Data Processing Agreement

Parties

between the customer, as stated on registration in BSTAGE,
– controller, hereinafter “Customer” –

and BSTAGE UG (haftungsbeschränkt) in formation, Unterer Ahlenbergweg 39a, 58313 Herdecke, represented by its management, David Peters,
– processor, hereinafter “BSTAGE” –

This data processing agreement (Auftragsverarbeitungsvertrag, AVV) governs the data protection obligations of both parties insofar as BSTAGE processes personal data on behalf of customers within the scope of the contract of use (Nutzungsvertrag) under the General Terms and Conditions (Allgemeine Geschäftsbedingungen, AGB). It is concluded in electronic form upon acceptance of the Terms (Art. 28(9) GDPR). In matters of data protection law, it takes precedence over the Terms.

§ 1 Subject matter and duration

1. The subject matter is the processing of personal data that customers record, upload or generate in their workspaces in BSTAGE – for example guest lists, staff planning, travel and hotel details, contact persons, contracts, invoices and messages. Details are set out in Annex 1.
2. The account, contract and billing data of the customers themselves is not the subject matter of this agreement. BSTAGE is an independent controller for this data; the privacy policy applies.
3. This agreement runs for as long as the contract of use. The obligations under § 10 continue to apply after the end of the contract of use.

§ 2 Nature, purpose and scope

1. BSTAGE processes the data exclusively in order to provide the platform to customers. The nature of the processing, the categories of data and the categories of data subjects are described in Annex 1.
2. BSTAGE does not use the data for its own purposes or for advertising and does not disclose it to third parties, except to the sub-processors under § 6 and to persons to whom customers themselves grant access. Aggregated, non-personal metrics on the operation of the platform are excepted.
3. Processing takes place via the infrastructure of the sub-processors named in Annex 3. § 7 applies to transfers outside the EU and the EEA.

§ 3 Instructions

1. BSTAGE processes the data only on documented instructions from customers. The instructions are set out exhaustively in this agreement, the Terms and the settings and functions of the platform that customers use. Customers give further instructions in text form (Textform) to contact@bstage.studio.
2. If BSTAGE is required to carry out processing under Union or Member State law, BSTAGE informs customers of this in advance, unless that law prohibits such information.
3. If BSTAGE considers an instruction to be unlawful, BSTAGE informs customers of this without undue delay and may suspend its execution until the instruction is confirmed or changed.

§ 4 Confidentiality

BSTAGE only engages persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality. They access the data only insofar as this is necessary for operation, support or troubleshooting.

§ 5 Security of processing

1. BSTAGE takes the technical and organisational measures under Art. 32 GDPR described in Annex 2.
2. BSTAGE may adapt the measures to the state of the art, provided that the agreed level of protection is not reduced. Material changes are documented.

§ 6 Sub-processors

1. Customers approve the sub-processors named in Annex 3.
2. Before BSTAGE engages or replaces a sub-processor, BSTAGE informs customers at least four weeks in advance in text form at the account’s e-mail address. Within this period, customers may object for good cause relating to data protection. If no agreement is reached, either party may terminate the contract of use with effect from the date of the change.
3. BSTAGE contractually imposes on each sub-processor the same data protection obligations as those set out in this agreement (Art. 28(4) GDPR).
4. Transfers that customers initiate themselves and direct to recipients of their choice do not constitute sub-processing – for example synchronisation with their own Google Calendar, or guest access and invitations for partners.
5. Nor does the verification of VAT identification numbers (Umsatzsteuer-Identifikationsnummern, USt-IdNr.) with the European Commission (VAT Information Exchange System, VIES) constitute sub-processing. When customers create an invoice to another EU country without VAT (reverse charge), BSTAGE transmits for this purpose the VAT identification number of the invoice recipient and the customer’s own VAT identification number. The Commission carries out the verification as a public body, not on behalf of BSTAGE.

§ 7 Transfers to third countries

BSTAGE transfers data to countries outside the EU and the EEA only if the requirements of Art. 44 et seq. GDPR are met – in particular on the basis of an adequacy decision such as the EU-US Data Privacy Framework for certified recipients, or of the standard contractual clauses of the European Commission.

§ 8 Rights of data subjects

1. BSTAGE assists customers with appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. Customers can view, rectify, export and delete data in the platform themselves.
2. If a data subject contacts BSTAGE directly, BSTAGE forwards the request without undue delay to the customers concerned and does not answer it itself unless it has been instructed to do so.

