Data processing agreement

1. Role of this DPA

This Data Processing Agreement (“DPA”) is the standard contract of Horváth Digital Solutions™ pursuant to Art. 28 of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR). The wording on this page is the standard text that the parties sign via DocuSeal or the customer portal (or otherwise agree in a legally binding form).

Publication of this page does not of itself conclude this agreement, does not constitute an offer that is accepted merely by visiting the page, and does not commence processing as processor. Horváth Digital Solutions™ processes personal data as processor only after this DPA — or another legally binding arrangement satisfying Art. 28 GDPR — has been agreed with the Customer.

This DPA supplements the Terms and Conditions. Use of the Services remains subject to the Acceptable use policy. Service levels are in the Service Level Agreement. Independent controller processing by Horváth Digital Solutions™ is described in the privacy policy and is not subject to this DPA. Provider identity is also set out in the legal notice. For general enquiries use the contact page.

2. Parties and definitions

Horváth Digital Solutions™ Owner: Semjon Horváth Eichborndamm 90B 13403 Berlin Germany

Email: info@horvath-digital.solutions
Phone: +49 30 81451947-0
Fax: +49 30 81451947-3
Legal: legal@horvath-digital.solutions

Horváth Digital Solutions™ (“HDS”) is the processor under this DPA (“Processor”). Further provider details are in the legal notice. For general enquiries use the contact page.

The controller is the customer who agrees this DPA (“Customer”). Where the Customer acts as processor for a third-party controller, the Customer warrants that it is authorised to instruct HDS, and HDS remains processor solely toward the Customer under this DPA.

Terms used in this DPA have the meaning given in Art. 4 GDPR, including “personal data”, “processing”, “controller”, “processor”, “personal data breach”, and “supervisory authority”. “Services” means the in-scope products listed in §4 and Annex 1. “Customer Content” means personal data that HDS processes on the Customer’s documented instructions in those Services. “Subprocessor” means a processor engaged by HDS to process Customer Content.

3. Subject matter, nature, purpose, and duration

The subject matter of this DPA is the processing of Customer Content by HDS as processor in order to provide the in-scope Services that the Customer has ordered or configured.

The nature of the processing is the storage, hosting, transmission, organisation, retrieval, restriction, erasure, and related technical operations that are necessary to operate those Services (including backup and restore where included, TLS certificate issuance for customer domains on HDS-operated infrastructure, and authoritative DNS zone serving where HDS DNS™ is used).

The purpose of the processing is solely the provision of the ordered Services on the Customer’s documented instructions. HDS does not process Customer Content for its own independent purposes, for advertising, or for profiling across customers.

This DPA applies for the duration of the processor relationship. That relationship runs for the term of the contract for the relevant in-scope Services, including any wind-down until Customer Content is deleted or returned in accordance with §15, unless the parties agree otherwise in writing.

4. Scope of processor processing

HDS acts as processor under this DPA only for Customer Content that the Customer instructs HDS to process in the in-scope Services listed in Annex 1 (Managed Hosting, Email & Presence, HDS DNS™, HDS Sentinel™, and HDS Verify™ as managed products). Annex 1 also sets out typical categories of personal data and data subjects for those products.

HDS does not act as processor under this DPA for processing in which HDS determines purposes and means independently. Those controller activities are described in the privacy policy and include: customer accounts and portal authentication (including OAuth sign-in via GitHub or Google); billing, invoicing, accounting, and payment reconciliation (including Mollie B.V. as independent payment service provider and Lexware Office for HDS administration); HDS marketing websites, contact forms, and related website logs; abuse reports and security vulnerability reports; HDS Broadcast™ (HDS’s own newsletter to subscribers); electronic signing of contracts between HDS and the Customer via self-hosted DocuSeal; and short-lived platform security and operations data (for example infrastructure logs, rate-limit signals, and genuinely anonymised or aggregated capacity statistics).

