Agreement on commissioned processing (Article 28 GDPR)
Agreement
between
the client
and
LINC GmbH
Grapengießerstr. 16, 21335 Lüneburg, Germany
– Processor, hereinafter referred to as the “Contractor”
Client and Contractor each referred to individually as a “Party” and jointly as “Parties”.
1.Definition of the Client
Clients are coaches and companies that wish to use the Coaching Board for the administration, execution, and documentation of their coaching activities. The Coaching Board is provided by LINC GmbH as a data processor. As the client, the coach or company determines the purposes and means of processing personal data and acts as the data controller pursuant to Art. 4 No. 7 of the GDPR concerning the processing of data related to coachees.
2. Subject Matter of the Agreement
Within the framework of the service relationship between the parties, it is necessary for the contractor, acting as a data processor pursuant to Art. 4 No. 8 of the GDPR, to handle personal data for which the client acts as the data controller pursuant to Art. 4 No. 7 of the GDPR (hereinafter referred to as “Client Data”). This agreement specifies the data protection rights and obligations of the parties in connection with the contractor’s handling of Client Data for the performance of the agreed-upon services.
3. Type and Purpose of Processing, Type of Personal Data, Categories of Data Subjects, Duration of Data Processing
The contractor processes personal data during the term of service provision solely on behalf of and according to the instructions of the client. The type and purpose of processing, as well as the type of personal data and the categories of data subjects, are defined in Appendix 1. Any processing of personal data that deviates from or exceeds these terms, particularly for the contractor’s own purposes, is strictly prohibited.
4. Instructions of the Client
4.1 The instructions of the client are generally given in written or text form (e.g., email). Deviations from this may include (remote) verbal instructions, which must subsequently be confirmed in written or text form.
4.2 The contractor is obligated to execute the client’s instructions immediately or, if applicable, within a reasonable timeframe specified by the client, and in particular, to promptly rectify, delete, or block personal data upon the client’s instruction and confirm this in writing upon request.
4.3 If the contractor believes that an instruction from the client violates this agreement, the GDPR, or other data protection regulations of the EU or its member states, the contractor must notify the client without delay. The contractor is entitled to suspend the execution of the instruction until it is confirmed or modified by the client.
4.4 If the contractor is obligated by Union or member state law to process personal data without the client’s instruction, the contractor shall inform the client of the reason for the processing and the corresponding legal requirements before the processing begins, unless such notification is prohibited due to an important public interest.
5. Obligations of the Client
5.1 The client is responsible, externally—i.e., toward third parties and data subjects—for the legality of the processing of Client Data and for safeguarding the rights of the data subjects.
5.2 The client is obligated to treat all knowledge of operational and business secrets obtained within the scope of the contractual relationship (particularly regarding technical and organizational measures for data security) of the contractor as confidential. This obligation remains in effect even after the termination of this agreement.
5.3 If the contractor seeks to defend against a claim for damages under Art. 82 of the GDPR, against an impending or already imposed fine under Art. 83 of the GDPR, or other sanctions under Art. 84 of the GDPR by legal means, the client permits the contractor to disclose details of the data processing, including instructions issued, for the purpose of defense.
6. Obligations of the Contractor
6.1 If a data subject exercises their rights under Chapter 3 of the GDPR (Articles 12 to 23 GDPR), considering Part 2, Chapter 2 of the Federal Data Protection Act (Sections 32 to 37 BDSG), and addresses their request directly to the contractor, the contractor shall forward the request to the client without delay. The contractor shall support the client, to a reasonable extent, by implementing suitable technical and organizational measures to enable the client to fulfill their obligation to respond to such requests concerning the rights of the data subject as specified in Chapter 3 of the GDPR.
6.2 The contractor shall assist the client, taking into account the nature of the processing and the information available to the contractor, in fulfilling the obligations specified in Articles 32 to 36 of the GDPR.
6.3 If the contractor becomes aware of a personal data breach concerning the client’s data, as defined in Article 4 No. 12 of the GDPR (“data breach”), the contractor shall notify the client without delay. As part of the notification pursuant to Article 33(2) of the GDPR, the contractor shall, to the extent possible, provide the client with details such as the time, nature, and scope of the incident, the affected IT system, the impacted individuals, the time of discovery, any foreseeable adverse consequences of the data security breach, and the measures taken in response.
6.4 The contractor shall promptly inform the client if the rights of the client to personal data held by the contractor are significantly affected by third-party actions or other events.
6.5 Upon request by the client, the contractor is obligated to hand over all client data. Data carriers received from the client must be specifically labeled and managed continuously. Copies and duplicates of personal data may only be created with prior consent from the client unless they are necessary for the proper execution of this agreement or the respective project assignment, or to comply with statutory retention obligations.
