Data Processing Agreement
Last updated 02 May 2023.
Processing in accordance with Article 28 General Data Protection Regulation (GDPR)
between
_____________________
_____________________
_____________________
_____________________
_____________________
– the Data Controller – hereinafter referred to as the Controller –
and
ticketbro GmbH
represented by Dirk Mönning, Alexander Pohlein, Fabian Finke
Habichtshöhe 88
D-48282 Emsdetten
– the Data Processor - hereinafter referred to as the Processor –
Preamble
This agreement specifies the obligation of the contracting parties to data protection, which arise in their details described commissioned processing. It shall apply to all activities related to the contract in which employees of the Processor or persons commissioned by the Processor process personal data ("Data") of the Customer. The agreement shall apply accordingly to (remote) testing and maintenance of automated processes or data processing systems if access to personal data cannot be excluded in the process.
1. Subject-matter and duration of the Agreement
This Agreement governs the rights and obligations of the data controller and the data processor (hereinafter referred to as the "Parties") in the context of processing personal data on behalf of the data controller.
This Agreement shall apply to all activities in which employees of the Processor or subProcessors engaged by the Processor process personal data of the Controller on behalf of the Controller.
Terms used in this contract are to be understood according to their definition in the EU General Data Protection Regulation. In this sense, the Controller is the "responsible party" and the Processor is the "processor". Insofar as declarations in the following are to be made "in writing", the written form according to § 126 BGB is meant. Otherwise, declarations may also be made in another form, provided that appropriate verifiability is ensured.
Furthermore, the following terms shall have the meaning assigned to them unless the context expressly indicates otherwise:
ticketbro platform: Entirety of all services of the Processor
Non-EU countries: Countries outside the European Economic Area (EEA)
2. Subject and duration of processing
The Processor shall undertake the following processing operations:Processing of personal data in the area of Software-as-a-Service (SaaS) tool (ticketbro platform) for the fulfillment of the services paid by the Controller in the area of marketing, management and sale of its offers. This includes in particular the provision of the following services:
To provide the ticketbro platform for the online distribution & sale of tickets, tickets of any kind & other products such as food, beverages, ride chips or express passes.
Supervision and accounting of all purchase and payment transactions
Support for end customers (e.g. ticket buyers) and merchants (e.g. theme park owners)
The processing is based on the service contract existing between the Parties (hereinafter "Main Contract").
Processing shall begin with the existing performance agreement and shall continue indefinitely until termination of this Agreement or the primary agreement by either party.
Amendments and supplements to this Agreement and all of its contained components - including any representations made by Processor - shall require an agreement in writing or in an electronic format that expressly states that it is an amendment or supplement to this Agreement.
Insofar as other agreements between the Processor and the Processor result in other arrangements for the protection of personal data, this contract for commissioned processing shall take precedence, unless the parties expressly agree otherwise.
3. Nature, purpose and data subjects of data processing
The type and purpose of the processing result from the main contract. In individual cases, the following data in particular are part of the data processing:
Type of data:
Personal data
First name, last name
E-mail address
Phone number
Address
Date of birth
If applicable, IBAN, BIC, tax number, company name, copy of photo ID
Online related data:
Cookie/session identification number
IP address
Timestamp
Login data
Customer data:
Name
Email address
Phone number
Payment method
Nature and purpose of data processing:
Online registration, purchase and payment processing
Shipping of tickets & admissions, merchant & customer support, marketing campaigns
Categories of data subjects:
End customers (e.g. ticket buyers)
Interested parties
Customers
Users
Merchants (organizers - e.g. theme park owners)
Staff
Trainees
Industrial employees
Employees
Trainees
Managing director / owner / operator
4. Technical and organizational measures
The Processor shall take all necessary technical and organisational measures in its area of responsibility in accordance with Article 32 GDPR to protect personal data and shall provide the Controller the documentation for inspection [Annex 1]. If approved by the Controller, the documented measures become the basis of the Agreement.
Insofar as the inspection/audit by the Controller reveals the need for amendments, such amendments shall be implemented by mutual agreement.
The agreed technical and organisational Measures are subject to technical progress and further development. In this respect, it is permissible for the Processor to implement alternative adequate measures in the future. In so doing, the security level of the defined measures must not be reduced. The Controller shall be informed immediately of any significant changes which have to be documented by the Processor without delay.
