Data processing agreement

This English version is provided for convenience. Only the German version is legally binding.

As of: release date

Data processing agreement under Art. 28 GDPR between you as our customer ("controller") and Giegler Developing (owner Zoey Evelyn Giegler), Im Mediapark 5, 50670 Köln, Germany ("processor", "we"). It becomes part of the hosting contract under our terms with your order and applies as long as we process personal data on your behalf.

1. Subject matter, nature and purpose

We run a Fluxer instance for you. In doing so we process the personal data stored in it in order to provide, back up, monitor and update the instance, to create exports and to fix faults. We process the data for these purposes only.

2. Types of data and data subjects

• Data subjects: members, moderators, guests and other users of your instance.
• Data: account data (username, email address, password hash, profile details), messages and reactions, uploaded files and media, memberships and roles, connection and log data (IP addresses, times, device details), moderation data.
• Special categories (Art. 9 GDPR): may appear in content, for example information about sexual orientation or health in messages. We treat all content as equally confidential and do not analyse it.

3. Instructions

We process the data only on your documented instructions. Instructions are this agreement, the settings and actions in the dashboard (such as export, plan change, cancellation) and instructions in text form to legal@giegler.software. If the law requires us to process data otherwise, we tell you beforehand unless the law forbids it. If we consider an instruction unlawful, we tell you at once.

4. Confidentiality

Only people bound to confidentiality who need it for their work have access to the data. Currently that is Zoey Evelyn Giegler only. adjust when there are staff We only look at the content of your instance where needed for operation, troubleshooting, your request or a legal duty (such as a report under Art. 16 DSA).

5. Technical and organisational measures (Art. 32 GDPR)

• Separation: each instance runs in its own containers with its own database, its own storage and dedicated resources.
• Network: the servers sit in a separate private network segment behind a firewall. Only web access through Cloudflare is reachable from outside. Exports run in an isolated environment without internet access.
• Encryption: transfer over TLS only. Database backups are encrypted. check: encryption of file backups and disks
• Access: administration requires single sign-on with group permission or SSH keys; the dashboard uses passkeys or one-time mail links, no passwords. Administrative actions are logged.
• Availability: nightly backups at a second location (14 daily, 8 weekly snapshots), continuous monitoring with alerting, new versions on a test instance first.
• Review: we review these measures regularly, at least annually, and adapt them to the state of the art.

6. Sub-processors

You consent to the following sub-processors:

Instances not running at OVHcloud run on our own servers in Germany. Emails from the instance to members (such as confirmations) go through an SMTP account on our own mail server that can only be used from within the instance. If you enter your own SMTP server in the instance, you engage its provider yourself.

We announce new or changed sub-processors by mail at least 4 weeks in advance. You can object for an important data protection reason; if we can't agree, you may cancel the contract effective when the change takes effect. We contractually bind sub-processors to at least the level of protection of this agreement.

7. Assistance

We assist you with appropriate measures in handling data subject requests (Art. 15 to 22 GDPR), with security of processing, with notifying data breaches and with data protection impact assessments. You can handle many requests yourself in your instance (Fluxer administration) or answer them with an export. If a request concerning you reaches us, we forward it to you. check: payment for exceptional effort

8. Personal data breaches

We inform you without undue delay, at the latest within 48 hours of becoming aware of a personal data breach in your instance, with the information under Art. 33(3) GDPR as far as we have it.

9. Deletion and return

During the term you can download a full export at any time. When the contract ends we pause the instance; you can still fetch an export for 30 days. After that we delete all the instance's data. Backups expire on their schedule (database after 8 weeks at the latest, files 30 days after their deletion). We only keep data beyond these periods where the law requires us to.

10. Evidence and audits

On request we provide the information needed to demonstrate compliance with this agreement. We allow audits, including on site, with reasonable notice, during business hours and without disrupting operations. Confidentiality towards other customers is maintained.

11. Final provisions

Liability follows Art. 82 GDPR; otherwise the liability rules of the terms apply. Where they conflict, this agreement takes precedence over the terms as far as the protection of personal data is concerned. full review by a lawyer