Parties: The processor is Ausbildungszentrum für Selbstverteidigung und Kampfkunst SportUnion ("PrivacyAds"). The controller is the customer named in the contract for PrivacyAds. This addendum forms part of the respective contract where PrivacyAds processes personal data on the customer's behalf. Individually signed agreements take precedence over this text.
1. Subject matter, duration and instructions
PrivacyAds processes personal data exclusively to provide, maintain, secure and support the agreed platform features, for the duration of the contract and on the controller's documented instructions, unless Union or Member State law requires otherwise. An instruction that is evidently unlawful is pointed out and not carried out until clarified.
2. Nature, purpose, data and data subjects
- Purposes: measurement of page views and enquiries on the controller's websites, receipt, storage and delivery of form submissions, evaluation of advertising cost and search data, proposals and changes to website content in accordance with the configuration.
- Data: technical details of a request (IP address, browser and device details, page viewed, origin), entries in forms including contact details, files, signatures and consents, and usage and security data. Special categories may only be processed where there is a documented legal basis and a suitable configuration.
- Data subjects: visitors to the controller's websites, people who submit forms there, and employees and users of the controller.
3. Duties of PrivacyAds
PrivacyAds commits people with access to confidentiality, provides reasonable assistance with data subject rights, data protection impact assessments and consultations with authorities, keeps a record of relevant processing activities and provides necessary compliance information.
4. Security
Taking into account the state of the art, cost, nature, scope and risks, PrivacyAds takes appropriate measures under Art. 32 GDPR. These include in particular encrypted transmission, encryption of form content and credentials, role-based access, separation of data per customer, separate environments, logging, backups, and update and incident processes. The measures may be developed further provided the level of protection does not materially decrease.
5. Subprocessors
The controller grants general authorisation for the categories and providers described under Security & subprocessors. PrivacyAds contractually commits subprocessors to an appropriate level of data protection and gives notice of material changes. The controller may object on reasoned data protection grounds; the parties seek a reasonable solution, failing which the feature concerned may be ended.
6. Transfers to third countries
Transfers outside the EEA take place only on a permissible basis, in particular an adequacy decision or standard contractual clauses together with any additional measures required. Connections to third-party providers set up by the controller itself also count as a documented instruction to the extent they are required for the feature.
7. Personal data breaches
After becoming aware of a breach of the protection of data processed on the controller's behalf, PrivacyAds informs the controller without undue delay and provides available information so that the controller can assess its notification and information duties.
8. Data subject requests
If a request concerning data processed on the controller's behalf reaches PrivacyAds directly, it is generally forwarded to the controller. PrivacyAds answers it only on the controller's instruction or on the basis of mandatory law and provides technically available assistance.
9. Return and deletion
The controller can export its data in the account and delete individual submissions, forms or its entire business. After the end of the service, PrivacyAds deletes or returns the data at the controller's choice, unless a statutory duty or a justified technical transition period prevents this. Data in backups is blocked and removed with the regular overwrite cycle.
10. Evidence and audits
PrivacyAds provides reasonable information as evidence. Audits are to be carried out with reasonable notice, during normal business hours, under confidentiality and without endangering other customers or systems. Existing audit reports and documentation may be used first; necessary additional costs are generally borne by the controller, unless the audit reveals a material breach by PrivacyAds.
11. Responsibility of the controller
The controller remains responsible for lawfulness, transparency, data minimisation, retention rules, user permissions, consents and its instructions. It informs the visitors to its websites about the measurement and the forms and sets up optional integrations only where there is a sound legal basis and the data subjects have been informed.