Terms & Conditions
SaaS Licence Terms · Version 21 January 2025
These SaaS Licence Terms govern the licensing and provision of the turfcoach platform by Turf Coach GmbH. The English version is the binding version; the German text is a non-binding translation.
- 1. Scope of application
- 2. Conclusion of Contract
- 3. Platform
- 4. Contractual Components
- 5. Rights of use
- 6. Provision of the Platform and maintenance services
- 7. Updates
- 8. Troubleshooting and Support services
- 9. Customer obligations
- 10. Prohibited use of the Platform
- 11. Responsibility of Turf Coach
- 12. Data protection
- 13. Interfaces to third-party software
- 14. Open-Source Software
- 15. Use of AI
- 16. Confidentiality
- 17. Renumeration
- 18. Warranties
- 19. Liability
- 20. Term and Termination
- 21. Blocking of content and complaint management
- 22. Other provisions
- 1. Scope
- 2. Defined Terms
- 3. Description of data processing
- 4. Rights and Obligations of the Controller
- 5. Instructions
- 6. Obligations of the Processor
- 7. Sub-processors
- 8. Place of data processing
- 9. Documentation and Audits
- 10. Data security
- 11. Return and deletion of data of the Controller
- 12. Term and Termination
- 13. Final Provisions
1.Scope of application
These SaaS Licence Terms ("Terms") apply to the licensing and provision of a Platform as a Service platform turfcoach ("Platform") and the services offered in this context by Turf Coach GmbH, Kottbusser Damm 86, DE 10967 Berlin ("Turf Coach").
These terms and conditions become an integral part of all contracts ("Individual Contracts") concluded between Turf Coach and the contractual partner ("Customer") for the licensing of the Platform. This also applies if these Terms are not expressly included in the Turf Coach offer. General terms and conditions of the Customer do not apply.
Individual Contracts usually consist of an individual offer by Turf Coach and a purchase order placed by the Customer.
The Customer has to be a commercial entity as defined in sec. 14 of the German Civil Code (Bürgerliches Gesetzbuch). These terms and conditions do not apply to consumers within the meaning of sec. 13 of the German Civil Code.
2.Conclusion of Contract
Contracts with Turf Coach are concluded through an offer by Turf Coach and the unconditional acceptance by the Customer ("Contract"). Offers made by Turf Coach are non-binding and can be revoked by Turf Coach at any time until they are accepted by the Customer. The electronic communication channel is deemed to be agreed with the Customer.
Unless expressly agreed otherwise, the object of delivery or service shall only have the contractually warranted characteristics; these shall only constitute guarantees if Turf Coach expressly declares that it wishes to assume liability for them regardless of fault or if they are expressly designated as such by Turf Coach; guarantee declarations must be made in writing to be effective.
Quality requirements or other performance requirements (e.g. IT security requirements, compliance requirements, programming requirements, documentation requirements) shall only become part of the contract if they were expressly included upon conclusion of the contract and confirmed by Turf Coach without reservation.
3.Platform
The Platform is a Platform-as-a-service solution designed to facilitate the monitoring and management of sports turf. It provides tools for collecting and analyzing data related to turf conditions, supporting users in planning and maintaining sports facilities.
The specific scope of services and functions of the Platform is set out in the Individual Contract.
When using the Platform or a service labeled as a "beta version", the Customer is aware that the Platform may still be faulty and that damage to the system may be possible under certain circumstances.
4.Contractual Components
The following documents are part of the contract:
Data processing agreement;
Individual Contract and any documents referenced therein;
these Terms.
In the event of contradictions, the documents mentioned first shall take precedence over the documents mentioned subsequently.
5.Rights of use
Turf Coach grants the Customer the non-exclusive, revocable, non-transferable right to use the Platform as a cloud application for the duration of the contract in accordance with its intended use.
Turf Coach reserves the right to continuously develop the Platform and to expand the scope of functions or to adapt or restrict them to an appropriate extent.
The creation of individual adaptations or configurations of the Platform ("Customizations") must be contractually agreed. Without a contractual agreement, there is no entitlement to the creation of Customizations. Insofar as Turf Coach creates Customizings for the Customer, the rights of use to the Platform granted under these Terms shall also apply to Customizings.
