Order processing agreement pursuant to Art. 28 (3) of the General Data Protection Regulation (hereinafter "DSGVO")

NatureWebServices GmbH acts as a processor in accordance with Art. 28 GDPR (hereinafter "Contractor") when providing the services for customers who use the services as entrepreneurs. An entrepreneur within the meaning of these Terms of Use is a natural or legal person or a partnership with legal capacity that is acting in the exercise of its commercial or independent professional activity when concluding the Terms of Use. In this case, the person responsible for data processing is the customer who uses the services as an entrepreneur (hereinafter referred to as the "Client"). The data processing agreement pursuant to Art. 28 para. 3 GDPR is concluded between the Contractor and the Client upon acceptance of the Terms of Use by the Client.

• The subject of the order processing agreement is the processing of access data to the web and APP service (email address), of data entered in the application on a voluntary basis (title, first name, surname) and images and/or videos in accordance with the terms of use (hereinafter "processing activity").
• This Processing Agreement shall commence upon acceptance of the Terms of Use and shall terminate as set forth in paragraph 10 Contract period and termination cited.
• The processing activity shall be performed exclusively in a member state of the European Union or in a state party to the Agreement on the European Economic Area. Any relocation of the service or parts thereof to a third country shall require the prior consent of the Client.
• The Contractor undertakes to process data and processing results exclusively within the scope of these Terms of Use. If the Contractor receives an official order to release data of the Client, the Contractor shall - insofar as legally permissible - immediately inform the Client thereof and refer the authority to the Client. Similarly, any processing of the data for the Contractor's own purposes shall require the Client's written consent.
• The Client shall be solely responsible for assessing the permissibility of the processing pursuant to Art. 6 (1) DSGVO and for safeguarding the rights of the data subjects pursuant to Art. 12 to 22 DSGVO. The contractor shall forward requests to the client if they are recognisably directed exclusively to the client.
• Duties of the Contractor
  • The Contractor confirms that it is aware of the data protection regulations of the GDPR relevant to the commissioned processing.
  • The Contractor declares in a legally binding manner that it has obliged all persons entrusted with the data processing to maintain confidentiality prior to commencement of the activity or that they are subject to an appropriate statutory confidentiality obligation. In particular, the confidentiality obligation of the persons entrusted with the data processing shall remain in force even after termination of their activity and leaving the contractor.
  • The Contractor declares in a legally binding manner that it has taken all necessary measures to ensure the security of the processing in accordance with Art 32 GDPR.
  • The Contractor shall ensure a level of protection for the Service appropriate to the risk to the rights and freedoms of the natural persons concerned by the processing. To this end, the protection objectives of Article 32 (1) of the GDPR, such as confidentiality, integrity and availability of the systems and services as well as their resilience in relation to the type, scope, circumstances and purpose of the processing operations shall be taken into account in such a way that the risk is permanently contained by means of appropriate technical and organisational remedies.
  • The Contractor shall carry out a review, assessment and evaluation of the effectiveness of the technical and organisational measures to ensure the security of the processing when there is cause to do so, but at least annually.
  • The contractor shall take the technical and organisational measures to ensure that the client can fulfil the rights of the data subject under Chapter III of the GDPR (information, access, correction and deletion, data portability, objection, as well as automated decision-making in individual cases) at any time within the statutory time limits and shall provide the client with all the necessary information for this via web and APP services. If a corresponding request is addressed to the contractor and the contractor indicates that the applicant mistakenly believes him to be the principal of the data processing operated by him, the contractor shall immediately forward the request to the principal and inform the applicant thereof.
  • The Contractor shall support the Client in complying with the obligations set out in Art 32 to 36 GDPR (data security measures, notifications of personal data breaches to the supervisory authority, notification of the person affected by a personal data breach, data protection impact assessment, prior consultation).
  • The Contractor shall cooperate to the necessary extent in the fulfilment of the rights of the data subjects pursuant to Articles 12 to 22 of the GDPR by the Client, in the creation of directories of processing activities as well as in necessary data protection impact assessments of the Client and shall support the Client in an appropriate manner as far as possible.
  • The Contractor shall notify the Client of any disruptions, infringements by the Contractor or the persons employed by the Contractor and against provisions of data protection law or the stipulations made in the order as well as of any suspected data protection infringements or irregularities in the processing of personal data. This shall also apply with regard to any reporting and notification obligations of the Client pursuant to Art. 33 and Art. 34 of the GDPR. If necessary, the Contractor shall support the Client in its obligations pursuant to Art. 33 and 34 of the GDPR in an appropriate manner.
  • The Contractor shall set up a processing directory for the present commissioned processing in accordance with Art. 30 of the GDPR.
  • With regard to the processing of the data provided by the Client, the Client shall be granted the right to inspect and control the data processing facilities at any time, including through third parties commissioned by the Client. The contractor undertakes to provide the client with the information necessary to monitor compliance with the obligations set out in this agreement.
  • The Contractor shall offer the Client the possibility via the web and APP services,
    • download individual or all images and/or videos at any time and/or
    • delete individual or all images and/or videos from the contractors' server.

In accordance with Art. 28 para. 3 lit. g DSGVO, with the deletion of the access data (email address), additional data entered voluntarily in the application (title, first name, surname) and images and/or videos by the client via the web and APP services, all deleted personal data are also deleted from the contractor and its subcontractors. On the backup files, the data is deleted after completion of the next backup cycle.

• Sub-processor
  • The Client shall grant the Contractor general authorisation to use further sub-processors within the meaning of Article 28 of the GDPR for the performance of the contract. In doing so, it must be ensured that the sub-processor assumes the same obligations as the contractor on the basis of this agreement. If the sub-processor fails to comply with its data protection obligations, the contractor shall be liable to the client for compliance with the obligations of the sub-processor.
  • The Contractor shall inform the Client of the name and address as well as the intended activity of the sub-processor by email request (info@icuserver.com). The contractor shall ensure that it carefully selects the sub-processor, paying particular attention to the suitability of the technical and organisational measures taken by the sub-processor within the meaning of Article 32 of the GDPR.