5. Categories of data and data subjects

The categories of personal data and the groups of data subjects depend on what the Customer stores, transmits, or configures in the in-scope Services. Typical categories and subjects for the managed products are set out in Annex 1. The Customer may specify additional categories or data subjects in the order or another documented instruction in text form.

HDS does not determine those categories independently. Data subjects are typically the Customer’s end users, communication partners, website or application users, mailbox users, persons named in hosted content or zone records, and other individuals whose data the Customer places in Customer Content.

The Customer determines whether Customer Content includes special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). HDS processes such data only on documented instructions and only where the Customer has a lawful basis. The Customer does not instruct HDS to process such data unless that basis exists.

6. Customer’s duties as controller

The Customer is controller for Customer Content (or a processor authorised to instruct HDS). The Customer is responsible for the lawfulness of the processing and for the documented instructions given to HDS.

The Customer ensures that a legal basis under Art. 6 GDPR exists for the processing of Customer Content (and, where applicable, Art. 9 or Art. 10 GDPR). Art. 28 GDPR governs the processor relationship; it is not a legal basis under Art. 6.

The Customer fulfils its information duties toward data subjects under Art. 13 and Art. 14 GDPR. This DPA and the privacy policy do not replace those duties.

The Customer is responsible for the accuracy of Customer Content, for configuring the Services (including access rights of the Customer’s own users), and for ensuring that use of the Services complies with the Acceptable use policy and applicable law. The Customer designates authorised contacts who may give instructions.

7. Documented instructions

HDS processes Customer Content only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless Union or Member State law to which HDS is subject requires processing. In that case, HDS informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).

Documented instructions are those given through the customer portal, the ordered Service configuration, this DPA (including Annexes 1 to 3), and written instructions from authorised Customer contacts (including email). Configuration of a Service by the Customer constitutes an instruction to process as necessary to provide that Service.

HDS immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. HDS is entitled to suspend execution of that instruction until the Customer confirms or amends it in writing. The Customer remains responsible for the lawfulness of its instructions.

HDS does not process Customer Content except as instructed, except as required by law as set out above. Staff access to Customer Content is restricted to what is necessary to provide the Services, to follow instructions, or to comply with law, and is logged as set out in Annex 2.

8. Confidentiality

HDS ensures that persons authorised to process Customer Content have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

HDS imposes corresponding confidentiality duties on its personnel and on subprocessors engaged under §10. The confidentiality obligation continues after the end of the processor relationship.

9. Security of processing

HDS implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk to the rights and freedoms of natural persons (Art. 28(3)(c) and Art. 32 GDPR).

The measures in force are described in Annex 2. They include access control, encryption in transit (TLS), logging of privileged access to Customer Content, environment separation, backup and restore per product, and incident handling. There is no separate public technical-and-organisational-measures page; Annex 2 to this DPA is the processor security schedule.

HDS may adapt the measures to technical and organisational developments, provided that the level of protection is not reduced. Material changes are documented. The Customer takes security measures under its control (for example strong authentication of Customer users, lawful content, and endpoint security).

10. Subprocessors

The Customer grants HDS a general written authorisation (Art. 28(2) GDPR) to engage subprocessors insofar as they are listed on the public subprocessors and key recipients page (as updated in accordance with this §10 and identified in Annex 3) and insofar as they process Customer Content to deliver the in-scope Services.

Hetzner Online GmbH (Germany, EEA) is engaged as infrastructure subprocessor to host and operate the in-scope Services on servers that HDS configures and operates. For HDS DNS™, The Constant Company, LLC (Vultr) and iFog GmbH are engaged as subprocessors solely for authoritative DNS zone serving at anycast points of presence. Primary zone data remains on Hetzner. Zone synchronisation does not include client (querier) IP addresses; queried names are not transferred back to HDS. The purpose is zone serving, not query-log analytics.

