{"id":427919,"date":"2026-06-29T21:34:14","date_gmt":"2026-06-29T19:34:14","guid":{"rendered":"https:\/\/reev.com\/data-processing-agreement-dpa-reev\/"},"modified":"2026-08-10T08:05:21","modified_gmt":"2026-08-10T06:05:21","slug":"data-processing-agreement-dpa-reev","status":"publish","type":"page","link":"https:\/\/reev.com\/en\/data-processing-agreement-dpa-reev\/","title":{"rendered":"Data Processing Agreement (DPA) reev"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
Home<\/a><\/div>\n\t\t<\/div>\n\t\t<\/div>\n\t\t<\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Data Processing Agreement (DPA)<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

As of July 2026 <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Disclaimer:<\/strong> Translation of the original document in German. In the event of discrepancy, inconsistency or conflict with the German version (in particular due to translation delays), the German version shall prevail<\/span><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
This Data Processing Agreement (hereinafter the \u201cDPA\u201d) applies between reev GmbH,\u00a0<\/span>Sandstra\u00dfe<\/span>\u00a03, 80335 M\u00fcnchen (hereinafter the \u201cProcessor\u201d) and the respective customer that uses the Processor’s services and has concluded the main agreement underlying this DPA (hereinafter the \u201cController\u201d). The DPA is incorporated upon conclusion of the main agreement or acceptance of the General<\/span><\/span>\u00a0Terms and Conditions of the Processor and forms part of the contractual relationship between the parties.<\/span><\/span>\u00a0<\/span><\/span><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. <\/strong>General<\/strong> <\/span><\/b><\/h3>

1.1<\/b> The Processor processes personal data on behalf of the Controller within the meaning of Art. 4(8) and Art. 28 of Regulation (EU) 2016\/679 \u2013 General Data Protection Regulation (GDPR). This Agreement governs the rights and obligations of the parties in connection with the processing of personal data.<\/span><\/span>\u00a0<\/span><\/span><\/p>

1.2<\/b> Where this Agreement uses the term \u201cData processing\u201d or \u201cProcessing\u201d (of data), the definition of \u201cprocessing\u201d within the meaning of Art. 4(2) GDPR shall apply.<\/span><\/span>\u00a0<\/span><\/span><\/p>

\u00a0<\/h3>

2. Subject Matter of the Order<\/strong><\/h3>

The subject matter of the processing, the nature and purpose of the processing, the type of personal\u00a0<\/span>data<\/span>\u00a0and the categories of data subjects are set out in\u00a0<\/span><\/span>Annex 1<\/span><\/span>\u00a0to this Agreement.<\/span><\/span>\u00a0<\/span><\/p>

3. Rights and Obligations of the Controller<\/strong><\/h3>

3.1<\/b>The Controller is the controller within the meaning of Art. 4(7) GDPR for the processing of data on behalf carried out by the Processor.\u00a0<\/span>Pursuant to<\/span>\u00a0Section 3(5), the Processor is entitled to inform the Controller if, in its opinion, processing of data that is legally inadmissible is the subject of the order and\/or of an instruction.\u00a0<\/span><\/span><\/span><\/p>

3.2<\/b> The Controller, as the controller,\u00a0<\/span>is responsible for<\/span>\u00a0safeguarding data subject rights. The Processor shall inform the Controller without undue delay if data subjects assert their data subject rights in connection with this processing of data on\u00a0<\/span>behalf<\/span>\u00a0vis-\u00e0-vis the Processor.<\/span><\/span>\u00a0<\/span><\/span><\/p>

3.3<\/b> The Controller shall be entitled at any time to issue supplementary instructions\u00a0<\/span>regarding<\/span>\u00a0the nature,\u00a0<\/span>scope<\/span>\u00a0and procedure of the data processing to the Processor.\u00a0<\/span>Instructions must be given in text form (e.g. e-mail).<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

3.4<\/b> Provisions concerning any\u00a0<\/span>remuneration<\/span>\u00a0of\u00a0<\/span>additional<\/span>\u00a0expenditure incurred by the Processor\u00a0<\/span>as a result of<\/span>\u00a0supplementary instructions of the Controller shall remain unaffected.<\/span><\/span>\u00a0<\/span><\/span><\/p>

3.5<\/b> The Controller shall inform the Processor without undue delay if it discovers errors or irregularities in connection with the processing of personal data by the Processor.<\/span><\/span>\u00a0<\/span><\/span><\/p>

3.6<\/b><\/span>\u00a0In the event that an obligation to provide information to third parties exists under Art. 33, 34 GDPR or under any other statutory reporting obligation applicable to the Controller, the Controller shall\u00a0<\/span>be responsible for<\/span>\u00a0compliance therewith.<\/span><\/span>\u00a0<\/span><\/p>

\u00a0<\/h3>

4. General Obligations of the Processor<\/strong><\/h3>

4.1<\/b> The Processor processes personal data exclusively within the scope of the agreements made and\/or in compliance with any supplementary instructions issued by the Controller. Excepted from this are statutory provisions that may oblige the Processor to process data otherwise. In such a case, the Processor shall notify the Controller of these legal requirements prior to the processing, unless the law in question prohibits such notification on grounds of an important public interest. The purpose,\u00a0<\/span>nature<\/span>\u00a0and scope of the data processing shall otherwise be governed exclusively by this Agreement and\/or the instructions of the Controller. Any processing of data deviating therefrom is prohibited to the\u00a0<\/span>Processor, unless<\/span>\u00a0the Controller has consented thereto in writing.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

4.2<\/b> The Processor shall, as a matter of principle, carry out the processing of data on behalf\u00a0<\/span>in<\/span>\u00a0Member States of the European Union (EU) or of the European Economic Area (EEA). Any transfer to a third country requires the prior consent of the Controller and may only take place if the\u00a0<\/span>special requirements<\/span>\u00a0of Art. 44-48 GDPR are met or an exception within the meaning of Art. 49 GDPR applies.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

4.3<\/b> The Processor shall inform the Controller without undue delay if, in its opinion, an instruction issued by the Controller infringes statutory provisions. The Processor shall be entitled to suspend the implementation of the instruction in question until it is confirmed or amended by the Controller. Where the Processor can\u00a0<\/span>demonstrate<\/span>\u00a0that processing\u00a0<\/span>in accordance with<\/span>\u00a0the Controller’s instruction may lead to liability of the Processor under Art. 82 GDPR, the Processor shall be free to suspend further processing to that extent until the liability between the parties has been clarified.<\/span><\/span>\u00a0<\/span><\/span><\/p>

\u00a0<\/h3>

5. Data Protection Officer of the Processor<\/strong><\/h3>

5.1<\/b> The Processor confirms that it has appointed a data protection officer\u00a0<\/span>in accordance with<\/span>\u00a0Art. 37 GDPR. The Processor shall ensure that the data protection officer has the necessary qualifications and the necessary\u00a0<\/span>expertise<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

5.2<\/b> The obligation to appoint a data protection officer under paragraph 1 may cease to apply at the discretion of the Controller if the Processor can demonstrate that it is not legally obliged to appoint a data protection officer and the Processor can demonstrate that internal arrangements exist which ensure that personal data are processed in compliance with the statutory provisions, the provisions of this Agreement and any further instructions of the Controller.<\/span><\/span>\u00a0<\/span><\/span><\/p>

\u00a0<\/h3>

6. Reporting Obligations of the Processor<\/strong><\/h3>

6.1<\/b> The Processor is obliged to notify the Controller without undue delay of any infringement of data protection provisions or of the contractual agreements made and\/or the instructions issued by the Controller which has occurred in the course of the processing of data by it or by other persons engaged in the processing. The same applies to any personal data breach concerning data which the Processor processes on behalf of the Controller.<\/span><\/span>\u00a0<\/span><\/span><\/p>

6.2<\/b> Furthermore, the Processor shall inform the Controller without undue delay if a supervisory authority\u00a0<\/span>takes action<\/span>\u00a0against the Processor under Art. 58 GDPR and this may also concern a review of the processing which the Processor performs on behalf of the Controller.<\/span><\/span>\u00a0<\/span><\/span><\/p>

6.3<\/b> The Processor is aware that the Controller may be subject to a reporting obligation in the case of personal data breaches under Art. 33, 34 GDPR, which provides for notification to the supervisory authority within 72 hours of becoming aware. The Processor shall support the Controller in implementing the reporting obligations. In particular, the Processor shall notify\u00a0<\/span>the Controller of any\u00a0<\/span>unauthorised<\/span>\u00a0access to personal data processed on behalf of the Controller without undue delay, but at the latest within 72 hours of becoming aware of the access. The Processor’s notification to the Controller must\u00a0<\/span>in particular contain<\/span>\u00a0the following information:<\/span><\/span>\u00a0<\/span><\/span><\/p>

  • a description of the nature of the personal data breach, where possible specifying the categories and the approximate number of data subjects concerned, the categories concerned and the approximate number of personal data records concerned;<\/span>\u00a0<\/span><\/li>
  • a description<\/span>\u00a0of the measures taken or proposed by the Processor to remedy the personal data breach and, where\u00a0<\/span>appropriate<\/span>, measures to mitigate its possible adverse effects.<\/span><\/span>\u00a0<\/span><\/li><\/ul>

    \u00a0<\/h3>

    7. Duties of Cooperation of the Processor<\/strong><\/h3>

    7.1<\/b> The Processor shall support the Controller in its obligation to respond to requests for the exercise of data subject rights under Art. 12-23 GDPR. The provisions of Section 12 of this Agreement shall apply.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    7.2<\/b> The Processor shall\u00a0<\/span>assist<\/span>\u00a0in the preparation of the records of processing activities by the Controller. It shall provide the Controller with the information\u00a0<\/span>required<\/span>\u00a0in this respect in\u00a0<\/span>an appropriate manner<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    7.3<\/b> The Processor shall assist the Controller, taking into account the nature of the processing and the information available to it, in complying with the obligations set out in Art. 32-36 GDPR.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    7.4<\/b> For support services that are not included in the service description or are not attributable to misconduct of the Processor and that go beyond the statutory obligations of the Processor, the Processor may claim reasonable remuneration on the basis of a market-standard offer (cf. Section 1<\/span>3<\/span>).\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    8. Provision on Mobile Workplaces<\/strong><\/h3>

