Agreement on the processing of personal data on behalf of the Client pursuant to the EU General Data Protection Regulation (GDPR)
This English version is a convenience translation. In the event of any discrepancy, the German version shall prevail.
Between
Adverfly GmbH
Südring 1a
51702 Bergneustadt, Germany
– hereinafter “Adverfly” or the “Contractor” –
and
the customer who registers via the Adverfly websites or subscribes to the Adverfly services
– hereinafter the “Client” –
the following agreement is concluded
1. Introduction, Scope, Definitions
(1)This agreement governs the rights and obligations of the Client and Adverfly in connection with the processing of personal data on behalf of the Client.
(2)This agreement applies to all activities in which Adverfly or subcontractors (sub-processors) engaged by Adverfly process personal data of the Client.
(3)Terms used in this agreement shall be understood in accordance with their definitions in the EU General Data Protection Regulation. Where declarations are required to be made in writing under this agreement, this refers to the written form pursuant to Section 126 of the German Civil Code (BGB). Otherwise, declarations may also be made in another form, provided that adequate proof is ensured.
2. Subject Matter and Duration of the Processing
2.1 Subject Matter of the Processing
(1)Adverfly provides the Client with cloud-based IT services in the form of the Adverfly web application (the “Adverfly Platform”) and related services. The Adverfly Platform serves in particular to collect, analyze and optimize marketing, usage and conversion data and to connect external systems.
(2)Depending on the package booked, the modules activated and the configuration chosen by the Client, this includes in particular:
- the collection and analysis of website and shop usage and conversion data (e.g. via pixel or API integrations), including the attribution to marketing campaigns and channels,
- the transfer of conversion and event data to connected advertising and analytics platforms (e.g. CAPI interfaces, GA4, TikTok, Snap), where activated by the Client,
- functions for surveys, segmentation, personalization and loyalty programs, and the import, consolidation and enrichment of data (e.g. CSV imports, shop and third-party integrations),
- the provision of dashboards, reports, analyses and, where applicable, AI-supported analyses and benchmarks,
- the operation of integrations, APIs and webhooks for connecting further systems of the Client or of third parties,
- user and access management (workspaces, role and permission concepts) for the Client’s users,
- service and support services (e.g. tickets, error analysis, monitoring and system surveillance) in connection with the use of the Adverfly Platform.
(3)The specific services commissioned result from the Main Agreement (e.g. the agreement concluded by subscribing to the Adverfly services via the Adverfly websites, or a SaaS/license or framework agreement), the associated annexes (in particular service descriptions and offers) and the modules and configurations booked in each case. Personal data is processed exclusively for the performance of these contractually agreed services.
(4)The Contractor processes personal data exclusively on documented instructions from the Client and not for its own purposes, unless it is legally obliged to process the data on its own account.
2.2 Duration of the Processing
(1)The processing begins when the Main Agreement between the parties enters into force and continues for the term of that Main Agreement and of the associated service agreements.
(2)If the Main Agreement or the underlying contractual relationship ends, this processing on behalf of the Client also ends, unless continued processing on behalf of the Client is required by statutory obligations (e.g. retention periods) or separate agreements.
(3)After the contractual relationship has ended, the provisions of Section 11 of this agreement apply.
3. Nature and Purpose of the Collection, Processing or Use of Data
3.1 Nature and Purpose of the Processing
(1)Adverfly processes personal data exclusively for the purpose of providing the contractually agreed SaaS services and related services to the Client. These include in particular:
- the provision and operation of the Adverfly Platform for collecting, analyzing and displaying marketing, usage and conversion data,
- the attribution of conversions and events to marketing measures, campaigns, channels and target groups,
- the provision of integrations with third-party platforms (e.g. advertising and analytics platforms, shop systems, CRM and email tools) and the transfer of data to these systems on the Client’s instructions,
- functions for personalization, segmentation and customer loyalty (e.g. loyalty programs, segment logic, individual displays on websites),
- the import and consolidation of data sets (e.g. CSV imports, data transfers from other systems),
- the provision of dashboards, reports, analyses and, where applicable, AI-supported analyses and benchmarking functions,
- the operation of APIs, webhooks and an audit log to keep platform actions traceable,
- the operation, monitoring, maintenance and securing of the Adverfly Platform, including backup, patch and security measures,
- the handling of support requests (e.g. tickets, chat, email, remote support).
