Beet Lotse

Data Processing Agreement (DPA)

Information for commercial customers per Art. 28 GDPR. The German version of this page is the legally binding one.

When do you need a DPA with us?

If you use Beet Lotse commercially and process the personal data of third parties through it — e.g. as a gardening business, farming operation, or school that manages tasks for customers, employees, or pupils — you are the "controller" (Art. 4 Nr. 7 GDPR) and we act as "processor" (Art. 4 Nr. 8 GDPR). A Data Processing Agreement (DPA / "AVV" in German) per Art. 28(3) GDPR is then mandatory.

If you use Beet Lotse only for your own private garden / balcony, you are the only data subject — no separate DPA is needed, the regular Privacy Policy covers you.

What does our DPA cover?

  • Subject matter, nature and purpose of processing.
  • Categories of data subjects and data.
  • Rights and obligations of the controller (you).
  • Technical and organisational measures (TOMs) — encryption, backups, access control, staff training.
  • Sub-processors — see Annex B of the DPA and the list in our Privacy Policy.
  • Support with data-subject requests.
  • Support with Data Protection Impact Assessments (Art. 35 GDPR).
  • Data-breach notification within 24 hours.
  • Return or deletion of all data at contract end.

How to get the DPA

Download our standard template below, read it, and send the signed version back by email. We countersign and return the full document within 5 business days.

Download DPA template (PDF)

Note: the current template is marked DRAFT and will be finalised by a German IT-law specialist before market launch. If you need the DPA before that step, email info@beetlotse.de and we'll handle your case individually.

Sub-processors

We use the sub-processors listed in our Privacy Policy. The DPA regulates in detail how we announce changes or additions of sub-processors and what objection rights you have (typically 30 days advance notice by email to your registered contact).

Technical and organisational measures

Annex A of the DPA describes the TOMs in detail. Key points:

  • Transmission exclusively over TLS 1.2+.
  • Database + backup encryption at rest (LUKS / AES-256).
  • Hosting in German data centres (Hetzner, Falkenstein / Nuremberg) — ISO 27001 certified.
  • Multi-factor authentication for admin access.
  • Structured audit logs for all administrative actions.
  • Staff training on GDPR + confidentiality (§ 28 BDSG).
  • Regular penetration tests and dependency scans.