    8.1<\/b> The Processor may\u00a0<\/span>permit<\/span>\u00a0its employees who are tasked with the processing of personal data for the Controller to process personal data at mobile workplaces outside the Processor’s business premises.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    8.2<\/b> The<\/span>\u00a0Processor shall ensure that compliance with the contractually agreed technical and\u00a0<\/span>organisational<\/span>\u00a0measures is also guaranteed when its employees use mobile workplaces. Deviations from individual contractually agreed technical and\u00a0<\/span>organisational<\/span>\u00a0measures must be agreed in advance with the Controller and approved by it in text form.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

    8.3<\/b> In particular, the<\/span>\u00a0Processor shall ensure that, where personal data\u00a0<\/span>are<\/span>\u00a0processed at mobile workplaces, the storage locations are configured in such a way that local storage of data on IT systems is excluded. Should this not be possible, the Processor shall ensure that local storage takes place exclusively in encrypted form and that other persons present at the location of the respective mobile workplace do not obtain access to these data.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    9. Audit Rights<\/strong><\/h3>

    9.1<\/b> The Controller\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>entitled<\/span>, at\u00a0<\/span>any<\/span>\u00a0time and to the\u00a0<\/span>extent<\/span>\u00a0<\/span>necessary<\/span>, to monitor the\u00a0<\/span>Processor’s<\/span>\u00a0<\/span>compliance<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>statutory<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>protection<\/span>\u00a0<\/span>provisions<\/span>\u00a0and\/<\/span>or<\/span>\u00a0<\/span>compliance<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>contractual<\/span>\u00a0<\/span>arrangements<\/span>\u00a0<\/span>made<\/span>\u00a0<\/span>between<\/span>\u00a0the\u00a0<\/span>parties<\/span>\u00a0and\/<\/span>or<\/span>\u00a0<\/span>compliance<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>instructions<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    9.2<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>obliged<\/span>\u00a0to\u00a0<\/span>provide<\/span>\u00a0<\/span>information<\/span>\u00a0to the Controller\u00a0<\/span>insofar<\/span>\u00a0as\u00a0<\/span>this<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>necessary<\/span>\u00a0for\u00a0<\/span>carrying<\/span>\u00a0out the\u00a0<\/span>monitoring<\/span>\u00a0<\/span>within<\/span>\u00a0the\u00a0<\/span>meaning<\/span>\u00a0of\u00a0<\/span>paragraph<\/span>\u00a01.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    9.3<\/b> The Controller\u00a0<\/span>may<\/span>,\u00a0<\/span>subject<\/span>\u00a0to\u00a0<\/span>prior<\/span>\u00a0<\/span>notice<\/span>\u00a0<\/span>given<\/span>\u00a0<\/span>within<\/span>\u00a0a\u00a0<\/span>reasonable<\/span>\u00a0<\/span>period<\/span>, carry out the\u00a0<\/span>monitoring<\/span>\u00a0<\/span>within<\/span>\u00a0the\u00a0<\/span>meaning<\/span>\u00a0of\u00a0<\/span>paragraph<\/span>\u00a01 at the\u00a0<\/span>Processor’s<\/span>\u00a0<\/span>place<\/span>\u00a0of\u00a0<\/span>business<\/span>\u00a0<\/span>during<\/span>\u00a0the usual\u00a0<\/span>business<\/span>\u00a0<\/span>hours<\/span>. In\u00a0<\/span>doing<\/span>\u00a0so, the Controller\u00a0<\/span>shall<\/span>\u00a0<\/span>ensure<\/span>\u00a0<\/span>that<\/span>\u00a0the\u00a0<\/span>monitoring<\/span>\u00a0<\/span>measures<\/span>\u00a0<\/span>are<\/span>\u00a0<\/span>carried<\/span>\u00a0out\u00a0<\/span>only<\/span>\u00a0to the\u00a0<\/span>extent<\/span>\u00a0<\/span>necessary<\/span>, so as not to\u00a0<\/span>disrupt<\/span>\u00a0the\u00a0<\/span>Processor’s<\/span>\u00a0<\/span>business<\/span>\u00a0<\/span>operations<\/span>\u00a0<\/span>disproportionately<\/span>. The\u00a0<\/span>parties<\/span>\u00a0<\/span>assume<\/span>\u00a0<\/span>that<\/span>\u00a0<\/span>monitoring<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>required<\/span>\u00a0at\u00a0<\/span>most<\/span>\u00a0<\/span>once<\/span>\u00a0a\u00a0<\/span>year<\/span>. Further\u00a0<\/span>audits<\/span>\u00a0<\/span>must<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>justified<\/span>\u00a0by the Controller\u00a0<\/span>stating<\/span>\u00a0the\u00a0<\/span>occasion<\/span>. In the\u00a0<\/span>case<\/span>\u00a0of on-site\u00a0<\/span>monitoring<\/span>, the Controller\u00a0<\/span>shall<\/span>\u00a0<\/span>reimburse<\/span>\u00a0the\u00a0<\/span>Processor<\/span>, to a\u00a0<\/span>reasonable<\/span>\u00a0<\/span>extent<\/span>, for the\u00a0<\/span>expenses<\/span>\u00a0<\/span>incurred<\/span>,\u00a0<\/span>including<\/span>\u00a0the\u00a0<\/span>personnel<\/span>\u00a0<\/span>costs<\/span>\u00a0for the support and\u00a0<\/span>accompaniment<\/span>\u00a0of the\u00a0<\/span>auditing<\/span>\u00a0<\/span>personnel<\/span>\u00a0on\u00a0<\/span>site<\/span>. The\u00a0<\/span>basis<\/span>\u00a0for the\u00a0<\/span>calculation<\/span>\u00a0of\u00a0<\/span>costs<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>communicated<\/span>\u00a0to the Controller by the\u00a0<\/span>Processor<\/span>\u00a0<\/span>prior<\/span>\u00a0to\u00a0<\/span>carrying<\/span>\u00a0out the\u00a0<\/span>monitoring<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    9.4<\/b> At the Processor’s option, evidence of compliance with the technical and\u00a0<\/span>organisational<\/span>\u00a0measures may, instead of an on-site inspection, also be furnished by submitting a suitable, current attestation, reports or excerpts of reports from independent bodies (e.g. auditors, internal audit, data protection officer, IT security department, data protection auditors or quality auditors) or a suitable certification, where the audit report enables the Controller to satisfy itself in an appropriate manner of compliance with the technical and\u00a0<\/span>organisational<\/span>\u00a0measures pursuant to Annex\u202f3 to this Agreement. Should the Controller have justified doubts as to the suitability of the audit document within the meaning of sentence 1, an on-site inspection may be carried out by the Controller. The Controller is aware that an on-site inspection in data\u00a0<\/span>centres<\/span>\u00a0is not possible or only possible in justified exceptional cases. For support services that are not included in the service description or are not attributable to misconduct of the Processor and that go beyond the statutory obligations of the Processor, the Processor may claim reasonable remuneration on the basis of a market-standard offer (cf. Section 1<\/span>3<\/span>).<\/span><\/span>\u00a0<\/span><\/span><\/p>

    9.5<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>obliged<\/span>, in the\u00a0<\/span>case<\/span>\u00a0of\u00a0<\/span>measures<\/span>\u00a0by the\u00a0<\/span>supervisory<\/span>\u00a0<\/span>authority<\/span>\u00a0<\/span>against<\/span>\u00a0the Controller\u00a0<\/span>within<\/span>\u00a0the\u00a0<\/span>meaning<\/span>\u00a0of Art. 58 GDPR, in\u00a0<\/span>particular<\/span>\u00a0<\/span>with<\/span>\u00a0<\/span>regard<\/span>\u00a0to\u00a0<\/span>obligations<\/span>\u00a0to\u00a0<\/span>provide<\/span>\u00a0<\/span>information<\/span>\u00a0and to\u00a0<\/span>permit<\/span>\u00a0<\/span>monitoring<\/span>, to\u00a0<\/span>provide<\/span>\u00a0the Controller\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>necessary<\/span>\u00a0<\/span>information<\/span>\u00a0and to\u00a0<\/span>enable<\/span>\u00a0the\u00a0<\/span>respective<\/span>\u00a0<\/span>competent<\/span>\u00a0<\/span>supervisory<\/span>\u00a0<\/span>authority<\/span>\u00a0to carry out an on-site\u00a0<\/span>inspection<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>inform<\/span>\u00a0the Controller of\u00a0<\/span>any<\/span>\u00a0such planned\u00a0<\/span>measures<\/span>.<\/span><\/span><\/p>

    9.6<\/b> The\u00a0<\/span>parties<\/span>\u00a0<\/span>agree<\/span>\u00a0<\/span>that<\/span>, in the\u00a0<\/span>case<\/span>\u00a0of\u00a0<\/span>processing<\/span>\u00a0of personal\u00a0<\/span>data<\/span>\u00a0at mobile\u00a0<\/span>workplaces<\/span>, the\u00a0<\/span>monitoring<\/span>\u00a0<\/span>measures<\/span>\u00a0<\/span>shall<\/span>, in\u00a0<\/span>order<\/span>\u00a0to\u00a0<\/span>safeguard<\/span>\u00a0the\u00a0<\/span>personality<\/span>\u00a0<\/span>rights<\/span>\u00a0of\u00a0<\/span>further<\/span>\u00a0<\/span>persons<\/span>\u00a0at\u00a0<\/span>these<\/span>\u00a0mobile\u00a0<\/span>workplaces<\/span>,\u00a0<\/span>primarily<\/span>\u00a0<\/span>take<\/span>\u00a0<\/span>place<\/span>\u00a0by\u00a0<\/span>way<\/span>\u00a0of a review of the\u00a0<\/span>assurance<\/span>\u00a0of the\u00a0<\/span>measures<\/span>\u00a0to\u00a0<\/span>be<\/span>\u00a0<\/span>taken<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>\u00a0<\/span>pursuant<\/span>\u00a0to\u00a0<\/span>Section<\/span>\u00a09(2) and (3). On a\u00a0<\/span>case<\/span>-by-<\/span>case<\/span>\u00a0<\/span>basis<\/span>, the Controller\u00a0<\/span>shall<\/span>\u00a0also\u00a0<\/span>be<\/span>\u00a0<\/span>enabled<\/span>\u00a0to monitor the mobile\u00a0<\/span>workplace<\/span>\u00a0of the\u00a0<\/span>Processor’s<\/span>\u00a0<\/span>employees<\/span>.<\/span><\/span>\u00a0<\/span>
    <\/span><\/span><\/p>

