Data Processing Agreement

Data Processing Agreement in accordance with Art. 28 GDPR

Between the customer (hereinafter the “Client”) in accordance with the General Terms and Conditions of Clockodo GmbH (hereinafter also the “GTC” or the “Main Agreement”) and Clockodo GmbH, Viktoriastraße 25 A, 59425 Unna (hereinafter the “Contractor” or “Clockodo”) concerning the provision of the service described in the GTC. (download contract as PDF).

As of: October 15, 2026

1. General

(1) The Contractor processes personal data on behalf of the Client within the meaning of Art. 4(8) and Art. 28 of Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR). This Agreement governs the rights and obligations of the Parties in connection with the processing of personal data.

(2) Where this Agreement uses the term “data processing” or “processing” (of data), the definition of “processing” within the meaning of Art. 4(2) GDPR applies.

2. Subject Matter of the Assignment

The subject matter of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects are set out in Annex 1 to this Agreement.

3. Rights and Obligations of the Client

(1) The Client is the controller within the meaning of Art. 4(7) GDPR for the processing of data carried out on its behalf by the Contractor. Pursuant to Section 4 para. 3, the Contractor is entitled to point out to the Client if, in the Contractor’s opinion, processing that is legally inadmissible forms the subject matter of the assignment and/or of an instruction.

(2) As controller, the Client is responsible for safeguarding data subject rights. The Contractor shall inform the Client without undue delay if data subjects assert their data subject rights against the Contractor in connection with this processing of data on behalf of the Client.

(3) The Client may issue supplementary instructions regarding the nature, scope and procedure of the data processing, pro vided that they can be implemented within the scope of the Contractor’s standardised service. Instructions shall be given in text form or by using and configuring the service, in particular by activating or deactivating features. Declarations and instruc tions of users with administrator rights or with the right to manage the subscription shall be deemed declarations and instruc tions of the Client.

(4) Provisions on any remuneration for additional expenses incurred by the Contractor as a result of supplementary instructions from the Client remain unaffected.

(5) The Client shall inform the Contractor without undue delay if it identifies errors or irregularities in connection with the pro cessing of personal data by the Contractor.

(6) Where an obligation to provide information to third parties exists under Art. 33, 34 GDPR or under any other statutory noti fication obligation applicable to the Client, the Client shall be responsible for complying with it.

4. General Obligations of the Contractor

(1) The Contractor shall process personal data exclusively within the scope of the agreements made and/or in compliance with any supplementary instructions issued by the Client. This does not apply to statutory provisions that may oblige the Contractor to process the data otherwise. In such a case, the Contractor shall notify the Client of those legal requirements prior to the pro cessing, unless the law in question prohibits such notification on important grounds of public interest. In all other respects, the purpose, nature and scope of the data processing shall be governed exclusively by this Agreement and/or the instructions of the Client. Any processing of data deviating from this is prohibited to the Contractor unless the Client has consented to it in text form.

(2) As a matter of principle, the Contractor shall carry out the processing of data on behalf of the Client in Member States of the European Union (EU) or of the European Economic Area (EEA). The Contractor is also permitted to process data outside the EU or EEA if corresponding sub-processors in a third country are engaged in compliance with the requirements of Section 10 and the requirements of Art. 44-48 GDPR are met or an exception within the meaning of Art. 49 GDPR applies.

(3) The Contractor shall inform the Client without undue delay if, in the Contractor’s opinion, an instruction issued by the Client infringes statutory provisions. The Contractor is entitled to suspend the implementation of the instruction concerned until the Client confirms or amends it. If the Contractor can demonstrate that processing in accordance with the Client’s instruction may result in liability of the Contractor under Art. 82 GDPR, the Contractor is free to suspend further processing to that extent until liability has been clarified between the Parties.

5. Data Protection Officer of the Contractor

(1) The Contractor confirms that it has designated a data protection officer pursuant to Art. 37 GDPR. The Contractor shall en sure that the data protection officer has the necessary qualifications and expertise.

6. Notification Obligations of the Contractor

(1) The Contractor is obliged to notify the Client without undue delay of any infringement of data protection provisions or of the contractual agreements made and/or of the instructions issued by the Client that has occurred in the course of the pro cessing of data by the Contractor or by other persons engaged in the processing. The same applies to any personal data breach relating to data that the Contractor processes on behalf of the Client.

