Skip to content
deen
Get started for free MENU LOGIN

Choose language

deen
×

Data Processing Agreement

pursuant to Art. 28 General Data Protection Regulation (GDPR)

between

the Customer (operator or agency managing a shop/website on the Smarda platform, as identified in the Main Agreement) — hereinafter the “Controller” or “Customer”; for the allocation of roles in agency arrangements, see § 3 paras. 4 to 6 —

and

Smarda GmbH, Businesspark 6, Top 49, 8200 Gleisdorf, Austria, registered in the Commercial Register of the Regional Court for Civil and Commercial Matters in Graz under FN 513822x — hereinafter the “Processor” —

— together, the “Parties” —

Preamble

The Processor provides the Controller with a cloud-based shop and website system as Software-as-a-Service (“Main Agreement”). In providing its services, the Processor processes personal data on behalf of and in accordance with the Controller’s instructions. This Agreement specifies the Parties’ data protection obligations under Art. 28 GDPR. It is based on the European Commission’s standard contractual clauses pursuant to Commission Implementing Decision (EU) 2021/915 of 4 June 2021.

§ 1 Subject Matter, Duration and Specification of Processing

  1. The subject matter of this Agreement is the processing of personal data by the Processor in connection with the operation, maintenance and further development of the shop/website instance used by the Controller, including related services (hosting, database operation, email delivery, support, backups, optional additional features).
  2. The subject matter and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1. Annex 1 forms part of this Agreement.
  3. The term of this Agreement corresponds to the term of the Main Agreement. It shall not end before all personal data have been fully deleted or returned in accordance with § 10.
  4. Processing shall take place exclusively in Member States of the European Union or the European Economic Area. Processing in third countries shall take place only under the conditions set out in § 8.

§ 2 Controller’s Right to Issue Instructions

  1. The Processor shall process personal data only on documented instructions from the Controller, unless it is required to do so by Union or Member State law; in such a case, the Processor shall inform the Controller of those legal requirements before processing, unless that law prohibits such notification on important grounds of public interest (Art. 28(3)(a) GDPR).
  2. The Main Agreement, this Agreement and the Controller’s use of the features and configuration options provided by the platform (including backend settings, API calls and activation of optional services) shall constitute documented instructions. Further individual instructions must be provided in text form (e.g. by email or via the support/ticketing system).
  3. Oral instructions must be confirmed in text form without undue delay.
  4. The Processor shall inform the Controller without undue delay if it considers that an instruction infringes the GDPR or other data protection provisions of the Union or Member States. The Processor is entitled to suspend execution of the instruction in question until it has been confirmed or amended by the Controller.
  5. Persons authorized to issue instructions on behalf of the Controller are its administrators listed in the backend and the contacts named in the Main Agreement.