5. Scope and responsibility
The Processor processes personal data on behalf of the Controller. This includes activities that are specified in the main contract and in the service description. Within the scope of this Annex, the Controller shall be solely responsible for compliance with the statutory provisions of the data protection laws, in particular for the lawfulness of the transfer of data to the Processor as well as for the lawfulness of the data processing ("Controller" within the meaning of Art. 4 No. 7 GDPR).
The instructions shall initially be determined by the main contract and may thereafter be amended, supplemented or replaced by the Controller in writing or in an electronic format (text form) to the body designated by the Processor by means of individual instructions (individual instruction). In accordance with the instructions, the Processor shall not use the data provided for data processing for any purposes other than those listed under § 1. Copies or duplicates shall not be made without the knowledge of the Customer. However, the Processor shall be entitled to copy data in the course of normal business processes, such as for internal backups.
6. Rights of the data subject
The Processor shall support the Controller within its area of responsibility and as far as possible by means of appropriate technical and organisational measures in responding to requests from data subjects. The Processor must not on its own discretion respond to data subject requests concerning access to data, portability, rectification, erasure or the restriction of processing of data being processed on behalf of the Controller, but only on documented instructions from the Controller. Insofar as the Data Subject contacts the Processor directly, the Processor will immediately forward the Data Subject’s request to the Controller.
Insofar as it is included in the scope of services, the right of access, to rectification, to restriction of processing, to erasure and to data portability shall be ensured directly by the Processor in accordance with documented instructions from the Controller.
7. Duties of the Processor
The Processor shall process personal data exclusively as contractually agreed or as instructed by the Customer, unless the Processor is legally obliged to carry out a specific processing. If such obligations exist for the Processor, the Processor shall notify the Controller of these prior to processing, unless the notification is prohibited by law. Furthermore, the Processor shall not use the data provided for processing for any other purposes, in particular not for its own purposes. Der Auftragnehmer bestätigt, dass ihm die einschlägigen, allgemeinen datenschutzrechtlichen Vorschriften bekannt sind. Er beachtet die Grundsätze ordnungsgemäßer Datenverarbeitung.
The Processor undertakes to strictly maintain confidentiality during processing.
Persons who may gain knowledge of the data processed in the order shall undertake in writing to maintain confidentiality, insofar as they are not already subject to a relevant confidentiality obligation by law.
The Processor warrants that the persons employed by it for processing have been familiarized with the relevant provisions of data protection and this Agreement prior to the start of processing. Corresponding training and awareness-raising measures shall be repeated on an appropriate regular basis. The Processor shall ensure that persons deployed for commissioned processing are appropriately instructed and monitored on an ongoing basis with regard to compliance with data protection requirements.
In connection with the commissioned processing, the Processor shall support the Customer to the extent necessary in fulfilling its obligations under data protection law, in particular in creating and updating the list of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The required information and documentation shall be kept available and provided to the Customer without undue delay upon request.
If the Processor is subject to inspection by supervisory authorities or other bodies or if data subjects assert rights against it, the Processor undertakes to support the Controller to the extent necessary, insofar as the processing under the contract is affected.
The Processor may only provide information to third parties or the person concerned with the prior consent of the Controller. The Processor shall immediately forward any inquiries addressed directly to it to the Customer.
To the extent required by law, the Processor shall appoint a competent and reliable person as data protection officer. It must be ensured that there are no conflicts of interest for the commissioner. In cases of doubt, the Customer may contact the data protection officer directly. The Processor shall inform the Customer without delay of the contact details of the data protection officer or give reasons why no officer has been appointed. The Processor shall inform the Customer without delay of any changes in the person or the internal tasks of the data protection officer.
As a matter of principle, the commissioned processing shall take place within the EU or the EEA. Any relocation to a third country may only take place with the consent of the Controller and under the conditions contained in Chapter V of the General Data Protection Regulation and in compliance with the provisions of this contract.
Data, data carriers and all other materials shall be either surrendered or deleted at the request of the Controller after the end of the order. If additional costs arise due to deviating specifications for the release or deletion of the data, these shall be borne by the Controller.
In the event of a claim against the Controller by a data subject with regard to any claims under Art. 82 GDPR, the Processor undertakes to support the Controller in defending the claim to the extent of its possibilities.
