Order processing agreement pursuant to Art. 28 para. 3 of the General Data Protection Regulation (hereinafter "GDPR")

NatureWebServices GmbH acts as a processor in accordance with Art. 28 GDPR (hereinafter "Contractor") when providing the services for customers who use the services as entrepreneurs. An entrepreneur within the meaning of these Terms of Use is a natural or legal person or a partnership with legal capacity that is acting in the exercise of its commercial or independent professional activity when concluding the Terms of Use. In this case, the person responsible for data processing is the customer who uses the services as an entrepreneur (hereinafter referred to as the "Client"). The data processing agreement pursuant to Art. 28 para. 3 GDPR is concluded between the Contractor and the Client upon acceptance of the Terms of Use by the Client.

• The subject of the order processing agreement is the processing of access data to the web and APP service (email address), of data entered in the application on a voluntary basis (title, first name, surname) and images and/or videos in accordance with the terms of use (hereinafter "processing activity").
• This Data Processing Agreement begins with the acceptance of the Terms of Use and ends as described in paragraph 10 Contract term and cancellation cited.
• The processing activity shall be carried out exclusively in a member state of the European Union or in a signatory state to the Agreement on the European Economic Area. Any relocation of the service or parts thereof to a third country requires the prior consent of the client.
• The Contractor undertakes to process data and processing results exclusively within the scope of these Terms of Use. If the Contractor receives an official order to disclose the Client's data, the Contractor shall - if legally permissible - inform the Client immediately and refer the authority to the Client. Similarly, any processing of the data for the Contractor's own purposes shall require the written consent of the Client.
• The client is solely responsible for assessing the permissibility of the processing in accordance with Art. 6 para. 1 GDPR and for safeguarding the rights of the data subjects in accordance with Art. 12 to 22 GDPR. The Contractor shall forward enquiries to the Client if they are recognisably addressed exclusively to the Client.
• Obligations of the contractor
  • The Contractor confirms that it is aware of the relevant data protection regulations of the GDPR for order processing.
  • The Contractor declares in a legally binding manner that it has obligated all persons commissioned with data processing to maintain confidentiality before commencing their activities or that they are subject to an appropriate statutory confidentiality obligation. In particular, the confidentiality obligation of the persons commissioned with data processing shall remain in force even after termination of their activity and departure from the Contractor.
  • The Contractor declares in a legally binding manner that it has taken all necessary measures to ensure the security of processing in accordance with Art 32 GDPR.
  • The Contractor shall ensure a level of protection for the Service appropriate to the risk to the rights and freedoms of natural persons affected by the processing. To this end, the protection objectives of Art. 32 para. 1 GDPR, such as confidentiality, integrity and availability of the systems and services as well as their resilience in relation to the type, scope, circumstances and purpose of the processing, are taken into account in such a way that the risk is permanently mitigated by appropriate technical and organisational measures.
  • The Contractor shall carry out a review, assessment and evaluation of the effectiveness of the technical and organisational measures to ensure the security of the processing as required, but at least once a year.
  • The Contractor shall take the technical and organisational measures to ensure that the Client can fulfil the rights of the data subject in accordance with Chapter III of the GDPR (information, access, rectification and erasure, data portability, objection and automated decision-making in individual cases) at any time within the statutory time limits and shall provide the Client with all necessary information via web and APP services. If a corresponding request is sent to the contractor and the contractor realises that the applicant mistakenly believes it to be the client of the data processing it is carrying out, the contractor must forward the request to the client immediately and inform the applicant of this.
  • The Contractor shall support the Client in complying with the obligations set out in Art. 32 to 36 GDPR (data security measures, notification of personal data breaches to the supervisory authority, notification of the person affected by a personal data breach, data protection impact assessment, prior consultation).
  • The Contractor shall cooperate to the extent necessary in the fulfilment of the rights of the data subjects pursuant to Art. 12 to 22 GDPR by the Client, in the preparation of the records of processing activities and in the necessary data protection impact assessments of the Client and shall support the Client as far as possible in an appropriate manner.
  • The Contractor shall notify the Client of any disruptions, violations by the Contractor or the persons employed by the Contractor, violations of data protection regulations or the specifications made in the order, as well as suspected data protection violations or irregularities in the processing of personal data. This shall also apply with regard to any reporting and notification obligations of the Client pursuant to Art. 33 and Art. 34 GDPR. If necessary, the Contractor shall support the Client in its obligations under Art. 33 and 34 GDPR in an appropriate manner.
  • The Contractor shall draw up a processing directory in accordance with Art. 30 GDPR for the present order processing.
  • The Client shall be granted the right to inspect and control the data processing facilities at any time, including by third parties authorised by the Client, with regard to the processing of the data provided by the Client. The Contractor undertakes to provide the Client with the information necessary to monitor compliance with the obligations specified in this agreement.
  • The Contractor offers the Client the option of using the web and APP services,
    • download individual or all images and/or videos at any time and/or
    • delete individual or all images and/or videos on the contractor's server.

In accordance with Art. 28 para. 3 lit. g GDPR, the deletion of the access data (email address), additional data entered in the application on a voluntary basis (title, first name, surname) and images and/or videos by the client via the web and APP services will also delete all deleted personal data from the contractor and its subcontractors. The data on the backup files is deleted after the end of the next backup cycle.

• Sub-processors
  • The Client shall grant the Contractor general authorisation to use further sub-processors within the meaning of Art. 28 GDPR to fulfil the contract. It must be ensured that the sub-processor fulfils the same obligations that are incumbent on the Contractor on the basis of this agreement. If the sub-processor does not fulfil its data protection obligations, the Contractor shall be liable to the Client for compliance with the obligations of the sub-processor.
  • The Contractor shall inform the Client of the name and address as well as the intended activity of the sub-processor upon email request (info@icuserver.com) with. The Contractor shall ensure that it carefully selects the sub-processor, taking particular account of the suitability of the technical and organisational measures taken by the sub-processor within the meaning of Art. 32 GDPR.