integrity, availability and resilience of the systems and services in connection with the processing of personal data. These technical and organizational measures are listed in Annex 1. The customer is responsible for ensuring that these provide an appropriate level of protection for the risks of the data to be processed.
• 2.3

  Weiss AG guarantees to comply with its obligations under the EU Data Protection Basic Regulation and to use a procedure to regularly check the effectiveness of the technical and organizational measures to ensure the security of the processing.
• 2.4

  Weiss AG reserves the right to make changes to the technical and organizational measures taken. However, it must be ensured that the contractually agreed level of protection is not undercut.
• 2.5

  Weiss AG shall support the customer, to the extent agreed and within the scope of its possibilities, in fulfilling the requests and claims of persons affected under Chapter III of the DS-GVO as well as in meeting the obligations set out in Articles 33 to 36 of the DS-GVO. Weiss AG may demand appropriate remuneration for this. Weiss AG may only provide information to third parties or the affected party with the prior consent of the customer. Requests addressed directly to Weiss AG will be forwarded to the customer without delay, and Weiss AG will not itself act in an external relationship with third parties.
• 2.6

  Weiss AG shall inform the customer immediately as soon as it becomes aware of any violations of the protection of personal data of the customer. Weiss AG shall take the necessary measures to secure the personal data and to reduce possible adverse consequences for the persons concerned.
• 2.7

  The correction and deletion of personal data is the responsibility of the customer. The same applies to the restriction of the processing of personal data.
• 2.8

  Weiss AG guarantees that employees involved in the processing of the client’s data and other persons working for the client are prohibited from processing personal data outside the scope of the instructions. Also, it is guaranteed that the persons authorized to handle the personal data have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality. The obligation of confidentiality shall continue to apply even after the termination of the order.
• 2.9

  The contact details of the data protection officer appointed on behalf of Weiss AG are stored at imprint.
• 2.10

  he personal data will be deleted after the end of the booking period. It is the customer’s responsibility to make backup copies of his personal data and to move the personal data before the end of the contract. Weiss AG is not obliged to disclose personal data to which the customer himself has access.
• 2.11

  Weiss AG shall prove to the customer by appropriate means that the obligations laid down in this contract have been fulfilled.
• 2.12

  Should inspections by the customer or an auditor commissioned by the customer be necessary in individual cases, these shall be carried out during regular business hours without disrupting the operating procedure after registration, taking into account an appropriate lead time. The customer may make this dependent on prior notification with a reasonable lead time and the signing of a confidentiality agreement concerning the data of other customers and the technical and organizational measures set up. If the auditor commissioned by the customer is in a competitive relationship with Weiss AG, Weiss AG shall have a right of objection against this.
• 2.13

  If a data protection supervisory authority or another sovereign supervisory authority of the customer carries out an inspection, § 2.10 shall apply accordingly. It is not necessary to sign a confidentiality agreement if this supervisory authority is subject to professional or legal confidentiality, where a violation is punishable under the Criminal Code.

§ 3 Obligations of the customer

• 3.1

  The customer is responsible for the quality of the personal data. The customer must inform Weiss AG immediately and completely if it detects any errors or irregularities regarding data protection regulations or its services.
• 3.2

  In the event of a claim by a third person concerned with regard to any claims pursuant to Art. 82 DS-GVO, the customer and Weiss AG undertake to support each other in defending against the claim.

§ 4 Subcontractors

• 4.1

  The use of subcontractors as further contract processors is only permissible if the client has given his prior consent.
• 4.2

  A subcontractor agreement subject to approval exists if the contractor commissions further contractors with all or part of the performance agreed in the contract. The contractor will make agreements with these third parties to the extent necessary to ensure adequate data protection and information security measures.
• 4.3

  The contractually agreed services or the partial services described below shall be performed with the involvement of the following subcontractor:

§ 5 Liability

• 5.1

  The limitations of liability set out in the SaaS Conditions shall apply.
• 5.2

  The customer shall indemnify Weiss AG against all claims asserted by third parties against Weiss AG due to the violation of their rights due to the processing of personal data commissioned by the customer, unless the third party’s claim is based on the processing of personal data by Weiss AG contrary to instructions.

§ 6 Duty to provide information, written form clause, choice of law

• 6.1

  If the customer’s data at Weiss AG is endangered by seizure or confiscation, by insolvency or composition proceedings or by other events or measures of third parties, Weiss AG must inform the customer immediately. Weiss AG will immediately inform all persons responsible in this context that the sovereignty and ownership of the data lies exclusively with the customer as the “person responsible” within the meaning of the Basic Data Protection Regulation.
• 6.2

  Amendments and supplements to this Annex and all its components – including any assurances given by the Contractor – shall require a written agreement, which may also be made in an electronic format (text form), and an express reference to the fact that these Terms and Conditions have been amended or supplemented. This also applies to the waiver of this formal requirement.
• 6.3

  In the event of any contradictions, the provisions of this data protection agreement shall apply to the provisions of the contract. Should individual parts of this agreement be ineffective, this does not affect the effectiveness of the rest of the agreement.
• 6.4

  German law applies.

Technical and Organizational Measures to Ensure Data Privacy

1. Organisation

• Data protection officer:

  Weiss AG has currently appointed the following data protection officer:
  Jens Wacker
  Merkurstraße 45
  67663 Kaiserslautern
  Phone: +49 631 4140490
  Mobile: +49 151-56344016
  E-Mail: info@weiss-ag.de
  

1. Measures to ensure Confidentiality

a) Access Control (premises)

b) Access (entrance) and user control (Systems)

c) Access control (data)

d) Transfer control

e) Job Control

3. Integrity

a) Input control

• –

  Measures to ensure that it is subsequently possible to verify and establish which personal data have been input into automated processing systems and when and by whom the personal data were input.
• –

  All employees are instructed in accordance with Article 32 Paragraph 4 of the DS-GVO and are obliged to ensure that personal data is handled in compliance with data protection regulations.
• –

  Traceability of input, modification and deletion of data through individual user names.
• –

  Deletion of data in accordance with data protection regulations after completion of the order.

b) Documentation control

• –

  Maintenance of a processing register
• –

  Documentation of the IT systems used and their system configuration

4. Availability control

• –

  Fire and smoke alarms are available
• –

  Monitoring of temperature and humidity in server rooms
• –

  Backup data stored in a secure and separate location
• –

  Existing of a concept for disaster management

5. Separation control

• –

  Definition of technology of database rights
• –

  Separation of data from different clients

6. Ensuring the resilience of the systems

• –

  The import of backups is tested regularly.
• –

  All server systems are subject to monitoring, which in the event of faults immediately triggers reports to an administrator.