Data processing agreement (Art. 28 GDPR)

1. Parties and subject matter

1.1 The controller is the User (hereinafter “Client”); the processor is iBeekeeper UG (haftungsbeschränkt), Lessingstraße 4, 15345 Altlandsberg, Germany (hereinafter “iBeekeeper”).

1.2 iBeekeeper processes personal data on behalf of the Client insofar as the Client stores them in the Service within the framework of the contract of use (T&Cs). Duration: term of the contract of use plus the periods under Section 9.

2. Nature, purpose and scope

3. Instructions

iBeekeeper processes the data only on documented instructions from the Client. The instructions are conclusively laid down in the contract of use and in the settings and functions of the Service that the Client uses. The Client gives further instructions in text form to service@ibeekeeper.de. If iBeekeeper considers an instruction to be unlawful, iBeekeeper informs the Client of this without undue delay (Art. 28(3), third sentence, GDPR).

4. Confidentiality

iBeekeeper only uses persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5. Technical and organisational measures

iBeekeeper takes the measures under Art. 32 GDPR described in Annex 1 and adapts them to the state of the art without lowering the level of protection.

6. Sub-processors

6.1 The Client authorises the sub-processors listed in Annex 2.

6.2 iBeekeeper informs the Client in text form at least 30 days in advance of any intended addition or replacement. The Client may object within this period for an important reason under data protection law. If the parties cannot reach an agreement, the Client may cancel the contract of use with effect from the time of the change.

6.3 iBeekeeper contractually imposes the same data protection obligations on each sub-processor.

7. Assistance to the Client

iBeekeeper assists the Client with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR), in particular through the export, modification and deletion functions of the Service, and with the obligations under Art. 32 to 36 GDPR. If a data subject contacts iBeekeeper directly, iBeekeeper forwards the request to the Client.

8. Personal data breaches

iBeekeeper notifies the Client of a breach of the protection of the commissioned data without undue delay, if possible within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR, insofar as known.

9. Deletion and return

The Client can export and delete the data himself or herself at any time. After the end of the contract of use or after deletion of the account, iBeekeeper deletes the commissioned data in accordance with the periods of the T&Cs (Section 9.7), unless there is a legal obligation to store them. Daily backups are deleted after 30 days, one state per calendar month after 12 months. Backups are encrypted and are used only for restoration; after a restoration, data deleted in the meantime are deleted again.

10. Evidence and inspections

On request, iBeekeeper makes available to the Client the information necessary to demonstrate compliance with these obligations and allows for audits by the Client or by an auditor mandated by the Client and bound to confidentiality, after notification with reasonable notice during business hours. Evidence is provided primarily by documents and information.

11. Liability and final provisions

Liability is governed by Art. 82 GDPR; otherwise, the T&Cs apply. In the event of conflicts, this agreement takes precedence over the T&Cs insofar as the protection of personal data is concerned.

Annex 1: Technical and organisational measures

• Physical access and physical security: servers exclusively in OVHcloud data centres, contracting party OVH GmbH, Cologne; physical access control by OVHcloud in accordance with its data processing agreement (version of 17 October 2025).
• System access: login with password, passwords stored only as a hash; administrator access to the servers only via SSH key.
• Data access: rights in the Service per account, sharing only by the User; administrative access is logged (admin app, log of customer actions).
• Transfer: TLS transport encryption for all connections; photos without metadata.
• Input control: change log for the cash book and outgoing invoices, unalterable filing with checksum.
• Availability: daily backup of the database and media on separate storage (OVHcloud object storage in Germany); daily backups are deleted after 30 days, one state per calendar month after 12 months; the backups are encrypted and are used only for restoration; restoration is tested at least once a year and the result is documented.
• Separation: multi-tenant data storage, queries per account.
• Review: security updates of the servers and dependencies, annual review of the measures.

Annex 2: Sub-processors

OVH GmbH in turn uses companies of the OVHcloud group, for support and maintenance also OVH Hébergement Inc. (Canada) and OVH Limited (United Kingdom); the current list is available at https://contract.eu.ovhapis.com/1.0/pdf/OVH_Sub_processors-de.pdf.

Not sub-processors: Mollie, Apple and Google (payment or delivery in their own relationship with the User, no commissioned data).