Notwithstanding the rights of use granted under these Terms, Turf Coach retains all rights to the Platform.
If any content stored by the Customer on the Platform is protected by copyright, trademark law or other legal rights, the Customer grants Turf Coach the right to use such content to the extent necessary for the contractual or intended provision of the Platform. This includes, in particular, the right to make the content accessible via the internet, to reproduce it, and to distribute it.
The Provider is entitled to use data stored or processed on the Platform for its own purposes, provided such use is necessary for the operation, improvement, or development of the Platform. The Provider shall ensure that any use of personal data complies with applicable data protection laws. Where possible, data shall be anonymized or aggregated to the extent that no individual user or Customer can be identified by third parties without disproportionate effort.
6.Provision of the Platform and maintenance services
The Platform is provided as a cloud application. Turf Coach shall provide the Customer with the latest version of the Platform and the associated storage space for use via the internet and shall carry out any necessary maintenance work.
Turf Coach does not provide the Platform as a high-availability solution and is therefore not responsible for the uninterrupted availability of the Platform. However, Turf Coach shall take appropriate measures to achieve an availability of approximately 90 % on a monthly average. Availability is defined as the ability of the customer to use the owed functionalities of the contract Platform without restriction. Downtimes due to maintenance work shall not be considered a limitation of availability.
Maintenance services are included in the remuneration for the provision of the Platform. Maintenance services include regular checks of the Platform to ensure its contractual performance and security, including bug fixes and the provision of updates, patches or releases. Turf Coach shall take appropriate account of the legitimate interests of the Customer and inform the Customer in good time of any necessary maintenance work. In general, Turf Coach shall carry out maintenance work outside core business hours.
Improvements, innovations and enhancements or new functions of the contractual Platform ("Upgrades") are not covered by the contractually owed maintenance services. Upgrades shall be provided against separate remuneration on the basis of a separate agreement. However, Turf Coach is free to provide such upgrades free of charge.
Turf Coach shall take appropriate technical measures to protect the Platform to prevent unauthorized access by third parties. In particular, Turf Coach shall use state-of-the-art transport encryption for this purpose.
7.Updates
Turf Coach is entitled to update and expand the content and functions of the Platform at any time in order to ensure its high quality standard on an ongoing basis ("Update"). For the duration of the contract period, Turf Coach shall provide the Updates required to maintain the contractual conformity of the Platform.
If an Update has to be installed or activated by the Customer and the Customer fails to install or activate the Update despite being requested to do so by Turf Coach, Turf Coach shall not be responsible for a product defect that is solely attributable to the absence of this Update.
8.Troubleshooting and Support services
The Customer shall inform Turf Coach immediately of any errors or defects in the Platform. In this case, Turf Coach shall make reasonable efforts to keep the downtime and rectification time as short as possible. Errors shall be categorized according to their severity and Turf Coach shall give priority to rectifying serious errors.
Insofar as the reported errors are caused by improper or non-contractual use of the Platform by the Customer, the Customer shall reimburse the expenses incurred for the rectification of errors at standard market conditions.
Turf Coach shall provide support services and general consulting services (e.g. user training) by corresponding agreement and against separate remuneration. However, Turf Coach is free to provide such support services and general consulting services free of charge.
The Customer is invited to provide feedback on the Platform and on the support and maintenance services. Turf Coach shall take this feedback into account in order to continuously improve the quality of its services. The Customer grants Turf Coach the right to use the feedback to improve the Platform or other services of Turf Coach free of charge and without restriction in terms of time, place or content.
9.Customer obligations
The Customer shall take appropriate technical and organizational measures to prevent unauthorized access to the Platform by third parties.
Insofar as special system requirements are specified for the use of the Platform, the Customer must ensure at their own responsibility that these are fulfilled by their system.
10.Prohibited use of the Platform
The Platform may not be used for purposes other than those defined in the service description.
The Platform may not be modified, decompiled, reverse engineered or disassembled. Furthermore, no other attempt may be made to extract the source code of the Platform.