    \u00a0<\/h3>

    10. Sub-processing<\/strong><\/h3>

    10.1<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>entitled<\/span>\u00a0to\u00a0<\/span>use<\/span>\u00a0the sub-<\/span>processors<\/span>\u00a0<\/span>specified<\/span>\u00a0in\u00a0<\/span><\/span>Annex 2<\/span><\/span>\u00a0to\u00a0<\/span>this<\/span>\u00a0Agreement for the\u00a0<\/span>processing<\/span>\u00a0of\u00a0<\/span>data<\/span>\u00a0on behalf. The\u00a0<\/span>replacement<\/span>\u00a0of sub-<\/span>processors<\/span>\u00a0<\/span>or<\/span>\u00a0the\u00a0<\/span>engagement<\/span>\u00a0of\u00a0<\/span>further<\/span>\u00a0sub-<\/span>processors<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>permitted<\/span>\u00a0<\/span>subject<\/span>\u00a0to the\u00a0<\/span>conditions<\/span>\u00a0<\/span>set<\/span>\u00a0out in\u00a0<\/span>paragraph<\/span>\u00a02.<\/span><\/span>\u00a0<\/span><\/p>

    10.2<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>select<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>carefully<\/span>\u00a0and,\u00a0<\/span>prior<\/span>\u00a0to\u00a0<\/span>engagement<\/span>,\u00a0<\/span>verify<\/span>\u00a0<\/span>that<\/span>\u00a0it\u00a0<\/span>is<\/span>\u00a0<\/span>able<\/span>\u00a0to\u00a0<\/span>comply<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>agreements<\/span>\u00a0<\/span>made<\/span>\u00a0<\/span>between<\/span>\u00a0the Controller and the\u00a0<\/span>Processor<\/span>. In\u00a0<\/span>particular<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>verify<\/span>, in\u00a0<\/span>advance<\/span>\u00a0and\u00a0<\/span>regularly<\/span>\u00a0<\/span>during<\/span>\u00a0the\u00a0<\/span>term<\/span>\u00a0of the\u00a0<\/span>contract<\/span>,\u00a0<\/span>that<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>has<\/span>\u00a0<\/span>taken<\/span>\u00a0the\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>required<\/span>\u00a0<\/span>under<\/span>\u00a0Art. 32 GDPR for the\u00a0<\/span>protection<\/span>\u00a0of personal\u00a0<\/span>data<\/span>. In the\u00a0<\/span>case<\/span>\u00a0of a planned\u00a0<\/span>replacement<\/span>\u00a0of a\u00a0<\/span>sub-<\/span>processor<\/span>\u00a0<\/span>or<\/span>\u00a0a planned\u00a0<\/span>engagement<\/span>\u00a0of a\u00a0<\/span>new<\/span>\u00a0sub-<\/span>processor<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>inform<\/span>\u00a0the Controller in\u00a0<\/span>good<\/span>\u00a0time, but at the\u00a0<\/span>latest<\/span>\u00a04\u00a0<\/span>weeks<\/span>\u00a0<\/span>prior<\/span>\u00a0to the\u00a0<\/span>replacement<\/span>\u00a0<\/span>or<\/span>\u00a0the\u00a0<\/span>new<\/span>\u00a0<\/span>engagement<\/span>, in\u00a0<\/span>text<\/span>\u00a0form (\u201cInformation\u201d). The Controller\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>entitled<\/span>\u00a0to\u00a0<\/span>object<\/span>\u00a0to the\u00a0<\/span>replacement<\/span>\u00a0<\/span>or<\/span>\u00a0the\u00a0<\/span>new<\/span>\u00a0<\/span>engagement<\/span>\u00a0of the sub-<\/span>processor<\/span>,\u00a0<\/span>stating<\/span>\u00a0the\u00a0<\/span>reasons<\/span>\u00a0in\u00a0<\/span>text<\/span>\u00a0<\/span>form<\/span>,\u00a0<\/span>within<\/span>\u00a02\u00a0<\/span>weeks<\/span>\u00a0of\u00a0<\/span>receipt<\/span>\u00a0of the \u201cInformation\u201d. The\u00a0<\/span>objection<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>withdrawn<\/span>\u00a0by the Controller at\u00a0<\/span>any<\/span>\u00a0time in\u00a0<\/span>text<\/span>\u00a0<\/span>form<\/span>. In the\u00a0<\/span>event<\/span>\u00a0of an\u00a0<\/span>objection<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>terminate<\/span>\u00a0the\u00a0<\/span>contractual<\/span>\u00a0<\/span>relationship<\/span>\u00a0<\/span>with<\/span>\u00a0the Controller\u00a0<\/span>subject<\/span>\u00a0to a\u00a0<\/span>notice<\/span>\u00a0<\/span>period<\/span>\u00a0of at least 14\u00a0<\/span>days<\/span>\u00a0to the end of a\u00a0<\/span>calendar<\/span>\u00a0<\/span>month<\/span>. In\u00a0<\/span>setting<\/span>\u00a0the\u00a0<\/span>notice<\/span>\u00a0<\/span>period<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>give<\/span>\u00a0<\/span>appropriate<\/span>\u00a0<\/span>consideration<\/span>\u00a0to the\u00a0<\/span>interests<\/span>\u00a0of the Controller.\u00a0<\/span>If<\/span>\u00a0the Controller\u00a0<\/span>does<\/span>\u00a0not\u00a0<\/span>object<\/span>\u00a0<\/span>within<\/span>\u00a0<\/span>2<\/span>weeks<\/span>\u00a0of\u00a0<\/span>receipt<\/span>\u00a0of the \u201cInformation\u201d,\u00a0<\/span>this<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>deemed<\/span>\u00a0to\u00a0<\/span>constitute<\/span>\u00a0the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>consent<\/span>\u00a0to the\u00a0<\/span>replacement<\/span>\u00a0<\/span>or<\/span>\u00a0the\u00a0<\/span>new<\/span>\u00a0<\/span>engagement<\/span>\u00a0of the sub-<\/span>processor<\/span>\u00a0<\/span>concerned<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.3<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>obliged<\/span>\u00a0to\u00a0<\/span>obtain<\/span>\u00a0<\/span>confirmation<\/span>\u00a0<\/span>from<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>that<\/span>\u00a0it\u00a0<\/span>has<\/span>\u00a0<\/span>appointed<\/span>\u00a0a\u00a0<\/span>data<\/span>\u00a0<\/span>protection<\/span>\u00a0<\/span>officer<\/span>\u00a0in\u00a0<\/span>accordance<\/span>\u00a0<\/span>with<\/span>\u00a0Art. 37 GDPR,\u00a0<\/span>provided<\/span>\u00a0<\/span>that<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>legally<\/span>\u00a0<\/span>obliged<\/span>\u00a0to\u00a0<\/span>appoint<\/span>\u00a0a\u00a0<\/span>data<\/span>\u00a0<\/span>protection<\/span>\u00a0<\/span>officer<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.4 <\/b>The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>ensure<\/span>\u00a0<\/span>that<\/span>\u00a0the\u00a0<\/span>provisions<\/span>\u00a0<\/span>agreed<\/span>\u00a0in\u00a0<\/span>this<\/span>\u00a0Agreement and\u00a0<\/span>any<\/span>\u00a0<\/span>supplementary<\/span>\u00a0<\/span>instructions<\/span>\u00a0of the Controller also\u00a0<\/span>apply<\/span>\u00a0vis-\u00e0-vis the sub-<\/span>processor<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.5<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>conclude<\/span>\u00a0a\u00a0<\/span>data<\/span>\u00a0<\/span>processing<\/span>\u00a0<\/span>agreement<\/span>\u00a0<\/span>with<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>which<\/span>\u00a0meets the\u00a0<\/span>requirements<\/span>\u00a0of Art. 28 GDPR. In\u00a0<\/span>addition<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>impose<\/span>\u00a0on the sub-<\/span>processor<\/span>\u00a0the same\u00a0<\/span>obligations<\/span>\u00a0for the\u00a0<\/span>protection<\/span>\u00a0of personal\u00a0<\/span>data<\/span>\u00a0as\u00a0<\/span>are<\/span>\u00a0<\/span>laid<\/span>\u00a0down\u00a0<\/span>between<\/span>\u00a0the Controller and the\u00a0<\/span>Processor<\/span>. A\u00a0<\/span>copy<\/span>\u00a0of the\u00a0<\/span>data<\/span>\u00a0<\/span>processing<\/span>\u00a0<\/span>agreement<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>provided<\/span>\u00a0to the Controller on\u00a0<\/span>request<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.6<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>, in\u00a0<\/span>particular<\/span>,\u00a0<\/span>obliged<\/span>\u00a0to\u00a0<\/span>ensure<\/span>\u00a0by\u00a0<\/span>means<\/span>\u00a0of\u00a0<\/span>contractual<\/span>\u00a0<\/span>provisions<\/span>\u00a0<\/span>that<\/span>\u00a0the\u00a0<\/span>audit<\/span>\u00a0<\/span>rights<\/span>\u00a0(<\/span>Section<\/span>\u00a09 of\u00a0<\/span>this<\/span>\u00a0Agreement) of the Controller and of\u00a0<\/span>supervisory<\/span>\u00a0<\/span>authorities<\/span>\u00a0also\u00a0<\/span>apply<\/span>\u00a0vis-\u00e0-vis the sub-<\/span>processor<\/span>\u00a0and\u00a0<\/span>that<\/span>\u00a0<\/span>corresponding<\/span>\u00a0<\/span>audit<\/span>\u00a0<\/span>rights<\/span>\u00a0of the Controller and of\u00a0<\/span>supervisory<\/span>\u00a0<\/span>authorities<\/span>\u00a0<\/span>are<\/span>\u00a0<\/span>agreed<\/span>. It\u00a0<\/span>must<\/span>\u00a0also\u00a0<\/span>be<\/span>\u00a0<\/span>contractually<\/span>\u00a0<\/span>stipulated<\/span>\u00a0<\/span>that<\/span>\u00a0the sub-<\/span>processor<\/span>\u00a0<\/span>must<\/span>\u00a0<\/span>tolerate<\/span>\u00a0<\/span>these<\/span>\u00a0<\/span>monitoring<\/span>\u00a0<\/span>measures<\/span>\u00a0and\u00a0<\/span>any<\/span>\u00a0on-site\u00a0<\/span>inspections<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.7<\/b> Services\u00a0<\/span>which<\/span>\u00a0the\u00a0<\/span>Processor<\/span>\u00a0<\/span>obtains<\/span>\u00a0<\/span>from<\/span>\u00a0<\/span>third<\/span>\u00a0<\/span>parties<\/span>\u00a0as a\u00a0<\/span>mere<\/span>\u00a0<\/span>ancillary<\/span>\u00a0<\/span>service<\/span>\u00a0in\u00a0<\/span>order<\/span>\u00a0to carry out\u00a0<\/span>its<\/span>\u00a0<\/span>business<\/span>\u00a0<\/span>activity<\/span>\u00a0<\/span>shall<\/span>\u00a0not\u00a0<\/span>be<\/span>\u00a0<\/span>regarded<\/span>\u00a0as sub-<\/span>processing<\/span>\u00a0<\/span>within<\/span>\u00a0the\u00a0<\/span>meaning<\/span>\u00a0of\u00a0<\/span>paragraphs<\/span>\u00a01 to 6. These\u00a0<\/span>include<\/span>, for\u00a0<\/span>example<\/span>,\u00a0<\/span>cleaning<\/span>\u00a0<\/span>services<\/span>,\u00a0<\/span>mere<\/span>\u00a0<\/span>telecommunications<\/span>\u00a0<\/span>services<\/span>\u00a0<\/span>without<\/span>\u00a0<\/span>any<\/span>\u00a0<\/span>specific<\/span>\u00a0<\/span>connection<\/span>\u00a0to\u00a0<\/span>services<\/span>\u00a0<\/span>which<\/span>\u00a0the\u00a0<\/span>Processor<\/span>\u00a0<\/span>provides<\/span>\u00a0for the Controller, postal and\u00a0<\/span>courier<\/span>\u00a0<\/span>services<\/span>,\u00a0<\/span>transport<\/span>\u00a0<\/span>services<\/span>,\u00a0<\/span>security<\/span>\u00a0<\/span>services<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>nevertheless<\/span>\u00a0<\/span>obliged<\/span>, also in the\u00a0<\/span>case<\/span>\u00a0of\u00a0<\/span>ancillary<\/span>\u00a0<\/span>services<\/span>\u00a0<\/span>provided<\/span>\u00a0by\u00a0<\/span>third<\/span>\u00a0<\/span>parties<\/span>, to\u00a0<\/span>ensure<\/span>\u00a0<\/span>that<\/span>\u00a0<\/span>appropriate<\/span>\u00a0<\/span>precautions<\/span>\u00a0and\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>have<\/span>\u00a0<\/span>been<\/span>\u00a0<\/span>taken<\/span>\u00a0to\u00a0<\/span>guarantee<\/span>\u00a0the\u00a0<\/span>protection<\/span>\u00a0of personal\u00a0<\/span>data<\/span>. The\u00a0<\/span>maintenance<\/span>\u00a0and\u00a0<\/span>servicing<\/span>\u00a0of IT\u00a0<\/span>systems<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>applications<\/span>\u00a0<\/span>constitutes<\/span>\u00a0a sub-<\/span>processing<\/span>\u00a0<\/span>relationship<\/span>\u00a0<\/span>requiring<\/span>\u00a0<\/span>consent<\/span>\u00a0and\u00a0<\/span>processing<\/span>\u00a0on behalf\u00a0<\/span>within<\/span>\u00a0the\u00a0<\/span>meaning<\/span>\u00a0of Art. 28 GDPR\u00a0<\/span>where<\/span>\u00a0the\u00a0<\/span>maintenance<\/span>\u00a0and\u00a0<\/span>inspection<\/span>\u00a0<\/span>concerns<\/span>\u00a0such IT\u00a0<\/span>systems<\/span>\u00a0as\u00a0<\/span>are<\/span>\u00a0also\u00a0<\/span>used<\/span>\u00a0in\u00a0<\/span>connection<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>provision<\/span>\u00a0of\u00a0<\/span>services<\/span>\u00a0for the Controller and\u00a0<\/span>where<\/span>\u00a0personal\u00a0<\/span>data<\/span>\u00a0<\/span>processed<\/span>\u00a0on behalf of the Controller\u00a0<\/span>can<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>accessed<\/span>\u00a0<\/span>during<\/span>\u00a0the\u00a0<\/span>maintenance<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    11. Confidentiality Obligation<\/strong><\/h3>