§ 3 Responsibility, Roles and Lawfulness of Processing

  1. As between the Parties, the Controller is generally the controller within the meaning of Art. 4(7) GDPR. In particular, it is responsible for the lawfulness of processing (Art. 6 GDPR), safeguarding data subjects’ rights and fulfilling information obligations (Art. 12 et seq. GDPR) towards the data subjects of its shop/website.
  2. If the Controller transfers personal data via the platform’s interfaces to third parties commissioned by the Controller itself (e.g. payment service providers, shipping service providers, inventory management/ERP systems, marketplaces or other systems connected via app/API integrations), the Processor acts solely as a transmitter on instructions in this respect. The Controller is responsible for selecting these third parties and establishing the legal basis for the transfer; the Controller shall enter into any required agreements with these third parties itself.
  3. Payment service providers (e.g. PayPal, Mollie) generally process payment data as independent controllers and are not subprocessors of the Processor.
  4. Customer acting as Processor (agency/reseller arrangement): If the Customer processes personal data relating to individual shops/websites not for its own purposes, but as a processor for a third party (e.g. as an agency for its client, who operates the shop/website), this Agreement shall apply to the data in question subject to the following: the Processor (Smarda) shall act in this respect as a subprocessor; the rights and obligations assigned to the “Controller” in this Agreement shall belong to or be incumbent upon the Customer in its role as processor for the respective controller.
  5. In this case, the following shall also apply: (a) The Customer’s instructions shall be deemed to be the respective controller’s documented instructions passed on by the Customer; the Customer shall remain the Processor’s sole point of contact. (b) The Customer warrants that its agreement with the respective controller meets the requirements of Art. 28(3) GDPR and permits the engagement of the Processor as a subprocessor — including the further subprocessors listed in the list referenced in Annex 3 (Art. 28(2) and (4) GDPR). (c) The Processor shall provide notifications and assistance under § 7 to the Customer; the Customer shall be responsible for forwarding them to and communicating with the respective controller. (d) The right to information and audit under § 9 shall also cover information the Customer needs to fulfil its obligations to provide evidence to the respective controller.
  6. If the Customer acts partly as a controller (e.g. for its own shops, test and demo environments and its own customer data) and partly as a processor, paragraphs 1 to 5 shall apply concurrently to each shop/website in the relevant role. No separate agreement is required.

§ 4 Confidentiality

  1. The Processor shall ensure that persons authorized to process personal data have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality (Art. 28(3)(b) GDPR). The duty of confidentiality shall continue after the end of the relevant employment relationship.
  2. Access to the Controller’s personal data shall be restricted to employees who need it to perform their duties (need-to-know principle).

§ 5 Technical and Organisational Measures (Art. 32 GDPR)

  1. The Processor shall implement all technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures in place at the time of entering into the Agreement are described in Annex 2.
  2. The technical and organisational measures are subject to technological progress. The Processor may develop them further and replace them with equivalent or better measures, provided that the agreed level of protection is not reduced. Material changes shall be documented; the Processor shall provide the Controller with the current version of Annex 2 upon request, and at least annually.

§ 6 Subprocessors

  1. The Controller grants the Processor general authorisation (Art. 28(2), first sentence, GDPR) to engage subprocessors. The subprocessors engaged are listed in the list referenced in Annex 3 at https://smarda.com/subverarbeiter; the version of this list published when the Agreement is entered into is hereby approved.
  2. The Processor shall inform the Controller in text form at least six weeks in advance of any intended addition or replacement of a subprocessor (e.g. by email to the contact address on file and/or by notification in the backend together with an updated list).
  3. The Controller may object to the intended change within four weeks of receiving the information, on important data protection grounds. Important grounds include, in particular, specific indications that the new subprocessor does not meet the requirements of this Agreement or the GDPR. In the event of a justified objection, the Parties shall seek an amicable solution (e.g. refraining from using the subprocessor for the Controller’s data, where technically feasible). If such a solution is not possible or reasonable, the Controller shall be entitled to terminate the Main Agreement and this Agreement extraordinarily, effective as of the date of the planned change. If the Controller does not object within the applicable period, the change shall be deemed approved.
  4. The Processor shall impose on each subprocessor, by contract, the same data protection obligations as those set out in this Agreement (Art. 28(4) GDPR), in particular sufficient guarantees to implement appropriate technical and organisational measures. The Processor shall regularly verify compliance with these obligations.
  5. If a subprocessor fails to fulfil its data protection obligations, the Processor shall be liable to the Controller for the subprocessor’s compliance with its obligations as if it were the Processor’s own fault.
  6. Services provided by third parties that the Processor uses as purely ancillary services without substantive access to data (e.g. telecommunications services, postal/courier services, cleaning, security), as well as the services described in § 3 paras. 2 and 3 commissioned by the Controller itself, shall not be considered subprocessing. In these cases, too, the Processor shall ensure appropriate confidentiality agreements and protective measures.