(2) The Contractor shall further inform the Client without undue delay if a supervisory authority takes action against the Con tractor pursuant to Art. 58 GDPR and this may also concern a review of the processing that the Contractor performs on behalf of the Client.

(3) The Contractor is aware that, in the event of a personal data breach, the Client may be subject to obligations to notify the supervisory authority (Art. 33 GDPR) and to communicate the breach to the data subjects (Art. 34 GDPR). The Contractor shall notify the Client of a personal data breach relating to data it processes on behalf of the Client without undue delay – but no later than within 48 hours – after becoming aware of it and shall support the Client, taking into account the information availa ble to the Contractor, in fulfilling the notification and communication obligations. To the extent known to the Contractor, the notification shall contain:

• a description of the nature of the breach, where possible stating the categories and approximate number of data subjects and records concerned;
• a description of the measures taken or proposed by the Contractor to remedy the breach and, where appropri ate, to mitigate its possible adverse effects.

7. Duties of Cooperation of the Contractor

(1) The Contractor shall support the Client in fulfilling its obligation to respond to requests for the exercise of data subject rights under Art. 12-23 GDPR. The provisions of Section 12 of this Agreement apply.

(2) Where applicable, the Contractor shall support the Client in drawing up the records of processing activities. It shall provide the Client with the information required for this purpose in a suitable manner.

(3) Taking into account the nature of the processing and the information available to it, the Contractor shall support the Client in complying with the obligations set out in Art. 32-36 GDPR.

8. Provisions on Mobile Workplaces

(1) The Contractor may permit its employees who are tasked with processing personal data for the Client to process personal data at mobile workplaces outside the Contractor’s business premises.

(2) The Contractor shall ensure that compliance with the contractually agreed technical and organisational measures is also guaranteed when the Contractor’s employees use mobile workplaces. The level of protection provided by the agreed technical and organisational measures must not be reduced.

(3) In particular, the Contractor shall ensure that, where personal data are processed at mobile workplaces, storage locations are configured in such a way that local storage of data on IT systems is excluded. If this is not possible, the Contractor shall en sure that local storage takes place exclusively in encrypted form and that other persons present at the respective mobile work place do not gain access to such data.

9. Inspection Rights

(1) The Client has the right to verify at any time and to the extent necessary the Contractor’s compliance with the statutory data protection provisions and/or with the contractual provisions agreed between the Parties and/or with the Client’s instruc tions.

(2) The Contractor is obliged to provide the Client with information to the extent necessary to carry out the inspection within the meaning of paragraph 1.

(3) Following prior notice within a reasonable period, the Client may carry out the inspection within the meaning of paragraph 1 at the Contractor’s place of business during normal business hours. In doing so, the Client shall ensure that the inspections are carried out only to the extent necessary, so as not to disrupt the Contractor’s business operations disproportionately. The Par ties assume that an inspection will be necessary no more than once a year. The Client must give reasons for any further audits, stating the occasion. In the case of on-site inspections, the Client shall reimburse the Contractor to a reasonable extent for the expenses incurred, including the personnel costs for supervising and accompanying the inspecting persons on site. The Contrac tor shall inform the Client of the basis for calculating these costs before the inspection is carried out.

(4) At the Contractor’s option, evidence of compliance with the technical and organisational measures may be provided, in stead of an on-site inspection, by submitting a suitable, current attestation, reports or extracts from reports by independent bodies (e.g. auditors, internal audit, data protection officer, IT security department, data protection auditors or quality audi tors) or a suitable certification, provided that the audit report enables the Client in a reasonable manner to satisfy itself of com pliance with the technical and organisational measures pursuant to Annex 3 to this Agreement. If the Client has justified doubts as to the suitability of the audit document within the meaning of sentence 1, the Client may carry out an on-site inspection. The Client is aware that an on-site inspection of data centres is not possible, or only in justified exceptional cases.

(5) In the event of measures taken by the supervisory authority against the Client within the meaning of Art. 58 GDPR, in partic ular with regard to obligations to provide information and to permit inspections, the Contractor is obliged to provide the Client with the necessary information and to enable the competent supervisory authority to carry out an on-site inspection. The Con tractor shall inform the Client of any such planned measures.

(6) The Parties agree that, where personal data are processed at mobile workplaces, the inspection measures shall be carried out by verifying that the measures to be taken by the Contractor pursuant to Section 8 paras. 2 and 3 are ensured, in order to safeguard the personality rights of other persons at those mobile workplaces.