This contract does not release the Processor from compliance with other requirements of the GDPR.
8. Processing security
The data security measures described in Annex 1 are defined as binding. They define the minimum owed by the Processor. The description of the measures must be made in such detail that a knowledgeable third party can at any time recognize beyond doubt, based on the description alone, what the minimum owed should be. A reference to information which cannot be taken directly from this agreement or its appendices is not permissible.
The data security measures may be adapted in accordance with the technical and organizational further development as long as the level agreed here is not undercut. The Processor shall implement any changes required to maintain information security without delay. The Customer shall be notified of any changes without delay. Significant changes shall be agreed between the parties.
Insofar as the security measures taken do not or no longer meet the requirements of the Customer, the Processor shall notify the Customer without delay.
The Processor warrants that the data processed under the Order will be strictly separated from other data files.
Copies or duplicates shall not be made without the knowledge of the Controller. Technically necessary, temporary duplications are excepted, insofar as an impairment of the level of data protection agreed here is excluded.
The processing of data in private residences is permitted. Insofar as no other processing takes place, the Processor shall ensure that a level of data protection and data security corresponding to this Agreement is maintained and that the Controller's control rights specified in this Agreement can also be exercised without restriction in the private residences concerned.
The Processor shall provide regular evidence of the fulfillment of its obligations, in particular the complete implementation of the agreed technical and organizational measures and their effectiveness. The proof shall be provided to the Customer at any time upon request. The evidence may be provided by approved rules of conduct or an approved certification procedure. Evidence shall be kept at least until the expiry of three calendar years after the end of the commissioned processing and shall be provided to the Principal at any time upon request.
9. Regulations on the authorization, deletion and blocking of data
The Processor shall only correct, delete or block data processed within the scope of the order in accordance with the contractual agreement reached or in accordance with the Controller's instructions. The instruction must be made in writing via the email address datenschutz@ticketbro.io. If a data subject contacts the Processor directly in this regard, the Processor shall forward this request to the Controller without delay.
The Processor shall comply with the corresponding instructions of the Customer at any time and also beyond the termination of this Agreement.
Insofar as included in the scope of services, the deletion concept, right to be forgotten, correction, data portability and information shall be ensured directly by the Processor in accordance with the Controller's documented instructions.
10. Subcontracting relationships
Subcontracting relationships within the meaning of this provision shall be understood to be those services which relate directly to the provision of the main service. This does not include ancillary services which the Processor uses, for example, as telecommunications services, postal/transport services, maintenance and user service or the disposal of data carriers and other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, the Processor shall be obligated to enter into appropriate and legally compliant contractual agreements as well as control measures to ensure data protection and data security of the Customer's data even in the case of outsourced ancillary services.
Outsourcing to subProcessors and change of existing subProcessor are permitted to the extent:
the Processor notifies the Customer of such outsourcing to subProcessors a reasonable time in advance in writing or in text form, which notification may also be made by updating Annex 2 to this Agreement in advance, which shall be reviewed by the Customer at regular intervals, giving the Customer the opportunity to object to such changes, and
the special requirements of Art. 44 et seq. GDPR are fulfilled.
The transfer of personal data of the Controller to the subProcessor and its first activity are allowed only after all conditions for subcontracting have been met.
If the subProcessor provides the agreed service outside the EU/EEA, the Processor shall ensure that it is permissible under data protection law by taking appropriate measures. The same shall apply if service providers within the meaning of Paragraph 1 Sentence 2 are to be used.
All contractual provisions in the contractual chain shall also be imposed on the subProcessors.
11. International data transfers
Any transfer of personal data to a third country or to an international organisation requires documented instructions from the Controller and compliance with the requirements for the transfer of personal data to third countries pursuant to Chapter V of the GDPR. The Controller allows data to be transferred to the recipients in a third country as specified in Annex 2. The Annex specifies the approved measures by the Controller to ensure an adequate level of data protection under Article 44 et seq. GDPR within the framework of the subcontracting.
Insofar as the Controller instructs a data transfer to third parties in a third country, the Controller shall be responsible for compliance with Chapter V of the GDPR.
12. Supervisory powers of the Controller
The Controller alone is responsible for assessing the permissibility of the commissioned processing and for safeguarding the rights of data subjects.
