Data Processing Agreement

English summary – Data Processing Agreement

The complete and legally authoritative Data Processing Agreement under Article 28 GDPR is available in German at /de/rechtliches/auftragsverarbeitung. This English text is provided solely as a non-binding aid to understanding.

The agreement applies where the customer is identified in the electronic order confirmation, Enterprise offer or order form and the DPA is validly incorporated through documented electronic acceptance, attachment or agreement in text form. Publication alone does not create a DPA.

It covers processing on the customer’s documented instructions through lumen.account, lumen.hr, lumen.pmo, lumen.crm, lumen.tm, lumen.privacy and lumen.mask, to the extent that the relevant products are ordered. It includes:

• documented instructions, confidentiality and purpose limitation,
• assistance with data-subject requests, security incidents, DPIAs and regulatory duties,
• advance notice and an objection mechanism for new sub-processors,
• audit and evidence rights,
• international-transfer safeguards,
• return, machine-readable export and erasure after the processing ends,
• product-specific data and data-subject categories,
• the approved sub-processor list for Hetzner and conditional Postmark email delivery.

The published DPA defines the contractual baseline. The measures actually implemented for the ordered product, including backup and recovery parameters, logging, erasure, administrative access and the status of encryption at rest, must be recorded in a product-specific TOM supplement before processing begins where required by the risk. The DPA does not promise universal encryption of data or backups at rest.

A signature-ready copy or further information may be requested from kontakt@vss-software.de.

Version 1.0 – Last updated: 24 July 2026