Agreement pursuant to Article 28 of the GDPR regarding the use of the ‘Dein Eventplaner’ software

As at September 2026

Parties

This Data Processing Agreement (‘Agreement’) is entered into between

the customer using the ‘Dein Eventplaner’ software (company name and address as provided during registration or in the customer account)
– hereinafter referred to as the ‘Data Controller’ –

and

Frankfurter Haus
, Darmstädter Landstraße 741, 63263 Neu-Isenburg
Represented by the managing director, Constantin von Bienenstamm
Commercial Register: HRB 125386, Frankfurt am Main
Local Court Telephone: 06102 7197890 , email: info@deineventplaner.com

– hereinafter referred to as the “data processor” –

It sets out in detail the parties’ data protection obligations in relation to the use of the ‘Dein Eventplaner’ software and supplements the relevant main contract (Terms and Conditions/SaaS Agreement). The contract comes into effect upon conclusion of the main contract.

§ 1 Subject-matter and duration

The data processor processes personal data on behalf of the data controller solely for the purpose of providing the contractually agreed services (provision and operation of the multi-tenant SaaS solution ‘Dein Eventplaner’). The duration of this contract corresponds to the term of the main contract.

§ 2 Nature and purpose of the processing, types of data, data subjects

Nature and purpose: Storage, organisation and processing of event, quotation and contact data within the scope of the software’s functions (quotations, function sheets, customers/CRM, calendar, invoice overview, reports, PDF and email dispatch).

Categories of personal data:

• Master data relating to the controller’s customers and business partners (company, contact person, address),
• Contact details (email, telephone),
• Contract and event details (dates, services, prices, notes),
• other data that the data controller enters into the software in the course of its use.

Categories of data subjects: customers, contacts and guests of the data controller, as well as the data controller’s employees, insofar as their data is processed in the system.

§ 3 Obligation to follow instructions

The data processor shall process personal data exclusively in accordance with documented instructions from the data controller, unless it is legally obliged to do so. Instructions are generally issued via the software’s functions; any instructions beyond this are provided in writing. If the data processor considers that an instruction contravenes applicable data protection law, it shall inform the data controller.

§ 4 Obligations of the data processor

• Confidentiality: Use only by persons who are bound by a duty of confidentiality or are subject to a statutory duty of secrecy.
• Security: Implementation of appropriate technical and organisational measures in accordance with Article 32 of the GDPR (Annex 1).
• Support: Assisting the data controller in responding to data subjects’ enquiries and in fulfilling the obligations under Articles 32–36 of the GDPR, insofar as this is possible and appropriate (see Section 7 and the document ‘Functions relating to data subjects’ rights’).
• Information: immediate notification of personal data breaches (see Section 8).
• Cooperation: Provision of the information required to comply with Article 28 of the GDPR.

§ 5 Technical and organisational measures

The data processor shall implement the technical and organisational measures described in Annex 1. It may further develop these measures during the term of the contract, provided that the level of protection is not reduced.

§ 6 Subcontracted data processors

The data controller consents to the use of the sub-processors listed in Annex 2. The data processor shall inform the data controller in advance of any intended changes (addition or replacement); the data controller may object on reasonable grounds. The obligations under this contract shall be contractually agreed with each sub-processor.

§ 7 Rights of data subjects

If a data subject contacts the data processor directly, the data processor shall forward the enquiry to the data controller without delay. The data processor shall, to the best of its ability, provide functions (access, rectification, erasure/archiving, export as CSV/Excel) that enable the data controller to fulfil data subjects’ rights. Details and the mapping of these rights to the app functions are set out in the document ‘Functions for Data Subjects’ Rights’.

§ 8 Reporting of data breaches

The data processor shall notify the data controller of any personal data breaches without undue delay after becoming aware of them and shall assist the data controller in fulfilling its reporting and notification obligations under Articles 33 and 34 of the GDPR.

§ 9 Rights of inspection and verification

The data processor shall provide the data controller with all the information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR and shall facilitate appropriate audits – primarily by providing suitable evidence (e.g. documentation of the measures, where applicable certificates), and, where necessary, through on-site audits with reasonable notice.

§ 10 Deletion and Return upon Termination

Upon termination of the contract, the data processor shall delete the processed personal data or, at the data controller’s discretion, return it (e.g. by exporting it), provided that there is no statutory obligation to retain the data. The deadline for this is 30 days after the end of the contract. The deletion shall also take effect in backup copies as part of the regular backup cycle.

§ 11 Liability

Liability is governed by Article 82 of the GDPR and by the provisions of the main contract. In relations between the parties, the allocation of liability set out in Article 82 of the GDPR applies.

§ 12 Final Provisions

Any amendments must be made in writing. In the event of any conflict between this agreement and the main contract, the provisions of this agreement shall take precedence in matters relating to data protection. German law shall apply.

Appendix 1 – Technical and organisational measures (Article 32 of the GDPR)

Confidentiality

• Access control: Operations are carried out in the hosting provider’s secure data centres (Raidboxes GmbH, Germany); physical access is controlled by the data centre operator.
• Access control: individual user accounts, secure authentication, password policy, protection against automated attacks (brute-force protection), secure HTTP headers.
• Access control: role-based authorisation model (super-admin, admin, users with configurable rights), restriction to what is strictly necessary (least privilege).
• Separation control: client-specific processing (multi-tenancy with tenant scoping); strict separation of data for each organisation; client-specific upload directories; automated tests of client separation during the deployment process.

Integrity

• Transmission control: Encryption of data transmission (TLS/HTTPS).
• Input validation: Logging of relevant accesses and changes; versioning and soft deletion of data records (traceability, recoverability).
• Input validation: server-side validation of input to protect against incorrect or malicious data.

Availability and resilience

• Data protection: regular backups and recovery tests; measures to prevent data loss.
• Scalability: CI/CD pipeline with automated tests prior to each deployment (including client isolation, price calculation and authentication).

Procedures for regular review, assessment and evaluation

• Update and patch management, as well as regular reviews of the effectiveness of the measures.
• Order monitoring: Subcontractors may only be used if they are contractually obliged to ensure an adequate level of protection (Annex 2).

Appendix 2 – Approved sub-processors

The following sub-processors process content data on behalf of the data controller or facilitate its processing:

Service provider	Head office / Country	Purpose
Raidboxes GmbH	Hafenstraße 32, 48153 Münster, Germany	Hosting and server operation, databases, file uploads
IONOS SE	Elgendorfer Str. 57, 56410 Montabaur, Germany	Domain and email; sending offers, notifications and system emails

Transfers to third countries: The sub-processors mentioned are based in Germany. Should sub-processors outside the EU or the EEA be engaged in future, the processor shall ensure appropriate safeguards (adequacy decision, EU-US Data Privacy Framework or standard contractual clauses plus a transfer impact assessment) and shall inform the controller in accordance with Section 6.

Definition: Payment service provider (Stripe)

Stripe (Stripe Payments Europe, Ltd., Ireland), the payment service provider used for subscription billing, is deliberately not listed in this annex as a sub-processor of content data. It processes the payment and billing data relating to the contractual relationship between the provider and the customer. The provider itself is the data controller in this regard; this processing is set out in the platform’s privacy policy and governed by a separate contract between the provider and the payment service provider. The data controller’s content data (e.g. guest or event data) is not transferred to the payment service provider.

As at September 2026