6.6 If there is a legal obligation, the contractor shall appoint a Data Protection Officer in accordance with Articles 37 and following of the GDPR. The contact details of the current Data Protection Officer are provided in Appendix 4 of this agreement.
7. Security of Processing
7.1 The contractor shall take all measures required under Article 32 of the GDPR to ensure a level of security appropriate to the risk of processing. These measures shall include, in particular, the ability to ensure the confidentiality, integrity, availability, and resilience of systems on a permanent basis and to rapidly restore the availability of personal data and access to it in the event of a physical or technical incident. The contractor shall regularly review, assess, and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of processing and shall document the results.
7.2 The contractor guarantees that prior to the commencement of processing the client’s data, the technical and organizational measures listed in Appendix 2 of this contract will be implemented, maintained throughout the duration of processing, and adjusted as necessary to reflect the state of the art and the risks associated with the processing.
7.3 The contractor ensures that individuals authorized to process personal data are committed to confidentiality or are subject to an appropriate statutory obligation of confidentiality.
8. Inspection Rights of the Client
8.1 The contractor grants the client the right to inspect and verify data processing as well as compliance with this contract or the respective project order. Specifically, the contractor shall provide the client with all information necessary to demonstrate compliance with the obligations laid down in this contract and shall allow for inspections, including audits. Such inspections may also be conducted by a third party bound by confidentiality, provided the third party is not a competitor of the contractor.
8.2 The parties agree that the client may conduct an inspection under Clause 7.1 by instructing the contractor to present an appropriate attestation, report, or report excerpts from independent bodies (e.g., auditors, internal auditors, data protection officers, information security officers, data protection auditors, or quality auditors) or a suitable certification from an IT security or data protection audit—e.g., pursuant to ISO 27001 or BSI Basic Protection (“Audit Report”). In justified exceptional cases, the client may conduct independent inspections.
8.3 The contractor undertakes to support the execution of inspections. This includes granting all necessary access, information, and insight rights. The same applies to public inspections conducted by the competent supervisory authority in accordance with applicable data protection regulations.
8.4 The client shall inform the contractor in good time (usually at least four weeks in advance) of all circumstances related to the execution of the inspection. The client is generally entitled to conduct one inspection per calendar year. This does not affect the client’s right to carry out additional inspections in the event of special incidents.
9. Subcontracting Relationships
9.1 The contractor may enter into subcontracting relationships with additional data processors (subcontractors). Currently, the contractor employs the subcontractors specified in Appendix 3. The client consents to their engagement. The contractor shall always inform the client of any intended changes regarding the involvement or replacement of subcontractors, thereby allowing the client to object to such changes within two weeks, provided there are important data protection-related reasons. If the client does not raise a justified objection within two weeks of being notified of the change, the change shall be deemed approved by the client. In the event of an objection, the contractor may, at their discretion, perform the service without the intended change or, if the performance of the service without the intended change is unreasonable for the contractor, terminate the service agreement with the client with immediate effect within two weeks of receiving the objection.
9.2 If the engagement of a subcontractor involves the transfer of client data to a country outside the European Union (EU) or the European Economic Area (EEA) (“third country”), the provisions outlined in Clause 10 shall additionally apply. 9.3 The contractor must ensure that the data protection obligations agreed upon in this contract also apply to the subcontractor and that the subcontractor is obligated, pursuant to Article 28(4) GDPR, by means of a contract or another legal instrument under Union law or the law of the relevant Member State, prior to commencing its activities. In particular, sufficient guarantees must be provided to ensure that appropriate technical and organizational measures are implemented so that the processing complies with the requirements of the GDPR.
10. Transfer of Client Data to Third Countries
The provision of the contractually agreed data processing services shall, in principle, take place in a Member State of the European Union (EU) or in a contracting state of the Agreement on the European Economic Area (EEA). Any transfer of client data to a country outside the EU/EEA (“third country”) will only occur if the specific conditions set forth in Articles 44 et seq. GDPR are fulfilled.
11. Return and Deletion of Client Data
11.1 Upon the conclusion of the provision of processing services and, in particular, upon the termination of the contractually agreed services (especially in the event of termination or other cessation of the collaboration), the contractor shall, at the client’s discretion, either return all client data to the client or delete it in compliance with data protection regulations (including any existing copies). Any data carriers received from the client must be returned to the client or destroyed while maintaining an appropriate level of protection. The same applies to test and scrap material. This does not apply if Union law or the law of a Member State requires the storage of personal data.
11.2 Documentation and records that serve to demonstrate proper and lawful data processing or compliance with statutory retention periods must be retained in accordance with the respective retention periods beyond the end of the contract.