The Controller shall issue all orders, partial orders or instructions in documented form. In urgent cases, instructions may be issued verbally. The Customer shall immediately confirm such instructions in a documented manner.
The Controller shall inform the Processor without delay if it discovers errors or irregularities in the examination of the order results.
The Controller has the right, after consultation with the Processor, to carry out inspections or to have them carried out by an auditor to be designated in each individual case. It has the right to convince itself of the compliance with this Agreement by the Processor in its business operations during normal business hours by means of random checks, which are ordinarily to be announced in good time.
Inspections of the Processor shall be carried out without avoidable disruption to its business operations. Unless otherwise indicated for urgent reasons to be documented by the Customer, inspections shall take place after reasonable advance notice and during the Processor's business hours, and not more frequently than every 36 months. Insofar as the Processor provides proof of the correct implementation of the agreed data protection obligations, any checks shall be limited to random samples.
The Processor shall ensure that the Controller is able to verify compliance with the obligations of the Processor in accordance with Article 28 GDPR**.** The Processor undertakes to give the Controller the necessary information on request and, in particular, to demonstrate the execution of the Technical and Organizational Measures.
Evidence of the Technical and Organisational measures for compliance with data protection requirements in general as well as those relating to this specific Agreement, may be provided by ticketbro.
13. Reporting requirements
The Processor shall notify the Controller without delay of any violations of the protection of personal data processed on behalf of the Controller. Reasonable suspicions thereof shall also be notified. The notification shall be sent to an address specified by the Customer within 48 hours of the Processor becoming aware of the relevant event. It must contain at least the following information:
A description of the nature of the personal data breach, including, to the extent possible, the categories and approximate number of data subjects, the categories involved, and the approximate number of personal data records involved;
The name and contact information of the Data Protection Officer or other point of contact for further information;
A description of the likely consequences of the personal data breach;
A description of the measures taken or proposed by the Processor to address the personal data breach and, if applicable, measures to mitigate its potential adverse effects.
Significant disruptions in the execution of the order as well as violations by the Processor or the persons employed by the Processor of the provisions of data protection law or the stipulations made in this contract shall also be reported immediately.
The Processor shall inform the Customer without undue delay of inspections or measures by supervisory authorities or other third parties, insofar as these relate to the commissioned processing.
The Processor warrants to support the Controller in its obligations pursuant to Art. 33 and 34 of the General Data Protection Regulation to the extent necessary.
14. Authority to issue directives
The Customer reserves a comprehensive right to issue instructions with regard to the processing on behalf of the Customer.
The Customer and the Processor shall name the persons exclusively authorized to issue and accept instructions in Annex 3.
In the event of a change or a longer-term prevention of the designated persons, the other party shall be informed immediately of successors or representatives.
The Processor shall immediately notify the Customer if, in its opinion, an instruction issued by the Customer violates statutory provisions. The Processor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the responsible person at the Customer.
The Processor shall document instructions issued to it and their implementation.
The Processor shall process personal data only on the basis of documented instructions from the Controller, unless it is obliged to process such data under the law of the Member State or under Union law. The Controller shall immediately confirm oral instructions (at the minimum in text form). The Controller's initial instructions shall be determined by this Agreement.
The Processor shall inform the Controller immediately if he considers that an instruction violates Data Protection Regulations. The Processor shall then be entitled to suspend the execution of the relevant instructions until the Controller confirms or changes them.
15. Deletion and return of personal data
Copies or duplicates of the data shall never be created without the knowledge of the Controller, with the exception of back-up copies as far as they are necessary to ensure orderly data processing, as well as data required to meet regulatory requirements to retain data.
After conclusion of the contracted work, or earlier upon request by the Controller, at the latest upon termination of the Service Agreement, the Processor shall hand over to the Controller or – subject to prior consent – destroy all documents, processing and utilization results, and data sets related to the Agreement that have come into its possession, in a data-protection compliant manner. The same applies to any and all connected test, waste, redundant and discarded material. The log of the destruction or deletion shall be provided on request.