No content may be stored or disseminated in the Platform that violates applicable laws, in particular, professional regulations, official orders or third-party rights (e.g. copyrights, industrial property rights, personal rights) or that has offensive, racist, defamatory or libelous content.
The use of the Platform shall not violate competition law regulations and, in particular, no unfair or harassing advertising may be disseminated.
No content shall be stored in the Platform that contain spam, harmful code, viruses or other malware or other information, files or programs that could interrupt, destroy and/or restrict the functionality of Platform or hardware or telecommunications equipment.
The Customer may not use the Platform as a reseller.
No protective notices, such as copyright notices and other legal reservations, may be changed, removed or added.
11.Responsibility of Turf Coach
Turf Coach does not carry out any content or technical checks on the data entered by the Customer in the Platform. In particular, Turf Coach is not responsible for the accuracy or completeness of the data entered by the Customer.
The Platform does not provide reliable suggestions, recommendations or calculations. Every output from the Platform has to be checked and verified by the Customer.
Turf Coach is not responsible for infringing content that is stored in or distributed via the Platform by the Customer.
The Customer is solely responsible for the accuracy and completeness of the data entered into the Platform provided. Turf Coach shall not be liable for errors, losses or damage resulting from inaccurate, incomplete or misleading information.
12.Data protection
Turf Coach shall comply with the statutory provisions on the protection of personal data, in particular those of the EU General Data Protection Regulation (GDPR) and the German Data Protection Act (Bundesdatenschutzgesetz, BDSG) when handling the personal data of the Customer. Turf Coach confirms that its employees and other vicarious agents have been obliged in writing to maintain confidentiality with regard to personal data and have been familiarized with the data protection regulations (in particular the BDSG and the GDPR).
Turf Coach and its employees or vicarious agents are prohibited from processing personal data obtained in the context of the contract for any purpose other than the purpose of fulfilling the respective task; Turf Coach is not permitted to disclose or make such data accessible to third parties unless this is necessary for the fulfillment of the contract.
The Customer is responsible for the processing of personal of the Customer data and the information on data processing for data subject in connection with the provision of the Platform from a data protection perspective. Turf Coach shall act as a processor with regard to the provision of the Platform for the Customer from a data protection perspective. Against this background, the agreement on order processing pursuant to Art. 28 GDPR (Annex 1) shall become an integral part of these Terms. In the event of contradictions between the order processing agreement and these Terms and the provisions of the order processing agreement shall take precedence
13.Interfaces to third-party software
The Platform may integrate with third-party software or services to provide additional functionality. Turf Coach is not responsible for the availability, performance, or accuracy of such third-party software or services. The Customer acknowledge that the use of third-party interfaces is subject to the terms and conditions of the respective third-party providers.
14.Open-Source Software
Insofar as the Platform contains open- source software and this is required according to the respective terms of use and license conditions of the open-source software, Turf Coach shall provide the Customer with the source code and the respective license conditions.
The rights of use granted under these Terms do not apply to open-source components of the Platform, unless this is permitted under the respective terms of use and license of the open-source software.
15.Use of AI
Turf Coach reserves the right to use systems with artificial intelligence ("AI systems") as part of the provision of services to analyse data and provide recommendations, predictions, or insights. These outputs are based on probabilistic models and are inherently subject to potential errors or inaccuracies.
The Customer acknowledges that AI-generated outputs are not guaranteed to be error-free or definitive.
Turf Coach strongly recommends that users exercise caution and critical judgment when relying on AI-generated outputs, especially for significant decisions.
Insofar as deliveries or services of Turf Coach include AI systems that are subject to the EU AI Regulation or other AI regulation, Turf Coach shall offer the necessary support services for the implementation of the legal requirements (e.g. documentation obligations, risk assessments) against separate remuneration.
16.Confidentiality
Turf Coach and the Customer are obliged to treat all confidential information and trade secrets obtained within the scope of the respective contract as confidential, in particular not to pass them on to third parties or to use them for purposes other than contractual purposes. "Confidential information" is information that a reasonable third party would consider worthy of protection or that is marked as confidential.
Turf Coach and the Customer shall take appropriate technical and organizational precautions to prevent third parties from gaining access to Confidential Information.