The following are not subprocessors of Customer Content under this DPA: Mollie B.V. (licensed payment service provider acting as independent controller); Haufe Service Center GmbH / Lexware Office (Art. 28 processor of HDS for HDS’s own administration, invoicing, and accounting — not product-hosting infrastructure for Customer Content); GitHub, Inc. and Google LLC as OAuth identity providers for portal sign-in (HDS controller activity); and DocuSeal as third-party SaaS (electronic signing between HDS and the Customer uses self-hosted DocuSeal on Hetzner under HDS control and is not a SaaS subprocessor).

Let’s Encrypt / ISRG is a technical certificate-authority / ACME recipient for TLS on HDS systems and on customer hosting and mail domains that HDS operates. It receives domain names and ACME technical validation data only. HDS does not transmit mailbox content or hosted application content to Let’s Encrypt. Let’s Encrypt is not a subprocessor of mailbox or hosted application content; for customer domains, ACME runs under the Customer’s documented instructions / contracted hosting-mail setup (HDS as processor).

HDS imposes on each subprocessor, by way of a contract or other legal act under Union or Member State law, the same data-protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures (Art. 28(4) GDPR). HDS remains fully liable to the Customer for the performance of a subprocessor’s obligations, without prejudice to §17 and to mandatory law.

HDS notifies the Customer of intended additions or replacements of subprocessors at least 14 days before the change takes effect, unless a shorter period is required for urgent security, legal, or operational need. Those notices are sent from legal@horvath-digital.solutions. The Customer may object by reply to that address within the notice period. If the Customer objects, the parties discuss the objection in good faith. If they do not reach a solution and HDS proceeds with the change, the Customer may terminate the affected Services. The current list, including locations and transfer tools, is on the subprocessors and key recipients page.

11. International transfers

Privacy-critical hosting and mail workloads, as well as HDS Verify™ and HDS Sentinel™, are designed to remain in Germany / the EU/EEA on Hetzner servers that HDS operates. Customer Content in those Services is not transferred to a third country by HDS except on documented instructions or as required by law under §7.

Where HDS DNS™ anycast zone serving involves processing of zone file content in countries without an adequacy decision (including the United States, Singapore, and Australia), HDS transfers that content to Vultr and/or iFog as subprocessors under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — Module Three (HDS as processor to Vultr or iFog as subprocessor). Module Two applies where an EEA controller transfers to Vultr or iFog acting as processor. EEA→United Kingdom and EEA→Switzerland rely on EU adequacy decisions where relevant. For UK restricted transfers: UK adequacy where applicable; otherwise the UK IDTA or EU SCCs together with the UK Addendum, as applicable. Swiss adaptations apply where Swiss law so requires. This DPA does not rely on the EU–US Data Privacy Framework for Vultr or iFog.

ACME/TLS validation via Let’s Encrypt / ISRG is limited to domain names and technical validation data for HDS systems and for customer hosting and mail domains that HDS operates; HDS does not transmit mailbox content or hosted application content. For customer domains, the Customer instructs HDS to disclose that data under the contracted hosting/mail setup (HDS as processor). This DPA does not assert SCCs or EU–US Data Privacy Framework certification for Let’s Encrypt. See also https://letsencrypt.org/privacy/.

The Customer instructs HDS to make the transfers described in this §11 and on the subprocessors and key recipients page insofar as they are necessary to provide the ordered Services (in particular HDS DNS™ anycast serving). Further information on safeguards may be requested as described in the privacy policy.

Where a restricted transfer of Customer Content requires appropriate safeguards under Art. 46 GDPR, the applicable modules of the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where a UK restricted transfer so requires, the UK Addendum (or UK IDTA) form part of the signed DPA pack and are concluded when this DPA is executed. This public page does not reproduce the Commission SCC text. Which modules apply to which recipients is described on the subprocessors and key recipients page.

12. Assistance with data-subject rights

Taking into account the nature of the processing, HDS assists the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR (Art. 28(3)(e) GDPR).