10. Sub-processing Relationships

(1) The Contractor is entitled to engage the sub-processors specified in Annex 2 to this Agreement for the processing of data on behalf of the Client. Changing sub-processors or engaging further sub-processors is permitted subject to the requirements set out in paragraph 2.

(2) The Contractor shall select the sub-processor carefully and shall verify prior to engagement that the sub-processor is able to comply with the agreements made between the Client and the Contractor. In particular, the Contractor shall verify in advance and regularly during the term of the Agreement that the sub-processor has taken the technical and organisational measures required under Art. 32 GDPR to protect personal data. In the event of a planned change of a sub-processor or a planned en gagement of a new sub-processor, the Contractor shall inform the Client in text form in good time, but no later than 2 weeks before the change or the new engagement (the “Notice”). The Client has the right to object to the change or the new engage ment of the sub-processor in text form, stating reasons, within 2 weeks of receipt of the “Notice”. The Client may withdraw its objection at any time in text form. In the event of an objection, the Contractor may terminate the Main Agreement and this Agreement with the Client giving at least 14 days’ notice to the end of a calendar month. The Contractor shall give reasonable consideration to the Client’s interests when setting the notice period. If the Client does not object within two weeks of receipt of the “Notice”, this shall be deemed to constitute the Client’s consent to the change or the new engagement of the sub-pro cessor concerned.

(3) The Contractor is obliged to obtain confirmation from the sub-processor that the sub-processor has designated a data pro tection officer pursuant to Art. 37 GDPR, provided that the sub-processor is legally obliged to designate a data protection of ficer.

(4) The Contractor shall ensure that the provisions agreed in this Agreement and any supplementary instructions of the Client also apply vis-à-vis the sub-processor.

(5) The Contractor shall conclude a data processing agreement with the sub-processor that meets the requirements of Art. 28 GDPR. In addition, the Contractor shall impose on the sub-processor the same obligations for the protection of personal data as are stipulated between the Client and the Contractor. A copy of the data processing agreement shall be provided to the Client on request.

(6) The Contractor shall ensure that it is able to verify the sub-processor’s compliance with its obligations. In relation to sub processors providing standardised services, this may be done by means of current audit reports and certifications, which the Contractor shall make available to the Client on request.

(7) Services that the Contractor obtains from third parties as purely ancillary services in order to conduct its business activities are not to be regarded as sub-processing relationships within the meaning of paragraphs 1 to 6. These include, for example, cleaning services, pure telecommunications services without specific reference to services that the Contractor provides for the Client, postal and courier services, transport services and security services. Nevertheless, the Contractor is obliged, also in the case of ancillary services provided by third parties, to ensure that appropriate safeguards and technical and organisational measures have been taken to ensure the protection of personal data. The maintenance and servicing of IT systems constitutes a sub-processing relationship requiring consent and processing on behalf of the Client within the meaning of Art. 28 GDPR if the maintenance and testing concerns IT systems that are also used in connection with the provision of services for the Client and if personal data processed on behalf of the Client can be accessed during the maintenance.

11. Confidentiality Obligation

(1) When processing data for the Client, the Contractor is obliged to maintain confidentiality regarding data that it receives or becomes aware of in connection with the assignment.

(2) The Contractor has familiarised its employees with the data protection provisions relevant to them and has obliged them to maintain confidentiality.

(3) Evidence of the employees’ obligations pursuant to paragraph 2 shall be provided to the Client on request.

12. Data Subject Rights

(1) The Client is solely responsible for fulfilling data subject rights. The Contractor is obliged to support the Client in fulfilling its obligation to handle requests from data subjects under Art. 12-23 GDPR. In doing so, the Contractor shall in particular ensure that the information required for this purpose is provided to the Client without undue delay, so that the Client can comply in particular with its obligations under Art. 12(3) GDPR.

(2) Insofar as the Contractor’s cooperation is required for the Client to safeguard data subject rights - in particular the rights to access, rectification, blocking or erasure - the Contractor shall take the measures required in each case in accordance with the Client’s instructions. Where possible, the Contractor shall support the Client with appropriate technical and organisational measures in fulfilling its obligation to respond to requests for the exercise of data subject rights.

