Data Processing Agreement (DPA)
Data processing agreement under Art. 28 GDPR for JASP apps: subject matter, data, instructions, security measures and subprocessors.
This agreement under Art. 28 GDPR applies when JASP Oldenburg & Henning PartG mbB, Dresdner Landstr. 11, 01744 Dippoldiswalde, Germany (“JASP”, processor) processes personal data in an app on behalf of your company (“Customer”, controller). It becomes part of the contract for the app (see the Terms, section 9). The German text is the binding one. For paid plans it is the agreement that JASP provides under section 9 (2) of the Terms; the Customer concludes it by ordering the plan. If you also need a signed copy, write to info@jasp.eu.
1. Subject matter and duration
(1) JASP provides the Customer with one or more of the apps Room Booking, JASP Events, Virtual Office, Calendar, Tournament Prediction Game or Widget Builder and processes personal data on the Customer’s behalf.
(2) The DPA applies as long as the contract for the app exists, and afterwards until JASP has deleted all data under section 9.
2. Nature, purpose, data and data subjects
(1) Nature and purpose: Storing, displaying, transmitting and deleting data so the Customer can use the app (for example book rooms, manage events, be present in the virtual office, share appointments, place predictions).
(2) Types of data: name, e-mail address and display name; role and sign-in identifier (subject) from the Customer’s sign-in route; bookings, registrations and answers in forms; calendar entries; presence and position in the virtual office; predictions in the Tournament Prediction Game; usage and log data (IP address, time). Depending on the app, only some of these data arise.
(3) Data subjects: employees, guests and participants of the Customer and persons the Customer invites to the app.
(4) Special categories of personal data (Art. 9 GDPR) are not intended. The Customer does not enter them in free-text fields.
(5) Where JASP processes data for its own purposes (operation and security of the platform, billing, administrators’ account and contact data), JASP is the controller for that; the privacy policy applies.
3. Instructions
(1) JASP processes the data only on documented instructions from the Customer. The contract for the app and this DPA are the instruction; settings in the app are further instructions. Without instruction, JASP processes data only where Union or Member State law requires it; JASP informs the Customer beforehand unless that law prohibits this. Data goes to third countries only as provided in the list of subprocessors and subject to section 6 (4).
(2) If JASP considers an instruction unlawful, JASP informs the Customer and may suspend execution until the Customer confirms or changes it.
4. Confidentiality
JASP obliges all persons with access to the data to keep it confidential, also after their engagement ends. They process the data only on JASP’s instructions, which follow the Customer’s instructions.
5. Security of processing
JASP takes the technical and organisational measures in the annex (“Annex 1”) and adapts them to the state of the art. The level of protection does not drop.
6. Subprocessors
(1) The Customer agrees to the use of the providers in the list of subprocessors and gives JASP a general authorisation under Art. 28(2) GDPR for further providers under paragraph 2.
(2) JASP announces a change (new or replaced provider) in text form at least 30 days in advance. The Customer may object within that period for an important data protection reason. A new provider is used at the earliest after the period expires. If an objection stays unresolved, either side may terminate the affected app without notice to the end of the current billing period, notwithstanding section 6 (2) and (6) of the Terms; section 6 (8) of the Terms remains unaffected.
(3) JASP binds every subprocessor by contract to the same data protection duties as in this DPA, in particular being bound by instructions, confidentiality, security under Art. 32 GDPR and assistance, and is liable to the Customer for its duties.
(4) Transfers to third countries take place only with safeguards under Chapter V GDPR (adequacy decision or standard contractual clauses). Details are in the list of subprocessors.
7. Rights of data subjects
JASP supports the Customer with technical and organisational means so that the Customer can answer requests for access, rectification, erasure, restriction and portability. If a data subject contacts JASP directly, JASP forwards the request to the Customer without answering itself. Where an app has no function of its own for access, export or erasure, JASP carries out the request on the Customer’s instruction.
8. Support and notification of personal data breaches
(1) JASP notifies the Customer of a personal data breach without undue delay after JASP becomes aware of it, with the information JASP has at that time.
(2) JASP supports the Customer with data protection impact assessments and consultations with the supervisory authority (Art. 32 to 36 GDPR) as far as the app requires.
9. Deletion and return
After the contract for the app ends, JASP, at the Customer’s choice, deletes all personal data including existing copies or returns it, unless Union or Member State law requires storage. The Customer states its choice within 30 days after the contract ends; without a choice, JASP deletes. Data in backups is not deleted individually; it disappears when the backup is overwritten after its retention time, at the latest after twelve months (see Annex 1).
While the contract runs, data stays stored until the Customer deletes it in the app or instructs JASP to do so. Some apps also delete automatically: in JASP Events the Customer can set a retention period per tenant; the Widget Builder deletes usage and audit data after 30 to 180 days; the mail log is deleted after 30 days.
10. Evidence and audits
On request JASP provides the Customer with the information needed to verify compliance with this DPA and allows audits, including by an auditor the Customer appoints. Both sides agree on the date and scope of an on-site audit in advance; it takes place during normal business hours and must not disrupt operations.
11. Liability and final provisions
The Customer is the controller (Art. 4(7) GDPR) and checks itself whether the processing is lawful. The liability rules of the contract for the app and Art. 82 GDPR apply. If this DPA and the contract for the app contradict each other, this DPA prevails as far as the protection of personal data is concerned. German law applies.
Annex 1: Technical and organisational measures
These measures apply to the platform the apps run on. JASP adapts them under section 5.
- Hosting: servers from netcup in Nuremberg. Apart from encrypted remote access for administration (SSH), no port is open to the internet; all access to the apps runs only through a Cloudflare tunnel.
- Separation of customers: each organisation is its own tenant. Separation takes place in the application.
- Administration access: operating tools (monitoring, logs) are reachable only after sign-in through Cloudflare Access with a JASP account.
- Encryption in transit: requests from the internet use HTTPS only; the connection from Cloudflare to the servers runs through the encrypted tunnel.
- Backup: hourly database dump on the server (48 copies), plus daily and monthly backup on a backup system operated by JASP outside the data centre (30 daily, 12 monthly copies); restoring the databases is documented and has been tested.
- Logs: container logs 14 days; mail log of the apps 30 days, sign-in codes redacted; error logs without default personal data, with paths, search parameters and free extra fields removed.
- Sign-in: through the Customer’s sign-in route (Staffbase, Microsoft Entra, Google or e-mail code, depending on the app).
- Separation of test and production: separate servers for stage and production.