Last update: October 6, 2024
This data processing agreement applies between you
Customer name
– Client –
and
Fabulr UG i.G. / peoplegraphics / JHO Consulting
Haimhauserstr. 8
80802 Munich
– Processor –
§ 1 Preamble, subject matter and order of precedence
(1) General.
This agreement (the "Data Processing Agreement" or the "DPA") is part of the contract for the provision of our services between you and Fabulr (the "Contract").
(2) Subject matter of the agreement.
This DPA describes how Fabulr processes comedy media project data and editor data that you provide to us in connection with your use of our services in accordance with the requirements of data protection laws.
(3) Conflicts.
In the event of a conflict, the provisions of this DPA take precedence over the provisions of previous or future confidentiality agreements and other agreements concluded between the parties.
§ 2 Definitions
In this DPA we will use certain words or phrases and it is important that you understand their meaning. The list is not all-inclusive and no definition should be considered binding if it makes this DPA seem unreasonable:
(1) “Customer” or “you” refers to you, the person entering into the contract (including this DPA) with Fabulr UG i.G. If you use our services on behalf of an organization, you agree to these terms on behalf of the organization and you represent that you are authorized to do so. In such a case, “Customer” or “you” refers to that organization.
(2) “Data Protection Laws” means all laws and regulations, including those of the European Union, the European Economic Area and its Member States, that apply to the processing of personal data (including data relating to the provision of telecommunications services and the conduct of email marketing), in particular the GDPR, the German Act against Unfair Competition (UWG), the German Telecommunications Act (TKG) and the German Telemedia Act (TMG).
(3) “GDPR” means the European General Data Protection Regulation.
(4) “Individual Contract” means the SaaS contract concluded between the Customer and Fabulr for the provision of SaaS services and/or additional services.
(5) “Contract processing” or “processing” means any operation or set of operations performed by Fabulr as part of the Services in relation to Comedy Media Project Data and Editor Data, whether or not by automated means, including but not limited to the collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, publication by transmission, distribution or otherwise making available, alignment or combination, blocking, erasure or destruction of data.
(6) “Services” means the services we provide through our Sites, including our Media Project Catalog Widget and Digital Signage Solution services for customers.
(7) “Site” means both our websites, fabulr.de and fabulr.com, and our platform.
(8) “Subcontractor” means a third party commissioned by Fabulr UG i.G. who processes Comedy Media Project Data and Editor Data as part of their contract.
(9) “Contract” means the individual contract, the General Terms and Conditions and this data processing agreement.
(10) “User” means any identified or identifiable natural person who is a customer, employee or business contact of yours and who has been or will be created by you as an editor or contacted as a service provider via our site.
(11) “Comedy Media Project Data and Editor Data” means personal information of a user that you or one of your employees have made available to Fabulr in connection with your use of the Services.
(12) “Special Categories of Data” means data about racial or ethnic origin, political opinions, religious or ideological beliefs or trade union membership, as well as genetic data, biometric data, data about health or data about the sex life or sexual orientation of a natural person (cf. Art. 9 Para. 1 GDPR).
Other terms have the meaning given to them under this Agreement or in the Contract.
§ 3 Subject matter and duration of processing, type of comedy media project data and editor data and categories of data subjects
(1) General subject matter.
Under this AVV, Fabulr processes comedy media project data, studio profile and editor data on behalf of the customer in accordance with Article 28 GDPR.
(2) Duration.
This AVV applies as long as Fabulr provides services under the contract and ends automatically upon expiration or termination of the contract.
(3) Subject, type and purpose of processing.
The subject of the processing is the collection and provision of the client's comedy media projects. The type of processing of comedy media project data and editor data is defined in our general terms and conditions and in our privacy policy, and if necessary additionally in the individual contract. The purpose of the data processing is content management and process optimization at the client.
(4) Type of data.
The processing can contain the following types/categories of comedy media project data and editor data: personal master data including name or email address, communication data, address data, contract data, location data, image, audio and video data, identification numbers, metadata, e.g. participation in projects, editorial activities, IP address, usage data, device data and information from cookies and page tags.
(5) Categories of data subjects.
The data subjects affected by the processing are assigned to the following categories:
(i) customers of the customer;
(ii) employees of the customer;
(iii) business contacts of the customer;
In each of the aforementioned cases (i) to (iii), to the extent that such a customer, employee or business contact has been or will be contacted by you via our site.
(6) Exclusion of processing of special categories of personal data.