§ 9 Notification and assistance

1. BSTAGE notifies customers of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it. Insofar as known, the notification contains the information under Art. 33(3) GDPR; missing information is provided subsequently.
2. Taking into account the information available, BSTAGE assists customers with their obligations under Art. 32 to 36 GDPR, in particular with notifications to the supervisory authority, with communicating to data subjects and with data protection impact assessments.
3. BSTAGE may charge reasonable remuneration for assistance that goes beyond the functions of the platform and is not based on a breach by BSTAGE.

§ 10 Deletion and return

1. Customers can retrieve their data at any time via the export functions of the platform. They export data they still need before deleting a workspace or their account.
2. Customers delete data themselves at any time via the deletion functions of the platform. When an account is deleted, BSTAGE deletes the account and profile data; the content of the workspaces – events, bookings, contracts, invoices, messages and files – is retained, because the customers’ business partners continue to work with it. BSTAGE deletes messages in chats and booking threads three years after the last message in the respective thread; customers who need them for longer export them beforehand.
3. After the end of the contract of use, BSTAGE also deletes this content within 30 days on instruction in text form to contact@bstage.studio, insofar as it is not also assigned to business partners and there is no obligation to store it under Union or Member State law (Art. 28(3)(g) GDPR). Return is effected via the export in the account settings, with all data and files.
4. Copies in restore points and backup copies of the database are deleted when they expire in the regular course, at the latest after 30 days.

§ 11 Evidence and audits

1. BSTAGE makes available to customers all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR – primarily in the form of documentation, information and certificates of the sub-processors.
2. If these are not sufficient, customers may carry out on-site inspections or have them carried out by auditors bound to confidentiality. Inspections must be announced with four weeks’ notice, take place during normal business hours, must not unreasonably disrupt operations and – except where there is a specific reason – are limited to one per calendar year. Customers bear the costs unless the inspection reveals a breach by BSTAGE.

§ 12 Obligations of customers

1. Customers are responsible for the lawfulness of the processing. This includes informing data subjects such as guests or staff in accordance with Art. 13 and 14 GDPR.
2. BSTAGE is not designed for special categories of personal data under Art. 9 and 10 GDPR. Customers do not enter such data.
3. Customers inform BSTAGE without undue delay if they detect errors or irregularities in the processing.

§ 13 Liability and final provisions

1. The parties are liable to data subjects in accordance with Art. 82 GDPR. As between the parties, the liability provisions of the Terms (§ 12) apply.
2. Amendments to this agreement are governed by § 15 of the Terms.
3. The law of the Federal Republic of Germany applies. Should individual provisions be or become invalid, the validity of the remaining provisions remains unaffected.

Annex 1 – Overview of processing

Nature of processing: storing, organising and displaying for authorised users, transmission to partners invited by customers, sending e-mails, export as PDF and CSV, verification of VAT identification numbers with the European Commission (VIES) for invoices with reverse charge (§ 6(5)), deletion.

Annex 2 – Technical and organisational measures

Confidentiality

• Physical access: BSTAGE does not operate its own servers. The sub-processors’ data centres are certified to ISO/IEC 27001 and audited to SOC 2.
• System access: Passwords are stored only as a hash and must be at least ten characters long at registration. The e-mail address is verified, sign-in attempts are limited, sessions expire after 30 days and can be ended. Two-factor authentication with recovery codes is available to all accounts.
• Data access: The server checks authorisation on every request. Files are held in private storage and are only delivered after sign-in and an authorisation check. Access tokens for external services are stored encrypted. Guest access is password-protected, time-limited and revocable, and shows no financial data.
• Separation: The data of each workspace is logically separated from that of the others. Development and testing run against separate data sets, not against production data.

Integrity

• Transfer: All connections are encrypted with TLS. Access credentials for the infrastructure are held exclusively as protected variables in the automated deployment.
• Input: Changes to shared events are recorded in a change log. Application logs record access and errors.

Availability and resilience

• Operation on distributed infrastructure with protection against overload (denial-of-service) attacks.
• The database can be restored to earlier points in time.
• Database changes are tested with a complete migration sequence before every release.

Review and evaluation

• Every change goes through a pull request with automated type checking, tests, a security check of dependencies and a build before it is released.
• These measures are reviewed regularly and whenever the platform changes materially.

Control of processing on instructions (Auftragskontrolle)

• Sub-processors are only engaged under a contract in accordance with Art. 28 GDPR.
• Instructions from customers are documented.

Annex 3 – Sub-processors