Turf Coach and the Customer undertake to agree with all employees and subcontractors on a regulation with the same content as the preceding paragraph.
After consultation with the Customer, Turf Coach may advertise the relationship with the Customer, i.e. in particular publicly name the Customer as a customer, use the customer logo on Turf Coach's website and in the context of social media. In the event that the Customer agrees (to any use of any of its name, trademarks or logos ("Trademarks") by Turf Coach, the Customer grants to Turf Coach a non-exclusive, non-transferable, royalty-free right to display and use its Trademarks for the purposes of marketing during the term of the Individual Contract.
17.Renumeration
The Customer shall pay license fees for the use and provision of the Platform. Details on the calculation of the license fee and the payment modalities are agreed upon in the Individual Contract.
All prices stated in the Individual Contract are subject to the applicable value added tax. The Customer is responsible for the payment of any other taxes or duties, if applicable.
In order to be able to react to cost increases, Turf Coach reserves the right to increase the license fees and the remuneration for services once per contract year from the second contract year onwards. Turf Coach shall inform the Customer of the price increase in text form, giving one month's notice to the end of the respective contract year. The amount of the adjustment shall be based on the producer price index for IT services (DL-IT) WZ08-631 of the Federal Statistical Office and shall take into account any compensation for costs in other areas. If the Customer objects within a period of fourteen (14) calendar days from the date of the change, Turf Coach shall be entitled to an extraordinary right of termination as of the date of the change. If the Customer does not object within this period, the change shall become effective for the Customer.
18.Warranties
Turf Coach shall maintain and update the Platform with the care customary in the industry. Given the current state of technology, it is not possible to keep Platform products completely free of errors with reasonable effort. However, Turf Coach shall keep the Platform free from such defects that impair its suitability for contractual or intended use more than insignificantly. The Customer must notify Turf Coach immediately of the nature and occurrence of any material defects.
No guarantee is given for the correctness, completeness and accuracy of the content, outputs and other services of the Platform.
Turf Coach warrants that the Platform does not infringe any third-party rights. The Customer shall inform Turf Coach without delay of any claims asserted against it by third parties due to the contractual use of the Platform. Turf Coach is entitled, but not obliged, to defend the asserted claims at its own expense.
If the rights of third parties are infringed by the Platform and this constitutes a defect of title, Turf Coach shall, at its own discretion and expense, (a) procure a corresponding right of use for the Customer or (b) redesign the Platform without infringing rights. If Turf Coach is unable to remedy the situation, Turf Coach shall be entitled to terminate the contract without notice. Turf Coach shall give due consideration to the Customer's interests when selecting the remedial measures.
All warranty is excluded for such defects that are based on use of the Platform that is not in accordance with the contract or the intended use.
Warranty claims expire after twelve (12) months.
Turf Coach shall not be liable for initial defects regardless of fault; § 536a para. 1 Alt. 1 of the German Civil Code (Bürgerliches Gesetzbuch) shall not apply. In all other respects, the limitations of liability of these Terms shall apply.
19.Liability
If Turf Coach is liable under statutory provisions for damage caused by slight negligence, Turf Coach's liability shall be limited: In this case, liability shall only exist in the event of a breach of material contractual obligations; these are obligations whose fulfillment is essential for the proper execution of the contract and on whose compliance the Customer regularly relies on and may rely. Liability is also limited to the typical damage foreseeable at the time of conclusion of the contract but not exceeding the amount of the remuneration due for the contractual year in question.
Irrespective of any fault on the part of Turf Coach, any liability in the event of fraudulent concealment of a defect, from the assumption of a guarantee or a procurement risk under the Product Liability Act shall remain unaffected.
Insofar as Turf Coach's liability for damages is excluded or limited in accordance with the above provisions, this shall also extend to the personal liability of the executive bodies, employees and other staff, representatives and vicarious agents and shall also apply to statutory liability in tort.
The limitations of liability in this Section shall not apply in the event of intent and gross negligence or injury to life, limb or health.
The Customer shall indemnify Turf Coach against any claims by third parties who have suffered damage as a result of a breach of the provisions of these Terms. Turf Coach reserves the right to block and, if necessary, delete the Customer's account and terminate the contract in the event of a breach of these Terms.
