Data processing agreement (DPA)

This data processing agreement (DPA) is entered into between Craftbase GmbH, as the provider identified in the Legal Notice, and the customer identified in the main agreement. It supplements the main agreement for the use of Craftbase.

The DPA is concluded electronically in the account or together with an individual offer. Craftbase records the accepted DPA revision, time, company, and acting person; the accepted revision remains available to the parties.

The DPA applies where Craftbase processes personal data on the customer's behalf. It covers paid plans, trials, and free accounts from the time Craftbase first processes personal customer data on the customer's behalf.

The customer generally acts as controller. Where the customer processes personal data on behalf of a third party, Craftbase acts as a further processor within the scope of this DPA; the customer ensures that it may validly engage Craftbase and issue the required instructions.

Craftbase does not act as processor for activities where it determines its own purposes and means, including its own contract administration, billing, and processing required by law for security or evidence. Those activities are described in the Privacy Policy.

Annexes 1 to 3 form part of this DPA. For processing on the customer's behalf, this DPA prevails over the Terms and general service description; individually negotiated data-protection arrangements take precedence.

The processing concerns the provision, operation, protection, maintenance, support, and contractual development of the cloud-based Craftbase application, including features subscribed to or activated by the customer.

Processing begins when Craftbase first processes personal customer data and continues for the term of the main agreement, including the agreed return, export, and deletion process.

After the main agreement ends, Craftbase processes remaining customer data only as required for the agreed export, deletion, security of backups, a documented instruction, or a legal obligation directly binding on Craftbase.

Duties intended by their purpose to continue after termination, including confidentiality, protection of existing backups, return, deletion, and evidence duties, remain in effect to the required extent.

Processing may include collecting, recording, organising, storing, adapting, retrieving, transmitting, making available, matching, linking, restricting, backing up, restoring, exporting, and deleting personal data.

Its nature and purpose follow from the main agreement, service description, subscribed features, administrative settings, and the customer's intended use. Annex 1 provides the details.

Production AI features process customer data only through active use or configuration by an authorised user. Beta and preview features require voluntary activation.

Craftbase does not use customer data for its own advertising, data trading, or to train its own generally available models or third-party models. An AI provider may process customer data only if it has been validly engaged under this DPA and is named in the current subprocessor list.

Craftbase processes personal data only on a documented instruction from the customer unless Union or Member State law directly requires Craftbase to process it.

Documented instructions arise from the main agreement, this DPA, the service description, intended operation of the application, administrative settings, and communications through the account, support system, or in text form.

The customer identifies persons authorised to give instructions or establishes their authority through account and role administration. Craftbase may reasonably verify that authority where there is doubt.

Where Craftbase is legally required to process data without an instruction, it informs the customer of that requirement before processing unless the applicable law prohibits that information on important grounds of public interest.

If Craftbase considers an instruction to infringe data-protection law, it informs the customer without undue delay. Craftbase may suspend the affected operation until the issue is resolved unless an immediately necessary legal or security measure requires otherwise.

The customer remains responsible for the lawfulness of processing, protection of data subject rights, and legality of its instructions. Within the agreed service, it determines the purposes and means of processing.

In particular, the customer meets transparency duties, establishes the required legal bases, and assesses the conditions for special categories of personal data under Article 9 GDPR and data under Article 10 GDPR.

The customer administers users, roles, and permissions according to need, protects credentials, and informs Craftbase without undue delay of suspected misuse or compromised accounts.

The customer provides the information and cooperation Craftbase requires for contractual processing, handling requests, containing incidents, and meeting statutory duties.

Under this DPA, the customer may issue instructions, request evidence, initiate handling of data subject requests, and exercise the agreed audit rights. Statutory rights remain unaffected.

Craftbase processes customer data in accordance with this DPA, documented instructions, and applicable data-protection law and ensures that persons entrusted with processing act only within the permitted scope.

Craftbase maintains the records of processing activities required of processors and provides the competent supervisory authority with information required by law.

Craftbase assists the customer as set out in clauses 11 to 13 and informs it of circumstances within Craftbase's responsibility that materially affect the customer's data-protection duties.

Copies of customer data are created only where required for operations, security, recovery, support, or performance of a documented instruction.

Data-protection communications to Craftbase may be sent to support@craftbase.de. A data protection officer is identified in the contract information only where the appointment and responsibility have been confirmed.