(3) Provisions on any remuneration for additional expenses incurred by the Contractor as a result of cooperation in connection with the assertion of data subject rights against the Client remain unaffected.

13. Remuneration

Any provisions on remuneration for services shall be agreed separately between the Parties.

14. Technical and Organisational Measures for Data Security

(1) The Contractor undertakes vis-à-vis the Client to comply with the technical and organisational measures necessary to com ply with the applicable data protection provisions. This includes in particular the requirements of Art. 32 GDPR.

(2) The status of the technical and organisational measures as at the time this Agreement is concluded is attached as Annex 3 to this Agreement. The Parties agree that changes to the technical and organisational measures may become necessary in order to adapt to technical and legal circumstances. The Contractor may adapt the measures to technical developments provided that the level of security is not reduced. Material changes shall be documented. Measures that entail only minor technical or organi sational changes and do not adversely affect the integrity, confidentiality and availability of the personal data may be imple mented by the Contractor without consulting the Client. The Client may request a current version of the technical and organisa tional measures taken by the Contractor at any time.

15. Term of the Assignment

(1) This Agreement begins upon conclusion and runs for the duration of the business relationship existing between the Parties under the General Terms and Conditions of Clockodo regarding the Client’s use of the Contractor’s services.

(2) The Client may terminate this Agreement at any time without notice if there is a serious breach by the Contractor of the applicable data protection provisions or of obligations under this Agreement, if the Contractor cannot or will not carry out an instruction of the Client, or if the Contractor refuses access to the Client or to the competent supervisory authority in breach of contract.

16. Termination

(1) After termination of this Agreement, the Client may retrieve its data via the export function of the service. The Contractor shall delete the data after expiry of the retention period provided for in the GTC, unless a statutory retention obligation exists.

(2) The Contractor may store personal data processed in connection with the assignment beyond the termination of this Agree ment if and to the extent that the Contractor is subject to a statutory retention obligation. In such cases, the data may be pro cessed only for the purposes of fulfilling the respective statutory retention obligations. After expiry of the retention obligation, the data shall be deleted without undue delay.

17. Final Provisions

(1) If the Client’s property held by the Contractor is endangered by measures taken by third parties (such as seizure or confisca tion), by insolvency proceedings or by other events, the Contractor shall inform the Client without undue delay. The Contractor shall inform the creditors without undue delay of the fact that the data concerned are data processed on behalf of the Client.

(2) Amendments and supplements to this Agreement must be made in text form. They may also be agreed by express confirma tion within the service, provided that the change is pointed out in the process.

(3) The Contractor is entitled to amend this Agreement with effect for the future insofar as the amendment

a) is necessary in order to adapt to amended statutory requirements, to decisions of courts or supervisory authorities or to guidelines of the European Data Protection Board, or

b) does not change the level of protection for the personal data or the rights and obligations of the Client to its detri ment, in particular in the case of editorial clarifications or improvements to the technical and organisational measures.

(4) The Contractor shall notify the Client of amendments pursuant to para. 3 in text form at least six weeks before they take effect. The notification shall contain the amended provisions, the date on which they take effect and a reference to the right to object, the objection period and the consequences of failing to object. If the Client does not object in text form within one month of receipt of the notification, the amendment shall be deemed agreed.

(5) If the Client objects in good time, the previous version shall continue to apply to it. In this case, the Contractor may termi nate the Main Agreement and this Agreement giving 14 days’ notice to the end of the month.

(6) Paras. 3 to 5 do not apply to amendments that extend the subject matter, nature or purpose of the processing, the types of personal data or the categories of data subjects. Such amendments require an agreement pursuant to para. 2. Section 10 para. 2 applies exclusively to the engagement and the change of sub-processors.

(7) Should individual parts of this Agreement be invalid, this shall not affect the validity of the remaining provisions of the Agreement.

(8) In the event of contradictions, the provisions of this Agreement take precedence over the provisions of the Main Agree ment.