If a data subject contacts HDS directly in relation to Customer Content, HDS does not respond on the merits without the Customer’s instruction, unless Union or Member State law requires HDS to do so. HDS forwards the request to the Customer without undue delay, where the Customer can be identified as controller.

HDS provides the Customer with the information and access reasonably available in the Services (including portal self-service where offered) so that the Customer can itself fulfil access, rectification, erasure, restriction, portability, and objection requests. Additional assistance that goes beyond the ordinary operation of the Services may be charged on a reasonable time-and-materials basis, unless the assistance is required because HDS has breached this DPA.

13. Further assistance (Art. 32 to 36 GDPR)

HDS assists the Customer in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to HDS (Art. 28(3)(f) GDPR). That assistance covers security of processing, notification of personal data breaches to the supervisory authority and communication to data subjects, data protection impact assessments, and prior consultation with the supervisory authority, in each case insofar as the obligation arises from processing of Customer Content under this DPA.

The Customer remains responsible for deciding whether a data-protection impact assessment or prior consultation is required. HDS provides relevant information about the Services and the measures in Annex 2 on written request.

14. Personal data breaches

The Customer (as controller) notifies HDS of personal-data incidents that are relevant to the processing under this DPA without undue delay and no later than 36 hours after becoming aware of them, so that HDS can support the Customer’s obligations under Art. 33 GDPR. This does not shorten any stricter deadline under mandatory law that applies to the Customer.

HDS notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content for which HDS acts as processor. Stricter deadlines under mandatory law remain unaffected. The notification describes, insofar as then reasonably available: the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned; the likely consequences; and the measures taken or proposed to address the breach and mitigate its possible adverse effects, together with a point of contact at HDS.

HDS documents breaches of Customer Content and provides further information reasonably required for the Customer to meet Art. 33 and Art. 34 GDPR. HDS does not notify supervisory authorities or data subjects on the Customer’s behalf unless instructed in writing or required by law to notify in its own name.

Incident handling measures are set out in Annex 2. Reports of abuse or vulnerabilities that do not constitute a personal data breach of Customer Content are handled under HDS’s abuse and security processes as controller, as described in the privacy policy.

15. Return and deletion

After the end of the provision of Services relating to processing, the Customer chooses, by instruction in text form (Textform), whether HDS is to return Customer Content or erase it. HDS then returns or erases Customer Content accordingly and erases existing copies, unless Union or Member State law requires storage (Art. 28(3)(g) GDPR).

The Customer retrieves Customer Content during the contract term using the ordinary functions of the Services (for example mailbox access, hosting access, zone export, or portal configuration). Return after the end of the Service is made in a commonly used electronic format reasonably available to HDS, or by continued retrieval access for a short handover window where that is more practical.

If the Customer gives no instruction in text form within 30 days after the end of the provision of Services relating to processing, HDS erases (or anonymises) Customer Content in its systems, except copies that HDS is required to keep under statutory retention. Backup copies are deleted in accordance with the backup cycles in Annex 2. On request, HDS confirms erasure.

Until deletion or return is complete, HDS continues to treat Customer Content as confidential and to process it only as necessary for deletion, return, dispute resolution, or compliance with law.

16. Information and audits

HDS makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer (Art. 28(3)(h) GDPR).

Audits are conducted in stages. The Customer first requires written information in text form (Textform) to demonstrate compliance with Art. 28 GDPR. HDS provides that information. HDS may fulfil information requests with current documentation; evidence from infrastructure providers (in particular Hetzner) may be used to demonstrate compliance insofar as it concerns the processing of Customer Content. A security questionnaire issued by HDS, or a substantially equivalent questionnaire, may form part of this written information; HDS answers the questionnaire to demonstrate compliance. The questionnaire is not a form that the Customer must complete as a controller.