16. Termination of the order
If, upon termination of the contractual relationship, data processed in the order or copies thereof are still in the Processor's power of disposal, the Processor shall, at the Controller's option, either destroy the data or hand them over to the Controller. The Controller shall make this choice within 2 weeks of being requested to do so by the Processor. The destruction shall be carried out in such a way that a recovery of even residual information is no longer possible with reasonable effort. Physical destruction shall be carried out in accordance with DIN 66399.
The Processor shall be obligated to bring about the immediate destruction or return, also in the case of subProcessors.
The Processor shall provide proof of proper destruction and submit it to the Customer without delay.
Documentation serving as proof of proper data processing shall be kept by the Processor at least until the end of the third calendar year after the end of the contract. The Processor may hand them over to the Controller for the purpose of discharging the Processor.
17. Liability
The Customer and the Processor shall be jointly and severally liable for compensation of damage suffered by a person due to unauthorized or incorrect data processing within the scope of the contractual relationship.
The Processor shall bear the burden of proof that any damage is not the result of a circumstance for which it is responsible, insofar as the relevant data was processed by it under this Agreement. As long as this proof has not been provided, the Processor shall indemnify the Customer upon first request against all claims asserted against the Customer in connection with the commissioned processing. Under these conditions, the Processor shall also reimburse the Customer for all legal defense costs incurred.
The Processor shall not be liable for any damage culpably caused by the Processor, its employees or the subProcessors engaged by it to perform the contract or the subProcessors engaged by it in connection with the provision of the contractual service commissioned.
18. Special right of termination
The Customer may terminate the Main Agreement and this Agreement at any time without notice ("extraordinary termination") if there is a serious breach by the Processor of data protection regulations or the provisions of this Agreement, the Processor cannot or will not carry out a lawful instruction of the Customer, or the Processor refuses control rights of the Customer in breach of the Agreement.
A serious breach shall be deemed to have occurred in particular if the Processor fails to fulfill or has failed to fulfill to a significant extent the obligations specified in this Agreement, in particular the agreed technical and organizational measures.
In the event of minor violations, the Customer shall set the Processor a reasonable deadline for remedial action. If the remedy is not provided in time, the Customer shall be entitled to extraordinary termination as described in this section.
The Processor shall reimburse the Controller for all costs incurred by the Processor as a result of the premature termination of the main contract or this contract as a result of extraordinary termination by the Controller.
19. Information obligations, written form clause, choice of law
Both parties are obligated to treat all knowledge of business secrets and data security measures of the respective other party obtained within the framework of the contractual relationship as confidential, even after the termination of the contract. If there is any doubt as to whether information is subject to the obligation of confidentiality, it shall be treated as confidential until it has been released in writing by the other party.
If property of the Customer with the Processor is endangered by measures of third parties (for example by attachment or seizure), by insolvency or composition proceedings or by other events, the Processor shall notify the Customer without delay.
Amendments and supplements to this Annex and all of its components - including any warranties of the Processor - shall require a written agreement, which may also be in an electronic format (text form), and the express indication that it is an amendment or supplement to these Terms and Conditions. This shall also apply to the waiver of this formal requirement.
Ancillary agreements must be made in writing and must expressly refer to this agreement.
The defense of the right of retention within the meaning of Section 273 of the German Civil Code (BGB) shall be excluded with regard to the data processed in the order and the associated data carriers.
Should individual parts of this agreement be invalid, this shall not affect the validity of the remainder of the agreement.
German law shall apply.
___________________
City, Date
___________________
Controller
___________________
City, Date
___________________
Processor
Annex 1 - Technical and organizational measures
The following specifies the order-related technical and organizational measures to ensure data protection and data security that the Processor must at least establish and maintain on an ongoing basis. The aim is to ensure in particular the confidentiality, integrity and availability of the information processed in the order.
Confidentiality (Art. 32 para. 1 lit. b GDPR)
a) Entrance control
The Processor shall use keys to ensure that only authorized persons have access to its premises.
Employees in the home office are prohibited from using company documents on paper or portable data carriers outside the office premises. Data is to be used exclusively via the central data management system.
b) Access control
The Processor grants employees access only to the systems they need to perform their specific tasks.
The Processor regulates access to its own systems via secure personalized passwords and password procedures. Authorizations are linked to a personal user ID and an account. In addition, all employees of the Processor have a password management system (1Password), which sets random passwords for sensitive systems if necessary.
Processor passwords are subject to minimum security requirements (such as min 16th characters, special characters, numbers, capital letters).