§ 7 Processor’s Obligations to Provide Assistance

  1. Data subject rights: Where possible, the Processor shall assist the Controller, by means of appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise data subject rights (Arts. 12–22 GDPR), in particular the rights of access, rectification, erasure, restriction, data portability and objection. Where possible, the platform provides self-service features for this purpose (including export, rectification and erasure functions in the backend). If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay and shall not respond to it itself, unless legally required to do so.
  2. Security and notification obligations: Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in complying with the obligations set out in Arts. 32 to 36 GDPR (security of processing, notification of personal data breaches, communication to data subjects, data protection impact assessments, prior consultation).
  3. Personal data breaches: The Processor shall notify the Controller of any personal data breach affecting the Controller’s data without undue delay and no later than 48 hours after becoming aware of it. To the extent already available, the notification shall include at least the information specified in Art. 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed to address the breach, contact point). Information not immediately available shall be provided without undue delay. The Controller is responsible for notifying the supervisory authority and communicating with data subjects; the Processor shall not do so without the Controller’s instructions.
  4. The Processor’s contact point for data protection matters is: legal@smarda.com. No data protection officer has been appointed, as the statutory requirements for such an appointment (Art. 37 GDPR) are not met.
  5. For assistance under this § 7 that goes beyond the self-service features provided and is not necessitated by a breach of the Processor’s obligations, the Processor may charge a reasonable fee based on the applicable price list. Assistance may not be made conditional on prior payment.

§ 8 Processing in Third Countries

  1. The Processor or its subprocessors may process personal data in a third country (outside the EU/EEA) only if the requirements of Arts. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision by the European Commission (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR, in particular the EU Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, together with any required supplementary measures).
  2. Where a transfer is based on the adequacy decision for the EU-U.S. Data Privacy Framework, the Processor shall ensure that EU Standard Contractual Clauses are also agreed as a fallback mechanism, which shall apply automatically if the adequacy decision is repealed or declared invalid.
  3. Existing third-country transfers are listed for each subprocessor in the list referenced in Annex 3 (registered office, processing location, transfer mechanism).

§ 9 Controller’s Rights to Information and Audit

  1. The Processor shall provide the Controller with all information necessary to demonstrate compliance with the obligations set out in Art. 28 GDPR (Art. 28(3)(h) GDPR).
  2. Evidence may be provided in particular by means of current attestations or reports from independent auditors, appropriate certifications (e.g. ISO/IEC 27001, C5, SOC 2) of the Processor or its subprocessors, self-assessments and documentation of the technical and organisational measures. The Processor shall provide this evidence free of charge.
  3. The Controller shall also be entitled to conduct audits — including on-site inspections at the Processor’s business premises — itself or through an auditor bound by confidentiality and not in competition with the Processor. On-site audits shall take place during normal business hours, upon reasonable advance notice (generally at least 14 calendar days, except where there are specific indications of violations or following a personal data breach), without avoidable disruption to business operations and while safeguarding the confidentiality of trade secrets and the data of other customers on the multi-tenant platform.
  4. Access to subprocessors’ data centres (cloud infrastructure) is generally excluded due to their security policies; in this respect, evidence shall be provided through the subprocessors’ audit reports and certifications, which the Processor shall make available to the Controller.
  5. The exercise of audit rights shall be free of charge. For on-site audits without cause that exceed one audit per calendar year, the Processor may claim reimbursement of reasonable personnel costs incurred; the audit may not be made conditional on such reimbursement.
  6. The Processor shall permit and cooperate with audits by the Controller’s competent supervisory authority to the same extent.

