Data Processing Agreement (DPA)

Contracting parties

Processor

Controller

The Controller is the customer who has commissioned bytebrise to provide services in the course of which personal data is processed. The specific details of the Controller arise from the respective main contract.

§ 1 Subject matter and duration

(1) The subject matter of this contract is the processing of personal data by bytebrise on behalf of the Controller within the scope of the services agreed in the main contract (web design, maintenance, online marketing, support).

(2) The term of this contract corresponds to the term of the main contract. It ends automatically upon termination of the main contract.

§ 2 Nature and purpose of the processing

(1) Nature of the processing: collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure and destruction.

(2) Purpose of the processing: provision of the services agreed in the main contract, in particular:

• Development, maintenance and servicing of the Controller’s websites
• Management of user inquiries from contact forms, newsletters and comparable functions on the website
• Support and evaluation of online marketing measures
• Provision and maintenance of web shops, booking systems or similar applications on behalf of the Controller

§ 3 Type of personal data

The processing may in particular concern the following categories of data:

• Master data (e.g. name, address, company, position)
• Communication data (e.g. email, telephone)
• Contract data (e.g. orders, bookings, payment information without complete account data)
• Usage data (e.g. pages accessed, time of access, IP addresses)
• Content data from forms (e.g. text of contact inquiries)

The processing of special categories of personal data (Art. 9 GDPR) is only permitted with express prior agreement.

§ 4 Categories of data subjects

• Customers and prospects of the Controller
• Employees and contact persons of the Controller
• Visitors to the Controller’s website
• Suppliers, business partners and other contacts of the Controller

§ 5 Obligations of bytebrise

(1) bytebrise processes personal data exclusively within the scope of the agreements made and in accordance with the Controller’s documented instructions, unless bytebrise is exceptionally required to process it by Union law or the law of a Member State.

(2) bytebrise ensures that the persons engaged in the processing are bound to confidentiality or are subject to an appropriate statutory duty of confidentiality.

(3) bytebrise assists the Controller in fulfilling its obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessment) insofar as necessary and reasonable.

(4) bytebrise informs the Controller without undue delay if, in its opinion, an instruction infringes data protection provisions.

(5) bytebrise assists the Controller, where possible, in responding to requests from data subjects for access, rectification, erasure, restriction of processing, data portability and objection.

§ 6 Technical and organisational measures (TOM)

(1) bytebrise implements appropriate technical and organisational measures to protect personal data in accordance with Art. 32 GDPR. These include in particular:

Confidentiality

• Physical access control: bytebrise’s office premises are locked, access only for authorised persons.
• System access control: work devices (laptops, mobile devices) are protected by passwords and full-disk encryption.
• Data access control: access to customer systems takes place via individual credentials, where possible with two-factor authentication.
• Separation control: client data is processed separately (own directories, own environments per customer).
• Pseudonymisation and encryption: where technically possible and reasonable.

Integrity

• Transfer control: data transfers take place over encrypted connections (HTTPS, SFTP, FTPS).
• Input control: changes to customer systems are traceable via access logs and version control.

Availability and resilience

• Regular backups of the working environment.
• Protection against malware through up-to-date antivirus software and prompt security updates.

Procedures for regular review, assessment and evaluation

• bytebrise reviews the effectiveness of the TOM at regular intervals and adjusts them where necessary.
• The implementation of new measures is documented.

(2) The specific design of the TOM may adapt over time to technical and organisational developments. Material changes will be communicated to the Controller. The level of security must not be reduced as a result.

§ 7 Sub-processing

(1) bytebrise may use sub-processors. The Controller hereby grants its general authorisation for the use of sub-processors.

(2) At the time of conclusion of the contract, the following sub-processors are used. Which of them are used in an individual case depends on the services commissioned; the current version of this list will be provided on request.