Liability for loss of data shall be limited to the typical recovery costs that would have been incurred if backup copies had been made regularly and in accordance with the risks involved, subject to the further provisions of this Section.
20.Term and Termination
The initial contract term is twelve (12) months as of the signing date of the Individual Contract. The contract shall be extended by another twelve (12) months, if it has not been properly terminated with a notice period of one month to the end of the respective contract term.
The right to extraordinary termination for good cause remains unaffected.
Declarations of termination must be made in text form to be effective.
Termination of the contract shall not release both parties from compliance with the obligations that have arisen during the term of the contract, including the obligations of confidentiality and data protection.
In the event of ordinary termination of the contract or justified extraordinary termination by Turf Coach, the Customer shall be obliged to cease using the contractual Platform immediately at the end of the contract term. Any license fees already paid shall be reimbursed on a pro rata basis.
21.Blocking of content and complaint management
Turf Coach reserves the right to remove or block content generated by the Customer or stored in the Platform if it constitutes a breach of these Terms, infringes third-party rights or is unlawful.
Turf Coach has set up a complaints management system through which corresponding reports can be submitted. The contact options for reporting content and further information on the complaints management system can be found directly in the contract Platform.
22.Other provisions
The Customer may only offset claims against claims of Turf Coach with undisputed or legally established claims.
The Customer may only assert a right to refuse performance or a right of retention on the basis of undisputed or legally established claims.
Unless otherwise agreed in, the Customer may only transfer rights and obligations arising from the Individual Contract to third parties with the prior written consent of Turf Coach. Section 354a German Commercial Code (Handelsgesetzbuch) shall remain unaffected hereby.
The English version of these Terms is the binding version. Translation into any other language is only a non-binding translation. In the event of any discrepancies between the English version and the translation, the English version shall prevail.
Turf Coach may make reasonable changes to these Terms. Amendments to these Terms shall become binding if the Customer has been notified of the amendments, the customer does not object within four (4) weeks of receipt of the notification and Turf Coach has expressly informed the customer of this consequence in the notification of amendment. If the Customer objects to the changes in due time, the changes shall not take effect for the Customer. In this case, Turf Coach has the right to terminate the contractual relationship with one (1) month's notice if it is impossible or unreasonable for Turf Coach to continue the contract without the changes. Any other possible amendments are not restricted by this clause.
Should individual provisions of this contract be invalid in whole or in part, or should there be a loophole in this contract, the validity of the remaining provisions shall not be affected.
This contract is subject to the law of the Federal Republic of Germany to the exclusion of the conflict of laws. The provisions of the UN Convention on Contracts for the International Sale of Goods shall not apply. The place of performance and exclusive place of jurisdiction for all legal disputes arising from the contract is the registered office of Turf Coach.
Annex 1Data Processing Agreement
1.Scope
This Data Processing Agreement ("DPA") is concluded between Turf Coach and the Customer (together "Parties"). Turf Coach is hereinafter referred to as the "Processor" and the Customer as the "Controller".
The Processor processes personal data on behalf of the Controller within the meaning of Art. 4 No. 8 and Art. 28 of Regulation (EU) 2016/679 - General Data Protection Regulation ("GDPR").
2.Defined Terms
The definitions from the GDPR apply accordingly in this DPA. Otherwise, the following definitions apply:
"Data of the Controller" means all personal data that the Processor processes on behalf of the Controller on the basis of this DPA.
"Data Protection Laws" means all laws and regulations, including the laws and binding regulations of the European Union, the European Economic Area and its Member States, Switzerland and the United Kingdom, which apply to personal data in the context of the DPA.
"Third Country" means any country outside a country in which the data protection laws restrict the transfer of personal data to destinations outside that country, unless the data protection laws and the competent supervisory authorities of the country of origin have made an adequacy decision with regard to the data protection laws of the country of destination, so that the transfer of personal data to that country of destination is not restricted.
