Data processing agreement

This English version is provided for convenience. The German version is legally binding.

This agreement (Art. 28 GDPR) applies between the customer (controller) and TZN Media Services Ltd. (processor) and is concluded on registration.

1. Subject matter

The processor operates Gearbook. Data of the customer's guests is processed: name or nickname, email address, agreements, appointment time, chosen location. This data may concern special categories under Art. 9 GDPR. The purpose is booking, managing and confirming appointments.

2. Instructions

Processing only takes place on the customer's documented instructions; settings in the dashboard count as instructions.

3. Confidentiality and security

Only personnel bound to confidentiality have access. Technical and organizational measures: TLS encryption, AES-256-GCM encryption of credentials, Argon2id password hashing, tenant separation, two-factor sign-in for administrators, logging of administrative actions, daily backups, automatic deletion periods.

4. Sub-processors

Used: Cloudflare, Inc. (network and protection), the provider of the server location and Stripe Payments Europe, Ltd. (customer payment data only, not guest data). We inform you of changes in advance; the customer may object.

5. Support

The processor assists with data subject requests, reports personal data breaches without undue delay and helps with audits. Access, export and deletion are available in the dashboard.

6. Termination

After the contract ends, data is deleted after 30 days unless a statutory retention duty applies. Backups are overwritten on a rolling basis.