FX
Facturx Prêt
Back to home

Data Processing Agreement pursuant to Article 28 GDPR

Version 1.2.1, October 2026

Convenience translation; the German version prevails.

This agreement applies to customers with an account: it is part of the terms (CGV), which only account holders accept. Files uploaded without an account (guest mode) are deleted after 7 days (90 days with an account). Businesses that process third parties' personal data, for example in invoices, should therefore use an account.

Text of the agreement

Radom UG (haftungsbeschränkt), version 1.2.1, October 2026

Preamble

The customer uses an online service of Radom UG (haftungsbeschränkt) under the general terms and conditions of that service (the “main contract”). In doing so, Radom UG processes personal data on behalf of the customer. This agreement governs the rights and obligations of the parties under Article 28 GDPR.

Parties

  • Controller (the “customer”): the business that uses the service with a customer account.
  • Processor (the “provider”): Radom UG (haftungsbeschränkt), Telemannstr. 2, 60323 Frankfurt am Main, Germany, Amtsgericht Frankfurt am Main, HRB 141671, represented by its managing director Arber Lamce.

Article 1: Subject matter, duration and details of the processing

  1. The subject matter is the processing of personal data that the customer enters or uploads when using the service. The subject matter, nature and purpose of the processing, the types of personal data, the categories of data subjects and the retention period are set out in Annex 1 of the relevant service.
  2. This agreement applies for the duration of the main contract. The obligations regarding deletion (Article 9) and confidentiality (Article 4) continue for as long as the provider processes customer data.
  3. Data that the provider processes as a controller in its own right is not covered by this agreement. This includes in particular the customer's account data, billing, server log files and abuse protection. The service's privacy policy applies to that data.

Article 2: Instructions

  1. The provider processes the data only on documented instructions from the customer, including with regard to transfers to a third country. This does not apply to processing that the provider is required to carry out under Union or Member State law. In that case, the provider informs the customer of that legal requirement before the processing, unless the law prohibits this (Article 28(3)(a) GDPR).
  2. The instructions result from the main contract, this agreement and the customer's use of the service's functions. The customer gives any further instructions in writing, including in electronic form (for example by e-mail). Instructions that go beyond the agreed scope of services are treated as a request to change the services.
  3. If the provider considers that an instruction infringes data protection provisions, it informs the customer without delay (Article 28(3), second subparagraph, GDPR). It may suspend carrying out the instruction until the customer confirms or changes it.

Article 3: Customer's obligations

  1. The customer is responsible for the lawfulness of the processing, in particular for the lawfulness of transmitting the data to the provider and for safeguarding the rights of data subjects.
  2. The customer informs the provider without delay if, when checking the results, it finds errors or irregularities with regard to data protection provisions.

Article 4: Confidentiality

The provider ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b) GDPR). This obligation continues after their activity has ended.

Article 5: Security of processing

  1. The provider implements the technical and organisational measures required under Article 32 GDPR, which are described in Annex 2.
  2. The measures are subject to technical progress. The provider may replace them with equivalent or better measures, provided the level of protection is not reduced. It documents material changes.

Article 6: Sub-processors

  1. The customer gives the provider general authorisation to engage other processors (sub-processors) (Article 28(2) GDPR). The sub-processors engaged when the agreement is concluded are listed in Annex 3 and are deemed authorised.
  2. The provider informs the customer in writing at least 30 days in advance if it intends to add or replace a sub-processor. The notice is sent by e-mail to the address stored in the customer account. The customer may object to the change in writing within 14 days of receipt, for an important reason relating to data protection. If the parties do not reach agreement, either party may terminate the main contract for cause with effect from the date of the change.
  3. The provider imposes on each sub-processor by contract the same data protection obligations as those set out in this agreement (Article 28(4) GDPR).
  4. A transfer to a third country takes place only if the conditions of Articles 44 et seq. GDPR are met, for example on the basis of an adequacy decision or standard contractual clauses.

