Data Processing Agreement

1. Parties and subject matter

This agreement applies between the Quickard customer as controller ("customer") and EBS Euchner Büro- und Schulsysteme GmbH as processor ("processor"). It supplements the main Quickard agreement and applies to any processing of personal data on the customer's behalf.

2. Duration, nature and purpose

Processing generally lasts for the term of the main agreement plus any technically or legally required wind-down periods. It covers storing, organizing, retrieving, transmitting, providing, restricting and deleting data to operate digital business cards, contact pages, forms, newsletter features, support and agreed add-on functions.

3. Data and data subjects

Depending on use, contact, professional, profile, content, communication, usage, device, log and support data are processed. Data subjects may include employees, cardholders, prospects, customers, form submitters, newsletter recipients and other persons designated by the customer. Special categories of data may only be processed on the basis of prior documented instructions and suitable safeguards.

4. Instructions and obligations

The processor processes data only on documented instructions, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case it informs the controller of that legal requirement before processing, unless that law prohibits this. Use and configuration of the service, support requests and written instructions constitute the instructions. Unlawful instructions will be notified. Persons authorised to process are bound to confidentiality.

5. Support and incidents

The processor reasonably supports the customer with data subject rights, data protection impact assessments, prior consultation and accountability obligations. Breaches of protection of processed personal data are reported without undue delay with the available mandatory information; supplementary information may follow in phases.

6. Technical and organizational measures

• Physical and logical access protection of the operating environment plus role-based, organization-scoped access controls in the application
• Multi-factor authentication for privileged access, secure sessions and regular permission review
• Transport encryption, protected secrets and separated tenant data with Row Level Security
• Logging of security-relevant events, monitoring, error analysis and a defined incident response
• Data backup, recovery procedures and regular availability testing
• Data minimization, defined deletion processes and control of exports and support access
• Confidentiality obligations, data protection and security training for authorized personnel
• Supplier vetting and contractual binding of subprocessors used

The measures are developed further on a risk basis. Material changes may not fall below the agreed level of protection.

7. Subprocessors

The controller grants general authorisation for the sub-processors listed below. The processor contractually imposes on them the same data protection obligations as set out in this agreement. Intended changes will be notified with reasonable notice; the controller may object for an important data protection reason.

• Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany: Operation of the production systems (application, database, authentication, file storage). Processing location: Data centre in Nuremberg, Germany.
• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany: Backups, error monitoring and deployment management. Processing location: Data centres in Germany.
• Plus Five Five, Inc. (Resend): Delivery of transactional emails. Processing location: USA; third-country transfer only with a safeguard under Art. 44 et seq. GDPR.

External services that the controller activates or links itself and that act as separate controllers are not sub-processors of the processor for that operation. This includes in particular Apple and Google where card holders add wallet passes, as well as embedded map and video providers.

8. Transfers to third countries

Processing outside the EEA only takes place where the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision or suitable safeguards including standard contractual clauses and any required supplementary measures.

9. Evidence and audits

The processor provides the information required to demonstrate compliance with its obligations and enables proportionate audits. To protect all customers, suitable certificates, reports and questionnaires are used first; on-site audits take place after reasonable advance notice, under confidentiality and without impairing other clients.

10. Return and deletion

After the service ends, processed data is returned or deleted at the customer's choice, unless a statutory retention obligation applies. Existing backup copies are locked until regular overwriting and are not used productively.

11. Precedence and form

In case of conflict, the data protection provisions of this DPA take precedence for the processing of personal data. Changes and supplementary instructions should be documented in text form. Statutory rights and obligations remain unaffected.

Acceptance

Sign in and reopen this page to log the acceptance with your organization and a timestamp.