(2)No processing takes place for the Contractor’s own purposes. Use for its own purposes is only permitted insofar as Adverfly is legally obliged to do so; in this case, Adverfly shall inform the Client in advance, unless such information is prohibited by law.
3.2 Type and Categories of Data
Depending on the service commissioned, the processing may in particular concern the following categories of data subjects:
- customer/workspace users of the Client (e.g. the Client’s employees, administrators, marketing and sales staff and other authorized user accounts),
- members of governing bodies and other office holders of the Client (insofar as recorded in the platform or accompanying systems),
- end customers, prospective customers and other users of the websites, online shops, apps or other digital offerings operated by the Client or under its responsibility,
- suppliers, partners, affiliates/publishers and other business partners of the Client, insofar as their data is processed in the Adverfly Platform (e.g. in partner or referral programs),
- employees of the Contractor, insofar as their data becomes visible in the Client’s systems in the course of providing the services (e.g. contact details of support or project staff in tickets or logs).
3.3 Categories of Personal Data
Depending on the modules booked, the configuration and the specific processing activity, the following categories of personal data in particular may be affected:
(a) Master and contact data (in particular customer/workspace users, partners, business contacts):
- name, job or role title, business contact details (email address, telephone number, postal address), user and workspace identifiers, role and permission information.
(b) Usage, tracking and conversion data (end customers/website/shop users):
- technical usage data (e.g. IP address, browser and device information, operating system, referrer URL),
- marketing and campaign identifiers (e.g. click IDs such as fbclid, gclid, ttclid),
- usage data (e.g. pages visited, time spent, number of sessions, interactions such as clicks, scroll events, shopping cart actions, form usage, appointment bookings),
- conversion and order data (e.g. order ID, products purchased, order value/currency, conversion type, timestamp, new/existing customer, channel and campaign path),
- where applicable, pseudonymous or hashed identifiers (e.g. hashed email address or telephone number) for server-side interfaces (e.g. CAPI), insofar as used by the Client.
(c) Communication and support data:
- content and metadata of support tickets, emails and chats (e.g. subject, message texts, timestamps, associated user or customer identifiers),
- log data from meetings or support sessions (insofar as documented in the platform or accompanying systems).
(d) System, log and audit data:
- login, access and permission data, logs of usage and administrative actions (audit log), system and configuration data, monitoring and alerting information.
(e) Contract and billing data:
- customer numbers, contract master data, records of services performed, billing and booking information, insofar as they relate to an identifiable person.
(f) Other data categories:
- other personal data processed in the Adverfly Platform or in connected systems within the scope of the specifically commissioned services (e.g. content from document management or workflow functions), provided that it is described in the Client’s contractual documents or in the Contractor’s record of processing activities.
(g) Special categories of personal data:
- Adverfly does not intend to process special categories of personal data within the meaning of Art. 9 GDPR. If the Client nevertheless uses the platform for such data, it must ensure that a suitable legal basis and an adequate level of protection exist and that this is agreed separately with Adverfly.
3.4 Legal Bases of the Processing
(1)The lawfulness of the processing of personal data by the Contractor is determined by the legal bases on which the Client relies within its area of responsibility (in particular Art. 6(1) GDPR and, where applicable, national provisions such as Section 26 of the German Federal Data Protection Act (BDSG)).
(2)The Client is responsible for ensuring the lawfulness of the processing, for determining the applicable legal bases and for providing the necessary information to the data subjects.
