Data processing agreement

When this agreement applies

This agreement applies as soon as acessio processes personal data on behalf of the client – for example because enquiries, appointments, feedback or customer data run through a system set up by acessio.

It does not apply to acessio's own websites (acessio.de and acessio.eu). There, acessio is the controller;

what is processed is set out in the privacy policy.

The agreement is concluded in text form before processing begins. It forms part of the respective main contract and ends with it.

Subject matter, nature and purpose

Subject matter. Operation, maintenance and further development of the client's digital systems set up by acessio.

Nature of processing. Collection, storage, organisation, retrieval, transmission between the connected software, analysis in aggregated form and erasure.

Purpose. Receiving and forwarding enquiries, managing appointments, analysing where enquiries come from, and operating and troubleshooting the processes set up.

Duration. For the term of the main contract.

Types of data and data subjects

Types of data. Master data (name, form of address), contact data (phone number, email address, postal address), content data (requests, free text from forms), appointment data, contract and billing data, and usage data (origin of an enquiry, time).

Data subjects. Prospective customers, customers, patients and employees of the client.

Special categories under Art. 9 GDPR. In medical practices and healthcare businesses, health data may arise, for example if a request is described in the free-text field of an enquiry form. acessio sets up forms so that such information is not asked for. If it cannot be avoided, the stricter requirements of Art. 9 GDPR apply; its permissibility must be clarified separately before processing begins.

Instructions

acessio processes the data only on documented instructions from the client. Instructions are given in text form; verbal instructions are confirmed in text form without delay.

If acessio considers an instruction to be unlawful, it will inform the client without delay and may suspend its execution until it is confirmed.

No processing for acessio's own purposes takes place.

Confidentiality

acessio only uses persons for processing who are bound to confidentiality and familiar with the relevant data protection regulations. This obligation continues after their work has ended.

At the time the agreement is concluded, acessio is a sole proprietorship; processing is carried out by Victor Knapp personally.

Technical and organisational measures

acessio takes the measures required under Art. 32 GDPR. They are described in detail in the annex at the end of this agreement and are adapted to the state of the art as necessary; the level of protection must not be reduced in the process.

Sub-processors

The client consents to the use of the sub-processors listed below. acessio concludes contracts with them that meet the requirements of Art. 28 GDPR.

acessio will notify the client of any change at least 30 days in advance in text form. The client may object for good cause within this period; if no solution can then be found, the client may terminate the main contract for cause.

The use of FormSubmit concerns form submission. It is the only point involving a transfer to the USA. Where the client wishes to rule this out, acessio sets up form delivery on its own server in Germany.

Support for the client

acessio supports the client in responding to requests from data subjects (Art. 12 to 23 GDPR) and with data protection impact assessments and notification obligations (Art. 32 to 36 GDPR).

If a data subject contacts acessio directly, acessio forwards the request to the client without delay and does not answer it itself.

If acessio becomes aware of a personal data breach, it informs the client without delay and compiles the information required under Art. 33(3) GDPR.

Evidence and audits

On request, acessio demonstrates compliance with this agreement, in particular by providing information and presenting the description of measures.

The client may satisfy itself of compliance on site. Audits are announced with reasonable notice and carried out in such a way that operations are not unreasonably disrupted.

Erasure and return

After the main contract ends, acessio returns or deletes the processed data, including any existing copies, at the client's choice.

Data is returned in a common, machine-readable format within 30 days of the end of the contract.

Where statutory retention obligations exist, the data concerned remains stored and is blocked from further processing.

Liability

Art. 82 GDPR applies. As between the parties, the liability provisions of the main contract apply in addition.

Physical and system access

Processing takes place on Hetzner servers in Germany and on work devices at Königstraße 35 in Stuttgart. The data centres are certified to ISO 27001; physical access is managed by the operator.

Work devices are fully encrypted and secured with a password and a second factor. The screen locks when inactive.

Server access is exclusively via SSH with a key pair; password login is disabled. Two-factor authentication is active for all services with administrative access.

Transfer and transmission

All connections run over TLS. The website is accessible only via HTTPS and sends HSTS.

Data carriers are not shipped. Access credentials are not sent by email.

Input control and traceability

Changes to systems and processes are recorded with version control. Access to servers is logged.

The logs do not contain content data of data subjects.

Availability and recovery

Daily backup of application data with a retention period of 30 days. The backups are encrypted.

Recovery is tested at least every six months.

Separation

Data of different clients is kept logically separate. Access across client boundaries is not intended.

Development and test environments do not work with real personal data.

Data minimisation

Forms collect only the information required for processing. No fields are provided for health information.

Audience measurement works without cookies and without storing IP addresses.

Review

The measures are reviewed at least annually and adapted when the system landscape changes.

Processors are checked for suitability before being commissioned.