3.Description of data processing
The data processing on the basis of this DPA has the following scope:
Categories of data subjects whose personal data is processed:
- Employees of the Controller
- Athletes of the Controller
Categories of personal data that are processed:
- Name
- Date of birth, personal address
- Age, size, personal measurements
- Email address
- IP address
Type, purposes and duration of data processing:
The Processor processes personal data as a provider of a SaaS platform for the Controller. Data Subjects are users of the SaaS Platform, in general employees of the Controller. The processing of data lasts for the entire term of the SaaS contract between the Processor and the Controller.
4.Rights and Obligations of the Controller
The Controller is responsible for the lawfulness of the data processing and the protection of the rights of the data subjects.
In the event that there is an obligation to inform third parties pursuant to Art. 33, 34 GDPR or any other statutory reporting obligation applicable to the Controller, the Controller is responsible for compliance with this obligation.
5.Instructions
The Controller has the right to issue instructions to the Processor at any time regarding the type, scope and procedure of data processing. The instructions must be issued in text form (e.g. e-mail). The Controller is responsible for the legality of the instructions.
The Parties may designate persons in text form who are authorised to issue or receive instructions. If these authorised persons change, the Parties shall inform each other of this in text form.
Insofar as not insignificant changes to the contractually agreed data processing operations would be necessary due to an instruction from the Controller and additional expenses or costs arise for the Processor as a result, the Parties shall negotiate an appropriate increase in the contractually agreed remuneration. Should the Parties fail to agree on an adjustment of the remuneration within a reasonable period of time, both Parties shall be entitled to extraordinary termination of the contract without notice.
The Processor shall inform the Controller immediately if, in its opinion, an instruction issued by the Controller violates legal regulations. The Processor is authorised to suspend the implementation of the instruction in question until it is confirmed or amended by the Controller.
6.Obligations of the Processor
The Processor shall process personal data exclusively within the framework of the agreements made and/or in compliance with any supplementary instructions issued by the Controller. Exceptions to this are legal regulations that may oblige the Processor to process the data in a different way. In such a case, the Processor shall notify the Controller of these legal requirements prior to processing, unless the law in question prohibits such notification. The purpose, type and scope of data processing shall otherwise be governed exclusively by this DPA and/or the Controller's instructions.
The Processor is obliged to notify the Controller immediately of any breach of data protection regulations or of the contractual agreements made and/or the instructions issued by the Controller that has occurred in the course of the processing of data by the Processor or other persons involved in the processing. The same applies to any breach of the protection of personal data.
Taking into account the nature of the processing, the Processor shall, where possible, assist the Controller with appropriate technical and organisational measures to fulfil the Controller's obligation to respond to requests from data subjects to exercise their rights.
In the event that a data subject asserts their rights against the Processor in accordance with Art. 12 - 23 GDPR, which obviously relate to the processing of data by the Controller, the Processor is authorised to inform the data subject that the Controller is responsible for the data processing. In this context, the Processor may provide the data subject with the contact details of the Controller.
The Processor shall support the Controller in complying with the obligations set out in Art. 32-36 GDPR, taking into account the nature of the processing and the information available to the Controller.
7.Sub-processors
The Controller consents to the Processor using sub-processors. The sub-processors currently engaged are available here. The Processor shall inform the Controller before engaging or replacing sub-processors after the conclusion of this DPA.
The Controller may object in writing to Processor's use of a new sub-Processor within thirty (30) calendar days after Controller becomes aware of such change. In such event, Processor shall use commercially reasonable efforts to provide Controller with a change to Processor's products and/or services or recommend a commercially reasonable change to Controller's configuration or use of Processor's products and/or services in order to avoid the processing of Personal Data by the objected-to new Sub-Processor without unduly burdening Controller. If the Processor is not able to make such changes within thirty (30) calendar days of the Controller's objection, either party may terminate the contract extraordinarily and without notice without forfeiting any contractual penalty. The Processor shall reimburse the Controller for any fees paid in advance on a pro rata basis.
The Processor must conclude a data processing agreement with the sub-processor in accordance with Art. 28 (2) GDPR and essentially impose the same data protection obligations on the sub-processor that apply under this DPA.
Services that the Processor utilises from third parties as a purely ancillary service in order to carry out the business activity are not to be regarded as subcontracting relationships. These include, for example, cleaning services, pure telecommunication services with no specific connection to services provided by the Processor for the Controller, postal and courier services, transport services, security services. The Processor is nevertheless obliged to ensure that appropriate precautions and technical and organisational measures are taken to guarantee the protection of personal data, even in the case of ancillary services provided by third parties.
