Data Processing Agreement (DPA)

1.1 The provider makes Quiz Planner available to the customer (usage contract). In doing so, it processes personal data on behalf of the customer.

1.2 Purpose: The customer uses Quiz Planner to run live quizzes, polls and word clouds, to evaluate them and to store the results. The provider stores, processes and displays this data so that the customer can do so.

1.3 Duration: the term of the usage contract. Section 9 governs deletion at the end.

1.4 Type of data and categories of data subjects: Annex 1.

2.1 The provider processes the data only on documented instructions from the customer. Instructions are the usage contract, this agreement and the customer's settings and actions in Quiz Planner (for example deleting a quiz, setting the retention period, exporting data). The customer gives further individual instructions in text form to kontakt@gremiumhub.de.

2.2 The provider does not process the data for its own purposes. This does not apply to processing that it is legally required to carry out; it informs the customer of this beforehand, unless the law prohibits this. It also does not apply to technical data that the provider needs for secure operation (for example access limits) and that it processes as a controller in its own right. This is stated in the privacy policy.

2.3 The provider informs the customer if it considers an instruction to be unlawful. It may then suspend execution until the customer confirms or changes the instruction.

The provider obliges all persons who work with the data to confidentiality, unless they are already bound by law.

4.1 The provider takes the measures under Art. 32 GDPR that are described in Annex 2.

4.2 The measures evolve. The provider may change them if the level of protection does not fall. It documents material changes.

5.1 The customer gives a general authorisation for the sub-processors in Annex 3.

5.2 The provider informs the customer by email at least 30 days before a new sub-processor is used or a sub-processor is replaced. The customer can object in text form for an important data protection reason. If the parties do not agree, either side can terminate the usage contract extraordinarily at the end of the current period.

5.3 The provider contractually obliges each sub-processor to the same data protection obligations as in this agreement. It is liable to the customer for the sub-processor's obligations.

6.1 Data subject rights: The provider supports the customer with technical means so that the customer can answer requests from data subjects. For this, Quiz Planner offers the export of session results (CSV, JSON), the removal of participants in the lobby, the deletion of quizzes and sessions and automatic deletion after a set period. If a data subject contacts the provider, the provider forwards the request to the customer without undue delay and does not answer it itself, unless it is obliged to.

6.2 The provider supports the customer with the obligations under Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessment), as far as this is necessary for processing on behalf and it has the information.

The provider notifies the customer of every personal data breach concerning data it processes on behalf of the customer without undue delay after becoming aware of it, as a rule within 48 hours, by email to the owners of the workspace. The notification contains, as far as known: the nature of the breach, the data and persons concerned, the likely consequences and the measures taken.

8.1 The provider makes available to the customer the information necessary to demonstrate compliance with this agreement.

8.2 The customer may check compliance or have it checked by an auditor bound to secrecy. The customer announces the audit at least 30 days in advance, carries it out during normal business hours without disrupting operations and bears the costs, unless a breach is found. The provider can refuse access to the data of other customers.

9.1 During the term, the customer can export (workspace export as JSON, results as CSV) and delete their data themselves.

9.2 After the usage contract ends, the provider deletes the customer's data at the customer's request in text form, at the latest 30 days after the request. If the customer requests nothing, the data stays stored until the customer deletes it or the retention period (retention setting of the workspace) deletes it. The provider is not obliged to delete data that it must keep by law; this data is blocked.

9.3 Daily backup copies contain the data until they are overwritten as usual (currently after 14 copies, so about 14 days). After that the data is deleted there as well.

The provider processes the customer's data on servers in Germany. A transfer to a country outside the EEA takes place only if the customer agrees or if a sub-processor under Annex 3 carries it out on the basis of Art. 44 et seq. GDPR (for example adequacy decision, standard contractual clauses).

Art. 82 GDPR and section 11 of the terms apply to liability.

In case of conflict, the rules of this agreement on the processing of personal data take precedence over the terms. German law applies. Contact of the provider for data protection: kontakt@gremiumhub.de.

Stripe Payments Europe, Ltd. (Ireland) processes the customer's payments for the pass. Stripe receives no data of guests and no session content. For information: Stripe processes the customer's payment and invoice data as a controller in its own right or as a processor of the provider (see privacy policy).