(3)Insofar as certain processing operations – in particular setting and reading cookies or comparable technologies and tracking measures on the Client’s websites or in its apps – require consent under the applicable telecommunications and ePrivacy law (e.g. TTDSG) or under Art. 6(1)(a) GDPR, obtaining, documenting and managing such consent is the responsibility of the Client. Adverfly merely provides the technically necessary functions for this, insofar as contractually agreed.
3.5 Record of Processing Activities and Annexes
(1)A detailed description of the processing activities typically performed under this agreement, of the categories of data and data subjects concerned, the recipients, the protection requirements and the platforms used is set out in the record of processing activities of Adverfly GmbH as amended from time to time (the “Adverfly Record of Processing Activities”). This record will be made available to the Client upon request.
(2)Changes to the record of processing activities that affect the services performed on behalf of the Client will be communicated to the Client in an appropriate manner insofar as they materially affect the contractual obligations or the level of protection.
4. Obligations of Adverfly
(1)Adverfly processes personal data exclusively as contractually agreed or as instructed by the Client, unless Adverfly is required by law to carry out a specific processing operation. If such obligations exist, Adverfly shall notify the Client of them before the processing, unless such notification is prohibited by law. Beyond this, Adverfly does not use the data provided for processing for any other purposes, in particular not for its own purposes.
(2)Adverfly confirms that it is familiar with the relevant general data protection regulations. It observes the principles of proper data processing.
(3)Adverfly undertakes to maintain strict confidentiality in the processing.
(4)Persons who may gain knowledge of the data processed on behalf of the Client must undertake in writing to maintain confidentiality, unless they are already subject to a relevant statutory duty of confidentiality.
(5)Adverfly warrants that the persons it employs for the processing have been familiarized with the relevant data protection provisions and with this agreement before the processing begins. Corresponding training and awareness measures shall be repeated at appropriate regular intervals. Adverfly shall ensure that the persons employed for the processing on behalf of the Client are continuously and appropriately instructed and supervised with regard to compliance with data protection requirements.
(6)In connection with the commissioned processing, Adverfly shall support the Client in creating and updating the record of processing activities and in carrying out data protection impact assessments. Any effort arising from this shall be agreed with the Client in advance.
(7)If the Client is subject to an inspection by supervisory authorities or other bodies, or if data subjects assert rights against the Client, Adverfly undertakes to support the Client to the extent necessary insofar as the processing on behalf of the Client is affected. Any effort arising from this shall be agreed with the Client in advance.
(8)Adverfly may only provide information to third parties or to the data subject with the prior consent of the Client. It shall forward any requests addressed directly to it to the Client without undue delay.
(9)Where legally required, Adverfly shall appoint a competent and reliable person as data protection officer. It must be ensured that the data protection officer has no conflicts of interest. In cases of doubt, the Client may contact the data protection officer directly. Adverfly shall inform the Client of the contact details of the data protection officer without undue delay or state the reasons why no data protection officer has been appointed. Adverfly shall inform the Client without undue delay of any change in the person or in the internal duties of the data protection officer.
(10)The Contractor (Adverfly) shall report to the Client without undue delay any incident that has come to its knowledge in which personal data has been damaged, lost, altered, disclosed or made accessible without authorization.
The report should contain all relevant information: what happened, which data is affected, what consequences could arise and which measures have been taken or are planned to limit the damage.
5. Technical and Organizational Measures
(1)The data security measures described in the annex “Technical and Organizational Measures (TOMs)” define the minimum owed by Adverfly. The annex will be provided to the Client in text form upon request.
(2)The data security measures may be adapted in line with technical and organizational developments, provided that the level agreed here is not undercut.
(3)Insofar as the security measures taken do not or no longer meet the Client’s requirements, Adverfly shall notify the Client without undue delay.
(4)Adverfly warrants that the data processed on behalf of the Client is kept strictly separate from other data sets.
