Data processing agreement (AVV, Art. 28 GDPR)

This is a convenience translation. Only the German version is legally binding. Deutsche Fassung (German version)

Contracting parties

This agreement governs the processing of personal data on behalf of the controller under Art. 28 of the General Data Protection Regulation (GDPR; German: DSGVO) between the customer that uses immonum (controller, the “Customer”) and KIWAX Thomas Wachsmuth, owner: Thomas Wachsmuth, Kantstr. 27, 10623 Berlin (email: info@kiwax.de; processor, the “Provider”). It forms part of the contract for the use of immonum under the general terms and conditions (AGB, the “Main Contract”) and is concluded together with it.

§ 1 Subject matter and duration

(1) The Provider processes personal data on behalf of the Customer to the extent that the Customer and its users enter, upload or generate such data in immonum.

(2) The agreement applies for the term of the Main Contract. The Provider's obligations continue beyond that until all data has been deleted in accordance with § 11.

§ 2 Nature and purpose of the processing

(1) Nature of the processing: storing, organising, reading, querying, using and displaying the data, outputting it as PDF and export, transmitting it to the recipients determined by the Customer (for example via client links or email), as well as backing up, restoring and deleting it.

(2) Purpose: provision of immonum as a web application, hosting and storage of the data, data backup, maintenance and operation, and supporting the Customer with questions and faults (support).

(3) The Provider accesses the content of the Customer's company only to the extent necessary for these purposes, for example at the Customer's request in support. If the Provider switches into the Customer's company for this purpose, this is logged; the Customer's administrators can see these entries.

(4) The Provider does not use the data for its own purposes and passes it on to third parties only in accordance with this agreement.

§ 3 Types of data and data subjects

(1) Types of data: – master and contact data of the Customer's prospects and clients and their spouses or partners (form of address, title, name, address, phone, email); – tax and income information (taxable income and its development, type of assessment, church tax attribute); – assets and liabilities; – contact history, notes, follow-ups and search profiles; – reservations, sales processes, sales and commission; – files uploaded by the Customer, as well as calculations and PDFs; – data of the Customer's users (name, user name, email address, role, sign-in data in hashed form, log entries).

(2) The church tax attribute (Kirchensteuermerkmal) allows conclusions to be drawn about membership of a religious community. It therefore belongs to the special categories of personal data under Art. 9 GDPR. The Customer ensures that it is permitted to process it under Art. 9(2) GDPR and enters it only if it needs it for the calculation. immonum does not provide for further special categories, such as health data; if the Customer nevertheless enters them, for example in notes or files, it is responsible for the lawfulness of doing so.

(3) Data subjects: prospects and clients of the Customer and their spouses or partners, employees of the Customer and external sales partners of the Customer.

§ 4 Instructions

(1) The Provider processes the data only on documented instructions from the Customer. Instructions are this agreement, the Main Contract, the use of immonum's functions by the Customer and its users, and individual instructions in text form.

(2) If the Provider is required by Union or Member State law to carry out other processing, it informs the Customer of this in advance, unless that law prohibits such information on important grounds of public interest.

(3) If the Provider considers that an instruction infringes data protection provisions, it informs the Customer without delay. It may suspend execution until the Customer confirms or changes the instruction.

(4) The Customer is responsible for the lawfulness of the processing. It informs the Provider without delay if it discovers errors or irregularities in data protection.

§ 5 Confidentiality

(1) For the processing, the Provider uses only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and who are familiar with the data protection provisions. The obligation continues after the end of their activity.

§ 6 Security of processing

(1) The Provider takes the technical and organisational measures under Art. 32 GDPR that are described in Annex 1.

(2) The measures develop further in line with the state of the art. The Provider may replace them with equivalent or better measures; the level of protection must not decrease. It records material changes in Annex 1.

§ 7 Sub-processors

(1) The Customer grants the Provider general authorisation to engage sub-processors (Art. 28(2) GDPR). At the time the agreement is concluded, these are the sub-processors named in Annex 2.

(2) The Provider informs the Customer in text form at least four weeks in advance of any intended addition or replacement of a sub-processor. If a service provider has to be replaced at short notice, for example because it fails, the Provider informs the Customer as early as possible.

(3) The Customer may object to the change in text form within two weeks of receiving the information. If it objects, the Provider refrains from the change for the Customer; if this is not reasonable, either party may terminate the Main Contract with effect from the date of the change.