Article 7: Assistance with data subjects' rights

  1. The provider assists the customer, by appropriate technical and organisational measures, in fulfilling the obligation to respond to requests from data subjects under Chapter III GDPR (Article 28(3)(e) GDPR).
  2. If a data subject contacts the provider directly, the provider forwards the request to the customer without delay. It does not respond to it itself, except on the customer's instructions.

Article 8: Assistance with other obligations, notification of breaches

  1. The provider assists the customer in complying with the obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (Article 28(3)(f) GDPR). This covers the security of processing, the notification and communication of breaches, and the data protection impact assessment.
  2. The provider notifies the customer of a personal data breach without undue delay after becoming aware of it (Article 33(2) GDPR). The notification contains, to the extent available, the information required by Article 33(3) GDPR. Information that is not yet available is provided later.

Article 9: Deletion and return

  1. The provider automatically deletes the customer's data when the retention period stated in Annex 1 expires. On the customer's instruction, it deletes the data earlier.
  2. After the main contract ends, the provider deletes all customer data still stored, at the latest when that retention period expires (Article 28(3)(g) GDPR). This does not apply to data that the provider is required to retain under Union or Member State law.
  3. The service makes the results of the processing available to the customer for download immediately. The provider owes no further return. The original data remains with the customer.

Article 10: Evidence and audits

  1. On request, the provider makes available to the customer all information necessary to demonstrate compliance with the obligations under Article 28 GDPR (Article 28(3)(h) GDPR). This may include certificates or evidence from the sub-processors.
  2. The customer, or an auditor mandated by it and bound to secrecy, may carry out audits, including inspections. It announces an inspection in writing at least 30 days in advance, unless there is a well-founded suspicion of an infringement. The inspection takes place during normal business hours, without disrupting operations, and as a rule no more than once per calendar year. The data centres of the sub-processors are verified by means of their evidence.
  3. The customer bears the costs of an inspection, unless it reveals a material breach of this agreement by the provider.

Article 11: Liability

Liability towards data subjects is governed by Article 82 GDPR. As between the parties, the liability provisions of the main contract otherwise apply.

Article 12: Conclusion of the agreement and final provisions

  1. This agreement forms part of the general terms and conditions of the relevant service. It is concluded in electronic form (Article 28(9) GDPR) as soon as the customer accepts the general terms and conditions, for example on registration. It applies to all personal data that the customer processes in the service from that moment.
  2. On request, the provider also makes this agreement available to the customer as a signed document (PDF).
  3. In the event of a conflict, this agreement takes precedence over the main contract as regards the protection of personal data.
  4. Any amendment or addition must be made in writing, including in electronic form. The same applies to any waiver of this formal requirement.
  5. If a provision is invalid, the validity of the other provisions is not affected.
  6. This agreement is governed by German law. The competent court is Frankfurt am Main, to the extent permitted by law.

The German version of this agreement prevails.

Annexes for Facturx-Prêt (facturx-pret.fr)

Annexes 1 to 3 describe the processing, the security measures and the sub-processors of the Facturx-Prêt service.

