Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

Controller (Client):
 ,  , Email:  

Processor:
Y. Baris Ozgun, Krefelder Str. 4, 10555 Berlin, Deutschland, Email: contact@thebozgun.com

This DPA forms part of the main contract and takes precedence over it with respect to data protection matters. Subject matter:  .

This DPA takes effect on the date of last signature and ends upon termination of the main contract. Obligations that by nature survive termination (confidentiality, deletion) remain in force.

The Processor processes personal data solely for the purpose of providing the agreed services ( ). Processing activities include: collection, storage, transmission, processing and deletion. Processing for any other purpose is prohibited.

Data categories:  

Data subjects:  

Special categories under Art. 9 GDPR are not processed unless separately agreed in writing.

The Processor processes personal data solely on documented instructions from the Controller. Instructions shall be given in writing; verbal instructions must be confirmed in writing without undue delay.

If the Processor considers an instruction to be in breach of data protection law, it shall immediately inform the Controller and may suspend execution pending clarification.

Confidentiality (Art. 28(3)(b), Art. 29 GDPR): All persons authorised to process personal data are bound by confidentiality obligations and trained in applicable data protection requirements.

Security (Art. 32 GDPR): The Processor implements all technical and organisational measures required by Art. 32 GDPR, as detailed in Annex 1.

The Processor assists the Controller in complying with obligations under Art. 32–36 GDPR.

Sub-processors may only be engaged with the Controller's prior written approval. Approved sub-processors are listed in Annex 2. Intended changes are communicated at least 14 days in advance; the Controller may object, triggering a right of extraordinary termination for both parties.

Sub-processors are bound by the same data protection obligations as the Processor (Art. 28(4) GDPR).

The Processor assists the Controller in fulfilling data subject requests under Art. 15–22 GDPR. Requests addressed to the Processor are forwarded to the Controller without undue delay.

Personal data breaches are reported to the Controller immediately, and in any event within 24 hours of becoming aware, including the nature of the breach, affected categories, likely consequences, and measures taken.

Upon completion of services or on the Controller's instruction, all personal data is deleted or returned and existing copies deleted, unless retention is required by law. Deletion is confirmed in writing.

The Processor makes all necessary information available to demonstrate compliance and permits audits (including on-site inspections) by the Controller or its appointed auditor (14 days notice, once per year, costs borne by the Controller).

Each party is liable for data protection breaches within its own scope of responsibility under Art. 82 GDPR. The Processor's total aggregate liability per incident is capped at  . This cap does not apply in cases of wilful misconduct, gross negligence, or injury to life, body or health.

Written form: Amendments require written form. No oral collateral agreements exist.

Governing law: Law of the Federal Republic of Germany.

Jurisdiction: Exclusive place of jurisdiction: Berlin.

Severability: Invalid provisions are replaced by valid ones closest to their economic purpose.