Data processing agreement (DPA)

1. Parties and subject matter

The controller is the customer (“Controller”). The processor is IBA-TEC | IT-Systemhaus GmbH, Möhnestrasse 55, 59755 Arnsberg (“Processor”), operator of the Wandlix service. For businesses this agreement is part of the general terms and conditions (see section 3 of the terms) and applies once they are accepted.

The subject matter is the processing of files the Controller uploads through the website or the interface (API) in order to convert, check or edit them (e.g. merge PDFs, Office to PDF, e-invoice check).

2. Nature, purpose, data and data subjects

Nature of processing: technical handling of the uploaded file and delivery of the result. Purpose: providing the conversion or check triggered by the Controller.

Type of data: the content of the uploaded files. It depends on the Controller and may contain personal data (e.g. names, addresses, invoice data). Data subjects: people whose data is contained in those files (e.g. the Controller’s customers, employees, business partners).

The Processor does not analyse file contents, does not build profiles and does not use them for its own purposes.

3. Duration and deletion

Processing lasts only as long as the individual request runs. Files are held in memory only, never written to disk, and discarded with the response; in any case they are deleted after one hour at the latest. After a server restart nothing is left.

Files and file names are not stored in logs, databases or backups. The agreement runs as long as the Controller uses the service and ends with the deletion of the account.

4. Instructions and obligations of the Processor

The Processor processes data only on documented instructions from the Controller. The instruction results from using the service (choice of tool and options). If the Processor considers an instruction unlawful, it says so.

Everyone who could have access is bound to confidentiality. The Processor assists the Controller with data subject requests, data protection impact assessments and breach notifications where it has the information, and reports a personal data breach without undue delay.

5. Technical and organisational measures

Processing exclusively on our own servers in Germany; no external processing services and no processing outside the EU.

Encrypted transfer (TLS); files in memory only; automatic deletion after one hour at the latest; virus scan of every upload; conversion containers without network access, without root rights and with time, memory and CPU limits.

Server access by key only; firewall and automatic lock-out after failed attempts; automatic security updates. Admin access only for authorised persons, additionally protected by a passkey; changes are logged. Database backups contain no file content and are encrypted.

The measures are reviewed continuously and adapted to the state of the art. A more detailed description is on the “Security & privacy” page.

6. Sub-processors

The Controller agrees to the use of the following sub-processors: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus (hosting provider of the server in Germany; its data processing agreement is annexed to its terms of service and contains the EU standard contractual clauses; the list of its sub-processors is in Appendix 3 of that agreement); operation of the servers, no access to file contents held in memory.

For e-mail sign-in codes and notifications Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) is used, with servers in the EU. The transfer to the US company relies on the EU standard contractual clauses in Resend's data processing agreement, which is part of its terms of service, and on its participation in the EU-US Data Privacy Framework. The current list of Resend's sub-processors is available at https://resend.com/legal/subprocessors. Resend only receives the e-mail address and the message text, never files. Payments are handled by Stripe as an independent controller; no files are transmitted.

The Processor announces changes in good time; the Controller may object for good cause.

7. Audit rights and evidence

On request the Processor provides the information needed to demonstrate compliance and allows audits (also by third parties) after reasonable notice and during normal business hours.

8. End of processing, liability, final provisions

After the end of the service remaining personal data is deleted unless a statutory retention duty applies (e.g. invoice data). Liability is governed by Art. 82 GDPR.

German law applies; the place of jurisdiction is, where permitted, Arnsberg. Changes require text form. Invalid provisions do not affect the others.

9. Conclusion and scope of the agreement

The agreement takes effect when the customer accepts the general terms: when signing in (one-time code by e-mail) or when buying credits, in each case after the explicit notice about the terms and this agreement. It covers all processing the customer triggers afterwards through the account or API key. A signature is not required.

The version that was on this page at the time of acceptance applies. The processor announces later changes, in particular new sub-processors, to signed-in accounts by e-mail in good time (see section 6). Those who process personal data only for personal purposes do not need this agreement.

On request the processor provides a signed copy (e-mail to support@wandlix.com).