Annex 1: Subject Matter of the Assignment

1. Subject Matter and Purpose of the Processing

The subject matter of the assignment follows from the Main Agreement. In detail, this includes in particular the following:

a) General

•  collection and storage of the data that the Client and its users enter or transmit via apps, terminals and inter faces;
• provision of the functions of the service, in particular working time and project time tracking, hour accounts, absence and leave management including approval processes, project and budget management, reports and anal yses, invoicing and payroll preparation;
• transmission of data to third-party systems (e.g. accounting, HR or calendar systems or AI applications via API or MCP server), insofar as the Client initiates this by setting up an interface or integration. The respective recipient is not a sub-processor of the Contractor;
• sending of system-generated transactional emails and push notifications in the mobile apps, e.g. notifications and approval requests. Push notifications contain no names and no information on reasons for absence. Delivery takes place via the push services of the operating system providers (Apple Push Notification Service and Firebase Cloud Messaging). In doing so, these provide a pure transmission service under their own responsibility and are not sub-processors of the Contractor;
• hosting, operation, maintenance, error analysis and data backup of the underlying IT systems
• support, insofar as this requires access to the Client’s data;
• deletion or return of the data on the Client’s instructions and after the end of the Agreement.

b) AI Features

Provision of AI features insofar as these are activated for the Client. The Client may activate or deactivate the AI fea tures in the service at any time. If the AI features are not activated or have been deactivated, the Contractor does not transmit any data to AI models.

The processing includes in particular the generation of suggestions from users’ inputs and voice transcripts (e.g. time entries from a description of the working day), the editing and summarisation of texts (e.g. descriptions or invoice items), the answering of questions about the Client’s data as well as analyses and forecasts relating to projects, budgets and invoicing.

Special categories of personal data, in particular information on absences that may contain such data (e.g. illness), are not transmitted to AI models. The AI features have no access to such data, even at a user’s request. If, however, a user enters such information independently in inputs or free-text fields (e.g. in an AI assistant or in descriptions of time en tries), it may be processed as part of the AI features.

Neither the Contractor nor its sub-processors use the Client’s data to train AI models.

2. Type(s) of Personal Data

The following types of data are the subject of this assignment:

• master data of users: e.g. name, personnel number, role and permissions, team or department, language;
• contact data: e.g. email address;
• employment data: e.g. working time model, target working hours, leave entitlement, hour account and overtime, cost and hourly rates;
• time tracking data: e.g. start, end, breaks and duration of working time, assigned customer, project and service, description texts, billability;
• absence data: e.g. type and period of absences (leave, home office, training, …) as well as requests and approv als;
• health data: e.g. reasons for absence that allow conclusions to be drawn about health (illness, maternity protec tion, …);
• customer, project and billing data: e.g. names and contact details of contact persons at the Client’s customers, projects and budgets, invoices and invoice items;
• usage and technical data, insofar as required for the operation, protection and error analysis of the service: e.g. login and access data, IP address, device and browser information, , device and app data of the mobile apps (e.g. device identifier for push notifications, app version, operating system), error logs, API calls;
• data from the AI features, insofar as activated: e.g. user inputs and the outputs generated by the AI model.

3. Categories of Data Subjects

The following groups of data subjects are the subject of the assignment:

• employees of the Client
• other users of the service who work for the Client (e.g. freelancers, temporary workers);
• customers of the Client or their contact persons;
• persons named in free-text fields (e.g. in descriptions of time entries).

Annex 2: Subcontracting relationship

The Contractor uses services from third parties that process data on its behalf for the processing of personal data on behalf of the Client (“sub-processors”).

These are the following companies:

Rapidmail

Adress:

Rapidmail GmbH
Wentzingerstr. 21
79106 Freiburg i. Br.
Germany

Subject matter of the engagement:

Sending of transactional emails

Microsoft Ireland Operations Limited

Adress:

Microsoft Ireland Operations Limited  
One Microsoft Place, South County Business Park, Leopardstown,  
Dublin 18, D18 P521,  
Ireland

Subject matter of the engagement:

Hosting of the  my.clockodo.com service in cluding storage of the customer data (server location Germany). If activated: operation of the AI models via Microsoft Foundry. Processing and storage within Microsoft’s EU Data Boundary (EU/EEA and Switzerland). 

Facade BV (Flare)

Adress:

Facade BV,  
Kruikstraat 22/12, 2018 Antwerpen,  
Belgium

Subject matter of the engagement:

Service monitoring and error tracking 

Functional Software Inc. d/b/a Sentry

Adress:

Functional Software Inc. d/b/a Sentry  
45 Fremont Street, 8th Floor  
San Francisco, CA 94105  
USA 

Subject matter of the engagement:

Service monitoring and error tracking 

Transfer instrument for data transfers to third countries:

EU-US Data Privacy Framework (Non-HR Data only) and EU Standard Contractual Clauses 

Hetzner Online GmbH

Adress:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Subject matter of the engagement:

Emergency server for Clockodo databases 

 

 

Annex 3 - Technical and Organisational Measures of the Contractor

The Contractor takes the following technical and organisational measures for data security within the meaning of Art. 32 GDPR.