    11.1 <\/b><\/span>When\u00a0processing\u00a0data for the Controller, the Processor\u00a0<\/span>is\u00a0obliged\u00a0to\u00a0maintain\u00a0confidentiality\u00a0regarding\u00a0data\u00a0which\u00a0it\u00a0receives\u00a0or\u00a0of\u00a0which\u00a0it\u00a0becomes\u00a0aware\u00a0in\u00a0connection\u00a0with\u00a0the\u00a0order.<\/span>\u00a0<\/span><\/p>

    11.2 <\/b>The\u00a0Processor\u00a0has\u00a0familiarised\u00a0its\u00a0employees\u00a0with\u00a0the\u00a0data\u00a0protection\u00a0provisions\u00a0relevant to\u00a0them\u00a0and\u00a0has\u00a0bound\u00a0them\u00a0to\u00a0confidentiality.\u00a0\u00a0<\/span><\/p>

    11.3<\/b> The\u00a0<\/span>obligations<\/span>\u00a0of the\u00a0<\/span>employees<\/span>\u00a0<\/span>under<\/span>\u00a0<\/span>paragraph<\/span>\u00a02\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>evidenced<\/span>\u00a0to the Controller on\u00a0<\/span>request<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    12. Safeguarding of Data Subject Rights<\/strong><\/h3>

    12.1<\/b> The Controller\u00a0<\/span>is<\/span>\u00a0<\/span>solely<\/span>\u00a0<\/span>responsible<\/span>\u00a0for\u00a0<\/span>safeguarding<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>subject<\/span>\u00a0<\/span>rights<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>obliged<\/span>\u00a0to support the Controller in\u00a0<\/span>its<\/span>\u00a0<\/span>obligation<\/span>\u00a0to\u00a0<\/span>process<\/span>\u00a0<\/span>requests<\/span>\u00a0<\/span>from<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>subjects<\/span>\u00a0<\/span>under<\/span>\u00a0Art. 12-23 GDPR. In\u00a0<\/span>doing<\/span>\u00a0so, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0in\u00a0<\/span>particular<\/span>\u00a0<\/span>ensure<\/span>\u00a0<\/span>that<\/span>\u00a0the\u00a0<\/span>information<\/span>\u00a0<\/span>required<\/span>\u00a0in\u00a0<\/span>this<\/span>\u00a0<\/span>respect<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>provided<\/span>\u00a0to the Controller\u00a0<\/span>without<\/span>\u00a0<\/span>undue<\/span>\u00a0<\/span>delay<\/span>, so\u00a0<\/span>that<\/span>\u00a0the Controller\u00a0<\/span>can<\/span>\u00a0in\u00a0<\/span>particular<\/span>\u00a0<\/span>comply<\/span>\u00a0<\/span>with<\/span>\u00a0<\/span>its<\/span>\u00a0<\/span>obligations<\/span>\u00a0<\/span>under<\/span>\u00a0Art. 12(3) GDPR.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

    12.2<\/b> Insofar<\/span>\u00a0as\u00a0<\/span>cooperation<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>necessary<\/span>\u00a0for the\u00a0<\/span>safeguarding<\/span>\u00a0of\u00a0<\/span>data<\/span>\u00a0<\/span>subject<\/span>\u00a0<\/span>rights<\/span>\u00a0\u2013 in\u00a0<\/span>particular<\/span>\u00a0as\u00a0<\/span>regards<\/span>\u00a0<\/span>access<\/span>,\u00a0<\/span>rectification<\/span>,\u00a0<\/span>blocking<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>erasure<\/span>\u00a0\u2013 by the Controller, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>take<\/span>\u00a0the\u00a0<\/span>respective<\/span>\u00a0<\/span>necessary<\/span>\u00a0<\/span>measures<\/span>\u00a0in\u00a0<\/span>accordance<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>instructions<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>,\u00a0<\/span>where<\/span>\u00a0possible, support the Controller by\u00a0<\/span>means<\/span>\u00a0of\u00a0<\/span>appropriate<\/span>\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0in\u00a0<\/span>complying<\/span>\u00a0<\/span>with<\/span>\u00a0<\/span>its<\/span>\u00a0<\/span>obligation<\/span>\u00a0to\u00a0<\/span>respond<\/span>\u00a0to\u00a0<\/span>requests<\/span>\u00a0for the\u00a0<\/span>exercise<\/span>\u00a0of\u00a0<\/span>data<\/span>\u00a0<\/span>subject<\/span>\u00a0<\/span>rights<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    12.3<\/b> For support\u00a0<\/span>services<\/span>\u00a0<\/span>that<\/span>\u00a0<\/span>are<\/span>\u00a0not included in the\u00a0<\/span>service<\/span>\u00a0<\/span>description<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>are<\/span>\u00a0not attributable to\u00a0<\/span>misconduct<\/span>\u00a0of the\u00a0<\/span>Processor<\/span>\u00a0and\u00a0<\/span>that<\/span>\u00a0go\u00a0<\/span>beyond<\/span>\u00a0the\u00a0<\/span>statutory<\/span>\u00a0<\/span>obligations<\/span>\u00a0of the\u00a0<\/span>Processor<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>claim<\/span>\u00a0<\/span>reasonable<\/span>\u00a0<\/span>remuneration<\/span>\u00a0on the\u00a0<\/span>basis<\/span>\u00a0of a\u00a0<\/span>market<\/span>-standard\u00a0<\/span>offer<\/span>\u00a0(cf.\u00a0<\/span>Section<\/span>\u00a01<\/span>3<\/span>).<\/span><\/span><\/p>