An inspection at HDS’s premises (or at a relevant processing location under HDS’s control) takes place only for good cause — in particular where written information is insufficient to demonstrate compliance, where a personal data breach affecting Customer Content so requires, or where a supervisory authority so requires — or, in the absence of such cause, at most once in any twelve-month period. Inspections are conducted during regular business hours, with reasonable prior notice, without disrupting operations, and subject to confidentiality. An equivalent remote inspection replaces an on-site inspection where it serves the same purpose.

The Customer bears the reasonable costs of an inspection, including HDS’s internal effort and any fees of infrastructure providers for evidence or escort, unless a material breach of this DPA by HDS is established. The Customer and any mandated auditor commit to confidentiality. Competitors of HDS are not appointed as auditors without HDS’s prior written consent.

17. Liability

Liability arising from this DPA and from processing under it is governed by the Terms and Conditions and by mandatory provisions of the GDPR, including Art. 82 GDPR.

Nothing in this DPA limits or excludes liability where applicable law does not permit limitation or exclusion — including mandatory liability under the GDPR and liability that cannot be limited under German law (in particular for intent and, where required, gross negligence, and for injury to life, body, or health). This DPA does not stipulate a separate contractual liability cap.

18. Final provisions

This DPA is provided in German and English. In case of conflict or ambiguity, the German text is authoritative. The English text is a convenience translation.

Amendments and side agreements require a written or electronic form that satisfies applicable law, including signature via HDS’s self-hosted DocuSeal or acceptance in the customer portal. On Art. 28 GDPR topics, this DPA — once executed — prevails over a conflicting ranking in the Terms and Conditions and over the privacy policy, unless a later written instrument expressly amends this DPA. Commercial terms, including fees, term of the Services, and service levels, remain in the Terms and Conditions and the Service Level Agreement. The executed DPA prevails on Art. 28 GDPR; the Service Level Agreement prevails on Availability and service credits.

If a provision of this DPA is or becomes invalid, the remaining provisions continue in effect. The invalid provision is replaced by a valid provision that comes as close as possible to the economic and data-protection purpose of the invalid provision. Notices under §10 are sent from legal@horvath-digital.solutions. The Customer objects by reply to that address. Other notices under this DPA may be sent to the contacts designated in the customer portal or the Terms and Conditions.

This DPA is governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and excluding conflict-of-laws rules that would lead to the law of another state. Mandatory Union data-protection law, including the GDPR, remains unaffected. Where legally allowed, Berlin is the exclusive venue. Mandatory consumer venues and exclusive statutory venues remain unaffected. Remaining commercial terms are in the Terms and Conditions.

Annex 1 — Processing in scope

This Annex 1 forms part of this DPA. It specifies the managed products in which HDS processes Customer Content as processor, typical categories of personal data, and typical data subjects. Nature, purpose, and duration of the processing are as in §3. No separate Hetzner fill-in form is required for these managed products.

The Customer may specify additional categories of personal data or data subjects in the order or another documented instruction in text form.

Typical data subjects are the Customer’s end users, communication partners, website or application users, mailbox users, persons named in hosted content or zone records, and other individuals whose data the Customer places in Customer Content.

• Managed Hosting — in scope: website, application, and database content hosted for the Customer. Typical categories: website and application content, databases, and end-user data in customer systems.
• Email & Presence — in scope: mailbox content processed to provide professional email. Typical categories: mailbox content and mailbox user data (messages, attachments, folders, and related mailbox objects).
• HDS DNS™ — in scope: customer DNS zone records (authoritative zone file content). Typical categories: resource records and related zone data.
• HDS Sentinel™ — in scope: customer monitors, check results, and alert recipient lists configured by the Customer. Typical categories: monitor targets, check results, and alert recipient emails.
• HDS Verify™ — in scope: processing when the Customer embeds Verify for the Customer’s own bot protection (SiteKey configuration and related challenge, proof-of-work, and token lifecycle as operated for that embed). Typical categories: SiteKey configuration and short-lived challenge, proof-of-work, and token data; HDS does not receive passwords or other login credentials through Verify.