12. Term and Termination
The term and termination of this contract are governed by the provisions concerning the term and termination of the collaboration. Termination of the collaboration automatically results in termination of this contract. Termination of this contract in isolation is excluded.
13. Priority Clause
If an individual data protection agreement has already been concluded between the parties in the past, that agreement shall take precedence and apply in place of this contract.
Attachments:
Attachment 1: Purpose, Nature, and Scope of Data Processing, Type of Data, and Categories of Data Subjects
Attachment 2: Technical and Organizational Measures
Attachment 3: Subcontractors
Attachment 4: Data Protection Officer
Attachment 1: Type and Purpose of Data Processing, Type of Data, and Categories of Data Subjects
Type and Purpose of Data Processing:
The data processing on behalf of the client is carried out within the framework of providing a coaching board by the contractor for the client. The coaching board is an online platform for the administration, execution, and documentation of coaching sessions. The coaching board may be used to collect, organize, store, and utilize personal data of coachees. An exchange between the client and their coachees can take place through the platform, as coachees are also provided access to the coaching board. These accesses are created and managed by the client.
Art der personenbezogenen Daten:
– Vor- und Nachname – E-Mail-Adresse – Inhaltsdaten – Nutzungsdaten – Meta-Daten und Logfiles |
Kategorien betroffener Personen:
| Coachees des Auftraggebers |
Anlage 2: Technische und organisatorische Maßnahmen
| 1. Vertraulichkeit (Art. 32 Abs. 1 lit. b) DSGVO) und Verschlüsselung (Art. 32 Abs. 1 lit. a) DSGVO) |
Zutrittskontrolle Maßnahmen, damit Unbefugten der Zutritt zu den Datenverarbeitungsanlagen verwehrt wird, mit denen personenbezogene Daten verarbeitet werden: |
– Eingangstüren werden stets verschlossen gehalten. – Besucher/Externe werden begleitet bzw. abgeholt und stets beaufsichtigt. – Schlüssel – Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister zusätzliche Maßnahmen. |
Zugangskontrolle/Verschlüsselung Maßnahmen, die verhindern, dass Unbefugte die Datenverarbeitungsanlagen und -verfahren benutzen: |
– Zugang zu extern gehosteten/betriebenen IT-Systemen ist besonders gesichert (Verschlüsselung, VPN) – Abschottung des Netzwerkes gegen ungewollte Zugriffe von außen (Firewall) – Zugang zu IT-Systemen nur mit Benutzerkennung und individuellem Passwort möglich – Zugangsberechtigungen werden dokumentiert. – Passwortrichtlinie wird über Active Directory durchgesetzt. – IT-Systeme werden bei wiederholt erfolglosem Anmeldeversuch automatisch gesperrt. – Mobile Datenträger sind verschlüsselt (Hardwareverschlüsselung). – Bildschirmsperre an Arbeitsstationen, automatische Sperrung bei längerer Abwesenheit – Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister zusätzliche Maßnahmen. |
Zugriffskontrolle Maßnahmen, die gewährleisten, dass die zur Benutzung der Datenverarbeitungsverfahren Befugten ausschließlich auf die ihrer Zugriffsberechtigung unterliegenden personenbezogenen Daten zugreifen können: |
– Individuelle Zugriffsrechte für jeden einzelnen Benutzer (in einem schriftlichen Berechtigungskonzept dokumentiert), zentrale Verwaltung und Steuerung – Zugriffsberechtigungen werden aufgabenbezogen und nach dem Need-to-know-Prinzip erteilt. – Regelmäßige Überprüfung der Zugriffsberechtigungen. Nicht mehr erforderliche Berechtigungen werden unverzüglich entzogen. – Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister zusätzliche Maßnahmen. |
Trennungskontrolle/Zweckbindungskontrolle Maßnahmen, die gewährleisten, dass zu unterschiedlichen Zwecken erhobene Daten getrennt verarbeitet werden können: |
– Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister folgende Maßnahmen: o Trennung der Zugriffsregelungen über Datenbankprinzip o Softwareseitige Mandantentrennung o Trennung von Produktiv- und Testsystemen (in getrennten Datenbanken) |
| 2. Integrität (Art. 32 Abs. 1 lit. b) DSGVO) |
