Draft: this text has not been legally checked yet.

Data processing agreement

This data processing agreement belongs to the agreement about heizcheck. The customer is the controller. Angelista Enterprise B.V. is the processor.

1. Subject and duration

The processor processes personal data only to provide heizcheck, for as long as the agreement runs.

2. Nature, purpose and data

Inspection plan for heating systems under §60a and §60b GModG (formerly GEG): calculate deadlines and collect inspection reports from installers.

• Email address of the property manager (sign-in)
• Building addresses and number of units
• System type, year installed and date of the last inspection
• Installer name, inspection date and inspection report (PDF)
• Email addresses of installers who are sent an upload link

Data subjects: employees, clients or contacts of the customer, as far as they appear in the customer's files.

3. Instructions

The processor processes the data only on documented instructions from the customer. Using the service as intended counts as an instruction.

4. Confidentiality

Everyone with access to the data is bound to confidentiality.

5. Security

The processor takes appropriate measures (GDPR art. 32): encrypted connections (HTTPS), access only after login, servers in the EEA, limited admin access, and backups.

6. Sub-processors

The customer gives general authorisation for these sub-processors:

• OVHcloud SAS, Roubaix, France (hosting of server and database)
• Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)

The processor announces a new sub-processor 30 days in advance. The customer may object and then cancel.

7. Assistance

The processor helps the customer with requests from data subjects and with the duties of GDPR art. 32 to 36.

8. Breaches

The processor reports a personal data breach to the customer without undue delay, and at the latest 48 hours after discovery (GDPR art. 33).

9. End

After the agreement ends, the customer can export the data for 30 days. Then the processor deletes it, also from backups within 30 days, unless the law requires keeping it.

10. Audits

The processor gives the customer all information needed to show compliance and cooperates with reasonable audits.

11. Transfers

No data is transferred to countries outside the EEA.