The processing of special categories of personal data is excluded.
(7) The legal basis for processing for the client is according to Art. 6 GDPR:
The data subject has given their consent to the processing of personal data concerning them for one or more specific purposes (Art. 6 Para. 1 lit. a GDPR).
The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures that are carried out at the request of the data subject (Art. 6 Para. 1 lit. b GDPR). The legal basis for processing for the contractor is Art. 28 GDPR.
§ 4 Instructions from the customer
(1) Instructions.
As long as we provide services to you, you may give us further instructions regarding the nature, scope and method of data processing in addition to the provisions set out in this DPA (each such instruction is hereinafter referred to as an “Instruction”) with regard to the processing of Comedy Media Project Data and Editor Data. Instructions may be given in written or electronic form. We will process your Comedy Media Project Data and Editor Data in accordance with the instructions.
(2) Requests for amendments.
Any instruction that changes or deviates from this DPA constitutes a request for amendment and is subject to the requirements described in Section 14 (1). We will negotiate with you in good faith regarding any changes to the services and/or fees resulting from your instructions.
(3) Compliance with data protection laws.
You are responsible for ensuring that your instructions comply with data protection laws.
(4) Notice.
If we consider that an instruction violates the GDPR or other data protection provisions of the Union or the Member States, we will inform you immediately.
§ 5 Rights and obligations of the customer
(1) Compliance of processing with data protection laws.
You are responsible for ensuring that the processing of Comedy Media Project Data and Editor Data under this agreement complies with the requirements of data protection laws, in particular with regard to
(i) the transfer of Comedy Media Project Data and Editor Data to Fabulr (including providing any required notifications and obtaining any required consents),
(ii) the use of Comedy Media Project Data and Editor Data in connection with any marketing or advertising you conduct and
(iii) your decisions and activities with regard to the processing and use of Comedy Media Project Data and Editor Data.
(2) The customer as the controller.
You are the controller in accordance with Article 4 Paragraph 7 of the GDPR. You are solely responsible for the nature and legal validity of the Comedy Media Project Data and Editor Data and for the means by which you acquired the Comedy Media Project Data.
(3) Special categories of personal data.
The controller must refrain from using the site or the services to process special categories of personal data.
(4) Recording of processing activities.
You are responsible for maintaining a record of processing activities in accordance with Article 30 GDPR.
(5) Duty to notify.
You will inform us immediately of any error you discover in our services and of any irregularity in the implementation of the statutory provisions on data protection.
§ 6 Obligations of Fabulr
(1) Processing only for the provision of the services.
We will only process your comedy media project data and editor data in accordance with your documented instructions and only for the provision of our services in accordance with Article 28 Paragraph 3 GDPR. We will
(i) not process or use your Comedy Media Project Data and Editor Data for any purposes other than those set out in the contract, including this DPA, and
(ii) not disclose your Comedy Media Project Data and Editor Data to third parties (except to subcontractors for the aforementioned purposes) unless this is required by Union law or the laws of the Member States to which we are subject. In such a case, we will inform you of this legal requirement before processing, unless the law prohibits such information for important reasons of public interest.
(2) Processing within and outside the EU/EEA.
In principle, the processor processes data within the Federal Republic of Germany, a member state of the European Union or another signatory to the Agreement on the European Economic Area or in a country with an adequate level of data protection in accordance with the decision of the European Commission. The servers for data processing are located exclusively within the scope of the EU GDPR. The processor may transfer the data to its subcontractors. In this case, the subcontractor guarantees compliance with the obligations under Art. 44 ff. GDPR.
(3) Employees of Fabulr UG i.G.
We guarantee that our employees involved in the processing of comedy media project data and user data and authorized to do so are informed about the confidentiality of the comedy media project data and user data and have either contractually committed themselves to keeping this data confidential or are subject to a corresponding statutory confidentiality obligation.
(4) Teleworking.
(i) The processor is entitled to offer teleworking to its employees. It concludes a company agreement with them on teleworking that ensures compliance with all data protection and data security regulations.
(ii) Any risk to the data must be excluded. The security of the data must be guaranteed in particular by a secure work computer and the setting up of an encrypted connection.
(5) Our data protection officer.
Data protection officer of Fabulr UG i.G.
Haimhauserstr. 8
80802 Munich.
This can be reached by email at dpo@fabulr.com.
§ 7 Technical and organizational measures
(1) Fabulr TOM measures.