Annex 1: Details of the processing

Annex 1: Details of the processing
Subject matter and purposeGeneration, conversion and checking (validation) of electronic invoices (invoices, credit notes, corrective invoices, advance invoices and self-billed invoices) in Factur-X format (PDF/A-3 with CII XML, EN 16931 profile), from data that the customer enters in the form, uploads as a file (PDF, image, CSV, Excel, XML, MT940 statement) or submits as a CSV or Excel file for batch processing. The customer can also save a seller profile and a client book in the account, to fill in its invoices in advance, and finds in the account history the invoices generated, whose file can be downloaded again during the retention period.
Nature of the processingReceiving, reading, converting, checking, storing for a limited time, making available for download, deleting. For some files, AI-assisted reading (Annex 3, no. 2).
Types of personal data
  • Names, company names, addresses and contact details (e-mail, telephone) of issuers, recipients and contact persons named on invoices.
  • Tax and company identifiers (VAT number, SIREN, SIRET, tax number).
  • Bank details (IBAN, BIC, account holder).
  • For the seller profile and the client book saved in the account: company name, name and label, address, e-mail address, legal form, share capital, RCS or RM registrations, SIREN, SIRET, VAT number, buyer reference, payment terms, legal mentions and invoice numbering pattern.
  • For the account's invoice history: number, date, recipient's name, total amount including VAT, currency and document type of each generated invoice (the history does not contain the invoices themselves).
  • Invoice and service data (line items, amounts, dates, references such as order, contract or project numbers).
  • For uploaded bank statements (MT940): account number and transaction descriptions.
  • Any other information contained in the files submitted.
Categories of data subjectsThe customer's customers, suppliers and other business partners, for example recipients of invoices; their contact persons and employees; the customer's employees named in invoices; third parties named in uploaded bank statements.
Retention periodUploaded files and generated results of a customer account are stored under a technical identifier, without their original file name and without the customer's name or e-mail address, and are deleted automatically 90 days after processing (daily purge), together with the associated tracking files (manifests). On the customer's instruction they are deleted earlier. Invoice files are included in no backup. Without an account (guest mode), files are deleted after 7 days; this agreement, however, applies only to customers with an account. The seller profile, the client book and the invoice history of the account are kept until the customer deletes them or the account is deleted; they are included in the backups of the account database (Annex 2), kept for 14 days. When the customer deletes the account from “My account”, the invoice files of the account (results, source files and tracking files) are first deleted from the provider's storage; if they cannot be, the account is not deleted. The account, this data, the counters linked to the account and the password-reset tokens are then deleted from the database. The backups contain no invoice file.
Place of processingServers of Hetzner Online GmbH, Nuremberg data centre, Germany. Exception: AI-assisted reading of some files (Annex 3, no. 2): Microsoft Azure OpenAI Service — regional (Standard) deployment in the Azure region Sweden Central (EU): requests are processed there. Entry in the form, generation of the Factur-X XML, validation and the batch processing of CSV and Excel files run on the servers in Germany, without AI: the content of the files of a batch is never sent to Microsoft.

Annex 2: Technical and organisational measures (Article 32 GDPR)

1. Confidentiality

  • Physical access control: The servers are located in the Hetzner Online GmbH data centre in Nuremberg. Physical access there is governed by Hetzner. The provider does not operate its own server rooms.
  • System access control
    • Administrative access only via SSH with a cryptographic key; password login is disabled.
    • A firewall allows only SSH, HTTP and HTTPS from the public internet.
    • The application's internal interface (API) and the validation services are reachable only locally on the server; the API is protected by an internal key.
  • Data access control
    • Customer accounts are protected by a password, which is stored only as a bcrypt hash.
    • Sign-in attempts are limited at the web server: 5 requests per minute per IP address (short bursts tolerated) on sign-in, registration and password reset.
    • Sign-in attempts are limited by the application: 50 attempts per 15 minutes per network (IP address, or /64 network for IPv6), 10 attempts per 15 minutes for the same network and e-mail address, and 100 attempts per hour for the same account, whatever the network; sign-up is limited to 5 per hour per network, and password reset requests are also limited. These limits count every attempt, successful or not.
    • The password reset link can be used once and is valid for one hour; changing the password ends the sessions opened before.
    • Only the managing director and persons he expressly authorises, who are bound to confidentiality, have access to the servers.
    • Secrets are split between the containers: the API container, which reads untrusted files, holds neither the payment keys nor the account authentication secret; the web container holds neither the Azure OpenAI credentials nor the mail credentials.
  • Separation control: Stored files are kept apart by user type (guest or account), date and operation identifier. The seller profile, the saved clients and the history of an account are tied to its internal identifier, and every read or write is limited to the identifier of the signed-in account; the file of an invoice is given only to the account that generated it, on a signed request between the web application and the API.
  • Minimisation: Uploaded files and results are stored under a technical identifier, without their original file name and without the customer's name or e-mail address.