§ 10 Deletion and Return upon Completion of Processing

  1. Upon termination of the Main Agreement, the Processor shall, at the Controller’s choice, delete all personal data processed on its behalf or return them in a structured, commonly used, machine-readable format (data export) and then delete existing copies — unless Union or Member State law requires their storage.
  2. If the Controller does not exercise its right to choose within 30 calendar days after termination of the Agreement, the Processor shall be entitled and obliged to delete the data. Before doing so, it shall notify the Controller in text form of the impending deletion and the option to export the data.
  3. Production data shall be deleted no later than 30 calendar days after termination of the Agreement or after return has taken place. Data in backups shall be automatically overwritten as part of the rolling backup cycle (retention period: seven days) and shall therefore be deleted no later than seven calendar days after deletion of the production data; until then, they shall be protected against other use and shall not be restored to production systems, except where required by law or contract to restore them following a security incident.
  4. The Processor shall confirm full deletion to the Controller in text form without being asked and shall ensure that its subprocessors also delete the data accordingly and confirm this.
  5. The Processor may retain documentation serving as evidence of proper data processing beyond the end of the Agreement in accordance with the applicable retention periods.

§ 11 Liability

  1. The Parties’ liability towards data subjects is governed by Art. 82 GDPR. This statutory liability towards data subjects shall not be limited by this Agreement.
  2. As between the Parties: If a Party is held liable by a data subject or a supervisory authority, the other Party shall indemnify it to the extent that it is responsible for the circumstances giving rise to the claim (in accordance with Art. 82(5) GDPR). Otherwise, the liability provisions of the Main Agreement shall apply; statutory provisions shall apply without limitation to damage arising from injury to life, limb or health, as well as in cases of intent and gross negligence.

§ 12 Final Provisions

  1. This Agreement shall be concluded in electronic form (Art. 28(9) GDPR); acceptance during the ordering/registration process or in the backend shall suffice.
  2. In the event of any conflict between this Agreement and the Main Agreement or other agreements, the provisions of this Agreement shall prevail with respect to the processing of personal data. Mandatory statutory provisions shall remain unaffected.
  3. Amendments and additions to this Agreement must be made in text form. The Processor may amend this Agreement with effect for the future where required due to changes in the law, case law or regulatory requirements, provided that the level of data protection for the Controller is not reduced; § 6 paras. 2 and 3 shall apply accordingly.
  4. The laws of the Republic of Austria shall apply, excluding its conflict-of-law rules. Mandatory provisions of the GDPR and mandatory data protection law at the Controller’s registered office shall remain unaffected. The place of jurisdiction shall be — to the extent permitted — the Processor’s registered office.
  5. If any provision of this Agreement is invalid, the validity of the remaining provisions shall remain unaffected. The invalid provision shall be replaced by the applicable statutory provision.

Annex 1 — Subject Matter of Processing, Data Categories, Data Subjects

1. Subject Matter and Purpose of Processing

Provision and operation of a multi-tenant cloud shop and website system (SaaS), including:

  • Hosting of the shop/website instance, databases and media files
  • Processing the Controller’s order, customer and account management processes
  • Sending transactional emails (e.g. order and shipping confirmations, registration, password resets) on behalf of the Controller
  • Backend interface for managing the shop, including user and access rights management
  • Technical support, troubleshooting and maintenance
  • Data backup and recovery
  • Provision of interfaces (API) and optional additional features (e.g. machine translation of content, AI-powered assistance features, analytics/tracking features), where activated by the Controller
  • SSL/TLS certificate management for the Controller’s domains

2. Nature of Processing

Collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission (on instructions), alignment, combination, restriction, erasure and destruction — in each case by automated means.

3. Categories of Data Subjects

  • Customers and prospective customers of the Controller (shop end customers, website visitors)
  • Newsletter subscribers of the Controller
  • Employees and other backend users of the Controller
  • Business partners/suppliers of the Controller, insofar as their data is processed on the platform (e.g. when using inventory management features)

4. Categories of Personal Data

  • Master data: name, address, company affiliation, customer number
  • Contact details: email address, telephone number
  • Contract and order data: products ordered, order history, billing and delivery addresses, payment method and payment status (no complete payment card/account details — these are processed by the respective payment service provider), vouchers, returns
  • Account data: username, password (stored only as a cryptographic hash), roles/permissions
  • Communication data: contents of transactional emails, support requests, reviews/comments (where the feature is used)
  • Usage and connection data: IP addresses, timestamps, device/browser information, log data, cookie/consent status, analytics data (where the feature is enabled)
  • Content data: content entered into the platform by the Controller, insofar as it contains personal data (e.g. product texts relating to individuals, customer list imports)

Special categories of personal data (Art. 9 GDPR) are not part of the processing under this Agreement. The Controller shall ensure that such data is not entered into the platform without a separate agreement (relevant, for example, for shops selling pharmacy/health products).

