Data processing agreement (Article 28 GDPR)
Draft before sales begin. Sales remain closed; ordering is currently not possible. The following texts describe the intended contract terms once sales begin and do not confirm that ordering, cancellation, withdrawal or commission processes are already available. Automatic AI handling of new support cases remains blocked until the provider connection has been verified.
The safeguards and provider agreements in the annexes must be evidenced before sales begin; this draft does not confirm that they have been implemented or concluded.
Annex to the “Berlzop Website” terms for business customers. The named AI provider in annex 2 will be fixed before the store opening; ordering is not possible before then.
The contract language is German. This complete translation is for information; the German version remains binding.
Between the customer (controller, “Customer”) and Daniel Pestow, Berlzop, Steinkauterweg 21, 56112 Lahnstein (processor, “Berlzop”). Phone: +49 2621 9189000. Email: kontakt@berlzop.de.
1. Subject matter and duration
1.1 Berlzop processes personal data on the Customer’s behalf to the extent necessary to create, host and maintain their website and operate their email mailbox under the Terms and Conditions.
1.2 This agreement applies for the term of the main contract and thereafter for as long as Berlzop continues to process the Customer’s data.
2. Nature, purpose, data and data subjects
- Nature and purpose: storing and serving the website, receiving and storing emails, processing form and chat messages, server log files, and creating and changing content on instruction.
- Types of data: contact and communication data, message and email contents, personal data published on the website, and technical access data (IP address, time, browser).
- Data subjects: website visitors, email senders and recipients, the Customer’s contacts and employees, and people named on the website.
3. Instructions
3.1 Berlzop processes the data only on the Customer’s documented instructions. The Terms and Conditions and orders given by chat or email constitute such instructions. Exceptions apply only where Berlzop is legally obliged to process the data; in that case, Berlzop informs the Customer beforehand to the extent permitted by law.
3.2 If Berlzop considers an instruction to breach data protection law, it informs the Customer without undue delay and may suspend carrying it out until the matter has been clarified.
4. Confidentiality
People who have access to the data at Berlzop are committed to confidentiality or subject to a statutory duty of confidentiality.
5. Security (Article 32 GDPR)
Berlzop implements the technical and organisational measures described in Annex 1 and adapts them to the state of the art without reducing the level of protection.
6. Sub-processors
6.1 The Customer authorises the sub-processors listed in Annex 2. Berlzop gives advance notice of planned changes by email; the Customer may object within 14 days on important data protection grounds. If no agreement is reached, the Customer may terminate the contract with effect from the date on which the change takes effect.
6.2 Berlzop contractually requires sub-processors to comply with equivalent data protection obligations and is liable to the Customer for their compliance (Article 28(4) GDPR).
6.3 Transfers to third countries take place only on the Customer’s instruction, as contained in the authorisation under Annex 2, and only on a basis under Articles 44 et seq. GDPR (such as an adequacy decision or standard contractual clauses).
7. Assistance to the Customer
Berlzop assists the Customer through appropriate measures with data subjects’ requests (Articles 12–22 GDPR) and with the obligations under Articles 32–36 GDPR. Berlzop forwards data subjects’ requests that it receives directly without undue delay.
8. Personal data breaches
Berlzop notifies the Customer of a personal data breach without undue delay, preferably within 24 hours of becoming aware of it, providing the information required by Article 33(3) GDPR where available.
9. End of processing
After the contract ends, Berlzop returns the data on request (an export of the website and mailbox) and deletes it 30 days after the contract ends, unless a statutory retention obligation applies.
10. Evidence and audits
Berlzop makes available to the Customer the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows audits, including inspections, by the Customer or an auditor appointed by them after reasonable advance notice.
Annex 1: Technical and organisational measures (summary)
- Servers in Germany; access only through encrypted connections (TLS, SSH using keys, a private network for operator access).
- Separate customer areas; customers can see only their own data.
- Credentials and keys encrypted in the vault; no sharing in the chat.
- Regular system updates during a fixed maintenance window.
- Error logging and automatic error handling without the contents of customer data in error records.
- Data minimisation: AI systems receive only the content needed for the specific order.
- Regular backups with tested restoration.
- Deletion periods: chat histories 30 days, statistics 90 days, customer data 30 days after the contract ends.
Annex 2: Sub-processors
- netcup GmbH, Karlsruhe — servers (website, email), domain registration; Germany; data processing agreement with netcup.
- AI provider for planning, text, implementation and support: to be named before sales begin, with a data processing agreement and third-country safeguards.