2. Integrity

  • Transmission control
    • All connections to the service are encrypted with TLS (HTTPS). Unencrypted requests are redirected to HTTPS, and browsers are instructed to use HTTPS only (HSTS).
    • The backup copy of the account database is transferred to the second server over an encrypted connection (SSH).
    • The checks of the generated e-invoices and PDF/A files (XSD, EN 16931 Schematron, PDF/A) run locally, without transmission to third parties.
  • Input control: Web server and container logs. Web server access logs are rotated daily and deleted after 14 days; container logs have a limited size and are overwritten continuously.

3. Availability and resilience

  • Backup: The account database (accounts, billing link, saved seller profiles, client books and invoice histories, quota and attempt-limit counters) is backed up daily: one copy on the same server and one copy on a second Hetzner Online GmbH server in Nuremberg, transferred over SSH. Both copies are kept for 14 days. Backups taken before each release or manual change are also deleted after 14 days. The copies (on the server and on the second server) are not encrypted at rest; the transfer to the second server is encrypted (SSH). Invoice files and results are included in no backup.
  • Operation: The services run in separate containers. The web application and API containers have memory and process limits; the validation services have a memory limit. All have reduced privileges (no new privileges, system capabilities dropped), health checks and automatic restart if they stop.

4. Procedures for regular review, assessment and evaluation

  • Tests: The automated tests of the web application run when the image is built; the build fails if a test fails. Those of the API are run before each delivery.
  • Deletion concept (applied automatically)
    • Uploaded files and results, with their manifests: 90 days with an account, or until the customer deletes the account if that comes first (7 days in guest mode);
    • seller profile, client book and invoice history: until the customer deletes them or the account is deleted, then up to 14 days in the backup copies;
    • web server access logs: 14 days; container logs: limited size, overwritten continuously;
    • backup copies of the account database: 14 days;
    • quota and attempt-limit counters: at most 32 days.
  • Data protection by default: Analytics tools are loaded only with the user's consent. File names, e-mail addresses and invoice contents are not sent to them.

Annex 3: Sub-processors

Annex 3: Sub-processors
No.Sub-processorServicePlace of processing
1Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Hosting, storage and backup.

Nuremberg data centre, Germany
2Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland

Azure OpenAI Service: AI-assisted reading of uploaded files, only in the following cases.

  • Image files (JPG, JPEG, PNG, HEIC): always; the images and the text recognised by OCR are transmitted.
  • PDFs without usable text (for example a scanned document) or whose automatic extraction is incomplete or uncertain (missing or ambiguous invoice number or date, seller or buyer details, seller tax identifier or line items): the extracted text is transmitted together with the file name and, if that is not enough, the page images (at most 10 pages). A PDF containing a complete Factur-X XML is in principle not read by AI.
  • CSV or Excel files uploaded one at a time (outside batch processing) whose column structure is not recognised: the file content (for an Excel workbook, the first 100 rows of each sheet) and its name are transmitted.
  • XML files that are neither CII (Factur-X/ZUGFeRD) nor a camt.053 statement, for example UBL XML: the file content and its name are transmitted. A CII file that our secure XML reader cannot parse (for example invalid XML) is transmitted too (without its original file name). A well-formed CII file that the reader cannot interpret is not sent to the AI, and camt.053 statements never are.
  • MT940 bank statements (.sta, .mt940, .940, .mt9): always; the first 10,000 characters of the statement and the file name are transmitted.

No AI is used for entry in the form, generation of the Factur-X XML, batch processing of CSV and Excel files or validation. A validation failure does not trigger any further AI call. According to Microsoft's terms, the content transmitted is not used to train models.