(5)Copies or duplicates are not made without the Client’s knowledge. Technically necessary, temporary copies are excepted, provided that an impairment of the level of data protection agreed here is ruled out.
(6)Dedicated data carriers originating from the Client or used for the Client are specially marked and subject to ongoing management. They must be stored appropriately at all times and must not be accessible to unauthorized persons. Their receipt and dispatch are documented.
(7)Adverfly regularly provides evidence of the fulfillment of its obligations, in particular of the full implementation of the agreed technical and organizational measures and of their effectiveness.
(8)The Contractor uses multi-factor authentication (MFA) for internal administration and support access. Access rights are assigned on a role basis and reviewed regularly.
6. Provisions on the Rectification, Erasure and Blocking of Data
(1)Adverfly shall only rectify, erase or block data processed on behalf of the Client in accordance with the contractual agreement made or on the Client’s instructions.
(2)Adverfly shall comply with the corresponding instructions of the Client at any time, including after the termination of this agreement.
7. Subcontracting
(1)The Client’s rights must also be effectively enforceable against the subcontractor. In particular, the Client must be entitled at any time to carry out inspections of subcontractors to the extent specified here, or to have them carried out by third parties.
(2)The responsibilities of Adverfly and of the subcontractor must be clearly delineated.
(3)Adverfly selects the subcontractor carefully, taking particular account of the suitability of the technical and organizational measures taken by the subcontractor.
(4)Data processed on behalf of the Client may only be passed on to the subcontractor once Adverfly has satisfied itself that the subcontractor has fully met its obligations.
(5)The engagement of subcontractors that do not perform the processing on behalf of the Client exclusively within the territory of the EU or the EEA is permitted if and for as long as the subcontractor provides appropriate data protection safeguards.
(6)Adverfly shall review the subcontractor’s compliance with its obligations appropriately and regularly, at least every 12 months.
(7)Subcontracting relationships within the meaning of this agreement are only those services that are directly related to the provision of the main service. Ancillary services, such as transport, maintenance and cleaning, as well as the use of telecommunications services or user services, are not covered. Adverfly’s obligation to ensure compliance with data protection and data security in these cases as well remains unaffected.
(8)Adverfly has the Client’s general authorization to engage subcontractors (sub-processors). Adverfly shall inform the Client in advance of any intended change concerning the addition or replacement of subcontractors and shall grant the Client the right to object (Art. 28(2) GDPR). The following subcontractors are currently engaged:
| Subcontractor | Address / Country | Service |
|---|
| Exoscale SA | Switzerland | CDN, content delivery |
| Amazon Web Services EMEA SARL | Luxembourg / AWS Region Frankfurt (Germany) | Hosting, database, storage, compute |
| HubSpot Ireland Ltd. | Ireland | Support chat and ticket handling |
| Stripe Payments Europe Ltd. | Ireland | Payment processing and billing |
8. Rights and Obligations of the Client
(1)The Client issues all orders, partial orders or instructions and documents them. In urgent cases, instructions may be given verbally. The Client shall confirm such instructions in documented form without undue delay.
(2)The Client shall inform Adverfly without undue delay if it discovers errors or irregularities when checking the results of the commissioned work.
(3)The Client is entitled to verify, to an appropriate extent and either itself or through third parties, Adverfly’s compliance with the data protection regulations and the contractual agreements, in particular by obtaining information, by inspecting the stored data and the data processing programs and by other on-site inspections. Adverfly shall grant the persons entrusted with the inspection access and insight to the extent necessary. Adverfly is obliged to provide the necessary information, to demonstrate procedures and to provide the evidence required to carry out an inspection.
(4)Inspections at Adverfly must be carried out without avoidable disruption to its business operations. Unless otherwise indicated for urgent reasons to be documented by the Client, inspections take place after reasonable advance notice, during Adverfly’s business hours and not more frequently than every 12 months. Insofar as Adverfly provides evidence of the correct implementation of the agreed data protection obligations, an inspection should be limited to random samples.
