Version avv-2026-10-24-entwurf · As of 24 October 2026 · Deutsche Fassung (maßgeblich)

This translation is for information only. The German version is legally binding: Auftragsverarbeitungsvereinbarung

Data Processing Agreement

Annex 1 to the General Terms and Conditions of ProntoWeb, under Art. 28 GDPR. The customer accepts it together with the terms.

§ 1 Parties and subject matter

1. This agreement applies between the customer as controller (“customer”) and tiro UG (haftungsbeschränkt), Solinger Straße 3, 10555 Berlin, Germany, prontoweb@tiro-agent.com, as processor (“we”).
2. Its subject matter is the operation of the customer’s website under § 3 of the terms. In doing so, we process personal data of the visitors to this website on behalf of the customer.
3. This agreement does not cover the data we process about the customer themselves, for example in the WhatsApp conversation and for billing. We are the controller for that data; it is described in our privacy policy.

§ 2 Term

The agreement applies as long as the contract for the website runs. Obligations under § 10 (deletion) continue beyond that until they are fulfilled.

§ 3 Nature, purpose and scope of processing

1. Purpose: to deliver the website and to protect it against misuse and attacks.
2. Nature of processing: receiving, briefly storing and deleting the data that arises technically with every request (server logs).
3. Types of data: IP address, time of the request, requested address, status code and amount of data transferred, browser and operating system identifier (user agent), and where applicable the referring page.
4. Data subjects: visitors to the customer’s website.
5. A live website sets no cookies, has no form, embeds no third-party content and builds no visitor profiles. It serves its fonts itself. We do not evaluate the server logs for statistics about visitors.

§ 4 Instructions

1. We process the data only on documented instructions from the customer. The terms and this agreement are those instructions. The customer gives further instructions in text form, for example by email or as a WhatsApp message in the conversation.
2. If, in our view, an instruction infringes data protection law, we tell the customer without undue delay. We may suspend it until the customer confirms or changes it.
3. If Union or Member State law requires us to process data, we inform the customer beforehand, unless that law prohibits this.

§ 5 Confidentiality

Only persons we have committed to confidentiality, or who are under a statutory obligation of confidentiality, have access to the data, and only insofar as necessary to operate the website.

§ 6 Technical and organisational measures

We take the measures required by Art. 32 GDPR. They include:

• Data minimisation: no cookies, no forms, no analytics or advertising services, no embedded third-party content, fonts from our own server.
• Encryption: every website is reachable only via encrypted connections (HTTPS).
• Access control: only authorised persons have access to the accounts with the host. Keys and credentials are not stored in the code but only in the protected settings of the services.
• Separation: every website is delivered separately; visitor data of different customers is not combined.
• Availability: the website runs on the host’s infrastructure with its redundancy. Our systems report disruptions automatically.
• Security at the sub-processor: for data centres, physical access and network, the measures of the host apply as described in its data processing agreement.

We may adapt the measures to technical progress as long as the level of protection does not decrease.

§ 7 Sub-processors

1. The customer agrees that we use the following sub-processors:

   Company	Service	Location
   Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA	Delivery (hosting) of the website; the server logs under § 3 arise here	USA, with servers in the EU
   Railway Corp., USA	Draft pages before going live only: they load an invisible counting image from our server so that we can see whether the draft was opened. IP address, time and browser identifier arise in the process. The live website does not load this image.	USA, with servers in the Netherlands (EU)

2. We have a contract with every sub-processor that imposes the same data protection obligations on it as this agreement imposes on us. Transfers to the USA are based on the EU Standard Contractual Clauses; Vercel is also certified under the EU-US Data Privacy Framework.
3. We announce a new or different sub-processor to the customer in text form at least four weeks in advance. The customer may object during this time. If we nevertheless make the change, the customer may terminate the contract with effect from the date the change takes effect.

§ 8 Assistance to the customer

1. If a visitor contacts us with a request under Art. 15 to 22 GDPR, we forward it to the customer without undue delay. We help the customer respond to the request insofar as we hold the data.
2. We support the customer in their obligations under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment, prior consultation) with the information available to us.

§ 9 Personal data breaches

If we become aware of a breach of the security of the data covered by this agreement, we notify the customer without undue delay with what we know about its nature, scope, consequences and countermeasures. We provide anything we learn later as a follow-up.

§ 10 Deletion after the end of the contract

When the contract ends, we take the website offline (§ 6 (5) of the terms). After that no new visitor data arises. Server logs still held by the host are deleted by the host according to its retention periods; we keep no copy. Handing the server logs over to the customer is not provided for, because we do not store them ourselves.

§ 11 Evidence and audits

1. On request, we provide the customer with the information they need to verify compliance with this agreement. For this we may refer to certifications and reports of our sub-processors.
2. The customer, or an auditor commissioned by them and bound to confidentiality, may carry out audits after giving reasonable notice and during normal business hours, without disproportionately disrupting operations.

§ 12 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise § 11 of the terms applies.
2. If a provision of the terms contradicts this agreement, this agreement takes precedence with regard to the protection of personal data.
3. If any provision is invalid, the remaining provisions remain valid.