Data processing agreement

Version and status of this document

Version of 9 October 2026. New versions take effect in accordance with the section "Liability and final provisions".

For questions regarding its content or for the conclusion of an individual data processing agreement, please contact hello@erseni.com.

Conclusion of this agreement

This DPA forms part of the contract for the Erseni Hub platform and is concluded together with it in accordance with the provisions of the General Terms and Conditions on the conclusion of the contract. It also covers personal data that we have processed for the controller since the registration of the business. It can be accessed at any time in the customer area, where it can be printed or saved as a PDF. We record the details of the conclusion with the confirmation of the registration.

Upon conclusion, we store the contracting party, the name provided, the version concluded, the language version and the time of conclusion, and we send the full text of the version concluded to the email address on file. The list of sub-processors and of the systems we operate ourselves that applies at the time of conclusion forms part of the concluded text as an annex and is stored and sent together with it. Conclusion by electronic means satisfies the requirement of electronic form under Art. 28 (9) GDPR; no signature is required.

Parties and subject matter of the processing

This data processing agreement (hereinafter the "DPA") sets out in detail the data protection obligations of the parties arising from the use of the service. It applies to all processing of personal data that we carry out on behalf of and on the instructions of the controller.

Controller

The controller within the meaning of this DPA is the business whose website we create and operate on the Erseni Hub platform and whose details are stored in the customer area. It determines the purposes and means of the processing of the personal data arising from the operation of its website.

Processor

Erseni Ltd, Private Company Limited by Shares
Archiepiskopou Makariou III, 59, MOUYIAS TOWER, 3rd floor, Flat/Office 301
6017 Larnaca, Cyprus
Registration number: HE 487031
Email: hello@erseni.com

Subject matter of the processing

The subject matter of the processing is the creation and operation of the controller's website on the Erseni Hub platform (hereinafter the "service"). This includes hosting and delivering the pages, receiving and forwarding enquiries from booked modules, backup and maintenance.

In addition, our privacy policy applies to the processing operations for which we are ourselves the controller. In the event of conflicts between this DPA and the privacy policy, this DPA takes precedence.

Nature, scope and purpose of the processing

Nature of the processing

Collection, storage, provision, forwarding, backup and erasure of the personal data arising from the operation of the website and its booked modules. The processing is largely automated. The data is not analysed for our own purposes.

Purpose of the processing

The sole purpose is to provide the website and its functions to the controller.

Duration of the processing

The processing takes place for the term of the contract for the Erseni Hub platform and ends with the deletion in accordance with the section on return and deletion.

Categories of personal data

On behalf of the controller, we process the following categories of data:

Enquiries from booked modules, such as the contact form: name, email address, telephone number and message.
Master data and content of the website, in so far as they relate to persons, such as the name of the management and contact details.
Server access logs containing the IP address truncated before storage (without the last octet for IPv4, without the trailing part for IPv6), the time, the path requested, the status code, the volume of data transferred, the referrer and the user agent. They are deleted after 90 days.

Processing under our own responsibility

This DPA does not cover the contract and billing data of the controller or the accounts and contact data of the persons who manage the business in the customer area; we process these ourselves in order to perform the contract for the platform. Our privacy policy applies to them.

Categories of data subjects

Visitors to the website.
Persons who submit an enquiry via the website.
Owners, management and employees of the controller.

Special categories of personal data

The website is not designed for the processing of special categories of personal data within the meaning of Art. 9 GDPR. If the controller nevertheless records such data, the lawfulness of that processing is solely the responsibility of the controller.

Processing on documented instructions

We process personal data solely on documented instructions from the controller, unless we are required to do so by Union or Member State law. In such a case we inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The controller gives instructions via the settings in the customer area or in text form, for example by email to the address stated in the section "Version and status of this document". The settings in the customer area constitute instructions.

We inform the controller without undue delay if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. We are entitled to suspend the execution of such an instruction until it is confirmed or amended.

Personal data is processed in a third country or by an international organisation only to the extent that this is disclosed in the list of sub-processors and the requirements of Chapter V GDPR are met. The servers are located in a data centre in Germany and thus in the European Union.

Where the controller is established outside the European Economic Area, the transfer of personal data from us to the controller is additionally governed by the standard contractual clauses pursuant to Implementing Decision (EU) 2021/914, Module Four (transfer processor to controller). We are the data exporter and the controller is the data importer. The information in this DPA on the parties, the subject matter, the categories of data and the data subjects constitutes Annex I, and the technical and organisational measures constitute Annex II, of the standard contractual clauses. In the event of conflict, the standard contractual clauses prevail.

