# Data Processing Agreement (Art. 28 GDPR) — DRAFT > Engineering draft, version 0.4 (2026-08-04). Customer fields are marked > ⟨CUSTOMER⟩. This template requires professional legal review before > signature. Between **Controller (Customer):** ⟨CUSTOMER: name, address⟩ and **Processor (Provider):** Thomas Braun, trading as Quovalis (Einzelunternehmen), Oskar-von-Miller-Ring 20, 80333 München, Germany — contact@quovalis.eu ## 1. Subject matter and duration The Processor validates X.509 certificates submitted by the Controller against the EU List of Trusted Lists and national trusted lists and stores the resulting validation records. The agreement takes effect on the date of the last signature and runs for the duration of the service contract; retention windows per the Controller's plan apply. ## 2. Nature and purpose of processing Certificate-chain validation, qualified-status mapping, revocation checking, qcStatement/PSD2 parsing; storage, retrieval and deletion of the resulting records; supporting and troubleshooting that processing under controlled access. ## 3. Categories of data and data subjects Certificate contents (subject/issuer distinguished names, serial numbers, subject alternative names, PSD2 authorisation attributes) and the validation records derived from them — data subjects are the natural persons identifiable from those certificates. Account, billing, usage and audit data that the Provider processes for its own purposes as controller are described in the Provider's Privacy Policy and are not subject to this agreement. ## 4. Documented instructions This agreement, the service contract, and the Controller's use of the API and console (requests submitted, plan and retention-affecting settings, deletion and export actions) constitute the Controller's documented instructions. Additional instructions require text form and the Provider's confirmation; the Provider may refuse instructions that would require material changes to the service. The Provider informs the Controller without undue delay if, in the Provider's opinion, an instruction infringes the GDPR or other Union or Member State data-protection law (Art. 28(3)(h)). ## 5. Obligations of the Processor The Processor shall: process personal data only on the documented instructions of Section 4, including with regard to transfers to third countries; ensure that all persons authorised to process are bound by confidentiality obligations; implement the technical and organisational measures of Annex 1; assist the Controller, taking into account the nature of the processing, in responding to data subject requests (Art. 12–23) and in complying with the obligations of Art. 32–36; and make available all information necessary to demonstrate compliance with Art. 28. ## 6. Data subject requests If the Processor receives a request from a data subject concerning processing under this agreement, it forwards the request to the Controller without undue delay and does not respond to it itself, except to refer the data subject to the Controller. The assistance duties of Section 5 remain unaffected. ## 7. Obligations of the Controller The Controller is responsible for the lawfulness of the processing it instructs: it warrants that it has a legal basis for the certificate data it submits, remains responsible for the information duties toward the persons identifiable from that data (Art. 13/14 GDPR) and for data subject rights addressed to it, and shall not submit data exceeding the categories of Section 3. In particular, the Controller shall not submit private keys, credentials, other secrets, or personal data not required for certificate validation. ## 8. Deletion or return At the end of the provision of services the Processor deletes or returns all personal data, at the Controller's choice: - **Return:** validation records are exportable by the Controller via the API and console at any time before account closure. In addition, on the Controller's documented request made within the 7-day grace window after account closure, the Processor returns the remaining stored validation records in a commonly used, machine-readable format before they are deleted. - **Deletion (default, automated):** account closure erases user data immediately and purges validation records after a 7-day grace window; backup copies rotate out within at most 31 days thereafter, unless Union or Member State law requires continued storage. The automated deletion behaviour described above is the agreed standard of erasure under this agreement. Statutory retention duties of the Processor remain unaffected. On request, the Processor confirms deletion in text form. ## 9. Audits The Processor demonstrates compliance primarily by providing documentation, audit reports and answers to reasonable written questionnaires. On-site audits by the Controller or a qualified auditor bound to confidentiality are permitted with reasonable prior notice (at least 14 days), during normal business hours, at the Controller's cost, without disrupting operations, and not more than once per calendar year unless a personal data breach or concrete indication of non-compliance gives cause. The statutory rights of Art. 28(3)(h) remain unaffected. ## 10. Sub-processors General authorisation for the sub-processors of Annex 2. The Processor informs the Controller of intended additions or replacements at least 30 days in advance; the Controller may object within that period on reasonable data-protection grounds. If the parties cannot resolve an objection, the Controller may terminate the affected service as of the date the change takes effect. The Processor imposes on each sub-processor, by written contract, the same data-protection obligations as set out in this agreement (Art. 28(4)), in particular sufficient guarantees of appropriate technical and organisational measures; where a sub-processor fails to fulfil its data-protection obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor's obligations. ## 11. Data location Processing within the EU/EEA. No transfer to third countries without the Controller's documented instruction and a Chapter V transfer mechanism. ## 12. Personal data breaches The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data. The notification contains, so far as available: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed (mirroring Art. 33(3)); further information is provided as the investigation progresses. The Processor reasonably assists the Controller in meeting the Controller's own notification obligations (including the 72-hour deadline of Art. 33(1)) and does not notify supervisory authorities or data subjects on the Controller's behalf without the Controller's authorisation unless legally required to do so. ## 13. Final provisions This agreement is governed by German law. For personal-data processing within its scope it prevails over the Terms of Service in case of conflict. The parties' liability for damage caused by processing, including the allocation of recourse between them, follows Art. 82 GDPR (in particular Art. 82(2) and (5)); the statutory rules apply. Amendments require text form. ## Annex 1 — Technical and organisational measures (summary) - **Transport encryption:** TLS-encrypted transport only. - **Credential protection:** passwords stored as salted argon2id hashes; API keys and tokens stored as one-way hashes of high-entropy random values — never in plain text. - **Access control and tenant isolation:** role-based console access (owner, admin, viewer); per-tenant data isolation through tenant-scoped data access, covered by automated tests. - **Privileged and support access:** production access is restricted to the operator; support and troubleshooting take place under controlled access, and administrative actions on tenants are recorded in the audit log. - **Audit logging:** append-only audit log of administrative actions; modification and deletion of audit records are revoked at the database level as a tamper safeguard. - **Change management:** changes are made through version control and pass automated CI checks (build, tests, linting) before release. - **Vulnerability management:** automated dependency-update monitoring on both repositories; security-relevant updates are released through the same CI-gated process. - **Deletion controls:** automated, monitored retention and erasure jobs implement the retention windows and the erasure behaviour of Section 8. - **Backups:** nightly encrypted backups, encrypted before leaving the production host, with documented rotation of at most 31 days and failure monitoring. - **Operations:** monitoring and alerting on service health and backup failures; documented operational runbook; personal data breaches are handled per Section 12. - **Infrastructure:** least-privilege internal service architecture; rate limiting and abuse controls; EU/EEA processing only (Section 11). ## Annex 2 — Approved sub-processors | Sub-processor | Role | Processing location | |---|---|---| | Hetzner Online GmbH, Gunzenhausen, Germany | Infrastructure hosting and backup storage | Germany (EU) | Service providers used only for the Provider's own controller-side processing (e.g. transactional email) are listed in the Provider's Privacy Policy and are not sub-processors under this agreement. Should personal data covered by this agreement ever be routed through such a provider, it is added to this annex under Section 10 before that processing begins. Signatures: Controller: ______________________ Processor: ______________________ Date: ____________________________ Date: ____________________________