When we process Comedy Media Project data and user data on your behalf, we take all measures required by Article 32 GDPR. We have introduced and will maintain certain technical and organizational measures, as specified in Appendix 1, for the processing of such data. These measures serve the purpose of protecting Comedy Media Project data and user data against accidental or unauthorized loss, destruction, alteration, publication or access and against all other unlawful forms of processing.
(2) Changes to the TOMs.
All technical and organizational measures for data security are subject to technical progress and development. Accordingly, we may change our security measures and/or introduce alternative security measures, provided, however, that these do not fall short of the security standard contractually agreed in Appendix 1.
§ 8 Customer's control rights
(1) The customer can determine compliance with the data protection regulations and the requirements of this contract through controls. The inspections may also be carried out by third parties designated by the customer at its discretion. The processor has the right to refuse inspection by the third party in the event of special circumstances (or, for example, the existence of a competitive relationship between the contractor and the third party). The processor is obliged to assist the customer with the inspections to the best of its ability, including by providing the necessary information, allowing access to its documents and granting access to its premises.
(2) The customer must generally announce the inspections at a reasonable interval. They must be carried out within a reasonable framework and with consideration for the interests of the processor. This includes that they take place during the processor's normal business hours and, as far as possible, do not unduly disrupt the normal course of business.
(3) Report instead of an audit. If the requested audit scope has been covered in a SSAE 16/ISAE Type 2, ISO, NIST or similar audit report and was performed by a qualified third-party auditor within the previous twelve months, the customer agrees to accept the audit report in lieu of the requested audit of the systems.
(5) Use of reports. You as the customer will provide us with all audit reports generated under this section unless prohibited by law. You may only use the audit reports to confirm that our technical and organizational measures meet the requirements of this DPA. The audit reports are confidential information of the parties under the terms of the contract.
(6) Audit costs. Any audit will be carried out at your own expense. Any request to Fabulr UG i.G: for assistance with an audit will be considered a separate service if such audit assistance requires the use of other or additional resources. We will obtain your written approval and agreement to pay the associated fees before we provide such audit assistance.
Support services to meet data protection requirements, such as those arising from the GDPR and the BDSG, are covered by the main contract and no additional fees are charged for these services.
(7) External auditors. If a third party carries out the audit, the customer and Fabulr UG i.G. must jointly agree with the third party and, before the audit is carried out, a written confidentiality agreement acceptable to Fabulr UG i.G. must be concluded.
§ 9 Subcontractors
(1) Subcontractors.
We may use subcontractors to assist us in processing your Comedy Media Project data and user data. By concluding this AVV, you give us your general written permission to use subcontractors in accordance with Article 28 Paragraph 2 GDPR. The list of subcontractors can be found in Appendix 2. If we intend to bring in or replace a subcontractor, we will inform you of this in order to give you the opportunity to object to such a change if there are reasonable concerns about the adequate protection of personal data. If you do not object within two weeks of our notification of the change of a subcontractor, this will have the same effect as consent. If the customer objects to a change, Fabulr reserves the right to terminate the contractual relationship with two weeks' notice.
(2) Our agreements with subcontractors.
We guarantee that our subcontractors adhere to the same obligations as Fabulr within the framework of this AVV. This applies in particular to the requirements in § 4, § 7, § 8, and § 10 to § 13. Fabulr remains responsible at all times for the fulfillment of the conditions of this DPA by all subcontractors involved in the provision of our services to you.
(3) To the extent that we work with freelancers who have access to your personal data, we ensure that we only work with freelancers who implement technical and organizational measures so that the data processing complies with the requirements of the General Data Protection Regulation (GDPR) and ensures the protection of the rights of the data subject. Data processing by a freelancer is subject to a data processing agreement that guarantees the same data protection standard that you and we have agreed. We will provide you with a list of freelancers on request.
(4) Copies of the relevant provisions.
You are entitled to receive copies of the relevant provisions from agreements with our subcontractors who process your comedy media project data and user data, if the agreement does not contain any confidential content; if this is the case, Fabulr UG i.G. can provide an edited version of the agreement.
(5) Additional services.
This Section 9 does not apply if we use third parties for additional services; these include in particular telecommunications services, postal and shipping services, building security services, building management services and services related to the cleaning or disposal of data media.
§ 10 Rights of the data subject
(1) Forwarding requests.
If a data subject asks us to correct, block or delete comedy media project data, studio profile and editor data, we will forward the request to you. Fabulr will not respond to any requests from data subjects without your prior written consent.
