Data processing agreement
Last updated: 7 October 2026
This data processing agreement ("DPA") under Article 28 of the General Data Protection Regulation (GDPR) forms part of the contract between the customer as controller and Mag. Werner Braun, Rudolfstrasse 231, 8047 Graz, Austria, as processor ("we"), for the use of dpp24.org. It applies automatically as soon as the customer stores personal data in its workspace. Customers who need a signed copy can request one at office@dpp24.org.
1. Subject, nature and purpose
1.1 We process personal data on behalf of the customer only to provide the services described in our terms and conditions: managing dynamic QR codes, forwarding requests to the destinations set by the customer, and hosting and publishing the passport documents uploaded by the customer.
1.2 Duration: for the term of the contract, including any archive period, and until the data is deleted under section 9.
2. Types of data and data subjects
2.1 Types of data: names, business contact details and other personal data contained in the customer's labels, product names, destination addresses and uploaded passport documents; account data of the customer's members (name, email, role, change history); technical request data of persons scanning the customer's codes (IP address, time, requested code, user agent).
2.2 Data subjects: the customer's employees and members; contact persons named in the customer's product documents; persons who scan the customer's codes or open its passport pages.
2.3 The customer will not upload special categories of personal data (Article 9 GDPR) unless expressly agreed.
3. Instructions
3.1 We process personal data only on documented instructions from the customer. The contract, these Terms and the customer's use of the workspace functions are the customer's complete instructions. Further instructions must be given in writing or by email.
3.2 We will inform the customer without undue delay if we believe that an instruction violates data protection law.
3.3 We process data for other purposes only where required by EU or member state law. In that case we will inform the customer beforehand unless the law prohibits this.
4. Confidentiality
Everyone who processes personal data on our behalf is bound to confidentiality or is subject to a statutory obligation of confidentiality (including § 6 DSG).
5. Security of processing
We maintain technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular:
- encryption of all connections (HTTPS with HSTS);
- passwords stored only as hashes; personal accounts with roles; sign-in sessions protected against cross-site requests;
- passport files stored outside the public web directory and delivered only through published passport pages;
- separation of customers' data by company in the application;
- a change history of forwards, sets and plans;
- hosting in a professionally operated data centre with physical access control;
- regular backups of the database and files provided by the hosting provider;
- updates of the application and its environment.
We may adapt these measures to technical progress, provided the level of protection is not reduced.
6. Sub-processors
6.1 The customer gives general authorisation for the use of sub-processors. Currently used:
- Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA: hosting, storage and email delivery.
6.2 We will inform the customer by email at least 30 days before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds. If no solution can be found, the customer may terminate the affected service with effect from the date of the change.
6.3 We impose data protection obligations on each sub-processor that are equivalent to those in this DPA.
7. Transfers to third countries
Personal data may be processed in the USA by our hosting provider. Such transfers are based on the EU-U.S. Data Privacy Framework (Article 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).
8. Assistance
8.1 We support the customer, as far as possible with the services, in responding to requests from data subjects. We forward requests we receive directly to the customer without undue delay.
8.2 We support the customer in meeting its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us.
8.3 We will notify the customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the customer's data, with the information required under Article 33(3) GDPR as far as available.
8.4 Assistance that goes beyond our statutory obligations or is caused by the customer may be charged at our usual hourly rate.
9. Deletion and return
After the end of the contract and any archive period, we delete the customer's personal data within 90 days, unless EU or member state law requires us to keep it. Before that, the customer can download its passport documents and export its forwards from the workspace.
10. Proof and audits
We make available the information necessary to demonstrate compliance with Article 28 GDPR, primarily by written answers and documentation. On-site audits are possible after at least 30 days' notice, during normal business hours, without disrupting operations, and at the customer's expense; auditors must be bound to confidentiality.
11. Liability and precedence
11.1 Liability is governed by Article 82 GDPR and, in the relationship between the parties, by the liability provisions of our terms and conditions.
11.2 In case of conflict, this DPA takes precedence over the terms and conditions with regard to the processing of personal data.