All data carriers are encrypted.
All Windows laptops use Full Disk Hardware Encryption of the installed SSDs. All MacBooks use the integrated Filevault Encryption of MacOS.
c) Control access
Authorized users can only access data that is set up in their individual authorization profile.
There are strict rules and procedures for creating and changing authorization profiles, which include management approval.
All Processor services are continuously monitored.
d) Separation control
Authorization concepts prevent the unplanned use of sensitive data. Access to the data itself is also restricted by the fact that employees use services (applications) that control access and do not allow the data to be written to.
All customer data is managed in the same database, as it is not possible to separate this at database level due to the system. Since the data can only be accessed via the corresponding software anyway, separation is ensured via a role concept in the software.
Exceptions are made for developers and the customer service team, who are allowed direct access to the database for troubleshooting purposes. This access is read-only, so that no data can be changed past the role concept.
Test and production systems are separated. If software changes do not satisfy the separation control, they are detected in the test system and not transferred to the production system.
e) Pseudonymization (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)
Data for internal evaluations for statistical purposes to increase productivity are anonymized before processing by shortening or randomly changing the IP addresses.
In the area of online marketing in particular, we work exclusively with pseudonymous online identifiers and profiles. These are pseudonymized by means of so-called 'hashing'.
Integrity (Art. 32 para. 1 lit. b GDPR)
a) Transfer control
No unauthorized reading, copying, modification or removal during electronic transmission.
All transport routes are SSL-encrypted.
The profile and user management for the Controller's data readout lie with the Controller.
The front end has https encryption and a corresponding SSL certificate.
Hardware components or documents are destroyed in such a way that recovery is not possible or only possible with disproportionate effort.
There are clear rules and procedures for making multiplications such as copies.
Various firewalls exist.
b) Input control
Determining whether and by whom personal data has been entered into, modified or removed from data processing systems.
Specific activities are logged accordingly.
Optional session logs are recorded.
Database structure changes are logged in detail in the "linear" tool. Logs are kept in an audit-proof manner for 12 months. The entry, modification and deletion of data can be traced using individual user names.
Availability and resilience (Art. 32 para. 1 lit. b GDPR)
a) Availability control
The Processor automatically creates another overall backup, which is stored in the cloud. These backups can be used if other availability measures fail. This is an overall backup that cannot be used to restore individual data, but only restores the complete system.
There is an emergency plan which shows which steps have to be taken and when, and which persons and departments have to be informed at what time and for what purpose.
Our servers and backup systems are located in Amazon Web Services data centers which are comprehensively protected for business continuity. Details can be found here: https://aws.amazon.com/de/compliance/data-center/controls/.
Highly available systems are operated redundantly in parallel in several data centers.
The overloading of servers is excluded by a so-called 'autoscaling group'. If the load on the servers increases, additional servers are automatically added to prevent overloading.
Procedures for regular review, assessment and evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)
a) Data protection management
The Processor regularly reviews its data privacy management with the involvement of the company-appointed data privacy officer.
All employees receive regular training on the subject of data privacy. In addition, all employees are obligated to maintain data secrecy. Employees in home offices are instructed separately on the special rules.
b) Incident Response Management
In the event of a data breach, a comprehensive set of rules applies to the processes and communication steps to be initiated.
The responsible employees are trained to inform the supervisory authorities if necessary, so that nothing stands in the way of informing them within 72 hours.
c) Privacy-friendly default settings
We follow the Privacy by Design approach and take this into account in the developments of every technology. From the outset, the aim is to minimize the amount of data to be collected and to reduce the scope of data processing.
As far as possible, data is only processed pseudonymously. Data privacy statements, which are easily accessible and describe all data processes in detail, ensure transparency.
d) Order control
All Processors are selected with due diligence.
Order processing contracts are concluded with all Processors and technical and organizational measures are regularly reviewed.
Control rights are contractually agreed with Processors.
Annex 2 - Overview of all subcontracting relationships (sub-service providers)
The use of subProcessors as further processors shall only be permissible if the Controller has given its prior consent.