Confidentiality of personnel

We ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

The group of persons with administrative access to the production systems is limited to the minimum strictly necessary for operations.

The obligation of confidentiality continues to apply after the end of the respective activity and after the termination of this agreement.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we implement the technical and organisational measures described below in order to ensure a level of security appropriate to the risk.

Physical access control

The servers are physically operated in a data centre of Hetzner Online GmbH in Falkenstein, Germany. Access protection, video surveillance, fire protection and uninterruptible power supply are ensured there by the data centre operator; the corresponding evidence is available via the operator. We do not maintain our own premises with access to the controller's personal data.

System access control

Administrative access to the servers takes place exclusively via SSH using public key authentication; password login is disabled.
Administrative accounts are assigned on a named-person basis and limited to the group of persons required for operations.
Passwords of user accounts are stored solely as hash values using a computationally intensive procedure suitable for passwords. Access credentials and key material for services are stored in encrypted form and are not held in the source code.
The systems are protected by a firewall; only those services required for operations are reachable from outside. Database and cache services are not accessible from outside.

Data access control

Within the application there is a role-based authorisation concept.
Only the data required for the purpose is collected.

Transfer control

All transmissions between the end device and the server take place exclusively via TLS-encrypted connections. Unencrypted requests are redirected to HTTPS.
The application employs security-related HTTP headers, including a Content Security Policy and HTTP Strict Transport Security, in order to impede the execution of foreign code and a downgrade of the transport encryption.

Input control

Logging in to the customer area requires access to the email address on file. Logins to the servers are recorded in the system log.

Availability control and resilience (Art. 32 (1) (b) and (c) GDPR)

The application server with the database is backed up automatically every day. The backups of the last 7 days are retained; older backups are overwritten automatically. The backups are held by our hosting provider in the European Union. The self-operated systems for sending mail are not backed up.
The operating system and the components used are updated regularly; security-related updates are applied promptly.
Operations are monitored; disruptions and error conditions are reported automatically.

Separation control

Data of different projects is processed logically separated in dedicated databases. Production, staging and development environments are separated from one another; no production personal data is used in development environments.

Secure development

Changes to the source code undergo a review and are deployed via an automated pipeline.
Static code analysis and automated tests are used, which must pass without errors prior to deployment.
The third-party libraries used are pinned to fixed versions and are changed exclusively via the deployment pipeline. The deployment pipeline automatically screens those libraries for known vulnerabilities; a finding is reported and assessed by us, but does not stop the deployment.

Testing and evaluation (Art. 32 (1) (d) GDPR)

The effectiveness of the measures is reviewed as and when required and upon material changes to the architecture, the systems or the sub-processors, and this document is updated accordingly.

Limits of the measures

We consider it part of a credible security commitment to also disclose what we do not provide:

We currently hold no certification under ISO/IEC 27001, no certification under Art. 42 GDPR, and we are not subject to any approved code of conduct under Art. 40 GDPR.
To date, no external security audit and no penetration test has been carried out.
Databases and backups are not additionally encrypted on the servers, unless otherwise agreed in the individual case.

Sub-processors

The controller grants general written authorisation for the engagement of further processors within the meaning of Art. 28 (2) sentence 2 GDPR. The sub-processors engaged at the time of conclusion of the contract are set out in the separately maintained list and are deemed authorised. The systems we operate ourselves, which are listed there alongside them, are not sub-processors; the provisions of this section do not apply to them.

In addition to the hosting provider, we use systems that we operate ourselves: our own mail server for sending notifications and a self-operated GitLab instance for technical error reports. They run on servers of the same hosting provider in Germany and are identified separately in the list as systems we operate ourselves. Error reports contain technical information about the error and may contain personal data from the request concerned; we remove passwords and access keys before transmission. We retain error reports for as long as they are required for troubleshooting and for documenting it.

We impose on each sub-processor, by contract, the same data protection obligations as are incumbent on us under this agreement, and we remain liable to the controller for the sub-processor's compliance with the data protection obligations.

We inform the controller of any intended changes concerning the addition or replacement of a sub-processor at least 30 days in advance by email to the address on file and on the page listing the sub-processors. The controller may object to a change on data protection grounds in text form within this period. If the controller does not object in time, the change is deemed approved. If the controller objects, we do not use the new sub-processor for it, in so far as this can reasonably be expected of us; otherwise the controller may terminate this DPA and the underlying contract with effect from the date of the change without further cost. We refund on a pro rata basis any fees paid in advance for the period after termination.

Sub-processors obtain access to personal data only to the extent necessary for their respective service.