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

HDS implements the following technical and organisational measures for processor processing of Customer Content. Measures are appropriate to the risk and may be refined as set out in §9 without reducing the level of protection. Physical data-centre controls for Hetzner locations are those of Hetzner Online GmbH; HDS configures and operates the hosted systems.

• Physical access control: Customer Content is hosted in professional data centres (Hetzner, Germany). Access to halls and cages is restricted by the infrastructure provider (badges, locks, perimeter, and visitor procedures). HDS has no walk-in public access to production servers.
• System access control: Administrative access to production systems is limited to authorised HDS personnel, uses unique accounts, and is protected by strong authentication. Unused accounts are revoked. Customer-facing access uses the portal and Service credentials under the Customer’s control.
• Data access control: Privileged access to Customer Content is granted on a need-to-know basis for operations, documented instructions, or legal duty. Role-based permissions apply. Customers control access of their own users within the Services.
• Privileged-access logging: Privileged access to Customer Content is logged. Logs are protected against unauthorised alteration and retained as described in the privacy policy for security analysis and incident investigation.
• Transmission control: Customer Content in transit over public networks is protected with TLS for the ordinary Service interfaces (web, mail submission/retrieval as offered, APIs, and portal). Zone transfers to DNS anycast partners are limited to authoritative zone file content and do not include querier IP addresses.
• Input control: Changes to Customer Content are attributable to authenticated Customer users or to authorised HDS operations. HDS does not silently alter mailbox, hosting, Verify, Sentinel, or zone content except as instructed or as required to operate, secure, or restore the Service.
• Instruction / job control: Processing of Customer Content follows this DPA and documented instructions. Subprocessors are bound as in §10. HDS does not use Customer Content for independent advertising or cross-customer profiling.
• Environment separation: Customer environments are separated by technical means appropriate to the product (including logical isolation on shared infrastructure). Test and production are separated. HDS Verify™ does not reuse verification outcomes or fingerprints across customers for advertising or profiling.
• Encryption and confidentiality: TLS in transit as above. Disk and backup encryption of infrastructure providers is used where provided for the relevant platform. Secrets and credentials are stored with access restriction. Verify embed.js does not set cookies and does not use browser local storage.
• Availability, resilience, and restore: Systems are monitored. HDS Sentinel™ check history is retained for a maximum of 365 days per configuration. Email & Presence mail backups are retained for a maximum of 7 days, then deleted. Managed Hosting database backups are plan-dependent; where included, they are retained for up to 14 days, then deleted. DNS zone data is retained for the contract duration. Restore is performed on request or after a disruption within those backup windows where backups are included.
• HDS Verify™ lifecycle: Challenge data is retained for about 5 minutes; proof-of-work about 2 minutes; one-time tokens about 10 minutes (deleted on use); IP rate-limit counters about 1 minute; SiteKey configuration while configured by the Customer.
• Incident handling: HDS maintains operational procedures to detect, contain, and remediate security incidents affecting Customer Content, to notify the Customer under §14, and to restore availability within the backup and operations model of the relevant product.
• Evaluation: HDS reviews measures at appropriate intervals (Art. 32(1)(d) GDPR), including after relevant incidents or material changes to the Services. Infrastructure-provider evidence is used where relevant under §16.
• Personnel: Personnel who may access Customer Content are bound to confidentiality (§8) and act only on authorisation. Access is withdrawn when no longer required.

Annex 3 — Subprocessors

The Customer’s general written authorisation under §10 covers subprocessors listed on the public subprocessors and key recipients page, as updated in accordance with §10. This Annex 3 does not reproduce that list. Locations, roles, and transfer tools (including which EU SCC modules apply) are described on that page.

Where a restricted transfer requires Art. 46 GDPR tools, the applicable EU SCC modules and, if needed, the UK Addendum form part of the signed DPA pack and are concluded at execution of this DPA, as set out in §11. The Commission SCC text is not published on this page.