Annex 2 — Technical and Organisational Measures (Art. 32 GDPR)

1. Pseudonymisation and Encryption (Art. 32(1)(a) GDPR)

  • Encryption in transit for all connections (TLS, automated certificate management; HTTPS for all shop domains)
  • Encryption of stored data (encryption at rest) at the cloud provider’s infrastructure level
  • Passwords stored exclusively as salted hashes using state-of-the-art methods
  • Credentials for third-party systems (API tokens) are stored encrypted or as hashes

2. Confidentiality / Access and Entry Controls (Art. 32(1)(b) GDPR)

  • Physical access control: Operation in the cloud provider’s certified data centres (including ISO 27001, SOC 1/2/3); no physical access to servers by the Processor is required
  • System access control: individual administrator accounts, strong authentication, two-factor authentication for administrative access, role-based access rights, access revoked upon departure
  • Data access control: differentiated role and permission system on the platform (user, access rights and tenant management); need-to-know principle for support access; logging of administrative access
  • Tenant separation: logical separation of data for each shop (Tenant ID) at database and application level; all data access is tenant-specific; automated tests to ensure tenant separation
  • Segregation control: separate environments for development, staging and production

3. Integrity (Art. 32(1)(b) GDPR)

  • Transfer control: encrypted transmission; interface access only with user- or application-specific tokens (OAuth 2.0, token-based authentication); logging
  • Input control: logging of material changes; traceability through timestamps and user attribution

4. Availability and Resilience (Art. 32(1)(b) and (c) GDPR)

  • Redundant cloud infrastructure; scaling according to load
  • Regular automated backups; rolling retention for seven days
  • Recovery plan; regular restore tests
  • Protection against malware and infrastructure-level attacks (cloud provider: DDoS protection, firewalls)

5. Procedures for Regularly Testing, Assessing and Evaluating (Art. 32(1)(d) GDPR)

  • Privacy-friendly default settings for platform features (Art. 25 GDPR), including integrated consent management for shop operators
  • Change and approval processes for software changes (code review, automated tests, staged deployments via staging)
  • Regular review and updating of software components used (patch/dependency management)
  • Incident response process for detecting, reporting and resolving security incidents
  • Written confidentiality commitments for all employees upon commencement of employment, as well as regular data protection training
  • Selection and regular review of subprocessors based on certifications and audit reports

Annex 3 — Subprocessors

  1. The subprocessors engaged — including details of the provider, registered office, services, processing location and third-country transfer safeguards — are listed at https://smarda.com/subverarbeiter. The version of this list published when the Agreement is entered into shall be deemed approved (§ 6(1); changes to the list shall be made exclusively in accordance with the procedure in § 6 (notification, right to object) and shall not require an amendment to this Agreement. The list shall indicate its current version (date) and include a change log.
  2. Payment service providers (e.g. Stripe, PayPal, Mollie, Klarna) process payment data as independent controllers and are not subprocessors (§ 3(3) of this Agreement).
  3. Services connected by the Controller itself — in particular shipping service providers (e.g. DHL, DPD, Sendcloud), newsletter services (e.g. Brevo, Mailchimp, CleverReach), the Controller’s own SMTP server, inventory management/ERP systems, marketplaces and other app/API integrations (e.g. weclapp, Xentral, Amazon, Printful, Billbee, Zapier), as well as tracking/marketing services configured by the Controller (e.g. Google Tag Manager, Google Ads, Meta) — are commissioned by the Controller under its own responsibility; in this respect, the Processor only transmits data on instructions (§ 3(2)).