Data processing agreement for businesses

Effective: [terms.effectiveDate.en]

Agreement under Art. 28(3) GDPR between the provider using Handl (the "controller") and [company.name] [company.legalForm], [company.street], [company.zip] [company.city] ("Handl" or the "processor").

This agreement forms part of the terms and conditions for providers and is concluded with them in electronic form (Art. 28(9) GDPR). The German version is binding; this translation is provided for convenience.

§ 1 Scope: when Handl acts on your behalf

(1) Handl is itself the controller for handling orders placed through Handl; you receive the customer data needed to fulfil them as a controller in your own right (§ 12 of the terms for providers). This agreement does not apply to that.

(2) This agreement applies to data you bring into Handl for your own purposes and that Handl processes only on your behalf ("commissioned data"):

• external calendars you subscribe to in the provider portal (iCal addresses): Handl fetches them regularly and stores the busy times with their titles to protect you from double bookings;
• blocked times that you or your staff enter in the provider portal or in "Handl Orders", with their labels.

These entries may contain personal data of third parties, such as the name of a customer you serve outside Handl.

§ 2 Subject matter, duration, nature and purpose

(1) The subject matter is storing and displaying commissioned data in the calendar of the provider portal and "Handl Orders" and taking it into account when calculating free appointment slots.

(2) Types of data: time span, title or label of an appointment or block, recurrence rule, address of the subscribed calendar, assignment to a member of your team.

(3) Categories of data subjects: you and your staff; persons named in the titles of your calendar entries (for example your customers outside Handl).

(4) The agreement runs as long as you use Handl. It ends when your account is finally deleted (§ 11 of the terms for providers).

(5) Please put only what you need for planning into titles. Do not put special categories of personal data (for example health data such as "dentist") into titles of subscribed calendars, or share the calendar without titles.

§ 3 Instructions

(1) Handl processes commissioned data only on your documented instructions. Your instructions are set out conclusively in this agreement and in the functions of the provider portal (subscribing, refreshing, changing and deleting calendars and blocks). You give further instructions in text form to [privacy.contactEmail].

(2) If Handl considers an instruction unlawful, Handl informs you without delay and may suspend it until it is confirmed or changed.

(3) Handl does not process commissioned data for its own purposes unless required to do so by law; in that case Handl informs you beforehand unless the law prohibits this.

§ 4 Confidentiality

Handl uses only persons who are bound to confidentiality or under a statutory obligation of secrecy, and grants access to commissioned data only insofar as necessary for the service, support or troubleshooting.

§ 5 Security of processing

Handl implements the technical and organisational measures described in Annex 1. Handl may develop them further provided the level of protection is not reduced.

§ 6 Assistance

(1) Handl assists you with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR). You can view, change and delete commissioned data yourself in the provider portal at any time. If a data subject contacts Handl directly, Handl forwards the request to you without delay.

(2) Handl assists you, taking into account the information available to it, in complying with the obligations under Art. 32 to 36 GDPR.

§ 7 Subprocessors

(1) You give general authorisation for the engagement of further processors. Those engaged when the agreement is concluded are listed in Annex 2 (recipients and subprocessors).

(2) Handl informs you in text form at least four weeks before engaging a new subprocessor or replacing one. You may object within that period for a material data protection reason. If Handl cannot resolve the objection, you may stop using the functions named in § 1(2) or terminate the agreement with effect from the engagement of the new subprocessor.

(3) Handl imposes on each subprocessor by contract the same data protection obligations that this agreement imposes on Handl, and remains liable to you for their performance.

(4) Processing outside the EU and the EEA takes place only if the conditions of Art. 44 to 49 GDPR are met.

§ 8 Personal data breaches

Handl notifies you of a breach affecting commissioned data without undue delay, where possible within 24 hours of becoming aware of it, at the email address of your account owner. The notification contains, as far as known, the information under Art. 33(3) GDPR. Handl takes containment measures without delay and assists you with your notification obligations.

§ 9 Deletion and return

(1) Subscribed calendars are replaced in full on every fetch; if you remove a subscription, Handl deletes its entries. Deleted blocks are deleted immediately.

(2) After the agreement ends, Handl deletes all commissioned data at the latest when the 30-day period for restoring your account has expired. They are removed from backups when these expire in the normal course (seven days). There is no separate return, as the data comes from your own calendars or can be viewed in the portal at any time.

§ 10 Evidence and audits

(1) On request, Handl demonstrates compliance with this agreement by suitable documents, in particular the description of the technical and organisational measures and the certifications of its subprocessors.

(2) Beyond that, after timely notice (at least 30 days) you may carry out audits during normal business hours yourself or through an auditor bound to confidentiality, without disproportionately disrupting operations. You bear the cost of an on-site audit unless it reveals a material breach by Handl.

§ 11 Liability

Art. 82 GDPR applies to liability. Otherwise the liability rules of the terms for providers apply.

§ 12 Final provisions

(1) In the event of conflict, this agreement takes precedence over the terms for providers as regards the protection of commissioned data.

(2) Handl announces changes to this agreement in the same way as changes to the terms (§ 14 of the terms for providers).

(3) The law of the Federal Republic of Germany applies.

Annexes

• Annex 1: Technical and organisational measures
• Annex 2: Recipients and subprocessors