• Namecheap, Inc., 4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA: registration of domain names for websites operated on this platform. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).
• mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany: web hosting and email mailboxes for websites operated on this platform. Processing takes place within the EU.
• Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany: operation of the servers on which bytebrise runs the specialist applications it uses (management of inquiries and customer data, reach analytics, newsletter management, electronic signature, AI assistant) and hosting of individual websites. The data centres are located in Germany; no transfer to a third country takes place.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: DNS, content delivery network, protection against attacks and access protection as well as object storage and execution environment for websites delivered via Cloudflare, and object storage (Cloudflare R2) for keeping encrypted backup copies of the systems operated by bytebrise. Technical connection data (including IP address, user agent, requested URL) is processed in the process. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR); Cloudflare is additionally certified under the EU-US Data Privacy Framework.
• sipgate GmbH, Gladbacher Straße 74, 40219 Düsseldorf, Germany: telephony and telephone AI assistant, insofar as this service is commissioned. Processing takes place within the EU.
• Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany: technical dispatch of emails and newsletters, insofar as this service is commissioned. Processing takes place within the EU.
• Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA: technical dispatch of transactional and notification emails from websites and web applications (for example confirmations of form inquiries and bookings). The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR); Resend is additionally certified under the EU-US Data Privacy Framework.
• Anthropic, PBC, San Francisco, California, USA: commissioned processing for AI-assisted text and chat functions, insofar as such functions are commissioned. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).
• Backblaze, Inc., San Mateo, California, USA, and Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland: storage of encrypted backup copies of the systems operated by bytebrise, in addition to the primary backup at Cloudflare R2 (see above), as two mutually independent secondary locations (Google Cloud: data centre in Frankfurt am Main). The backups are encrypted before transfer; the keys remain exclusively with bytebrise. For the transfer to Backblaze in the USA, the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) apply.
• If bytebrise uses further sub-processors for a specific project (for example a host specified by the Controller, a CMS, a payment service provider, an analytics, appointment-booking or error-diagnosis service, or a different email service), these will be named to the Controller before use in accordance with paragraph 3.

(3) bytebrise informs the Controller of intended changes regarding the addition or replacement of sub-processors. The Controller may object to such changes within 14 days after notification on an important data protection ground.

(4) bytebrise obliges its sub-processors to equivalent data protection obligations as agreed in this contract.

§ 8 Rights and obligations of the Controller

(1) The Controller is responsible for the lawfulness of the processing of personal data and for safeguarding the rights of data subjects within the meaning of the GDPR (Art. 4 No. 7 GDPR).

(2) The Controller issues all orders, partial orders and instructions in text form. Oral instructions must be confirmed in writing without delay.

(3) The Controller has the right to satisfy itself of bytebrise’s compliance with the technical and organisational measures taken, e.g. by obtaining written information or, after prior notice and with reasonable regard for ongoing operations, by an on-site inspection.

§ 9 Notification of personal data breaches

bytebrise notifies the Controller without undue delay, and at the latest within 72 hours after becoming aware of it, of any personal data breach pursuant to Art. 33 and 34 GDPR. The notification contains all information required under Art. 33(3) GDPR, insofar as this is known to bytebrise at the time of notification.

§ 10 Deletion and return after the end of the contract

(1) After the end of the assignment, bytebrise hands over to the Controller all documents provided, processing and usage results created and data sets connected with the contractual relationship, or deletes them in accordance with data protection law at the Controller’s choice.

(2) bytebrise documents the deletion on request.

(3) Statutory retention obligations remain unaffected.

§ 11 Remuneration

Services of bytebrise under this contract are covered by the remuneration agreed in the main contract. Expenses exceeding the usual extent (e.g. extensive support services in connection with authority inquiries, on-site audits) may be charged separately on an effort basis.

§ 12 Liability

The liability provision of the main contract between the parties applies (see § 14 of the T&Cs). The provisions of Art. 82 GDPR remain unaffected.

§ 13 Final provisions

(1) This contract is governed by the law of the Federal Republic of Germany. Place of performance and place of jurisdiction are, where permissible, Fürstenfeldbruck.

(2) Amendments and supplements to this contract require text form.

(3) Should individual provisions be invalid, the validity of the remaining provisions remains unaffected. The invalid provision shall be replaced by the statutory provision.

Last updated

31 July 2026