A subcontracting relationship requiring consent exists if the Processor commissions further Processors to perform all or part of the service agreed in the contract. The Processor shall enter into agreements with these third parties to the extent necessary to ensure appropriate data protection and information security measures. The contractually agreed services or the partial services described below shall be performed with the involvement of the following subProcessors:
Name and address of the subcontractor Description of partial services Legal basis Amazon Web Services, Inc. 410 Terry Avenue North, Seattle WA 98109 United States Web Hosting & Data Storage Service Provider Art. 6 para. 1 (b) GDPR Mangopay SA 2 Avenue Amélie L-1125 Luxembourg Service provider for payment processing & creation of escrow account Art. 6 para. 1 (b) GDPR und Art. 6 para. 1 (c) GDPR PayPal (Europe) S.à.r.l etCie, S.C.A. 22-24 Boulevard Royal L-2449 Luxembourg Service provider for payment processing Art. 6 para. 1 (b) GDPR und Art. 6 para. 1 (c) GDPR Slack Technologies, Inc. 500 Howard Street San Francisco, CA, 94105 United States Communication tool for employees and beta testers Art. 6 para. 1 (b) GDPR Google LLC 1600 Amphitheatre Parkway Mountain View CA 94043 United States Data storage, communication, web analysis Art. 6 para. 1 (b) GDPR Hubspot, Inc. 25 First Street, 2nd Floor Cambridge, MA 02141 United States CRM system Art. 6 para. 1 (b) GDPR Functional Software, Inc. dba Sentry 132 Hawthorne St San Francisco, CA 94107 United States Error tracking and logs Art. 6 para. 1 (b) GDPR DATEV eG Paumgartnerstr. 6 - 14 90429 Nürnberg Germany Software for accounting and tax program Art. 6 para. 1 (b) GDPR GitHub Inc 88 Colin P Kelly Jr Street San Francisco, CA 94107 United States Version management for software development projects Art. 6 para. 1 (b) GDPR Notion Labs, Inc. 930 ALABAMA STREET SAN FRANCISCO CA 94110 United States Organization tool Art. 6 para. 1 (b) GDPR LINEAR ORBIT, INC. 340 South Lemon Avenue #4242, Walnut, CA 91789 United States Issue Tracking System Art. 6 para. 1 (b) GDPR Zapier Inc. 548 Market St. #62411. San Francisco CA 94104-5401 United States Automation tool between several tools Art. 6 para. 1 (b) GDPR LinkedIn Corp 1000 West Maude Avenue Sunnyvale CA 94085 United States Social Network Art. 6 para. 1 (b) GDPR Zoom Video Communications, Inc. 55 Almaden Boulevard, 6th Floor San Jose CA 95113 United States Video conferencing tool Art. 6 para. 1 (b) GDPR Strato AG Pascalstraße 10 10587 Berlin Germany Domain Art. 6 para. 1 (b) GDPR Apple Inc. 1 Apple Park Way Cupertino, California United States App-Distribution and management of calendar Art. 6 para. 1 (b) GDPR PandaDoc Inc. 3739 Balboa St. # 1083. San Francisco CA 94121 United States Software for digital signature of documents Art. 6 para. 1 (b) GDPR eRecht24 GmbH & Co. KG Lietzenburger Str. 94 10719 Berlin Germany Digital information platforms around the topics of Internet law, data protection and e-commerce Art. 6 para. 1 (b) GDPR Namecheap, Inc. 4600 East Washington Street Suite 305 Phoenix, AZ 85034 United States Domain hosting and e-mail provider Art. 6 para. 1 (b) GDPR Dynport GmbH ABC-Straße 4 20354 Hamburg Translation software Art. 6 para. 1 (b) GDPR Figma GmbH Zimmerstraße 78 10117 Berlin Germany Design Tool Art. 6 para. 1 (b) GDPR Microsoft Corporation One Microsoft Way Redmond WA, USA 98052 Office Software Art. 6 para. 1 (b) GDPR AgileBits, Inc. 4711 Yonge St, 10th Floor Toronto, Ontario, M2N 6K8 Canada Password management tool Art. 6 para. 1 (b) GDPR Bitly Europe GmbH Am Lenkwerk 13 33609 Bielefeld Germany Link shortener & QR code generator Art. 6 