Version avv-2026-11-07 · As of 7 November 2026 · Deutsche Fassung

This is the English version. Consumers receive these terms in the language of their conversation, and that version applies to them. For businesses, the German version prevails if the versions differ (Terms § 2 (5)): Auftragsverarbeitungsvereinbarung

Data Processing Agreement (Art. 28 GDPR)

Annex 4 to the General Terms and Conditions of ProntoWeb · You conclude it together with the terms.

§ 1 Parties and subject matter

1. This agreement applies between you as controller (“you”) and tiro UG (haftungsbeschränkt), Oranienburger Straße 45, 10117 Berlin, Germany, prontoweb@tiro-agent.com, as processor (“we”).
2. Its subject matter is the operation of your website under Terms § 3. In doing so, we process personal data of the visitors to your website on your behalf.
3. This agreement does not cover your own data that we process in the WhatsApp conversation and for billing. We ourselves are the controller for this data. What we do with it is described in our privacy policy.

§ 2 Term

The agreement applies as long as the contract for your website runs. § 10 continues to apply beyond that until the deletion has been carried out.

§ 3 Nature, purpose and scope

1. Purpose: to deliver your website and to protect it against misuse and attacks. Once we offer it, also to count visits and clicks under Annex 1 § 9.
2. Nature of processing: The data that arises technically with every request (server logs) is received, briefly stored and deleted. For the counting under Annex 1 § 9, our server only increments a total per day when a page is visited or a click occurs. It does not store the IP address for this.
3. Types of data: IP address, time of the request, requested address, status code, amount of data transferred, browser and operating system identifier and, where applicable, the referring page.
4. Data subjects: visitors to your website.
5. What your website does not do: It sets no cookies, has no form, embeds no third-party content and builds no visitor profiles. It serves fonts itself. We do not analyse the server logs. The figures under Annex 1 § 9 are created without reference to any person.

§ 4 Instructions

1. We process the data only on your documented instructions. Your instructions are the terms and this agreement. You give further instructions in text form, for example by email or via WhatsApp.
2. If, in our view, an instruction infringes data protection law, we tell you without undue delay. We may suspend the instruction until you confirm or change it.
3. If Union or Member State law requires us to carry out processing, we inform you beforehand, unless that law prohibits such information.
4. You instruct us to create the figures under Annex 1 § 9 without reference to any person. We may also use these figures for our own purposes under Terms § 8 (7).

§ 5 Confidentiality

Only persons whom we have committed to confidentiality or who are under a statutory obligation of confidentiality have access to the data, and only insofar as necessary to operate the website.

§ 6 Technical and organisational measures

We take the measures under Art. 32 GDPR described in Appendix A. We may adapt them to technical progress as long as the level of protection does not decrease.

§ 7 Sub-processors

1. You agree that we use the sub-processors listed in Appendix B.
2. We contractually impose on every sub-processor obligations that correspond to Art. 28(4) GDPR. Data is transferred to a third country only on a basis under Art. 44 et seq. GDPR. Appendix B states which basis that is.
3. We announce a new or different sub-processor to you in text form at least four weeks in advance. You may object during this time. If we nevertheless make the change, you may terminate the contract without notice, with effect from the day of the change.

§ 8 Assistance

1. If a visitor contacts us with a request under Art. 15 to 22 GDPR, we forward it to you without undue delay. We help you with the response insofar as we hold the data.
2. We support you in your obligations under Art. 32 to 36 GDPR with the information available to us.

§ 9 Personal data breaches

If we become aware of a breach of the security of the data covered by this agreement, we notify you without undue delay. We tell you what we know about its nature, scope, consequences and countermeasures. We provide anything we learn only later as a follow-up.

§ 10 Deletion after the end of the contract

When the contract ends, we take your website offline (Terms § 6 (5)). After that, no new visitor data arises. Server logs still held by the host are deleted by the host according to its retention periods (Appendix B). We ourselves store no copy. This is why we cannot hand the logs over to you either.

§ 11 Evidence and audits

1. On request, we provide you with the information you need to verify compliance with this agreement. For this we may refer to certifications and audit reports of our sub-processors.
2. You, or an auditor commissioned by you and bound to confidentiality, may carry out audits. You announce them in good time, carry them out during normal business hours and do not disrupt operations disproportionately.

§ 12 Liability and precedence

1. Liability is governed by Art. 82 GDPR and otherwise by Terms § 11.
2. If a provision of the terms contradicts this agreement, this agreement takes precedence with regard to the protection of personal data.

§ 13 Transfer

If the contract for your website is transferred under Terms § 15 (4), this agreement is transferred with it.

Appendix A – Technical and organisational measures

Area	Measure
Data minimisation	no cookies, no forms, no analytics or advertising services, no embedded third-party content, fonts from our own server
Encryption	Every website is reachable only via HTTPS.
System and data access	Only individually authorised persons have access to the accounts with the host. Two-factor login for all accounts. Keys and credentials are not stored in the program code but only in the protected settings of the services.
Input control	Every change to program code and delivery is traceable in the version control system and in the deployment log.
Separation	Every website is a separate deployment and reachable only at its own address. Visitor data of different customers is not combined or analysed together. Only figures without reference to any person are aggregated (Annex 1 § 9).
Availability	Delivery via the host’s infrastructure with its redundancy. Our systems report disruptions automatically.
Processor control	Data processing agreements with all sub-processors (Appendix B)
Physical security	For data centres, physical access and network, the measures of the host from its data processing agreement apply. Vercel is audited under SOC 2 Type 2 and ISO 27001:2022.
Review	Automated tests with every change. We review these measures at least once a year.

Appendix B – Sub-processors

Company	Service	Location and basis for the third country	Log retention period
Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA	Delivery (hosting) of the website; the server logs under § 3 arise here	Your website consists of static files. Vercel delivers them via its worldwide network and processes mainly in the USA. Registered office in the USA. Vercel is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses also apply.	according to Vercel’s retention periods: 1 day (runtime logs)