Microsoft Azure OpenAI Service — regional (Standard) deployment in the Azure region Sweden Central (EU): requests are processed there.
3Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Google Workspace: support e-mail, only if the customer sends files or invoice data to support by e-mail.

EU; a transfer to Google LLC (USA) cannot be excluded and relies on the EU-US Data Privacy Framework where the provider is certified.
German version (prevails) / Deutsche Fassung (maßgeblich)

Vereinbarung zur Auftragsverarbeitung (AVV) nach Art. 28 DSGVO

Radom UG (haftungsbeschränkt) · Version 1.2.1, Stand: Oktober 2026

Präambel

Der Kunde nutzt einen Online-Dienst der Radom UG (haftungsbeschränkt) nach den Allgemeinen Geschäftsbedingungen dieses Dienstes (im Folgenden „Hauptvertrag“). Dabei verarbeitet die Radom UG personenbezogene Daten im Auftrag des Kunden. Diese Vereinbarung regelt die Rechte und Pflichten der Parteien nach Art. 28 DSGVO.

Parteien

  • Verantwortlicher (im Folgenden „Kunde“): der Unternehmer, der den Dienst mit einem Kundenkonto nutzt.
  • Auftragsverarbeiter (im Folgenden „Anbieter“): Radom UG (haftungsbeschränkt), Telemannstr. 2, 60323 Frankfurt am Main, Amtsgericht Frankfurt am Main, HRB 141671, vertreten durch den Geschäftsführer Arber Lamce.

§ 1 Gegenstand, Dauer und Einzelheiten der Verarbeitung

  1. Gegenstand ist die Verarbeitung personenbezogener Daten, die der Kunde bei der Nutzung des Dienstes eingibt oder hochlädt. Gegenstand, Art und Zweck der Verarbeitung, die Arten personenbezogener Daten, die Kategorien betroffener Personen und die Speicherdauer ergeben sich aus Anlage 1 des jeweiligen Dienstes.
  2. Diese Vereinbarung gilt für die Dauer des Hauptvertrags. Pflichten zur Löschung (§ 9) und zur Vertraulichkeit (§ 4) bestehen darüber hinaus fort, solange der Anbieter Daten des Kunden verarbeitet.
  3. Daten, die der Anbieter als eigener Verantwortlicher verarbeitet, fallen nicht unter diese Vereinbarung. Das sind insbesondere die Kontodaten des Kunden, die Abrechnung, Server-Logfiles und der Missbrauchsschutz. Für sie gilt die Datenschutzerklärung des Dienstes.

§ 2 Weisungen

  1. Der Anbieter verarbeitet die Daten nur auf dokumentierte Weisung des Kunden, auch bei der Übermittlung in ein Drittland. Ausgenommen ist eine Verarbeitung, zu der der Anbieter nach dem Recht der Union oder eines Mitgliedstaats verpflichtet ist. In diesem Fall teilt er dem Kunden die rechtlichen Anforderungen vor der Verarbeitung mit, sofern das Recht dies nicht verbietet (Art. 28 Abs. 3 lit. a DSGVO).
  2. Die Weisungen ergeben sich aus dem Hauptvertrag, dieser Vereinbarung und der Nutzung der Funktionen des Dienstes durch den Kunden. Weitere Weisungen erteilt der Kunde in Textform (z. B. per E-Mail). Weisungen, die über den vertraglich vereinbarten Leistungsumfang hinausgehen, werden als Antrag auf eine Leistungsänderung behandelt.
  3. Ist der Anbieter der Ansicht, dass eine Weisung gegen datenschutzrechtliche Vorschriften verstößt, informiert er den Kunden unverzüglich (Art. 28 Abs. 3 Satz 3 DSGVO). Er darf die Ausführung der Weisung aussetzen, bis der Kunde sie bestätigt oder ändert.