    \u00a0<\/h3>

    13. Remuneration<\/strong><\/h3>

    Any\u00a0<\/span>claims<\/span>\u00a0for\u00a0<\/span>remuneration<\/span>\u00a0<\/span>which<\/span>\u00a0the\u00a0<\/span>Processor<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>assert<\/span>\u00a0<\/span>under<\/span>\u00a0the\u00a0<\/span>foregoing<\/span>\u00a0<\/span>clauses<\/span>\u00a0<\/span>must<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>reasonable<\/span>. The\u00a0<\/span>billing<\/span>\u00a0of the\u00a0<\/span>expenditure<\/span>\u00a0<\/span>incurred<\/span>\u00a0at the\u00a0<\/span>market<\/span>-standard\u00a0<\/span>hourly<\/span>\u00a0<\/span>rates<\/span>\u00a0<\/span>charged<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>, on the\u00a0<\/span>basis<\/span>\u00a0of an\u00a0<\/span>offer<\/span>\u00a0<\/span>agreed<\/span>\u00a0<\/span>between<\/span>\u00a0the Controller and the\u00a0<\/span>Processor<\/span>\u00a0<\/span>prior<\/span>\u00a0to the\u00a0<\/span>expenditure<\/span>\u00a0<\/span>being<\/span>\u00a0<\/span>incurred<\/span>,\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>deemed<\/span>\u00a0<\/span>reasonable<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    14. Technical and Organisational Measures for Data Security<\/span><\/b><\/h3>

    14.1<\/b> The\u00a0<\/span>Processor<\/span>\u00a0<\/span>undertakes<\/span>\u00a0vis-\u00e0-vis the Controller to\u00a0<\/span>comply<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>necessary<\/span>\u00a0to\u00a0<\/span>comply<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>applicable<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>protection<\/span>\u00a0<\/span>provisions<\/span>. This\u00a0<\/span>includes<\/span>, in\u00a0<\/span>particular<\/span>, the\u00a0<\/span>requirements<\/span>\u00a0of Art. 32 GDPR.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    14.2<\/strong> The\u00a0<\/span>status<\/span>\u00a0of the\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>existing<\/span>\u00a0at the time of\u00a0<\/span>conclusion<\/span>\u00a0of the\u00a0<\/span>contract<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>attached<\/span>\u00a0as\u00a0<\/span><\/span>Annex 3<\/span><\/span>\u00a0to\u00a0<\/span>this<\/span>\u00a0Agreement. The\u00a0<\/span>parties<\/span>\u00a0<\/span>agree<\/span>\u00a0<\/span>that<\/span>, in\u00a0<\/span>order<\/span>\u00a0to\u00a0<\/span>adapt<\/span>\u00a0to\u00a0<\/span>technical<\/span>\u00a0and legal\u00a0<\/span>circumstances<\/span>,\u00a0<\/span>amendments<\/span>\u00a0to the\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>become<\/span>\u00a0<\/span>necessary<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>agree<\/span>\u00a0material\u00a0<\/span>changes<\/span>\u00a0<\/span>which<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>affect<\/span>\u00a0the\u00a0<\/span>integrity<\/span>,\u00a0<\/span>confidentiality<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>availability<\/span>\u00a0of the personal\u00a0<\/span>data<\/span>\u00a0<\/span>with<\/span>\u00a0the Controller in\u00a0<\/span>advance<\/span>. Measures\u00a0<\/span>which<\/span>\u00a0<\/span>entail<\/span>\u00a0<\/span>only<\/span>\u00a0minor\u00a0<\/span>technical<\/span>\u00a0<\/span>or<\/span>\u00a0organisational\u00a0<\/span>changes<\/span>\u00a0and\u00a0<\/span>which<\/span>\u00a0do not\u00a0<\/span>adversely<\/span>\u00a0<\/span>affect<\/span>\u00a0the\u00a0<\/span>integrity<\/span>,\u00a0<\/span>confidentiality<\/span>\u00a0and\u00a0<\/span>availability<\/span>\u00a0of the personal\u00a0<\/span>data<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>implemented<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>\u00a0<\/span>without<\/span>\u00a0<\/span>coordination<\/span>\u00a0<\/span>with<\/span>\u00a0the Controller. The Controller\u00a0<\/span>may<\/span>\u00a0at\u00a0<\/span>any<\/span>\u00a0time\u00a0<\/span>request<\/span>\u00a0a\u00a0<\/span>current<\/span>\u00a0<\/span>version<\/span>\u00a0of the\u00a0<\/span>technical<\/span>\u00a0and organisational\u00a0<\/span>measures<\/span>\u00a0<\/span>taken<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    15. Term of the Order<\/strong><\/h3>

    15.1<\/b> This DPA\u00a0<\/span>shall<\/span>\u00a0<\/span>take<\/span>\u00a0<\/span>effect<\/span>\u00a0upon\u00a0<\/span>conclusion<\/span>\u00a0of the\u00a0<\/span>main<\/span>\u00a0<\/span>agreement<\/span>\u00a0<\/span>or<\/span>\u00a0upon the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>acceptance<\/span>\u00a0of the\u00a0<\/span>Processor’s<\/span>\u00a0General Terms and\u00a0<\/span>Conditions<\/span>\u00a0in electronic form (Art. 28(9) GDPR) and\u00a0<\/span>shall<\/span>\u00a0<\/span>run<\/span>\u00a0for the\u00a0<\/span>duration<\/span>\u00a0of the\u00a0<\/span>main<\/span>\u00a0<\/span>agreement<\/span>\u00a0<\/span>existing<\/span>\u00a0<\/span>between<\/span>\u00a0the\u00a0<\/span>parties<\/span>.<\/span><\/span><\/p>

    15.2<\/b> The Controller\u00a0<\/span>may<\/span>\u00a0<\/span>terminate<\/span>\u00a0the\u00a0<\/span>contract<\/span>\u00a0at\u00a0<\/span>any<\/span>\u00a0time\u00a0<\/span>without<\/span>\u00a0<\/span>observing<\/span>\u00a0a\u00a0<\/span>notice<\/span>\u00a0<\/span>period<\/span>\u00a0<\/span>if<\/span>\u00a0<\/span>there<\/span>\u00a0<\/span>is<\/span>\u00a0a\u00a0<\/span>serious<\/span>\u00a0<\/span>infringement<\/span>\u00a0by the\u00a0<\/span>Processor<\/span>\u00a0of the\u00a0<\/span>applicable<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>protection<\/span>\u00a0<\/span>provisions<\/span>\u00a0<\/span>or<\/span>\u00a0of\u00a0<\/span>obligations<\/span>\u00a0<\/span>under<\/span>\u00a0<\/span>this<\/span>\u00a0Agreement,\u00a0<\/span>if<\/span>\u00a0the\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>unable<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>unwilling<\/span>\u00a0to carry out an\u00a0<\/span>instruction<\/span>\u00a0of the Controller,\u00a0<\/span>or<\/span>\u00a0<\/span>if<\/span>\u00a0the\u00a0<\/span>Processor<\/span>, in\u00a0<\/span>breach<\/span>\u00a0of\u00a0<\/span>contract<\/span>,\u00a0<\/span>refuses<\/span>\u00a0<\/span>access<\/span>\u00a0to the Controller\u00a0<\/span>or<\/span>\u00a0to the\u00a0<\/span>competent<\/span>\u00a0<\/span>supervisory<\/span>\u00a0<\/span>authority<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    16. Termination<\/strong><\/h3>

    16.1<\/b> Upon\u00a0<\/span>termination<\/span>\u00a0of the\u00a0<\/span>contract<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>, at the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>option<\/span>,\u00a0<\/span>return<\/span>\u00a0to the Controller\u00a0<\/span>or<\/span>\u00a0<\/span>erase<\/span>\u00a0all\u00a0<\/span>documents<\/span>,\u00a0<\/span>data<\/span>\u00a0and\u00a0<\/span>processing<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>usage<\/span>\u00a0<\/span>results<\/span>\u00a0created\u00a0<\/span>which<\/span>\u00a0<\/span>have<\/span>\u00a0<\/span>come<\/span>\u00a0<\/span>into<\/span>\u00a0<\/span>its<\/span>\u00a0<\/span>possession<\/span>\u00a0and\u00a0<\/span>which<\/span>\u00a0<\/span>are<\/span>\u00a0<\/span>connected<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>order<\/span>\u00a0<\/span>relationship<\/span>. The\u00a0<\/span>erasure<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>documented<\/span>\u00a0in an\u00a0<\/span>appropriate<\/span>\u00a0<\/span>manner<\/span>.<\/span><\/span><\/p>

