Data processing agreement

The data processing agreement under Art. 28 GDPR is available in German only. It is published at www.supinion.com/avv and is the binding version.

The agreement forms part of our terms and conditions for organisations and our terms of use. It applies whenever we process personal data on behalf of a customer, in particular the answers of participants. No signature is needed for it to apply; on request we also conclude it with signatures.

What it covers

• § 1 to § 12: subject matter, duration, instructions, confidentiality, security of processing, sub-processors, support with data subject requests, notification of personal data breaches, audits, deletion after the end of the contract, obligations of the customer, final provisions.
• Annex 1: subject matter, nature and purpose of processing, types of data, categories of data subjects, retention periods.
• Annex 2: technical and organisational measures (Art. 32 GDPR).
• Annex 3: sub-processors (Hetzner Online GmbH in Germany; Mistral AI in the EU only if the optional AI features are used).

Questions about the agreement, or need a signed copy? Email hi@supinion.com.