§ 3 Pflichten des Kunden

  1. Der Kunde ist für die Rechtmäßigkeit der Verarbeitung verantwortlich, insbesondere für die Zulässigkeit der Übermittlung der Daten an den Anbieter und für die Wahrung der Rechte der betroffenen Personen.
  2. Der Kunde informiert den Anbieter unverzüglich, wenn er bei der Prüfung der Ergebnisse Fehler oder Unregelmäßigkeiten in Bezug auf datenschutzrechtliche Bestimmungen feststellt.

§ 4 Vertraulichkeit

Der Anbieter gewährleistet, dass sich die zur Verarbeitung befugten Personen zur Vertraulichkeit verpflichtet haben oder einer angemessenen gesetzlichen Verschwiegenheitspflicht unterliegen (Art. 28 Abs. 3 lit. b DSGVO). Die Pflicht besteht auch nach Ende ihrer Tätigkeit fort.

§ 5 Sicherheit der Verarbeitung

  1. Der Anbieter trifft die technischen und organisatorischen Maßnahmen nach Art. 32 DSGVO, die in Anlage 2 beschrieben sind.
  2. Die Maßnahmen unterliegen dem technischen Fortschritt. Der Anbieter darf sie durch gleichwertige oder bessere Maßnahmen ersetzen, solange das Schutzniveau nicht unterschritten wird. Wesentliche Änderungen dokumentiert er.

§ 6 Unterauftragsverarbeiter

  1. Der Kunde erteilt dem Anbieter die allgemeine Genehmigung, weitere Auftragsverarbeiter (Unterauftragsverarbeiter) einzusetzen (Art. 28 Abs. 2 DSGVO). Die bei Abschluss eingesetzten Unterauftragsverarbeiter stehen in Anlage 3 und gelten als genehmigt.
  2. Der Anbieter informiert den Kunden mindestens 30 Tage vorher in Textform, wenn er einen Unterauftragsverarbeiter hinzufügen oder ersetzen will. Die Information erfolgt per E-Mail an die im Kundenkonto hinterlegte Adresse. Der Kunde kann der Änderung innerhalb von 14 Tagen nach Zugang aus wichtigem datenschutzrechtlichem Grund in Textform widersprechen. Einigen sich die Parteien nicht, kann jede Partei den Hauptvertrag zum Zeitpunkt der Änderung außerordentlich kündigen.
  3. Der Anbieter erlegt jedem Unterauftragsverarbeiter vertraglich dieselben Datenschutzpflichten auf, die in dieser Vereinbarung festgelegt sind (Art. 28 Abs. 4 DSGVO).
  4. Eine Übermittlung in ein Drittland erfolgt nur, wenn die Voraussetzungen der Art. 44 ff. DSGVO erfüllt sind, z. B. durch einen Angemessenheitsbeschluss oder Standardvertragsklauseln.

§ 7 Unterstützung bei den Rechten betroffener Personen

  1. Der Anbieter unterstützt den Kunden mit geeigneten technischen und organisatorischen Maßnahmen bei der Erfüllung der Rechte betroffener Personen nach Kapitel III der DSGVO (Art. 28 Abs. 3 lit. e DSGVO).
  2. Wendet sich eine betroffene Person direkt an den Anbieter, leitet der Anbieter das Anliegen unverzüglich an den Kunden weiter. Er beantwortet es nicht selbst, außer auf Weisung des Kunden.

§ 8 Unterstützung bei weiteren Pflichten, Meldung von Verletzungen

  1. Der Anbieter unterstützt den Kunden bei der Einhaltung der Pflichten aus Art. 32 bis 36 DSGVO, soweit es die Art der Verarbeitung und die ihm verfügbaren Informationen zulassen (Art. 28 Abs. 3 lit. f DSGVO). Dazu gehören die Sicherheit der Verarbeitung, die Meldung und Benachrichtigung bei Verletzungen sowie die Datenschutz-Folgenabschätzung.
  2. Der Anbieter meldet dem Kunden eine Verletzung des Schutzes personenbezogener Daten unverzüglich, nachdem sie ihm bekannt geworden ist (Art. 33 Abs. 2 DSGVO). Die Meldung enthält, soweit verfügbar, die Angaben nach Art. 33 Abs. 3 DSGVO. Angaben, die noch nicht vorliegen, reicht er nach.

