Legal notice/Imprint

agreement

about a

Data processing on behalf of a controller pursuant to Article 28 GDPR

The person responsible:

The data processor:

[You as a customer]

Harald Lehenbauer

Narcissus Lane 2

3313 Wallsee-Sindelburg

Austria

(hereinafter referred to as the client)

(hereinafter referred to as the Contractor)

1. Subject of the agreement

(1) The subject of this contract is the performance of the following tasks: processing the order for the items you have purchased under the concluded purchase contract.

(2) The following categories of data are processed: name, address, email address (and, if provided, telephone number).

(3) The following categories of data subjects are subject to processing: Customers

2. Duration of the agreement

The agreement is concluded for an indefinite period and can be terminated by either party with immediate effect. The right to extraordinary termination for good cause remains unaffected.

3. Obligations of the Contractor

(1) The contractor undertakes to process data and processing results exclusively within the scope of the client's written instructions. If the contractor receives an official order to disclose the client's data, it shall – to the extent legally permissible – inform the client immediately and refer the authority to the client. Likewise, any processing of the data for the contractor's own purposes requires a written order.

(2) The contractor legally declares that it has obligated all persons entrusted with data processing to confidentiality before they commenced their work, or that these persons are subject to an appropriate statutory duty of confidentiality. In particular, the duty of confidentiality of the persons entrusted with data processing remains in effect even after the termination of their work and their departure from the contractor.

(3) The contractor declares in a legally binding manner that it has taken all necessary measures to ensure the security of processing in accordance with Article 32 GDPR.

(4) The contractor shall implement the technical and organizational measures necessary to enable the client to fulfill the data subject's rights under Chapter III of the GDPR (information, access, rectification and erasure, data portability, objection, and automated individual decision-making) at any time within the statutory time limits and shall provide the client with all necessary information for this purpose. If a corresponding request is addressed to the contractor and it is apparent that the requester mistakenly believes the contractor to be the controller of the data processing carried out by the contractor, the contractor shall forward the request to the client without undue delay and inform the requester accordingly.

(5) The Contractor shall assist the Client in complying with the obligations referred to in Articles 32 to 36 of the GDPR (data security measures, notification of personal data breaches to the supervisory authority, notification of the data subject affected by a personal data breach, data protection impact assessment, prior consultation).

(6) The contractor is advised that he must draw up a record of processing activities in accordance with Article 30 GDPR for the processing carried out on this contract.

(7) The client is granted the right to inspect and control the data processing facilities at any time with regard to the processing of the data provided by him, even if this control is exercised through third parties commissioned by him. The contractor undertakes to provide the client with the information necessary to monitor compliance with the obligations set out in this agreement.

(8) Upon termination of this agreement, the contractor is obligated to hand over all processing results and documents containing data to the client. If the contractor processes the data in a specific technical format, he is obligated to release the data upon termination of this agreement either in that format or, at the client's request, in the format in which he received the data from the client or in another common format.

(9) The contractor shall inform the client without delay if he considers that an instruction from the client infringes Union or Member State data protection provisions.

4. Location where data processing takes place

All data processing activities are carried out exclusively within the EU or the EEA.

5. Sub-processors1

The contractor is authorized to engage the following companies as sub-processors: Plentymarkets GmbH, Bürgermeister-Brunner-Straße 15, 34117 Kassel, Germany (data processor as software host of the sales system); Timme Hosting GmbH & Co. KG, Ovelgönner Weg 43, 21335 Lüneburg, Germany (hosting provider of the server).

Any intended changes to the sub-processor must be communicated to the client in writing with sufficient time to allow the client to object. The contractor shall conclude the necessary agreements with the sub-processor in accordance with Article 28(4) GDPR. It must be ensured that the sub-processor assumes the same obligations as the contractor under this agreement. If the sub-processor fails to comply with its data protection obligations, the contractor shall be liable to the client for the sub-processor's compliance.

{Permissibility of using sub-processors} The contractor may use sub-processors.

The contractor must inform the client of the intended engagement of a sub-processor in sufficient time to allow the client to object if necessary. The contractor shall conclude the necessary agreements with the sub-processor in accordance with Article 28(4) GDPR. It must be ensured that the sub-processor assumes the same obligations as the contractor under this agreement. If the sub-processor fails to comply with its data protection obligations, the contractor shall be liable to the client for the sub-processor's compliance.

Annex ./1 – Technical and organizational measures

confidentiality

Access control: Protection against unauthorized access to data processing systems, keys, alarm systems.

Access control: Protection against unauthorized system use, passwords (including appropriate policy), automatic locking mechanisms, two-factor authentication, .

Access control: No unauthorized reading, copying, modification or removal within the system, e.g.: standard permission profiles on a "need to know" basis, standard process for granting permissions, logging of accesses, periodic review of granted permissions, especially of administrative user accounts;

Pseudonymization: Where possible for the respective data processing, the primary identifying characteristics of the personal data are removed in the respective data processing and stored separately.

Data classification scheme: (confidential/internal).

integrity

Access control: No unauthorized reading, copying, modification or removal during electronic transmission or transport, e.g.: encryption, Virtual Private Networks (VPN), electronic signature;

Input control: Determining whether and by whom personal data has been entered, changed or removed from data processing systems: logging, document management;

Availability and resilience

Availability control: Protection against accidental or intentional destruction or loss; backup strategy (online & offline; on-site & off-site); virus protection; firewall.

Rapid recovery;

Deletion periods: Both for the data itself and metadata such as log files, etc.

Procedures for regular review, assessment and evaluation

Data protection management, including regular employee training;

Incident response management;

Privacy-friendly default settings;

Order control: No order data processing within the meaning of Art. 28 GDPR without corresponding instructions from the client, e.g.: clear contract design, formalized order management, strict selection of the data processor (ISO certification, ISMS), obligation to verify in advance, follow-up checks.

------------------------------------------------------------------------------------------------------