Weitergabekontrolle Maßnahmen, die gewährleisten, dass personenbezogene Daten bei der elektronischen Übertragung oder während ihres Transports oder ihrer Speicherung auf Datenträger nicht unbefugt gelesen, kopiert, verändert oder entfernt werden können, und dass überprüft und festgestellt werden kann, an welche Stellen eine Übermittlung personenbezogener Daten durch Einrichtungen zur Datenübertragung vorgesehen ist: |
– Übermittlungen personenbezogener Daten sind im Verzeichnis der Verarbeitungstätigkeiten dokumentiert. – Datenspeicherung und -verarbeitung erfolgt auf IT-Systemen im Rechenzentrum. Verbindung zwischen Clients und Server ist besonders gesichert (Verschlüsselung, VPN). – Mitbringen und verwenden privater Datenträger ist untersagt. Es dürfen nur verschlüsselte betriebliche Datenträger genutzt werden. – Wiederbeschreibbare Datenträger werden vor der Wiederverwendung nach Standard DOD 5220-220.M gelöscht. – Bei Hardwaretausch werden Festplatten vorher ausgebaut. – Kontrollierte Vernichtung von Datenträgern mit Protokollierung (physische Vernichtung, zertifizierter Entsorger). – Besucher haben keinen Zugriff auf betriebliches LAN/WLAN. – Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister zusätzliche Maßnahmen. |
Eingabekontrolle Maßnahmen, die gewährleisten, dass nachträglich überprüft werden kann, ob und von wem personenbezogene Daten in Datenverarbeitungssystemen eingegeben, verändert oder entfernt werden können: |
– Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister folgende Maßnahmen: o automatisierte Protokollierung der Dateneingabe, Änderung oder Löschung o Protokollierung der Aktivitäten des Systemverwalters und sämtlicher Benutzer o Protokollierung aller Aktivitäten auf dem Server o Sicherung der Protokolldaten gegen Verlust oder Veränderung |
3. Verfügbarkeit und Belastbarkeit (Art. 32 Abs. 1 lit. b) DSGVO), rasche Wiederherstellbarkeit (Art. 32 Abs. 1 lit. c) DSGVO |
Verfügbarkeitskontrolle Maßnahmen, die gewährleisten, dass personenbezogene Daten gegen zufällige Zerstörung oder Verlust geschützt sind (die Angaben beziehen sich auf eigene IT-Systeme des Auftragnehmers): |
– Die Daten werden in einem externen Rechenzentrum gespeichert. Dort gewährleistet der Dienstleister folgende Maßnahmen: o Datensicherheitskonzept o Versionierte Daten- und Systembackups nach Backup-Plan (täglich/wöchentlich) o Festplattenspiegelung (RAID), Backup-Rechenzentrum o Schadsoftwareschutz o Sicherheitsrelevante Updates und Patches werden regelmäßig und zeitnah eingespielt. o Unterbrechungsfreie Stromversorgung |
| 4. Verfahren zur regelmäßigen Überprüfung, Bewertung und Evaluierung (Art. 32 Abs. 1 lit. d) DSGVO, Art. 25 Abs. 1 DSGVO) |
Auftragskontrolle Maßnahmen, die gewährleisten, dass personenbezogene Daten, die im Auftrag verarbeitet werden, nur entsprechend den Weisungen des Auftragsgebers verarbeitet werden können: |
– Auftragnehmer werden sorgfältig ausgesucht. – Klare und unzweifelhafte vertragliche Regelungen zur Datenverarbeitung – Formalisiertes Weisungsmanagement – Kontrolle des Auftragnehmers durch die Geschäftsführung oder den Datenschutzbeauftragten. |
Datenschutz-Management Maßnahmen, die eine Steuerung der Datenschutzprozesse ermöglichen und die Einhaltung der datenschutzrechtlichen Vorgaben nachweisbar sicherstellen: |
– Es existiert ein dokumentiertes Datenschutz-Management-System. – Es wurde eine fachkundige Person zum Datenschutzbeauftragten benannt. – Beschäftigte werden regelmäßig im Datenschutz geschult und sensibilisiert und sind über die Vertraulichkeit von Daten belehrt. |
5. Pseudonymisierung (Art. 32 Abs. 1 lit. a) DSGVO, Art. 25 Abs. 1 DSGVO) Maßnahmen, die gewährleisten, dass personenbezogene Daten in einer Weise verarbeitet werden, dass die Daten ohne Hinzuziehung zusätzlicher Informationen nicht mehr einer spezifischen betroffenen Person zugeordnet werden können, sofern diese zusätzlichen Informationen gesondert aufbewahrt werden und entsprechenden technischen und organisatorischen Maßnahmen unterliegen. |
Anlage 3: Unterauftragnehmer
| Name | Anschrift/Land | Auftragsinhalt |
| Codecan solutions GmbH | Schmalzhofgasse 4 1060 Wien Österreich | Produkt-Entwicklung und Hosting der technischen Infrastruktur |
Anlage 4: Datenschutzbeauftragter
Datenschutzbeauftragter der LINC GmbH
David Oberbeck
Herting Oberbeck Datenschutz GmbH