Clockodo GmbH takes the following technical and organisational measures in order to ensure an appropriate level of protection when processing personal data in connection with the use of the SaaS solution clockodo.com. End customer data are processed and stored in ISO-certified Microsoft data centres in the EU Data Boundary. The technical and organisational measures taken by Microsoft can be found at https://www.microsoft.com/de-de/trust-center.

The effectiveness of the technical protective measures is reviewed at least annually. This also includes an assessment of the appropriateness of the level of protection and, where applicable, an adjustment to the current state of the art, for example a migration to newer encryption methods.

Date of last update: 9 October 2026

1. Confidentiality

Measures suitable for preventing unauthorised persons from gaining access to the data processing facilities and from using 
the data processing systems. 

Building management

• Good lighting of outdoor areas
• Security locks on the building doors
• Secure storage of keys not in use
• Persons without access authorisation may enter sensitive areas only under supervision
• Guests and visitors must report to reception
• Guests and visitors are always accompanied by employees
• External service providers must identify themselves when entering the premises/building
• Maintenance work by external service providers is supervised by internal staff

Personnel

• Employee agreement on the handling of keys/codes etc. (including in the event of loss)
• Established off-boarding process, among other things to inform all relevant departments/employees and to im plement all necessary changes regarding the permissions grantedPaper documents are kept in storage facilities appropriate to the risks
• Employee instruction to comply with the ""clean desk principle""
• Regular employee training on relevant data protection and IT security topics
• All employees sign a confidentiality undertaking
• All employees sign an IT usage agreement
• All employees sign an agreement on private email and internet use
• All relevant employees sign a policy on home/mobile office

IT

• Double opt-in for registration (activation link with limited validity)
• IT devices are secured by individual, state-of-the-art authentication methods
• Employees are instructed to actively lock IT devices when leaving the workstation
• Passwords are stored using a suitable cryptographic method
• Two-factor or multi-factor authentication for high-risk processing
• Automatic account lockout after repeated incorrect password entry
• Factory-set authentication information is changed without undue delay
• Full encryption of computers and laptops and external storage media
• Use of mobile device management (MDM)
• Access permissions based on the ""need-to-know"" principle
• Regular (random-sample) review of the permissions granted
• Role-based access control (RBAC) at user level, including within the AI processing
• Segmentation of networks
• Use of regularly updated antivirus software on all IT devices
• Regular vulnerability scans
• Defined deletion periods and automated deletion processes
• Destruction of storage media in accordance with the state of the art
• Carrying paper documents and data (media) outside the business premises is permitted only where strictly nec essary
• Destruction of files and storage media in accordance with the state of the art
• Separation of production, archive and test environments
• Secure software development and delivery through code review and defined release processes
• Separation of tenant data at database level
• Separation of tenant data in the AI processing: prompts, context, caches and indexes contain only data of the respective tenant
• IT and data protection incidents are handled via a defined process
• Remote wiping of mobile devices in the event of loss
• Unauthorised access to the company network is prevented by a ("NextGen") firewall
• Technical exclusion of sensitive reasons for absence and of special categories from the AI processing
• Pseudonymisation of personal data where possible
• Masking of sensitive customer data for Clockodo service staff
• Encryption of the database by Microsoft

2. Integrity

Measures that ensure that personal data cannot be read, copied, altered or removed without authorisation during elec
tronic transmission.

• Transport encryption (TLS) for all public connections over which personal data are transmitted - website via HTTPS protocol
• Remote access from insecure networks to the internal company network is generally carried out via a secure VPN connection • Implementation of the HSTS standard
• Where technically possible, individual input and deletion logs are created
• Encrypted backups separated from the production system with restricted access
• Careful selection of the processors as well as regular monitoring of the sub-processors beyond the selection stage

3. Availability and Resilience

Measures that ensure that personal data are protected against accidental destruction or loss. 

• Automatic security updates of the operating system and software applications
• A backup concept appropriate to the risk and the state of the art exists, which is evaluated regularly and adapted 
  as needed
• An emergency plan appropriate to the risk exists