    16.2 <\/strong>The\u00a0<\/span>Processor<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>store<\/span>\u00a0personal\u00a0<\/span>data<\/span>\u00a0<\/span>processed<\/span>\u00a0in\u00a0<\/span>connection<\/span>\u00a0<\/span>with<\/span>\u00a0the\u00a0<\/span>order<\/span>\u00a0<\/span>beyond<\/span>\u00a0the\u00a0<\/span>termination<\/span>\u00a0of the\u00a0<\/span>contract<\/span>\u00a0<\/span>if<\/span>\u00a0and\u00a0<\/span>insofar<\/span>\u00a0as the\u00a0<\/span>Processor<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>subject<\/span>\u00a0to a\u00a0<\/span>statutory<\/span>\u00a0<\/span>retention<\/span>\u00a0<\/span>obligation<\/span>. In such\u00a0<\/span>cases<\/span>, the\u00a0<\/span>data<\/span>\u00a0<\/span>may<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>processed<\/span>\u00a0<\/span>only<\/span>\u00a0for the\u00a0<\/span>purposes<\/span>\u00a0of\u00a0<\/span>fulfilling<\/span>\u00a0the\u00a0<\/span>respective<\/span>\u00a0<\/span>statutory<\/span>\u00a0<\/span>retention<\/span>\u00a0<\/span>obligations<\/span>. Upon\u00a0<\/span>expiry<\/span>\u00a0of the\u00a0<\/span>retention<\/span>\u00a0<\/span>obligation<\/span>, the\u00a0<\/span>data<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>erased<\/span>\u00a0<\/span>without<\/span>\u00a0<\/span>undue<\/span>\u00a0<\/span>delay<\/span>.<\/span><\/p>

    \u00a0<\/h3>

    17. Final Provisions<\/strong><\/h3>

    17.1<\/b> Should<\/span>\u00a0the\u00a0<\/span>Controller’s<\/span>\u00a0<\/span>property<\/span>\u00a0at the\u00a0<\/span>Processor<\/span>\u00a0<\/span>be<\/span>\u00a0<\/span>jeopardised<\/span>\u00a0by\u00a0<\/span>measures<\/span>\u00a0of\u00a0<\/span>third<\/span>\u00a0<\/span>parties<\/span>\u00a0(such as by\u00a0<\/span>attachment<\/span>\u00a0<\/span>or<\/span>\u00a0<\/span>seizure<\/span>), by\u00a0<\/span>insolvency<\/span>\u00a0<\/span>proceedings<\/span>\u00a0<\/span>or<\/span>\u00a0by\u00a0<\/span>other<\/span>\u00a0<\/span>events<\/span>, the\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>inform<\/span>\u00a0the Controller\u00a0<\/span>without<\/span>\u00a0<\/span>undue<\/span>\u00a0<\/span>delay<\/span>. The\u00a0<\/span>Processor<\/span>\u00a0<\/span>shall<\/span>\u00a0<\/span>inform<\/span>\u00a0the\u00a0<\/span>creditors<\/span>\u00a0<\/span>without<\/span>\u00a0<\/span>undue<\/span>\u00a0<\/span>delay<\/span>\u00a0of the\u00a0<\/span>fact<\/span>\u00a0<\/span>that<\/span>\u00a0the\u00a0<\/span>data<\/span>\u00a0<\/span>concerned<\/span>\u00a0<\/span>are<\/span>\u00a0<\/span>data<\/span>\u00a0<\/span>processed<\/span>\u00a0on behalf.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    17.2<\/b> Text form (\u00a7 126b BGB)\u00a0<\/span>shall<\/span>\u00a0<\/span>apply<\/span>\u00a0to\u00a0<\/span>ancillary<\/span>\u00a0<\/span>agreements<\/span>,\u00a0<\/span>amendments<\/span>\u00a0and\u00a0<\/span>supplements<\/span>\u00a0to\u00a0<\/span>this<\/span>\u00a0Agreement;\u00a0<\/span>this<\/span>\u00a0<\/span>shall<\/span>\u00a0also\u00a0<\/span>apply<\/span>\u00a0to\u00a0<\/span>any<\/span>\u00a0<\/span>amendment<\/span>\u00a0of\u00a0<\/span>this<\/span>\u00a0<\/span>text<\/span>\u00a0form\u00a0<\/span>clause<\/span>.<\/span><\/span><\/p>

    17.3<\/b> Should<\/span>\u00a0individual\u00a0<\/span>parts<\/span>\u00a0of\u00a0<\/span>this<\/span>\u00a0Agreement\u00a0<\/span>be<\/span>\u00a0invalid<\/span>,\u00a0<\/span>this<\/span>\u00a0<\/span>shall<\/span>\u00a0not\u00a0<\/span>affect<\/span>\u00a0the\u00a0<\/span>validity<\/span>\u00a0of the\u00a0<\/span>remaining<\/span>\u00a0<\/span>provisions<\/span>\u00a0of the\u00a0<\/span>Agreement.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Annex 1 – Subject Matter of the Order <\/strong><\/h3>\n

    The subject matter of the order results from the main agreement (offer together with the annex to the schedule of services and the Processor’s order confirmation). <\/span> <\/span><\/p>\n

    Duration: Term of the main agreement plus statutory retention periods.<\/span> <\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Type of data<\/strong><\/th>\nPurpose of processing<\/strong><\/th>\nCategories of data subjects<\/strong><\/th>\n<\/tr>\n<\/thead>\n
    Name (first name, surname)Email addressTelephone number (business) \u2013 optional<\/td>\nCreation of a user account and identification when transmitting passwords<\/td>\nEmployees with access to the administration interface<\/td>\n<\/tr>\n
    Email addressRFID tag number, charging card number (if applicable) and card name<\/td>\nCreation of a user account and identification when transmitting passwords<\/td>\n\n

    \u2022 Employees as EV (electric vehicle) drivers<\/p>\n

    \u2022 Other persons (guests, subcontractors) as EV drivers who are regularly authorised to use the charging infrastructure<\/p>\n<\/td>\n<\/tr>\n

    Surname, first nameAddress (street, house number, postcode, city)<\/td>\nBilling of completed charging sessions<\/td>\n\n

    \u2022 Employees as EV drivers<\/p>\n

    \u2022 Other persons (guests, subcontractors) as EV drivers who are regularly authorised to use the charging infrastructure<\/p>\n<\/td>\n<\/tr>\n

    \n

    Scan of the vehicle registration certificateBank account details:<\/p>\n

    \u2022 Account holder (surname, first name)<\/p>\n

    \u2022 IBAN<\/p>\n<\/td>\n

    		Processing and settlement of greenhouse gas reduction quota trading<\/td>\nEmployees as EV drivers<\/td>\n<\/tr>\n
    \n

    Company vehicle data:<\/p>\n

    \u2022 Vehicle registration number<\/p>\n

    \u2022 RFID tag number<\/p>\n

    \u2022 Optional: manufacturer, brand<\/p>\n<\/td>\n

    		Authorisation and assignment of charging sessions<\/td>\nOwners of the client\u2019s company vehicles<\/td>\n<\/tr>\n
    Scan of the vehicle registration certificate<\/td>\nProcessing of greenhouse gas reduction quota trading<\/td>\nOwners of the client\u2019s company vehicles<\/td>\n<\/tr>\n
    \n

    Charging session data:<\/p>\n

    \u2022 Charging station and connector<\/p>\n

    \u2022 RFID tag number of the driver or vehicle<\/p>\n

    \u2022 Start and end time<\/p>\n

    \u2022 Amount of energy charged, charging status and charging power every 5 minutes during the charging session<\/p>\n

    \u2022 Tariff<\/p>\n<\/td>\n

    		Authorisation, assignment and billing of charging sessions<\/td>\n\n

    \u2022 Employees as EV drivers<\/p>\n

    \u2022 Other persons (guests, subcontractors) as EV drivers who are regularly authorised to use the charging infrastructure<\/p>\n

    \u2022 Owners of the client\u2019s company vehicles<\/p>\n<\/td>\n<\/tr>\n

    \n

    \u2022 Geocoordinates of the PV\/wind installation (location)<\/p>\n

    \u2022 Operating\/meter data of the installation<\/p>\n

    \u2022 Contact email address<\/p>\n<\/td>\n

    		Creation of energy generation and demand forecasts<\/td>\nPrivate installation operators (where the installation can be attributed to a natural person), customer contact persons<\/td>\n<\/tr>\n
    \n

    \u2022 Vehicle account data (user authorisation\/role, pairing status of digital key)<\/p>\n

    \u2022 Vehicle and charging data (charging limits, battery capacity, state of charge, mileage, vehicle identification)<\/p>\n<\/td>\n

    		Integration of electric vehicles via the Smartcar API to provide battery and charging data<\/td>\nOwners\/users of the connected electric vehicles<\/td>\n<\/tr>\n
    \n

    Charging session data \u201cat work\u201d, if booked:<\/p>\n

    \u2022 Driver-related data (name\/email, charging card ID\/tagUid, card type)<\/p>\n

    \u2022 Use case (e.g. Charge at Work)\u2022 IDX (charging session ID)\u2022 Charging date<\/p>\n

    \u2022 Duration of the charging session (start and end time as well as total duration of the charging session)<\/p>\n

    \u2022 Electricity consumption in kW<\/p>\n

    \u2022 Costs<\/p>\n

    \u2022 Tariff, receipt<\/p>\n<\/td>\n

    		Provision of charging session data via API interface to LOCIO GmbH for display in the controller\u2019s fleet management dashboard<\/td>\nCompany car drivers of the controller who use the charging infrastructure at the workplace<\/td>\n<\/tr>\n
    Statistical data on usage behaviour (pseudonymised):\u2022 Use of the charging infrastructure \u2013 frequency, amount of energy and location per user<\/td>\nProduct improvement<\/td>\n\n

    \u2022 Employees with access to the administration interface<\/p>\n

    \u2022 Employees as EV drivers<\/p>\n

    \u2022 Other persons (guests, subcontractors) as EV drivers who are regularly authorised to use the charging infrastructure<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/span><\/b><\/h3>\n

