Data Processing Agreement

Data Processing Agreement pursuant to Art. 28 GDPR between the Customer as controller (“Customer”) and FHC+P GmbH, Würmstraße 55, 82166 Gräfelfing, as processor (“Processor”). It forms part of the contract for the use of the Adpressa software and applies from the conclusion of that contract.

1. Subject Matter and Duration

The Processor operates Adpressa for the Customer and in doing so processes personal data on the Customer’s behalf. The duration corresponds to the term of the usage contract, plus the period for export and erasure under Section 8.

2. Nature and Purpose of the Processing

Storing, organizing, displaying, transmitting and deleting data so that the Customer can create and publish articles, operate web portals and newsletters, manage subscriptions and ads, and create invoices. The Processor processes the data only for these purposes and not for its own purposes, including not for training AI models.

3. Data Subjects and Types of Data

Data subjects: employees and freelancers of the Customer, authors, readers and reader accounts, subscribers, recipients of newsletters and notifications, advertising customers and their contact persons, persons named in articles, comments or classified ads.

Types of data: names and contact details, access and role data, content of articles, comments and ads, consents and records thereof, subscription and contract data, invoicing data, usage and log data. The Processor processes special categories pursuant to Art. 9 GDPR only if the Customer enters them into content.

4. Instructions

The Processor processes the data only on documented instructions from the Customer. Instructions are this agreement, the settings the Customer makes in Adpressa, and instructions in text form. If the Processor considers an instruction to be unlawful, it informs the Customer thereof without undue delay.

5. Obligations of the Processor

The Processor commits all persons who have access to the data to confidentiality. It assists the Customer with requests from data subjects, with data protection impact assessments and with the notification of personal data breaches. It notifies the Customer of a personal data breach without undue delay, at the latest within 24 hours after becoming aware of it. It provides the Customer with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows audits after timely advance notice.

6. Technical and Organizational Measures

The Processor takes in particular the following measures and keeps them in line with the state of the art:
Transmission only in encrypted form via HTTPS.
Separation of data per customer in the database.
Roles and permissions per person, login with password, on request via the Customer’s identity provider.
Second factor for all of the operator’s accounts.
Passwords stored only as hash values, access keys to third-party services stored in encrypted form.
Log of important actions, including every access by the operator to the Customer’s data.
Limitation of login attempts and requests.
Deletion periods that are enforced automatically.
Regular backup of the data.
Servers in a data center in Germany.

7. Sub-processors

The Customer approves the following sub-processors:
Hosting service provider with a data center in Frankfurt am Main, Germany: provision of the servers.
Mistral AI SAS, Paris, France: AI functions, only if the Customer enables this provider.
OpenRouter Inc., USA: AI functions, only if the Customer enables this provider. The transfer is based on the standard contractual clauses of the EU Commission.

The Processor announces new or changed sub-processors at least four weeks in advance in text form. The Customer may object for good cause under data protection law. Payment providers that the Customer integrates into Adpressa itself are engaged by the Customer directly; they are not sub-processors of the Processor.

8. Return and Erasure

After the end of the contract, the Processor makes a full export available to the Customer for 30 days and then erases all of the Customer’s data, unless there is a statutory obligation to retain it. Backups are overwritten in the regular rotation. The Processor confirms the erasure in text form upon request.

9. Final Provisions

In the event of conflicts, this agreement takes precedence over the General Terms and Conditions insofar as the protection of personal data is concerned. Liability is governed by Art. 82 GDPR and otherwise by the General Terms and Conditions.