Data Processing Agreement (AVV)
The German version is authoritative; this English text is provided for convenience. This data processing agreement under Art. 28 GDPR is concluded when blendz.me, owner Leon Radermacher (brand leonradermacher.de), processes personal data of the customer's end users on behalf of the customer, in particular with the Full Service (hosting/operation) and, where applicable, setup. The customer is the controller, the provider is the processor. With the "website only" service path (customer hosts themselves), no AVV usually applies.
Contracting parties
The controller is the customer (name/company and address per the offer or the imprint details from the purchase flow). The processor is blendz.me, owner Leon Radermacher, Schmittenstr. 92, 50354 Hürth, Deutschland, email: [email protected].
§ 1 Subject matter, nature, purpose and duration of processing
(1) The subject matter of the processing is the operation, hosting and maintenance of the website/web application created for the controller and the associated functions (including contact/enquiry form, appointment booking, analytics). (2) Nature and purpose of processing: collection, storage, use, transmission to the controller and deletion of personal data of the website's end users, solely for the purpose of providing the contractually agreed services (hosting, form processing, appointment booking, privacy-compliant statistics, operation and security). (3) Duration: Processing takes place for the term of the underlying main contract (Full Service). It ends with the termination of that contract; the provisions on return and deletion (§ 9) continue to apply. (4) Processing takes place exclusively within the EU/EEA (see Annex 2, sub-processors). Processing in a third country does not take place unless expressly otherwise agreed and legally safeguarded (Art. 44 ff. GDPR).
§ 2 Categories of data subjects and types of data
(1) Categories of data subjects: visitors to the controller's website; persons using the contact/enquiry form; persons booking an appointment (where the booking function is active); where applicable, customers/prospects of the controller. (2) Categories of personal data: master/contact data (e.g. name, email address, telephone number); content data (message/form texts, uploaded files); appointment/booking data (date, time, occasion where applicable); usage/connection data (e.g. shortened IP address, timestamps, server logs); where applicable, privacy-compliant statistics data (Matomo, IP-anonymized). (3) Special categories of personal data (Art. 9 GDPR) are not the subject of processing unless expressly otherwise agreed.
§ 3 Controller's right to issue instructions
(1) The processor processes the data exclusively within the scope of the agreements made and in accordance with documented instructions from the controller, unless it is legally obliged to process (in which case it informs the controller before processing, where legally permissible). (2) Instructions are generally given in text form. Verbal instructions are confirmed in text form without delay. (3) If the processor is of the opinion that an instruction violates data protection law, it informs the controller without delay (Art. 28(3) sentence 3 GDPR).
§ 4 Obligations of the processor
The processor undertakes in particular to (1) process data only as instructed and for the designated purpose; (2) maintain confidentiality and oblige all persons involved in the processing to confidentiality or ensure their statutory duty of secrecy (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR); (3) comply with the required technical and organizational measures under Art. 32 GDPR (Annex 1); (4) observe the conditions for engaging sub-processors (§ 6); (5) support the controller in fulfilling data-subject rights (§ 7); (6) support the controller in complying with the obligations under Art. 32–36 GDPR (security, notification of data breaches, data protection impact assessment), as appropriate and taking into account the information available to it; (7) report personal data breaches (Art. 4 no. 12 GDPR) to the controller without undue delay after becoming aware of them, so that the controller can fulfil its notification/communication obligations (Art. 33, 34 GDPR); (8) document processing activities under Art. 30(2) GDPR; (9) name a contact for data protection to the controller (contact: [email protected]).
§ 5 Technical and organizational measures (Art. 32 GDPR)
The processor implements the technical and organizational measures described in Annex 1 and keeps them at a level appropriate to the risk throughout the term of the contract. Changes must not fall below the level of protection.
§ 6 Sub-processors
(1) The controller grants general authorization to engage the sub-processors named in Annex 2. (2) The processor informs the controller of intended changes (addition/replacement) in good time in advance in text form. The controller may object to justified objections within 14 days. (3) The processor obliges each sub-processor to data protection obligations equivalent to those of this agreement (Art. 28(4) GDPR), in particular to adequate technical and organizational measures.
§ 7 Support for data-subject rights
The processor supports the controller with suitable technical and organizational measures in responding to requests from data subjects for access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). If data subjects contact the processor directly, the processor forwards the request to the controller without delay.
§ 8 Evidence and audit rights
(1) The processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and enables reviews (including inspections) by the controller or an auditor commissioned by the controller (Art. 28(3)(h) GDPR). (2) Audits take place after reasonable prior notice, during normal business hours and without disrupting operations. Evidence may also be provided by suitable certificates, attestations or reports (e.g. of the sub-processors).
§ 9 Deletion and return after termination
After completion of the processing services, the processor, at the controller's choice, deletes or returns all personal data and deletes existing copies, unless a statutory retention obligation exists (Art. 28(3)(g) GDPR). The return/deletion is documented on request.
§ 10 Liability, final provisions
(1) Art. 82 GDPR applies to liability. In the internal relationship, the provisions of the main contract apply additionally, insofar as they do not conflict with mandatory data protection law. (2) In the event of conflicts between this AVV and the main contract, the provisions of this AVV prevail for processing on behalf. (3) German law applies. Amendments require text form.
Annex 1 — Technical and organizational measures (Art. 32 GDPR)
1. Confidentiality — Access control (physical): server operation in certified EU data centers of the sub-processor (Hetzner, DE/FI) with physical access safeguards. Access control (logical): individual user accounts, strong authentication (SSH keys/2FA), password policies, revocation of departed users' access. Data-access control: role-based permissions (need-to-know), separate customer instances/databases, logging of administrative access. Separation control: logical separation of data per customer (separate instances/databases). 2. Integrity — Transfer control: transport encryption (TLS/HTTPS) for website and mail delivery; encrypted connections to services. Input control: logging of security-relevant events, server logs. 3. Availability and resilience — regular, encrypted backups; recovery procedures; monitoring/failure surveillance; protective measures against attacks (including firewalling, bot protection via Friendly Captcha); regular security updates/patches. 4. Procedures for regular review, assessment and evaluation — data protection management: record of processing activities, data protection by design/default (data minimization, EU tools, IP anonymization). Order control: sub-processors obliged via AVV/DPA. Recoverability: backup/restore processes tested.
Annex 2 — Approved sub-processors
Hetzner Online GmbH, Gunzenhausen (DE) — hosting/servers, data centers in Germany/Finland (EU). Friendly Captcha GmbH, Wörthsee (DE) — bot/spam protection of the forms (without user tracking), processing in the EU. Matomo (self-hosted) — analytics; runs on our own EU infrastructure and is therefore generally not an external sub-processor. Email delivery (mail.blendz.me) — system/notification emails via our own EU mail server.
This version is used for processing on behalf within the Full Service; the specific party and operational details are completed at conclusion of the contract.