    Annex 2 – Sub-processors <\/strong><\/h3>\n

    The <\/span><\/span>Processor<\/span><\/span> uses, for the processing of data on behalf of the Controller, services of third parties which process data on its behalf (\u201csub-processors\u201d).<\/span><\/span> <\/span><\/p>\n

    These are the following undertaking(s):<\/span> <\/span><\/p>\n\n\n\n\n\n\n\n\n\n
    Subprocessor<\/strong><\/th>\nSubject of the engagement<\/strong><\/th>\nPlace of processing<\/strong><\/th>\nData transfer to third countries (legal basis)<\/strong><\/th>\n<\/tr>\n<\/thead>\n
    Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L1855 Luxembourg<\/td>\nCloud infrastructure and CDN<\/td>\nGermany \/ EU<\/td>\n\/<\/td>\n<\/tr>\n
    Intercom R&D Unlimited Company, 124 St Stephen’s Green, Dublin 2, D02 C628, Ireland<\/td>\nSupport and live chat<\/td>\nIreland \/ EU<\/td>\n\/<\/td>\n<\/tr>\n
    PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA (servers in Frankfurt, Germany)<\/td>\nProduct and usage analysis for product improvement<\/td>\nGermany \/ EU<\/td>\n\/<\/td>\n<\/tr>\n
    enercast GmbH, Universit\u00e4tsplatz 12, 34127 Kassel<\/td>\nEnergy forecasts (generation and demand forecasts for PV\/wind systems)<\/td>\nGermany<\/td>\n\/<\/td>\n<\/tr>\n
    Smartcar, Inc., 650 Castro Street, Ste 120-99699, Mountain View, CA 94041<\/td>\nVehicle data integration (charging and battery data)<\/td>\nUSA<\/td>\nAdequacy decision pursuant to Art. 45 GDPR. Smartcar is certified under the EU-U.S. Data Privacy Framework.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/span><\/p>\n

    Annex 3 – Technical and Organisational Measures (TOMs)<\/strong><\/h3>\n

    1. Introduction <\/span><\/strong><\/h3>\n

    In accordance with Art. 32 GDPR, reev GmbH (\u201creev\u201d) implements appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. In doing so, reev takes into account the state of the art, the costs of implementation as well as the nature, scope, context and purposes of the processing, as well as the likelihood of occurrence and the severity of the risk to the rights and freedoms of natural persons. <\/span> <\/span><\/p>\n

    These measures serve to protect personal data against unauthorised or unlawful processing as well as against accidental loss, accidental destruction, alteration, disclosure or unauthorised access. The measures described below apply to the processing of personal data by reev in connection with reev’s products, services, internal processes and supporting cloud infrastructure, unless otherwise stipulated in a customer-specific agreement. <\/span> <\/span><\/p>\n

    reev maintains an information security management system (ISMS) certified to ISO\/IEC 27001. The implementation, monitoring and demonstration of security controls may be supported by appropriate compliance tools, including Vanta. <\/span> <\/span><\/p>\n

     <\/h3>\n

    2. Technical Measures <\/strong><\/h3>\n
    2.1 Confidentiality<\/strong><\/h5>\n
    Access Control<\/strong><\/h6>\n

    Access to information, systems, applications, infrastructure and personal data is restricted to authorised persons and is granted in accordance with business requirements and the principle of least privilege. reev applies a strict need-to-know principle. <\/span> <\/span><\/p>\n

    Access rights are provisioned, adjusted, reviewed and revoked in accordance with reev’s Access Control Policy and in line with defined joiner, mover and leaver processes. Access is revoked or adjusted when employees change their role or leave the company. Privileged access is restricted to authorised persons and is subject to additional controls. <\/span> <\/p>\n

    Authentication <\/strong><\/h6>\n

    reev uses secure authentication mechanisms to prevent unauthorised access to information systems. Multi-factor authentication (MFA) is required for access to production environments and for further systems, insofar as this is required on a risk basis and according to criticality. <\/span> <\/span><\/p>\n

    As far as technically possible, centralised identity and access management, role-based access controls and secure password or authentication requirements are applied.<\/span> <\/p>\n

    Encryption of Data at Rest <\/strong><\/h6>\n

    Confidential data at rest are protected by strong encryption mechanisms, including AES-256-bit encryption where applicable, in accordance with reev’s Cryptography Policy. Encryption keys and secrets are managed by means of controlled key management and secrets management mechanisms. Access to encryption keys and secrets is restricted to authorised systems and persons; keys are rotated in accordance with the internal security requirements.
    <\/span> <\/p>\n

    Encryption in Transit <\/strong><\/h6>\n

    Data transmitted over public networks are protected by means of Transport Layer Security (TLS) and strong cipher suites. Publicly accessible services are configured and regularly reviewed in such a way that secure TLS configurations are maintained. reev aims to ensure that public endpoints meet recognised industry standards for transport encryption. <\/span><\/p>\n

    Physical Security <\/strong><\/h6>\n

    reev implements measures to prevent unauthorised physical access to information processing facilities. Physical access controls, security areas and entry controls are applied in accordance with reev’s Physical Security Policy. Insofar as infrastructure is hosted with third-party cloud service providers, physical security is covered by the respective provider’s certified data centre controls and contractual security commitments. <\/span> <\/p>\n

    Data Separation and Logical Segregation <\/strong><\/h6>\n

    Where applicable, customer data are logically separated in order to prevent unauthorised access between customers, environments and systems. Production, development and test environments are separated from one another; production data are not used in non-production environments unless they are appropriately protected and the use is authorised. <\/span> <\/p>\n

    Pseudonymisation, Masking and Data Minimisation <\/strong><\/h6>\n

    Where appropriate and technically possible, reev applies data minimisation, pseudonymisation, masking, aggregation or access restrictions in order to reduce the disclosure of personal data and to limit the processing to what is necessary for the respective purpose.<\/span> <\/span><\/p>\n

    2.2 Integrity<\/span><\/b> <\/span><\/h5>\n
    Change Management <\/strong><\/h6>\n

    Material changes to systems, networks, infrastructure and processing facilities are documented, reviewed, tested and approved prior to deployment in the production environment. Changes are tested in environments separate from production, for example in staging or development environments. <\/span> <\/span><\/p>\n

    Emergency changes are subject to appropriate review and documentation following their implementation. The change management procedures serve to reduce the risk of unauthorised, untested or unintended changes to production systems. <\/span> <\/p>\n

    Secure Development <\/strong><\/h6>\n

    reev applies secure development principles and engineering standards to software development activities. Development, test, staging and production environments are separated from one another. Access to source code repositories and deployment pipelines is restricted to authorised persons. <\/span> <\/span><\/p>\n

    Security aspects are integrated into the development life cycle, including code reviews, testing, dependency management and secure configuration practices.<\/span> <\/p>\n

    Logging and Monitoring <\/strong><\/h6>\n

    Production infrastructure and relevant applications are configured to generate logs for security-relevant events, including user authentication events, access to systems, administrative activities, relevant CRUD operations and changes to security settings, as far as technically possible.<\/span> <\/span><\/p>\n

    Logs are protected against unauthorised access, unauthorised alteration and unauthorised deletion. Logs are retained for a defined period determined by the criticality of the system, statutory requirements, contractual obligations and operational needs. Relevant production logs are stored for at least 30 days, unless a longer retention period applies. <\/span> <\/p>\n

    Protection of Integrity <\/strong><\/h6>\n

    reev implements controls intended to protect systems and data against unauthorised alteration, including access restrictions, change management, logging, monitoring, backup procedures and secure deployment processes.<\/span> <\/span><\/p>\n

    2.3 Availability and Resilience<\/span><\/b> <\/span><\/h5>\n
    Data Backup <\/strong><\/h6>\n

    Backups of relevant systems and databases are carried out daily. Backups are stored separately from production data and protected against unauthorised access. Where applicable, reev uses Cross-Region Replication (CRR) in AWS to support redundancy, resilience and disaster recovery. <\/span> <\/span><\/p>\n

    Backup data are protected by appropriate technical and organisational measures, including access restrictions and encryption where applicable.<\/span> <\/p>\n

    Recovery Testing <\/strong><\/h6>\n

    The recoverability of backups is tested at least annually in order to validate data integrity, recovery procedures and operational readiness. The results of recovery tests are documented and reviewed; identified issues are addressed by means of appropriate corrective measures. <\/span> <\/p>\n

    Redundancy and Resilience <\/strong><\/h6>\n

    Information processing facilities are implemented with sufficient redundancy in order to meet availability and resilience requirements. reev employs appropriate infrastructure and cloud architecture controls in order to reduce the risk of service interruptions and data loss. <\/span> <\/span><\/p>\n

    Personal data processed in the reev platform are, by default, hosted in AWS data centres within the European Union, in particular in the eu-central-1 region, Frankfurt am Main. Insofar as Cross-Region Replication is used, this takes place within the European Union or the European Economic Area. Processing of personal data outside the EU\/EEA takes place only in accordance with the provisions on international transfers described in Section 3.4. <\/span> <\/p>\n

    Business Continuity and Disaster Recovery <\/strong><\/h6>\n

    reev maintains business continuity and disaster recovery measures for critical systems and processes. These measures are designed to support the continuous availability of services and the timely restoration of access to personal data in the event of a physical or technical incident in accordance with Art. 32 GDPR. <\/span> <\/span><\/p>\n

    Recovery procedures and responsibilities are defined and reviewed regularly.<\/span> <\/span><\/p>\n

    2.4 Vulnerability, Patch and Malware Management<\/span><\/b> <\/span><\/h5>\n
    Technical Vulnerability Management <\/strong><\/h6>\n

    reev obtains information on technical vulnerabilities through vulnerability scans, vendor advisories, dependency monitoring, security advisories and penetration tests. Vulnerabilities are assessed on the basis of severity, exploitability, exposure and potential impact. <\/span> <\/span><\/p>\n