§ 9 Löschung und Rückgabe

  1. Der Anbieter löscht die Daten des Kunden automatisch nach Ablauf der in Anlage 1 genannten Speicherdauer. Auf Weisung des Kunden löscht er sie früher.
  2. Nach Ende des Hauptvertrags löscht der Anbieter alle noch gespeicherten Daten des Kunden spätestens mit Ablauf dieser Speicherdauer (Art. 28 Abs. 3 lit. g DSGVO). Ausgenommen sind Daten, zu deren Speicherung der Anbieter nach Unionsrecht oder dem Recht eines Mitgliedstaats verpflichtet ist.
  3. Die Ergebnisse der Verarbeitung stellt der Dienst dem Kunden unmittelbar zum Download bereit. Eine darüber hinausgehende Rückgabe schuldet der Anbieter nicht. Die Ausgangsdaten verbleiben beim Kunden.

§ 10 Nachweise und Überprüfungen

  1. Der Anbieter stellt dem Kunden auf Anfrage alle Informationen zur Verfügung, die zum Nachweis der Einhaltung der Pflichten aus Art. 28 DSGVO erforderlich sind (Art. 28 Abs. 3 lit. h DSGVO). Dazu können Zertifikate oder Nachweise der Unterauftragsverarbeiter gehören.
  2. Der Kunde oder ein von ihm beauftragter, zur Verschwiegenheit verpflichteter Prüfer kann Überprüfungen einschließlich Inspektionen durchführen. Eine Inspektion meldet er mindestens 30 Tage vorher in Textform an, außer bei einem begründeten Verdacht auf eine Verletzung. Sie findet zu den üblichen Geschäftszeiten statt, ohne den Betrieb zu stören, und in der Regel höchstens einmal im Kalenderjahr. Rechenzentren der Unterauftragsverarbeiter werden über deren Nachweise geprüft.
  3. Der Kunde trägt die Kosten einer Inspektion, außer sie ergibt einen wesentlichen Verstoß des Anbieters gegen diese Vereinbarung.

§ 11 Haftung

Für die Haftung gegenüber betroffenen Personen gilt Art. 82 DSGVO. Im Verhältnis der Parteien zueinander gelten im Übrigen die Haftungsregelungen des Hauptvertrags.

§ 12 Vertragsschluss und Schlussbestimmungen

  1. Diese Vereinbarung ist Bestandteil der Allgemeinen Geschäftsbedingungen des jeweiligen Dienstes. Sie wird in elektronischer Form geschlossen (Art. 28 Abs. 9 DSGVO), sobald der Kunde den AGB zustimmt, z. B. bei der Registrierung. Sie gilt für alle personenbezogenen Daten, die der Kunde ab diesem Zeitpunkt im Dienst verarbeitet.
  2. Auf Wunsch stellt der Anbieter dem Kunden diese Vereinbarung zusätzlich als unterzeichnetes Dokument (PDF) zur Verfügung.
  3. Bei Widersprüchen geht diese Vereinbarung dem Hauptvertrag vor, soweit es um den Schutz personenbezogener Daten geht.
  4. Änderungen und Ergänzungen bedürfen der Textform. Das gilt auch für den Verzicht auf dieses Formerfordernis.
  5. Sollte eine Bestimmung unwirksam sein, bleibt die Wirksamkeit der übrigen Bestimmungen unberührt.
  6. Es gilt das Recht der Bundesrepublik Deutschland. Gerichtsstand ist Frankfurt am Main, soweit gesetzlich zulässig.