9. Notification Obligations
(1)Adverfly shall notify the Client of personal data breaches without undue delay. Justified suspicions of such breaches must also be reported. The notification must be made to an address designated by the Client no later than 24 hours after Adverfly becomes aware of the relevant event. It must contain at least the following information:
- a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- the name and contact details of the data protection officer or of another contact point where more information can be obtained;
- a description of the likely consequences of the personal data breach;
- a description of the measures taken or proposed by Adverfly to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
(2)Significant disruptions in the performance of the commissioned processing, as well as violations by Adverfly or by the persons it employs of data protection provisions or of the stipulations made in this agreement, must also be reported without undue delay.
(3)Adverfly shall inform the Client without undue delay of inspections or measures by supervisory authorities or other third parties insofar as these relate to the processing on behalf of the Client.
10. Instructions
(1)The Client reserves a comprehensive right to issue instructions regarding the processing on its behalf.
(2)The Client and Adverfly shall designate the persons exclusively authorized to issue and receive instructions.
(3)If the designated persons change or are unavailable for a longer period, the other party must be notified of their successors or representatives without undue delay.
(4)Adverfly shall notify the Client without undue delay if, in its opinion, an instruction issued by the Client violates statutory provisions. Adverfly is entitled to suspend the execution of the instruction concerned until it is confirmed or amended by the person responsible at the Client.
(5)Adverfly shall document the instructions issued to it and their implementation.
11. Termination of the Engagement
(1)Upon termination of the processing relationship, or at any time at the Client’s request, Adverfly shall, at the Client’s option, either destroy the data processed on its behalf or hand it over to the Client. All existing copies of the data must also be destroyed. The destruction must be carried out in such a way that it is no longer possible to restore even residual information with reasonable effort.
(2)Adverfly is obliged to bring about the immediate return or erasure at subcontractors as well.
(3)Documentation serving as evidence of proper data processing shall be retained by Adverfly in accordance with the respective retention periods, including beyond the end of the agreement. Adverfly may hand it over to the Client at the end of the agreement to discharge itself.
(4)Unless the Client instructs otherwise, personal data will be erased or anonymized within a reasonable period after the end of the agreement, unless statutory retention obligations prevent this.
12. Remuneration
Adverfly’s remuneration is conclusively governed by the Main Agreement. No separate remuneration or reimbursement of costs is provided under this agreement.
13. Liability
(1)The Client and Adverfly are jointly and severally liable for compensation for damage suffered by a person as a result of inadmissible or incorrect data processing within the scope of the processing relationship.
(2)Adverfly bears the burden of proof that damage is not the result of a circumstance for which it is responsible, insofar as the relevant data was processed by it under this agreement.
(3)Adverfly is liable to the Client for damage culpably caused by Adverfly, its employees, the persons it has commissioned to perform the agreement or the sub-service providers it has engaged in connection with the provision of the commissioned contractual service.
(4)Paragraphs (2) and (3) do not apply insofar as the damage was caused by the correct implementation of the commissioned service or of an instruction issued by the Client.
14. Miscellaneous
(1)Both parties are obliged to treat as confidential all knowledge of the other party’s trade secrets and data security measures obtained within the scope of the contractual relationship, including after the termination of the agreement. If there is any doubt as to whether information is subject to the duty of confidentiality, it shall be treated as confidential until released in writing by the other party.
(2)Should the Client’s property held by Adverfly be endangered by measures of third parties (for instance by attachment or seizure), by insolvency or composition proceedings or by other events, Adverfly shall notify the Client without undue delay.
(3)Ancillary agreements must be made in writing.
(4)The defense of the right of retention within the meaning of Section 273 of the German Civil Code (BGB) is excluded with regard to the data processed on behalf of the Client and the associated data carriers.
(5)Should individual parts of this agreement be invalid, this shall not affect the validity of the remainder of the agreement.