We use tools of external providers with which we have error reports or data from the service processed, in particular AI-based analysis tools, only if the provider is disclosed in the list of sub-processors, and only for the purpose stated there.

You will find the current list of sub-processors, including purpose, region and privacy information, here: List of sub-processors

Assistance with data subject rights

We assist the controller, in so far as this is possible, by appropriate technical and organisational measures for the fulfilment of its obligation to respond to requests by data subjects for the exercise of their rights under Chapter III GDPR (Art. 28 (3) (e) GDPR).

If a data subject contacts us directly, we forward the matter to the controller without undue delay, in so far as the request relates to processing carried out on its behalf. In such a case we do not respond independently.

We further assist the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular with a data protection impact assessment and any prior consultation of the supervisory authority, and make the information available to us available for this purpose.

We provide the assistance services free of charge to the customary extent. For any effort going beyond this that is not attributable to a circumstance for which we are responsible, we may claim reasonable remuneration; we give advance notice of this.

Notification of personal data breaches

We inform the controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach that occurred in the course of the processing on its behalf (Art. 33 (2) GDPR). The notification is sent in text form to the email address that was on file when this DPA was concluded or that the controller has notified to us since.

The notification contains, in so far as known to us, a description of the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed. Where not all information is immediately available, we provide it without undue delay thereafter.

We take the necessary measures without undue delay to secure the data and to mitigate possible adverse effects, and we agree any further measures with the controller.

The notification to the supervisory authority under Art. 33 GDPR and the communication to data subjects under Art. 34 GDPR are incumbent on the controller. We do not make such notifications independently on behalf of the controller, but we support it in doing so.

Security incidents and vulnerabilities may be reported at any time to hello@erseni.com and via the reporting channel published at "/.well-known/security.txt".

Deletion and return after the end of the contract (deletion concept)

Each business has its own database with its own database user, separate from the data of other businesses. The platform automatically deletes enquiries from the contact form 180 days after they are received.

A termination of the contract for the platform that is received by the 15th of a month ends the contract at the end of that month, a later one at the end of the following month. Until the end of the contract, the website remains online and the controller can withdraw the termination in the customer area. When the contract ends, the website goes offline and continues to exist offline for 30 days; the termination can then no longer be withdrawn. Until this period expires, the controller can view its data in the customer area and request a copy of its data. Upon expiry of the period, we automatically and permanently delete the business's database with master data, content and enquiries, the access accounts for the business and the image files generated for the business.

Backups

The application server with the database is backed up automatically every day; the self-operated systems for sending mail are not backed up. The backups of the last 7 days are retained; older backups are overwritten automatically. A deleted record is therefore removed from all backups no later than 7 days after its deletion; records are not deleted individually within existing backups. The transaction logs of the database are continuously overwritten during operation and are not archived.

Return and deletion after the end of the contract

After termination of the contract, at the controller's choice, we either hand over the data processed on its behalf in a common machine-readable format or delete it, no later than 30 days after the end of the contract and unless Union or Member State law requires its retention. If the controller makes no choice, we delete the data. For this service, the controller makes its choice until the offline period under the section on the deletion concept expires: until then, it can request a copy of its data in a common machine-readable format in the customer area or in text form; we provide it to the controller before the deletion. If it does not request a copy, this counts as choosing deletion. The deletion takes place upon expiry of the offline period and thus 30 days after the end of the contract; we point out this consequence in the confirmation of the termination.

Upon request we confirm the deletion to the controller in text form.

Evidence and audit rights

We make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller (Art. 28 (3) (h) GDPR).

Evidence is provided primarily by presenting this documentation, the description of the technical and organisational measures, the list of sub-processors and the evidence made available by our service providers.

Where the controller considers this evidence insufficient in an individual case, we allow an on-site audit subject to reasonable advance notice, as a rule no more than once per calendar year (more frequently where there is a specific reason or at the request of a supervisory authority), during normal business hours, without disruption to operations and while preserving confidentiality towards other customers. The mandated auditor must not be in competition with us.

We expressly point out that we are currently unable to present any certification or external audit report that would replace an audit by the controller.

Liability and final provisions

Liability towards data subjects is governed by Art. 82 GDPR. For damage arising from the processing of personal data on behalf of the controller, we are liable, as between the parties, without limitation for intent and gross negligence, for damage resulting from injury to life, body or health, in cases of fraudulent intent, in so far as we have given a guarantee, and under mandatory statutory provisions. In cases of simple negligence, we are liable only for the breach of an essential contractual obligation, the fulfilment of which makes the proper performance of the contract possible in the first place and on the observance of which the controller may regularly rely, limited to the damage that is typical for the contract and foreseeable and to the fees paid by the controller in the twelve months preceding the damaging event, but to no less than 500 euros. If we or the controller are held liable by a data subject under Art. 82 GDPR, each party bears, as between the parties, that part of the compensation which corresponds to its share of responsibility for the damage (Art. 82 (5) GDPR); the above limitations do not apply to this apportionment. Administrative fines are borne by the party on which they are imposed.