para. 1 (b) GDPR Better Financial Services GmbH Rosenthaler Straße 34/35 10178 Berlin Germany Payment Service Provider Art. 6 para. 1 (b) GDPR Stripe Inc. 354 Oyster Point Blvd South San Francisco CA 94080 United States Payment Service Provider Art. 6 para. 1 (b) GDPR Twilio Inc. 101 Spear Street, 5th Floor San Francisco 94105 California United States Event tracking - Customer Data Platform Art. 6 para. 1 (b) GDPR Vercel Inc. 340 S Lemon Ave 4133 Walnut California, 91789 United States Website-Hosting Art. 6 para. 1 (b) GDPR Unbounce Marketing Solutions Inc. 400-401 W Georgia St Vancouver, British Columbia V6B 5A1 Canada Landingpage Builder Art. 6 para. 1 (b) GDPR Branch Metrics Inc. 1400B Seaport Blvd Redwood City California 94063 United States Link Shortener & Data Analysis Art. 6 para. 1 (b) GDPR Worldline Schweiz AG Hardturmstrasse 201 8005 Zürich Switzerland Payment Service Provider Art. 6 para. 1 (b) GDPR Beijing ByteDance Technology Co Ltd Room 10A, Building 2, No. 48, Zhichun Road Beijing 100098 China Social Media Platform Art. 6 para. 1 (b) GDPR Meta Platforms Inc. 1601 Willow Road Menlo Park California 94025 United States Social Media Platform Art. 6 para. 1 (b) GDPR Adobe Inc. 345 Park Avenue San Jose, CA 95110-2704 United States Graphic design program Art. 6 para. 1 (b) GDPR OpenAI, L.L.C. 3180 18th Street, San Francisco, CA 94110 United States Service for artificial intelligence Art. 6 para. 1 (b) GDPR 650 Industries, Inc. 420 Florence St Ste 200 Palo Alto DE 94031 United States App infrastructure & CI service Art. 6 para. 1 (b) GDPR Celonis, Inc. One World Trade Center, 87th Floor New York, NY, 10007 United States Automation tool between several tools Art. 6 para. 1 (b) GDPR Maze.design Limited London Office 5th Floor 167-169, Great Portland Street London, W1W 5PF United Kingdom Product discovery platform Art. 6 para. 1 (b) GDPR Telefónica Germany GmbH & Co. OHG Georg-Brauchle-Ring 50 80992 München Deutschland Mobile communication provider Art. 6 para. 1 (b) GDPR BroadSoft Germany GmbH c/o Cisco Systems GmbH Lothringer Straße 56 50677 Köln Deutschland Cloud calling provider Art. 6 para. 1 (b) GDPR Hotjar Ltd. 1601 S California Ave Palo Alto California, 94304 United States Website Heatmaps & Behavior Analytics Tool Art. 6 para. 1 (b) GDPR SurveySparrow Inc. 2345 Yale St FL 1 Palo Alto CA 94306 United States Survey tool Art. 6 para. 1 (b) GDPR Albacross Nordic AB Epicenter Mäster Samuelsgatan 36 111 57 Stockholm Sweden Sales & Marketing tool to identify leads Art. 6 para. 1 (b) GDPR Taboola Germany GmbH Alt-Moabit 2 10557 Berlin Germany Advertising platform Art. 6 para. 1 (b) GDPR Storyblok GmbH Peter-Behrens-Platz 2 4020 Linz Österreich Content Management System Art. 6 para. 1 (b) GDPR If the Processor places orders with subProcessors, it shall be incumbent upon the Processor to transfer its data protection obligations under this Agreement to the subProcessor.
Annex 3 - Persons authorized to give instructions, address for reporting data protection violations
The following persons are authorized to issue instructions:
Dirk Mönning
dirk@ticketbro.io
Alexander Pohlein
alex@ticketbro.io
Fabian Finke
fabian@ticketbro.io
The following persons are authorized to receive instructions:
Dirk Mönning
dirk@ticketbro.io
Alexander Pohlein
alex@ticketbro.io
Fabian Finke
fabian@ticketbro.io
The following persons are authorized to receive instructions:
Alexander Pohlein
alex@ticketbro.io
Annex 4 - Data Protection Officer
Currently appointed as external data protection officer at the Processor:
DSB Münster GmbH
André Korte
Martin-Luther-King-Weg 42-44
48149 Münster
Phone: 0251 718 790
Email: datenschutz@dsb-ms.de