8.Place of data processing
The Processor will process personal data primarily in member states of the European Union or the European Economic Area. Any transfer of data by the Processor to a Third Country shall take place exclusively on the basis of documented instructions from the Controller or to comply with a specific provision under Union law or the law of a Member State to which the Processor is subject and must comply with Chapter V of the GDPR.
The Controller agrees to a Third Country transfer of personal data of the Controller if the Processor uses a sub-processor to carry out certain processing activities (on behalf of the Controller) and these processing activities involve a transfer of personal data within the meaning of Chapter V of the GDPR and the Processor and the sub-processor can ensure compliance with Chapter V of the GDPR, for example by concluding standard contractual clauses adopted by the Commission pursuant to Article 46(2) of the GDPR.
9.Documentation and Audits
The Processor shall provide the Controller with all information necessary to demonstrate compliance with the data protection obligations of this DPA.
At the request of the Controller, the Processor shall authorise and contribute to the monitoring of compliance with the data protection obligations of this DPA. When deciding whether to carry out an inspection, the Controller shall take into account relevant certifications or other evidence of the Processor.
The Controller may carry out the inspection on the Processor's business premises during normal business hours after prior written notification with reasonable advance notice. The Controller shall not disproportionately disrupt the Processor's business operations as a result of the inspections. The inspections may be carried out by an independent auditor who is bound to secrecy. The auditor shall send a copy of the audit report to the Processor at the same time as to the Controller. If costs are incurred for carrying out the audit, these shall be borne by the Controller.
When carrying out the checks, the confidentiality interests and data protection rights of the Processor and its customers must be taken into account. These must not be impaired by the exercise of the Controller's control rights. The Processor may make the performance of the inspection dependent on the signing of a confidentiality undertaking, whereby this must not make it impossible for the Controller to provide evidence of the inspection activities or their results to the competent supervisory authority or the data subjects if necessary.
10.Data security
The Processor undertakes vis-à-vis the Controller to take appropriate technical and organisational measures to ensure the security of the Controller's personal data. This includes the protection of personal data against a breach of security which, whether unintentional or unlawful, results in the destruction, loss, alteration or unauthorised disclosure of, or access to, the data. In assessing the appropriate level of protection, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks presented to data subjects.
The technical and organisational measures taken by the Processor are available here. The Parties agree that changes to the technical and organisational measures may be necessary to adapt to technical and legal circumstances. The Processor shall inform the Controller of any changes to the technical and organisational measures.
The Processor shall only grant its personnel access to the Controller's personal data to the extent that this is absolutely necessary for the performance, administration and monitoring of the contract. The Processor shall oblige the persons authorised to process the personal data received to maintain confidentiality.
11.Return and deletion of data of the Controller
After termination of the DPA, the Processor shall, at the choice of the Controller, erase all personal data processed on behalf of the Controller or return all personal data to the Controller and erase existing copies, unless there is an obligation to retain the personal data under Union or Member State law. Until the deletion or return of the data, the Processor shall continue to ensure compliance with these clauses.
12.Term and Termination
The DPA begins with the conclusion of the Individual Contract and ends with the termination of the Individual Contract.
The Controller may terminate this DPA and the contract at any time without notice in the event of a serious breach by the Processor of the applicable data protection regulations or of the obligations arising from this DPA.
13.Final Provisions
Insofar as legally or contractually obligatory acts of cooperation on the part of the Processor result in a disproportionate effort in relation to the contractually agreed remuneration, the Processor may demand reasonable compensation for this from the Controller.
The English version of these Terms is the binding version. Translation into any other language is only a non-binding translation. In the event of any discrepancies between the English version and the translation, the English version shall prevail.
Should individual provisions of these DPA prove to be invalid or ineffective, the remaining provisions of these DPA shall remain unaffected. The invalid or ineffective provision shall be replaced by another valid provision that comes closest to the intention of the Parties.
The law of the Federal Republic of Germany shall apply to the DPA.