    Critical vulnerabilities are remediated or mitigated without undue delay on a risk basis. High-risk vulnerabilities are remediated within defined internal time limits, as a rule within 30 days, insofar as this is technically and operationally possible, unless a documented risk-based exception applies. <\/span> <\/p>\n

    Patch Management <\/strong><\/h6>\n

    Security updates are assessed and applied on the basis of risk, severity and system criticality. Patch management procedures are designed to reduce exposure to known vulnerabilities while at the same time maintaining system stability and availability. <\/span> <\/p>\n

    Penetration Tests and Security Assessments <\/strong><\/h6>\n

    reev carries out penetration tests at least annually and conducts additional security assessments where appropriate, for example following material changes to systems or architecture. Findings are reviewed, prioritised and remediated on a risk basis. <\/span> <\/p>\n

    Malware Protection <\/strong><\/h6>\n

    Anti-malware and endpoint protection measures are deployed on end devices provided by reev and on relevant e-mail systems. Protection mechanisms are, as far as technically possible, configured to update automatically. <\/span> <\/span><\/p>\n

    2.5 Regular Review, Assessment and Evaluation<\/span><\/b> <\/span><\/h5>\n

    reev regularly tests, assesses and evaluates the effectiveness of the technical and organisational measures by means of internal reviews, vulnerability assessments, penetration tests, risk assessments, monitoring activities, audits and ISO\/IEC 27001 control reviews. Identified weaknesses are tracked and addressed by means of appropriate corrective measures. <\/span> <\/span><\/p>\n

    3. Organisational Measures<\/span><\/b> <\/span><\/h3>\n
    3.1 Governance and Risk Management<\/span><\/b><\/h5>\n
    ISMS Framework<\/b>
    <\/strong><\/h6>\n

    reev maintains an information security management system (ISMS) certified to ISO\/IEC 27001. The ISMS defines governance structures, responsibilities, policies, controls, risk management procedures and continuous improvement processes for information security. <\/span><\/p>\n

    Risk Assessment<\/b>
    <\/strong><\/h6>\n

    reev regularly carries out risk assessments in the area of information security in order to identify threats, vulnerabilities and risks to information assets and personal data. Risk treatment measures are defined, implemented, monitored and reviewed in accordance with the ISMS. <\/span> <\/p>\n

    Policy Management<\/b>
    <\/span><\/h6>\n

    Information security and data protection policies are reviewed at least annually or in the event of material changes. Policies are communicated to the relevant persons and made available via appropriate internal channels. <\/span> <\/p>\n

    Classification of Assets and Information<\/b>
    <\/strong><\/h6>\n

    reev maintains processes for the identification and classification of information assets on the basis of their sensitivity, business importance and security requirements. Appropriate handling requirements are applied in accordance with the classification of the respective information or asset. <\/span> <\/span><\/p>\n

    3.2 Personnel Security<\/span><\/b> <\/span><\/h5>\n
    Screening <\/b>
    <\/span><\/h6>\n

    Insofar as legally permissible and proportionate to the respective role, reev carries out screening prior to the commencement of employment which corresponds to the responsibilities, access rights and risk profile of the position.<\/span> <\/p>\n

    Awareness and Training<\/b>
    <\/strong><\/h6>\n

    All employees receive regular information security training, including training on data protection responsibilities, confidentiality, the secure handling of personal data, phishing awareness, the reporting of security incidents and relevant GDPR obligations. Training takes place at least annually and as part of onboarding. <\/span> <\/p>\n

    Confidentiality Obligations <\/em><\/b><\/span><\/p>\n

    Employees, contractors and other persons with access to confidential information or personal data are obliged to enter into confidentiality obligations or non-disclosure agreements. These obligations continue to apply, insofar as legally enforceable, even after termination of the employment or contractual relationship. <\/span> <\/p>\n

    Acceptable Use and Endpoint Security<\/b>
    <\/strong><\/h6>\n

    reev defines requirements for the acceptable use of corporate systems, devices and information assets. End devices provided by reev are subject to appropriate security controls, which may include device management, encryption, screen lock requirements, anti-malware protection and update management. <\/span> <\/span><\/p>\n

    3.3 Incident Management<\/span><\/b> <\/span><\/h5>\n
    Incident Response Plan<\/b><\/strong><\/h6>\n

    reev maintains a formal incident response plan for the identification, reporting, assessment, escalation, containment, investigation and remediation of security incidents. Employees are obliged to report suspected or confirmed security incidents via defined reporting channels. <\/span> <\/p>\n

    Handling of Personal Data Breaches<\/b><\/strong><\/h6>\n

    Insofar as an incident concerns personal data, reev assesses whether the incident constitutes a personal data breach and examines reporting and notification obligations under Art. 33 and Art. 34 GDPR. Insofar as reev acts as a processor, reev notifies the respective controller within seventy-two (72) hours in accordance with Art. 33(2) GDPR and the applicable contractual obligations. <\/span> <\/span><\/p>\n

    Incidents and personal data breaches are documented, including the facts relating to the incident, the effects, the remedial measures taken and the decisions on reporting or notification. Findings from incidents are used to improve security controls and response procedures. <\/span> <\/span><\/p>\n

    3.4 Third-Party Provider and Supplier Management<\/span><\/b> <\/span><\/h5>\n
    Supplier Security<\/b><\/strong> <\/span><\/h6>\n

    Information security and data protection requirements are established and agreed with suppliers on the basis of the nature of the services provided and the risk associated with the processing. Suppliers that process personal data on behalf of reev or of reev’s customers are subject to appropriate contractual obligations. <\/span> <\/p>\n

    Data Processing Agreements<\/b><\/strong><\/h6>\n

    reev does not transfer personal data to a processor or sub-processor unless appropriate contractual arrangements are in place, including a data processing agreement or equivalent data protection provisions, insofar as this is required under Art. 28 GDPR.<\/span> <\/p>\n

    Sub-processors<\/b><\/strong><\/h6>\n

    Sub-processors are engaged only in accordance with the applicable customer agreements and the requirements of Art. 28 GDPR. Where necessary, the obligations of sub-processors include appropriate data protection, confidentiality, security, support, audit, deletion or return, as well as onward transfer obligations. <\/span> <\/span><\/p>\n

    A current list of the sub-processors used by reev is maintained at reev.com\/legal. reev informs customers at least 30 days in advance of intended changes to sub-processors that process personal data of the respective customer, unless a shorter period is required for security, availability or other urgent reasons. Customers may, on legitimate data protection grounds, object to the change within the notice period. In this case, the parties will cooperate in good faith in order to find an appropriate solution. <\/span> <\/p>\n

    International Transfers<\/b><\/h6>\n

    Insofar as personal data are transferred to a country outside the European Economic Area or are accessed from there, reev implements appropriate transfer mechanisms and safeguards in accordance with Chapter V GDPR, for example adequacy decisions, standard contractual clauses and supplementary measures where necessary.<\/span> <\/span><\/p>\n

    3.5 Data Retention and Secure Deletion<\/span><\/b> <\/span><\/h5>\n

    Personal data are retained only for as long as is necessary for the respective processing purpose or as is required under applicable law, contract or legitimate business needs. Retention and deletion procedures are implemented for relevant systems and data categories. <\/span> <\/span><\/p>\n

    Upon expiry of applicable retention periods or in the case of valid deletion requests, personal data are deleted, anonymised or otherwise handled in accordance with the applicable legal and contractual requirements, unless further retention is required or permitted by law.<\/span> <\/span><\/p>\n

    3.6 Data Subject Rights and Support of the Controller<\/span><\/b> <\/span><\/h5>\n

    Insofar as reev acts as a processor, reev supports the controller, as far as possible and taking into account the nature of the processing, in fulfilling obligations in connection with data subject rights under Chapter III GDPR as well as with the security of processing under Art. 32 GDPR, in accordance with the applicable contractual obligations.<\/span> <\/span><\/p>\n

    3.7 Audit, Compliance, and Continuous Improvement<\/span><\/b> <\/span><\/h5>\n

    reev monitors the effectiveness of its security controls by means of the ISMS, internal reviews, audits, risk assessments, technical assessments and corrective action processes. Security and compliance documentation is maintained in order to demonstrate the implementation of appropriate technical and organisational measures. <\/span> <\/span><\/p>\n

    The TOMs are reviewed regularly and updated as needed, particularly in light of changes in legal requirements, technology, the risk landscape, organizational structure, processing activities, or security practices.<\/span> <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

    Home Data Processing Agreement (DPA) As of July 2026 Disclaimer: Translation of the original document in German. In the event of discrepancy, inconsistency or conflict with the German version (in particular due to translation delays), the German version shall prevailThis Data Processing Agreement (hereinafter the \u201cDPA\u201d) applies between reev GmbH,\u00a0Sandstra\u00dfe\u00a03, 80335 M\u00fcnchen (hereinafter the \u201cProcessor\u201d) […]<\/p>\n","protected":false},"author":14,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_titles_title":"Data Processing Agreement (DPA) %%sep%% %%sitetitle%%","_seopress_titles_desc":"reev GmbH - Sandstra\u00dfe 3 - 80335 Munich We operate our websites in accordance with the principles set forth below: We are committed to complying with the statutory provisions on data protection and strive to consistently adhere to the principles of data avoidance and data minimization.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"Data Processing Agreement (DPA) %%sep%% %%sitetitle%%","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"Data Processing Agreement (DPA) %%sep%% %%sitetitle%%","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"both","_seopress_redirections_param":"","_seopress_redirections_type":301,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-427919","page","type-page","status-publish","hentry"],"translations":{"de":"data-processing-agreement-dpa-reev","en":"data-processing-agreement-dpa-reev","fr":"data-processing-agreement-dpa-reev"},"_links":{"self":[{"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/pages\/427919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/comments?post=427919"}],"version-history":[{"count":10,"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/pages\/427919\/revisions"}],"predecessor-version":[{"id":430528,"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/pages\/427919\/revisions\/430528"}],"wp:attachment":[{"href":"https:\/\/reev.com\/en\/wp-json\/wp\/v2\/media?parent=427919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}