Data Processing Agreement (DPA)

§ 1 Subject Matter and Duration of the Data Processing

(1) The subject matter of this agreement is the processing of personal data by the Processor on behalf of the Controller in connection with the use of the CERTavia services.

(2) The data processing begins with the first use of CERTavia services and ends upon termination of the contractual relationship. The provisions on deletion following the end of the contract remain unaffected (§ 9).

§ 2 Nature and Purpose of the Processing, Type of Personal Data, Categories of Data Subjects

The CERTavia scanner processes exclusively publicly accessible technical infrastructure parameters (DNS records, HTTP headers, SSL configuration, public web content). Page content, internal system data, and personal user data of the scanned domain are not collected.

§ 3 Controller's Right to Issue Instructions

(1) The Processor shall process personal data exclusively on documented instructions from the Controller, unless required to do so by Union or Member State law.

(2) Instructions may be given in writing (by email to [email protected]). Verbal instructions must be confirmed in writing without delay.

(3) If the Processor is of the opinion that an instruction infringes applicable data protection law, it shall inform the Controller thereof without delay. The Processor is entitled to suspend the execution of the instruction until the matter is clarified.

§ 4 Obligations of the Processor

The Processor undertakes in particular to:

• Process personal data exclusively on the instructions of the Controller (§ 3);
• Ensure that all persons authorized to process the data are bound by confidentiality (Art. 28(3)(b) GDPR);
• Take all technical and organizational measures required under Art. 32 GDPR (§ 6);
• Comply with the conditions for engaging further processors set out in § 7;
• Taking into account the nature of the processing, assist the Controller in complying with data subject rights (Art. 12–22 GDPR);
• Assist the Controller in complying with the obligations set out in Art. 32–36 GDPR;
• At the Controller's choice, delete or return all personal data upon termination of the processing (§ 9);
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.

§ 5 Notification Obligations

(1) The Processor shall assist the Controller in complying with the obligations under Art. 32–36 GDPR (security of processing, notification of personal data breaches, data protection impact assessment, prior consultation).

(2) The Processor shall notify the Controller of personal data breaches without undue delay, and in any event within 72 hours of becoming aware of them. Notification shall be sent by email to the Controller's most recently known email address.

§ 6 Technical and Organizational Measures (TOMs)

The Processor implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect the personal data processed. The measures currently implemented include:

Confidentiality

• Transport encryption: TLS 1.2 / 1.3 for all data transfers
• Encryption of data at rest in the Hetzner database (AES-256)
• Access control: role-based access management, MFA for administrative access
• Pseudonymization of scan logs through IP truncation (last octet removed)

Integrity

• Cryptographic signature of all audit records (Ed25519)
• DNS anchoring of vault records for tamper resistance
• Audit logs for administrative database access

Availability and Resilience

• Hosting infrastructure in certified data centers (Hetzner, ISO 27001)
• Cloudflare CDN with DDoS protection for the web presence
• Regular data backups (daily backups, 7-day retention)

Procedures for Regular Review

• Semi-annual review and update of security measures
• Automatic deletion routines for expired data records (scan leads after 30 days, vault records after 90 days on the Basic tier)

§ 7 Use of Sub-Processors

(1) The Processor is entitled to engage further processors (sub-processors). Sub-processor relationships shall be disclosed to the Controller. Publication at certavia.org/datenschutz constitutes the Controller's general authorization unless the Controller objects within 14 days of disclosure.

(2) Sub-processors currently engaged:

(3) The Processor imposes data protection obligations on its sub-processors that are equivalent to those agreed in this contract.

§ 8 Controller's Audit Rights

(1) The Controller has the right to verify the Processor's compliance with data protection provisions and with the agreements in this contract.

(2) Reviews are generally conducted by requesting documentation, certificates, or audit reports. On-site inspections are possible upon prior notice (at least 14 days) and at the Controller's expense.

(3) Requests for evidence and documentation should be directed to: [email protected]

§ 9 Deletion and Return After Termination

(1) Upon termination of the contractual relationship, the Processor shall, at the Controller's choice, delete or return all personal data processed in connection with the engagement, unless a statutory obligation requires further retention.

(2) Upon request, the Processor shall confirm complete deletion in writing.

(3) Statutory retention obligations (in particular accounting records, 10 years) remain unaffected.

§ 10 Liability

Liability between the Controller and Processor is governed by Art. 82 GDPR and the general liability provisions of the CERTavia Terms and Conditions.

§ 11 Governing Law and Jurisdiction

This contract is governed by the law of the Federal Republic of Germany. The provisions of the CERTavia Terms and Conditions apply to disputes.

§ 12 Formation of Contract

This DPA becomes effective upon acceptance of the CERTavia Terms and Conditions when purchasing a product or signing up for a newsletter. A countersigned copy can be issued upon request.