Annex 1 to the GTC of Next Commerce GmbH.
Between the Customer, as designated in the main contract (GTC), hereinafter “Controller”, and Next Commerce GmbH, Ahornweg 5, 97990 Weikersheim, HRB 748864, hereinafter “Processor” (together the “Parties”).
§ 1 Subject Matter, Duration and Commitment to Instructions
(1) This DPA specifies the data protection obligations of the Parties in connection with the processing of personal data that the Processor carries out on behalf of the Controller as part of the services under the GTC (Dealer Checkout, ListingShield).
(2) The term of this DPA corresponds to the term of the main contract (GTC). It ends automatically when the main contract ends, subject to the obligations under § 9 (deletion and return).
(3) The Processor processes personal data only on documented instructions from the Controller and within the scope of this DPA, unless it is required to process by Union or Member State law. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(4) The main contract and this DPA constitute the Controller’s complete instructions. Individual instructions must be given in text form and are documented by the Processor.
(5) If the Processor considers an instruction to be unlawful, it may suspend compliance with it and informs the Controller of this without undue delay.
§ 2 Nature, Purpose and Scope of Processing
(1) The subject matter and purpose of the processing follow from the GTC. It comprises in particular the brokering and processing of orders, the technical processing of requests under § 356a BGB and the storage, transmission and display of the related data.
(2) Nature of processing: collection, recording, storage, organization, display, transmission, provision, erasure.
(3) Categories of data subjects:
- End customers / purchasers / consumers,
- Employees and contact persons of the Controller and of the connected dealers.
(4) Categories of personal data:
- Master data (name, address, delivery address),
- Contact data (email, phone),
- Order and contract data,
- Payment-related data (unless processed exclusively by Stripe),
- Information transmitted and supporting documents attached in connection with § 356a BGB,
- Usage and log data.
(5) Special categories of personal data (Art. 9 GDPR) are not the subject of the commissioned processing. The Controller will not enter such data into the services.
§ 3 Obligations of the Processor
(1) The Processor processes the data only within the scope of this DPA and the Controller’s instructions.
(2) The Processor commits the persons authorized to process the data to confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR), unless they are already under an appropriate statutory obligation of confidentiality.
(3) The Processor implements the technical and organizational measures set out in Annex A and maintains them for the term of the contract (Art. 32 GDPR).
(4) On request, the Processor names to the Controller a contact person for data protection matters.
(5) The Processor keeps a record of the processing activities carried out on behalf of the Controller in accordance with Art. 30(2) GDPR.
§ 4 Assistance to the Controller
(1) The Processor assists the Controller, as far as possible, by appropriate technical and organizational measures in responding to requests from data subjects to exercise their rights (Chapter III GDPR). If a data subject addresses its request directly to the Processor, the Processor forwards it to the Controller without undue delay.
(2) The Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to the Processor.
(3) The Processor informs the Controller without undue delay after becoming aware of a personal data breach and assists the Controller with its obligations under Art. 33 and 34 GDPR.
§ 5 Subprocessors
(1) The Controller grants the Processor general authorization to engage subprocessors. The Subprocessors (Annex 2 / Annex B) engaged at the time the contract is concluded are listed in Annex B.
(2) The Processor informs the Controller in text form of any intended changes concerning the addition or replacement of subprocessors, giving at least 14 days’ notice. The Controller may object to the change within this period for an important reason under data protection law.
(3) The Processor imposes on each subprocessor by contract the same data protection obligations as are set out in this DPA (Art. 28(4) GDPR). The Processor is liable to the Controller for the subprocessor’s compliance with these obligations.
(4) If processing takes place in a third country, the Processor ensures an adequate level of data protection, in particular through an adequacy decision or through standard contractual clauses (Art. 44 et seq. GDPR).
§ 6 Audit Rights and Evidence
(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
(2) The Processor allows for and contributes to audits (including inspections) conducted by the Controller or by an auditor mandated by the Controller. Evidence may also be provided through suitable certifications, attestations or current audit reports.
(3) On-site audits must be carried out with reasonable advance notice, during normal business hours, no more than once a year (and in addition where there is a specific cause), and with due regard to the Processor’s business operations and confidentiality interests.
§ 7 Use of Anonymized and Aggregated Data; Improvement of the Services
(1) The Controller instructs and permits the Processor to process personal data insofar as this is necessary for providing, securely operating and maintaining the services, including ensuring IT and data security and correcting errors.
(2) The Controller further instructs the Processor to anonymize and/or aggregate personal data. Anonymized and aggregated data does not allow any conclusions to be drawn about the Controller, individual data subjects or individual end customers. It is no longer within the scope of the GDPR. The Processor is entitled to use such data for its own purposes without limitation in time or territory, in particular for operation, security, statistical analysis, further development and improvement of the services and for preparing market and benchmark analyses. This right continues after termination of the contract.
(3) Personal data is processed for product improvement purposes only insofar as this is permitted by law and compatible with the purposes under paragraph 1. Otherwise, the services are improved on the basis of anonymized and aggregated data under paragraph 2.
§ 8 Notification and Information Obligations
(1) The Processor informs the Controller without undue delay of any inspections or requests for information by a supervisory authority insofar as they relate to the commissioned processing.
(2) The Processor notifies the Controller without undue delay if it considers that an instruction infringes data protection law.
§ 9 Deletion and Return After Termination
(1) After the end of the provision of the processing services, the Processor, at the choice of the Controller, deletes all personal data or returns it and deletes existing copies, unless Union or Member State law requires storage.
(2) Data that the Processor continues to store due to statutory retention obligations is restricted in its processing accordingly.
(3) Anonymized and aggregated data under § 7 paragraph 2 is exempt from the deletion obligation.
§ 10 Liability
(1) Liability is governed by Art. 82 GDPR. In the internal relationship between the Parties, the liability provisions of the main contract (GTC) apply in addition, insofar as permitted by law.
(2) The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects (Art. 24, Art. 28(3)(a) GDPR).
§ 11 Final Provisions
(1) In the event of conflicts between this DPA and the main contract, the provisions of this DPA take precedence with regard to the processing of personal data.
(2) Changes and additions must be made in text form.
(3) The law of the Federal Republic of Germany applies. The place of jurisdiction is Weikersheim, insofar as permitted by law.
Annex A: Technical and Organizational Measures (Art. 32 GDPR)
Indicative measures (to be finalized in the final legal review):
- Confidentiality: physical access control (data centers of the subprocessors, ISO 27001 or SOC 2 certified), system access control (individual user accounts, MFA, role-based permissions), data access control (least privilege, logging), separation control (tenant-separated data storage).
- Integrity: encryption in transit (TLS) and at rest (including private R2 storage of withdrawal records), input and transfer control (logging).
- Availability and resilience: backups, redundancy of the hosting infrastructure, recovery procedures.
- Procedures for regular testing, assessment and evaluation: data protection management, incident response, monitoring of subprocessors’ performance of their contracts.
Annex B: Subprocessors (as of Conclusion of the Contract)
The current list of subprocessors engaged is maintained under Subprocessors (Annex 2 / Annex B) and forms part of this DPA.
Related Documents
- Main contract: GTC
- Annex 2: Subprocessors (Annex 2 / Annex B)