Between the customer as controller (“Customer”) and DACH Digital Growth Group LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America as processor (“Provider”). The Customer accepts this agreement electronically when approving their website; the time, name and version are documented.
§ 1 Subject matter and duration
The Provider processes personal data on behalf of the Customer in the course of operating the Customer’s website created with PageKoala. The duration corresponds to the term of the user agreement.
§ 2 Nature, purpose, types of data, data subjects
(1) Purpose: hosting and delivery of the customer website; receipt and provision of contact enquiries; cookieless visitor statistics; forwarding of enquiry notifications by email; contact and enquiry management (CRM functions) in the customer area.
(2) Types of data: names, email addresses, telephone numbers and message content of persons making enquiries; technical access data (IP address in system logs, max. 14 days); pseudonymous statistical identifiers (daily changing hash, 13 months); notes, statuses and order values recorded by the Customer in the CRM.
(3) Data subjects: visitors to and persons making enquiries via the customer website, as well as contacts recorded by the Customer.
§ 3 Instructions
The Provider processes the data exclusively within the framework of this agreement and on documented instructions from the Customer. Instructions are generally given by using the platform functions (e.g. deleting an enquiry, export, account deletion); further instructions must be given in text form to service@pagekoala.com. If the Provider considers an instruction to be unlawful, it informs the Customer without undue delay and may suspend its execution until the matter has been clarified.
§ 4 Confidentiality
Persons involved in the processing are bound to confidentiality and are familiar with the relevant data protection provisions. Only the Provider and persons engaged and bound to confidentiality by it have access to customer data, insofar as this is necessary for operation, support and troubleshooting.
§ 5 Technical and organisational measures
The Provider takes the measures described in Annex 1 in accordance with Art. 32 GDPR. The measures may be developed further provided that the level of protection is at least equivalent.
§ 6 Sub-processors
(1) The Customer approves the sub-processors listed in Annex 2. The Provider informs the Customer of intended changes at least four weeks in advance in text form; the Customer may object for good cause and, in that case, terminate the user agreement for cause.
(2) Agreements are in place with each sub-processor imposing obligations corresponding to this agreement.
§ 7 Place of processing, third countries, standard contractual clauses
(1) The processing of the commissioned data takes place exclusively on servers in Germany (Annex 2); the Provider accesses the data from Germany. The platform’s AI services only process the business details provided by the Customer for creating the website, not the commissioned data under § 2.
(2) As the Provider has its registered office in the USA, the parties additionally agree on the EU standard contractual clauses (Implementing Decision (EU) 2021/914, Module 2: controller → processor) in accordance with Annex 3. In the event of conflict, the standard contractual clauses take precedence over this agreement.
§ 8 Assistance to the controller
The Provider assists the Customer with the platform functions (viewing, export, deletion) and, beyond that, to a reasonable extent in responding to data subject requests (Art. 12–23 GDPR), in notifying personal data breaches (Art. 33, 34) and in data protection impact assessments (Art. 35, 36), in each case insofar as the processing on behalf is affected. The Provider notifies the Customer of personal data breaches affecting commissioned data without undue delay, at the latest within 48 hours of becoming aware of them, at the stored email address.
§ 9 Deletion and return
After the end of the contract or on instruction, the Provider deletes all data processed on behalf, unless there is a statutory retention obligation; backup copies are overwritten after 21 days at the latest. The Customer can export their enquiries and contacts as CSV themselves at any time.
§ 10 Evidence and audits
The Provider demonstrates compliance with its obligations through appropriate documentation (in particular these annexes and the documentation of the approval). The Customer may verify compliance after giving reasonable prior notice; audits are limited to what is necessary and take place during normal business hours.
§ 11 Liability, final provisions
Liability is governed by § 11 of the terms and conditions; Art. 82 GDPR remains unaffected. German law applies. Changes to this agreement require text form; in the event of conflict between this agreement and the terms and conditions, this agreement takes precedence in data protection matters.
Annex 1 – Technical and organisational measures
- Physical access/system access: Hetzner data centre (ISO 27001), server access exclusively via SSH key, password login disabled; firewall (only 22/80/443), automatic blocking of attack attempts (fail2ban).
- Data access: database only accessible locally; customer accounts with Argon2id-hashed passwords; two-factor authentication and passkeys for administrator accounts; administrator access to customer data is logged; customer view by administrators is read-only.
- Transmission: TLS encryption (HSTS) for all connections including customer websites; email sending via Microsoft 365 with SPF, DKIM and DMARC.
- Separation: client separation at database level (each enquiry is assigned to exactly one website and one customer); separate host names for the platform and customer websites.
- Availability: daily database and file backups, copy on a second, separate server (21 days); availability monitoring every minute with alerting; automatic security updates of the operating system.
- Deletion: automated daily deletion concept (system logs 14 days, IP addresses in login logs 30 days, statistics 13 months, guest accounts 14 days, orphaned files); account deletion by the Customer themselves, effective immediately.
- Data minimisation: no tracking cookies, visitor statistics without storing IP addresses (daily changing hash), honeypot and rate limiting instead of third-party captcha.
Annex 2 – Sub-processors
| Company | Service | Place of processing |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Server infrastructure (platform, customer websites, backups) | Germany (Nuremberg/Falkenstein) |
| Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland | Sending of enquiry notification emails (Microsoft 365) | EU |
The platform’s AI service providers (Anthropic, Black Forest Labs, DataForSEO) do not receive any commissioned data under § 2 and are therefore not sub-processors within the meaning of this agreement; they are described in the privacy policy.
Annex 3 – EU standard contractual clauses (Module 2)
The parties conclude the standard contractual clauses for the transfer of personal data to third countries pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 in the version Module 2 (transfer from controller to processor). The text of the clauses is available at eur-lex.europa.eu/eli/dec_impl/2021/914/oj and is incorporated into this agreement by reference. The parties make the following specifications:
- Clause 7 (docking clause): does not apply.
- Clause 9 (use of sub-processors): Option 2 – general written authorisation; notice period for changes four weeks (§ 6).
- Clause 11 (redress): the optional provision does not apply.
- Clause 13 (supervision): the competent supervisory authority is that of the EU representative, The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
- Clause 17 (governing law): Option 1 – law of the Federal Republic of Germany.
- Clause 18 (choice of forum and jurisdiction): courts of the Federal Republic of Germany.
Annex I – List of parties and description of the transfer
Data exporter: the Customer (controller) with the details documented upon approval (company, name, email address). Data importer: DACH Digital Growth Group LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America, email service@pagekoala.com (processor).
Categories of data subjects and data: as in § 2. Sensitive data: none intended; the Customer ensures that no special categories of data are collected via the contact form. Frequency: continuous during the term of the contract. Nature of the processing: storage, provision in the customer area, email notification, statistics. Purpose: operation of the customer website (§ 2). Duration: term of the user agreement plus the deletion periods under § 9. Sub-processors: Annex 2. Competent supervisory authority: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
Annex II – Technical and organisational measures
Corresponds to Annex 1 of this agreement. In addition, with regard to the transfer: the data do not physically leave Germany; there is no access from the USA. The data importer will review requests from authorities for disclosure of the data, challenge them where legally possible, and inform the data exporter without undue delay unless prohibited by law.