Data processing agreement (Art. 28 GDPR)

Processing covers the provision of Servotag Pro for the term of the main contract and continues until the complete return or deletion of the data processed on behalf of the customer. Processing is carried out only on the customer’s documented instructions; the configuration made in the application and this agreement are those instructions. We inform the customer if, in our opinion, an instruction infringes data protection law. Instructions, including those concerning international transfers, may be given in text form to the contact in the legal notice. Where Union or Member State law requires other processing, we inform the customer beforehand unless that law prohibits this on important grounds of public interest.

Storing and displaying machine records, documentation and maintenance history; receiving fault reports and forwarding them to the destinations the customer configures; producing usage statistics for the customer’s own account. Persons authorised to process the data are bound to confidentiality (Art. 28 (3) (b) GDPR).

Contact details of the customer’s employees and of their customers’ staff (name, email address, telephone number), fault descriptions and any photos or videos submitted with them, and pseudonymous usage events. Data subjects are the customer’s employees, their customers’ employees, and the people who scan a machine plate. Special categories of personal data under Art. 9 GDPR are not intended to be processed.

Tenant separation is enforced in the database itself: row level security is active on every table, reading requires organization membership, writing requires an editor role and configuration requires an administrator role, all checked against the caller’s own token rather than an application-level filter. Customer accounts cannot edit or delete change-log entries; changes are recorded on the server. Privileged operational access and automatic deletion after 24 months are not technically excluded. The log is not an immutable statutory tax archive. Public machine and portal addresses use unguessable codes with roughly 70 bits of entropy; documents are served through short-lived signed URLs. Outgoing webhooks are signed with HMAC-SHA256 and cannot be pointed at private, link-local or internal addresses. Public write endpoints are rate limited against a keyed hash of the client address; the raw address is never stored. Traffic is encrypted in transit with TLS. The database and file storage run on our server in Germany and are reachable only through the application’s gateway, never directly from the internet; hourly backups are encrypted before they leave the server, and the decryption key is kept separately from the backups. Servotag Pro does not connect to machine control systems.

The customer grants general authorisation for the following sub-processors: netcup GmbH, Germany (servers for the application, the database and file storage in its data centre in Nuremberg); Cloudflare, Inc., San Francisco, United States (delivery through its network, protection against attacks, storage of encrypted backups); Resend, United States (delivery of outgoing emails, sent from its EU region). Transfers to the United States are based on the EU–US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the EU standard contractual clauses under Art. 46 (2) (c) GDPR. Stripe, which customers use to pay by card or Stripe invoice with bank transfer, processes payment data as an independent controller and is not a sub-processor under this agreement. Changes are announced by email at least 30 days before the intended engagement. The customer may object on reasonable data-protection grounds before engagement. We consider a reasonable alternative; if no agreement is possible, the affected contract may end before engagement without an additional termination fee. Each sub-processor is bound in writing to equivalent data-protection duties; we remain responsible to the customer for their performance.

We support the customer in answering data subject requests, in data protection impact assessments and in dealing with supervisory authorities, and we notify them without undue delay of any personal data breach affecting their data. We make available the information needed to demonstrate compliance with Art. 28 GDPR and allow audits, which may be carried out by the customer or by an auditor they appoint, after reasonable notice and without disrupting operations. The initial notification is sent at the latest within 48 hours after awareness and includes the available information under Art. 33(3) GDPR; further information follows without undue delay. Reasonable notice, business hours and cost arrangements must not prevent or delay audits required by law or justified by a concrete suspicion, personal data breach or supervisory-authority request. The processor allows and contributes to these audits, including inspections at short notice; statutory audit rights are not conditional on advance payment.

The customer can export their data as CSV at any time during the term. On the customer’s choice, after the contract ends we delete or return the data processed on their behalf. Backups are overwritten in the ordinary backup cycle; until then the data remains protected by the same measures. Data we are legally required to keep — invoices and the records attached to them — is retained for the statutory period and blocked from any other use.

This agreement in the version dated at the top of the page is the agreed text. A copy signed by us, for the customer’s own records, is sent on request to the contact address in the imprint, stating the organization name and the email address of the account.