Before access, Craftbase binds all persons who may access customer data to confidentiality or ensures they are subject to an appropriate statutory duty of confidentiality. The obligation continues after their work ends.

Access is limited to authorised persons, required tasks, and the minimum necessary scope. Permissions are personal and role-based and are withdrawn when the need ends.

Support and administrative access to customer content occurs only when required for support, maintenance, or security, is limited in purpose and duration, and is logged where technically provided.

Where Craftbase must disclose customer data under an enforceable authority or court order, it informs the customer in advance where legally permitted and limits disclosure to what the law requires.

Taking account of the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and the risks, Craftbase maintains appropriate technical and organisational measures under Article 32 GDPR.

Annex 2 describes the control areas and measures applying to this agreement. To protect the systems, security-sensitive operational detail and evidence may be provided confidentially only to authorised customers, auditors, and authorities.

Craftbase may adapt measures to technical developments and changing risks provided the agreed level of protection is not reduced overall. A material reduction requires a separate lawful basis.

Craftbase maintains procedures for risk-based assessment of the effectiveness of the measures and appropriate handling of identified material weaknesses. Specific assessment intervals apply only where expressly documented.

The customer's security contributions, including secure devices, suitable role assignment, and protection of credentials, complement Craftbase's measures but do not transfer Craftbase's statutory duties to the customer.

The customer grants Craftbase general written authorisation to engage the subprocessors listed in Annex 3 for the services described there.

Craftbase publishes the current subprocessor list as part of this DPA and retains previous operative list revisions in a traceable form.

Craftbase generally informs the customer's administrative contact by email at least 30 calendar days before engaging a new or replacement subprocessor and updates the public list.

The customer may object within the notice period on specific, substantiated data-protection grounds. An objection to changes in general without a connection to the protection of personal data is insufficient.

The parties first consider a reasonable alternative or configuration. If no appropriate solution is available, either party may terminate the service affected by the change on reasonable notice; further rights under the main agreement and mandatory law remain unaffected.

Where a security need or emergency requires a faster replacement, Craftbase may shorten the period to what is necessary and informs the customer with reasons as early as possible.

Craftbase imposes at least equivalent data-protection obligations on each subprocessor and remains responsible to the customer for the subprocessor's contractual performance under Article 28(4) GDPR.

Personal data is transferred to a third country or international organisation only on the customer's documented instruction or because of a legal obligation directly binding on Craftbase and in compliance with Chapter V GDPR.

A legally relevant remote access from a third country also constitutes a transfer. The current Annex 3 describes known processing locations and safeguards used for each service.

Where required, Craftbase relies in particular on an adequacy decision or appropriate safeguards such as the applicable EU Standard Contractual Clauses and takes account of required transfer assessments and supplementary measures.

Selection of a German region for regionally configurable core data is not a general promise that all data, metadata, support operations, or subprocessing take place exclusively in Germany.

Taking account of the nature of processing, Craftbase assists the customer through available search, access, export, rectification, restriction, and deletion functions and reasonable supplementary assistance with data subject requests.

The customer assesses identity, legal basis, scope, and exceptions for a data subject request and remains responsible for responding within the applicable period.

Where a request received directly by Craftbase clearly concerns customer data, Craftbase securely forwards it to the responsible customer contact without deciding its substance and without undue delay, unless Craftbase is legally required to act directly.

If the customer cannot retrieve the required data through the application, it provides Craftbase with a sufficiently specific documented instruction and the information needed to identify the data.

Craftbase notifies the customer of a personal data breach affecting customer data within Craftbase's responsibility without undue delay after becoming aware of it.

The initial notice includes, where available, a description of the incident, affected data and categories of persons, likely consequences, measures taken or proposed, and a contact. Missing information is supplied without undue delay.

Craftbase takes appropriate steps to contain, investigate, preserve evidence of, and prevent comparable incidents and assists the customer with available information for its risk assessment.

The customer generally decides on notifications to supervisory authorities and communications to data subjects. Craftbase communicates about customer data only on a documented instruction or under its own mandatory legal obligation.

Taking account of the nature of processing and information available, Craftbase assists the customer with its obligations under Articles 32 to 36 GDPR, including security, notifications, communications, data protection impact assessments, and prior consultations.