(2) Support.
If a data subject requests you to correct, block or delete comedy media project data, studio profile and editor data, or if a data subject requests information about the collection, processing or use of the data in connection with our service, and you are unable to handle the request yourself via our site, as well as in the cases of Art. 18, 20 and 21 GDPR, we will, as far as possible, support you by taking appropriate technical and organizational measures to answer and process the request, provided that
(i) you give us appropriate instructions in writing or in text form and
(ii) you compensate us for the costs and expenses incurred in providing such support.
Support services to meet data protection requirements such as those arising from the GDPR and the BDSG are covered by the main contract and no additional fees are charged for these services.
§ 11 Deletion of data
(1) No copies or duplicates.
We will not create copies or duplicates of your Comedy Media Project data, studio profile and editor data without your prior knowledge. Notwithstanding the preceding sentence, we are entitled to
(i) create backup copies and replications of our databases to the extent necessary to ensure the proper processing of the data of the Comedy Media Management System, the functionality of our platform and product development
(ii) create and store copies of the Comedy Media Project data, studio profile and editor data to the extent necessary to fulfill statutory retention and storage obligations.
(2) Deletion of data.
After deletion of your account, or after your written request at an earlier point in time, we will delete all copies of your Comedy Media Project Data, Studio Profile and Editor Data from our systems within one month. We are not liable for any loss or damage resulting from such deletion. It is your responsibility to ensure that all Comedy Media Project Data, Studio Profile and Editor Data are backed up using the export function before deletion.
(3) Further use to fulfill legal obligations.
Notwithstanding the above, we will only retain Comedy Media Project Data, Studio Profile and Editor Data that is necessary to fulfill our legal obligations, resolve disputes and enforce our agreements.
§ 12 Service analyses and data anonymization
(1) Service analyses.
We may compile statistical and other information relating to the performance, operation and use of our services. The data of the customer's employees or contacts are not included in the service analysis in a form that could identify a person or serve to identify them.
(2) Anonymization of data.
As stated in §11(1), we are entitled to create backup copies and replications of our databases. Fabulr is also entitled to anonymize the comedy media project data, studio profile and editor data in such backup copies and replications and to carry out the processing steps required for such anonymization. The original data set is not affected by the anonymization.
(3) Anonymized or aggregated data is no longer considered personal data. While maintaining anonymity, Fabulr can use all generated data for its own purposes such as statistical analyses, industry comparisons, research and development and other purposes. Fabulr is entitled to use and store this data for its own purposes beyond the end of the contract.
§ 13 Notification obligations and further support
(1) Notifications of (official) searches and seizures.
We will inform you immediately if your Comedy Media Project Data, Studio Profile and User Data under our control has become the subject of a search or seizure, attachment order, confiscation during insolvency or bankruptcy proceedings or similar measures by third parties. In such a case, we will inform all parties involved in such an action that any data affected here is your sole property and falls under your area of responsibility, that the data is at your sole disposal and that you are the controller within the meaning of the GDPR.
(2) Notification of incidents and legal violations.
We will inform you immediately if we become aware that
(i) your Comedy Media Project Data, Studio Profile and User Data have been subject to a security incident (including by a Fabulr employee) or
(ii) if Fabulr has breached (including by a Fabulr employee) the data protection laws applicable to the performance of our services to you or any of the provisions set out in this DPA.
In such a case, we will immediately investigate the security incident or breach and take appropriate measures to identify the root cause and prevent a recurrence.
(3) Assistance.
If the security incident or breach requires you to comply with disclosure obligations under Article 33 GDPR, we will assist you in complying with such obligations, provided that
(i) you instruct us to do so in writing or in text form and
(ii) you reimburse us for our reasonable and documented costs and expenses incurred in providing such assistance. Support services to meet data protection requirements, such as those arising from the GDPR and the BDSG, are covered by the main contract and no additional fees are charged for these services.
(4) Further support.
In addition to our support obligations set out above, we will support you in complying with the obligations set out in Articles 32-36 GDPR, taking into account the nature of the processing and the information available to us, provided that
(i) you instruct us to do so in writing or in text form and
(ii) you reimburse us for our reasonable and documented costs and expenses incurred in providing such support.
§ 14 Changes
(1) Changes to these Terms.
Fabulr may change these Terms at any time for various reasons, provided that the level of data protection is at least maintained, for example to reflect changes in applicable law, to reflect updates to our services or the technical and/or organizational measures we use, or to take into account new services or functionalities.