The controller is solely responsible for the lawfulness of the processing, in particular for the content of its website, the privacy information provided to its visitors and the legal bases of the booked modules.

This DPA applies for the term of the contract for the Erseni Hub platform and ends together with it. The provisions on confidentiality and on deletion continue to apply beyond that. In the event of conflicts with the General Terms and Conditions, the provisions of this DPA take precedence in so far as they concern the processing of personal data, including liability for damage resulting from that processing.

We may update the description of the technical and organisational measures, provided that the level of protection is not thereby reduced; for sub-processors, the procedure set out in the section "Sub-processors" applies. We announce any other new version of this DPA to the controller in accordance with the provisions of the General Terms and Conditions on their amendment by email to the address on file, pointing out the time limit and the significance of silence; at the same time, we make the new version available in the customer area. If the controller does not object in text form by the announced date, the new version takes effect. If it objects, the previous version continues to apply to it; the right of both parties to terminate under the General Terms and Conditions remains unaffected. We amend the DPA in this way only where the amendment does not fall below the agreed level of protection, in particular in order to reflect changes in legislation, requirements of supervisory authorities or new functions of the platform; other amendments take effect only once the controller concludes them in the customer area.

Amendments and supplements to this DPA must be made in text form. This also applies to any waiver of this formal requirement.

Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions shall remain unaffected. The parties shall replace the invalid provision with a valid provision that comes closest to its economic and data protection purpose.

This DPA is governed by the laws of the Republic of Cyprus, excluding the UN Convention on Contracts for the International Sale of Goods; mandatory provisions of the GDPR remain unaffected. The exclusive place of jurisdiction for all disputes arising from this DPA is Larnaca, Cyprus, provided that the controller is a business, a legal entity under public law or a special fund under public law. The competence of the data protection supervisory authorities remains unaffected.

This DPA is available in German, English and Greek. In the event of discrepancies between the language versions, the German version prevails.

Annex: Sub-processors and systems we operate ourselves

List as of: 29 September 2026

The list sets out all sub-processors and systems we operate ourselves that we use for the services provided under this DPA. Entries marked "Only for ..." relate exclusively to the applications named there. The authorisation under the section "Sub-processors" extends only to those sub-processors that actually act for the controller's service; for a service that does not include an application, we do not use the sub-processors disclosed for that application and do not transfer any of the controller's data to them.

Sub-processors engaged

Hetzner Online GmbH: Operation of the servers and databases of the applications, backups and resolution of the domains (DNS). Falkenstein data centre, Germany (EU). Privacy information DPA
seven communications GmbH & Co. KG: Sending text messages, for example sign-in PINs and notifications: mobile number and message text. Only for the applications Meine MAV and Mein Betriebsrat. Kiel, Germany (EU). Privacy information
DeepL SE: Translation of user contributions such as forum posts, comments, chat messages and tickets. Only for the application Cyber Sovereigns. Cologne, Germany (EU). Privacy information
Groq, Inc.: Detecting the language of user contributions and, as a fallback, translating them when the translation service does not respond. Only for the application Cyber Sovereigns. USA. The transfer is based on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) in the provider's data processing agreement for its commercial services. Privacy information
Portunity GmbH (faxnummer.de): Sending forms by fax: content of the form and fax number of the recipient. Only for the application Cyber Sovereigns. Germany (EU). Privacy information

Systems we operate ourselves (not processing by a sub-processor)

Stalwart Mail Server: Sending e-mails of the applications, for example notifications and sign-in PINs. Instance operated by us on rented infrastructure in Germany (EU); no external provider. Privacy information
Matomo Analytics: Cookieless audience measurement of the public pages without disclosure to third parties. Instance operated by us on rented infrastructure in Germany (EU); no external provider. Privacy information
GitLab: Recording technical error reports to resolve faults. They may contain personal data from the affected request. Instance operated by us on rented infrastructure in Germany (EU); no external provider. Privacy information
Jitsi Meet: Video conferences in the applications: name, e-mail address and profile picture of the participants as well as audio and video during the session. Instance operated by us on rented infrastructure in Germany (EU); no external provider. Privacy information