Ordinary assistance through product functions, documentation, and standard information is included in the SaaS fee. Exceptional customer-specific work may be charged after prior information and agreement; baseline assistance required by law remains unaffected.

Craftbase provides the customer with the information required to demonstrate compliance with Article 28 GDPR and contributes to audits required by law.

Evidence is provided first through this DPA, the TOM documentation, the subprocessor list, standardised information, and available suitable audit reports.

If that evidence does not resolve substantiated questions, the customer may conduct a supplementary audit itself or through an independent qualified auditor. Audits are announced reasonably, limited to what is necessary, and generally conducted during customary business hours.

Without a specific cause, one customer audit per calendar year is generally permitted. Additional audits remain possible after a material incident, on substantiated suspicion, following a material change, or under an authority's order.

Auditors must be bound by confidentiality. Other customers' data, trade secrets, source code, and security-sensitive information are disclosed only where legally required and no equivalent evidence is sufficient.

Each party generally bears its own audit costs. Craftbase agrees exceptional additional work with the customer in advance; necessary evidence costs are not shifted to the customer where a material Craftbase breach is established.

During the agreement, the customer may use the export and deletion functions then supported in production. Customer-specific formats or additional data preparation are owed only where separately agreed.

After a paid main agreement ends, the customer receives restricted read and export access for 30 calendar days. During that period, the customer secures the data and documents it requires.

Return generally takes place through the supported exports. Different documented instructions are implemented where lawful, technically feasible, and included in the agreed service.

After the export period, Craftbase deletes or anonymises customer data from production systems under the documented deletion process. This generally includes invoices issued by the customer and other documents unless separate retention has been commissioned or a duty directly binding on Craftbase requires otherwise.

The customer's statutory retention duties alone do not provide Craftbase with its own authority to retain data after termination. Continued retention on the customer's behalf requires a documented instruction and corresponding contractual basis.

Data remaining in backups is processed only for recovery and security and is overwritten under the technically defined backup cycles. If a backup is restored, the deletion and restriction rules apply again.

On request, Craftbase provides reasonable documented confirmation that the regular deletion process has been completed. Any legally permitted or required residual processing is limited to its relevant purpose.

Liability between the parties is governed by Article 82 GDPR, other mandatory law, and the legally approved liability provisions of the main agreement. Data subject rights and supervisory authority powers are not restricted by this DPA.

For a material remediable breach of this DPA, the other party may first require cure within a reasonable period. If the breach continues or waiting is unreasonable, the affected service may be terminated for cause.

Termination of the main agreement also terminates this DPA except where confidentiality, return, deletion, protection of backups, and evidence duties continue by their purpose.

Material amendments to this DPA are actively agreed by the parties. Editorial clarifications and exclusively protection-enhancing changes may be notified in documented form without retrospectively changing existing rights.

The TOMs may be changed without renewed consent if the agreed level of protection is maintained overall. Changes to the subprocessor list follow only the procedure in clause 9.

The governing law and, where validly agreed, jurisdiction specified in the main agreement apply. Mandatory data-protection jurisdiction remains unaffected.

If a provision of this DPA is invalid or unenforceable, the remaining provisions continue in effect. Applicable law applies in place of the affected provision.

Only the German version of this DPA is legally binding. This English version and any other translation are provided for information only; if the texts differ, the German version prevails.

This Annex specifies the subject matter, duration, nature, and purpose of processing and the types of personal data and categories of data subjects. Only features actually used by the customer apply.

The customer may process special categories of personal data only within the intended scope and where the statutory requirements are met. This gives Craftbase no authority to use that data for its own purposes.

If the subscribed feature set changes, this Annex applies to processing operations added through the intended use of those features unless a material amendment to the DPA is required.

The following control areas describe the contractually required level of protection. Craftbase implements the measures according to risk and the technical architecture used at the relevant time.

Individual measures may be replaced with equivalent or more effective measures. The overall level of protection must not be reduced.

Further technical evidence, configurations, and audit material are provided confidentially to authorised recipients where required as evidence and compatible with protecting the systems.

This Annex lists subprocessors confirmed for processing on the customer's behalf. A service may process customer data only after its role, service, and required transfer information have been assessed and documented.

Changes are announced under clause 9 and published as a new dated list revision. Previous operative list revisions are retained as evidence.

Region information applies only to services that can be configured regionally. Different support, metadata, or further subprocessing is governed by the service-specific contract and transfer information.