(2) Notification of changes.
We will usually not inform you in advance of changes or updates to the terms of this Agreement. However, when you log into our site for the first time after such a change or update, we will notify you of the change electronically. If you continue to use our services, you consent to such changes or adjustments unless Fabulr receives timely objection from you.
(3) Current version.
Changes to these Terms will take effect upon posting on our site. You are responsible for familiarizing yourself with the most current terms of our Agreement. You can always find the latest version at https://fabulr.de/de/services/avv.htm.
§ 15 Miscellaneous
(1) Severability clause.
If individual provisions of this AVV are invalid or unenforceable, this does not affect the validity and enforceability of the other provisions of this AVV. The same applies to cases of a gap in this AVV.
(2) Choice of law and place of jurisdiction.
This AVV is subject to German law. The courts in Munich have sole jurisdiction for disputes arising from or in connection with this AVV.
Note: This order processing agreement is effective without a signature by concluding an individual contract with Fabulr. However, for the purpose of easier proof, we recommend that the client print out the contract and attach it to their own documents.
Customer
Name:
Title:
Date:
Signature:
Fabulr UG i.G.
Name:
Title:
Date:
Signature:
Appendix 1 to the order processing agreement (AVV)
Technical and organizational measures
The order processor guarantees that it has taken the following technical and organizational measures:
1. Measures to ensure confidentiality
1.1. Access control
Measures that physically prevent unauthorized persons from accessing IT systems and data processing systems with which personal data is processed, as well as confidential files and data carriers.
Fabulr does not have its own data center. All of our servers and hosting equipment are rented as a service from Contabo GmbH, Aschauer Straße 32a, 81549 Munich. We refer to the TOMs of Contabo GmbH (Appendix 2). Contabo's server locations are in Germany. Further data processing takes place in-house at the company's location.
The data centers used - unless otherwise agreed or otherwise documented, the data centers of Contabo GmbH, Germany - have extensive and modern access controls (e.g. electronic access control systems, camera surveillance, burglar alarm systems, security personnel) and implement processes that provide long-term protection against unauthorized access (e.g. defined security areas, individual access authorization allocation, role-based authorization concept). Further information about the protective measures taken can be found on the Contabo portal.
1.2. Access control
Measures that prevent unauthorized persons from processing or using data protected by data protection law. Description of the access control system:
1.3. Admission control
Measures that ensure that those authorized to use the data processing procedures can only access the personal data subject to their access authorization, so that data cannot be read, copied, changed or removed without authorization during processing, use and storage. Description of the access control system:
1.4. Separation requirement
Measures that ensure that data collected for different purposes is processed separately and is separated from other data and systems in such a way that unplanned use of this data for other purposes is excluded. Description of the separation control process:
1.5. Pseudonymization
Pseudonimization measures are intended to exclude or significantly complicate the identification of the data subject.
1.6 Encryption
2. Measures to ensure integrity
2.1. Transfer control
Measures that ensure that personal data cannot be read, copied, changed or removed without authorization during electronic transmission or during transport or storage on data media, as well as measures that can be used to check and determine where personal data is to be transferred. Description of transfer control:
2.2. Input control
Measures that ensure that it can be subsequently checked and determined whether and by whom personal data has been entered, changed or removed from IT systems. Description of the input control process:
3. Measures to ensure availability and resilience
The measures for availability and resilience are intended to ensure the services and internal operational processes, as well as their information security, even in the event of operational disruptions and unforeseen events.
4. Measures for regular evaluation of data processing security
The effectiveness testing measures serve to regularly monitor and evaluate the effectiveness of all the technical and organizational measures described above.
Appendix 2 to the Data Processing Agreement (DPA)
Subcontracting relationships according to the Data Processing Agreement
The Data Processor is currently working with the following additional data processors to fulfill the order, with whose appointment the Data Controller agrees.
1. Contabo GmbH
Name/company: Contabo GmbH, Aschauer Straße 32a, 81549 Munich
Country of registration: Germany
Function: Server for hosting
Storage location: Germany
https://contabo.com/en/legal/privacy/
2. 1&1 IONOS SE
Name/company: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur,
Country of registration: Germany
Function: Server for Matomo tracking and NextCloud collaboration
Storage location: Germany
https://www.ionos.de/terms-gtc/datenschutzerklaerung/
https://www.ionos.de/terms-gtc/avv/