(4) The Provider imposes on each sub-processor by contract the same data protection obligations as are laid down in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures. If a sub-processor fails to fulfil its obligations, the Provider is liable to the Customer for this (Art. 28(4) GDPR).

§ 8 Place of processing

(1) Processing takes place exclusively in member states of the European Union or in other states party to the Agreement on the European Economic Area. Any transfer to a third country requires the prior consent of the Customer in text form and is permitted only if the conditions of Art. 44 et seq. GDPR are met.

§ 9 Assistance to the Customer

(1) The Provider assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights (Chapter III GDPR). The Customer can do much of this itself in immonum: view and export data, rectify it and delete it permanently.

(2) If a data subject contacts the Provider directly, the Provider forwards the request to the Customer without delay. It answers the request only on the Customer's instructions.

(3) Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of breaches, data protection impact assessment, prior consultation).

§ 10 Notification of breaches

(1) The Provider notifies the Customer of personal data breaches without delay, if possible within 24 hours of becoming aware of them, in text form to the Customer's contact address known to it.

(2) As far as known, the notification contains the information under Art. 33(3) GDPR: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences and the measures taken or proposed. The Provider supplies anything not yet known without delay.

(3) The Provider takes the necessary measures without delay to protect the data and to mitigate possible adverse consequences. It assists the Customer with the notification to the supervisory authority and with informing the data subjects.

§ 11 Deletion and return

(1) Until the end of the term, the Customer can download all data of its company itself (company backup, CSV exports); this is how it receives the data back. Within the period under paragraph 2, the Provider provides the Customer with a company backup on request.

(2) 30 days after the end of the Main Contract, the Provider permanently deletes all data of the Customer's company, unless Union or Member State law requires the data to be stored.

(3) Copies in backups are deleted as part of the regular backup rotation: of the automatic backups that immonum creates once a day, only the 7 most recent are kept; older ones are deleted, as a rule therefore after 7 days. Safety copies made before program updates and the copy of a deleted company are deleted after 30 days. Until then, the copies are used only for restoration after a failure; if a backup has to be restored, the Provider deletes the data again afterwards. Backups that the Provider additionally keeps outside the server are subject to the same obligations and are deleted with their rotation.

(4) Log entries concerning the company (sign-ins, changes to users, deletions) are retained as evidence until their retention period of 2 years has expired and are then deleted automatically.

(5) On request, the Provider confirms the deletion in text form.

§ 12 Evidence and audits

(1) The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular an up-to-date description of the measures in Annex 1.

(2) The Provider allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. On-site audits take place after notice with a reasonable period, during normal business hours and without disrupting operations disproportionately. Auditors must be bound to confidentiality and must not be in competition with the Provider.

(3) The data centre is operated by the hosting provider (Annex 2). Audits there are governed by its rules; for this purpose, the Provider provides the hosting provider's evidence to the extent that it receives it.

(4) Each party bears its own costs of an audit.

(5) The Provider informs the Customer without delay of audits and measures by a supervisory authority to the extent that they concern the processing for the Customer.

§ 13 Liability

(1) Art. 82 GDPR remains unaffected.

(2) Otherwise, liability between the Customer and the Provider is governed by § 13 of the general terms and conditions.

§ 14 Final provisions

(1) If this agreement and the general terms and conditions contradict each other, this agreement takes precedence insofar as the protection of personal data is concerned.

(2) Changes to this agreement take effect only with the consent of both parties in text form. § 6(2) (further development of the measures) and § 7 (sub-processors) remain unaffected.

(3) Text form is sufficient for declarations under this agreement. Otherwise, the general terms and conditions apply, in particular with regard to applicable law and place of jurisdiction.

(4) Contact for instructions, notifications and questions on data protection: info@kiwax.de.

Annex 1: Technical and organisational measures

This annex describes the measures under Art. 32 GDPR that immonum and the Provider implement.

Physical access control: the server is located in the hosting provider's data centre (Annex 2). The hosting provider's measures apply to physical protection – access, fire protection, power supply and air conditioning.

System access control: access only with a personal user account. Passwords have at least 10 characters and are stored only as an Argon2 hash. After 5 consecutive failed attempts, an account is locked for 15 minutes; in addition, a throttle per IP address slows down repeated sign-in attempts. Two-factor authentication with one-time codes from an authenticator app (TOTP) is available to all users; each company can make it mandatory for its administrators. At the user's request, a device can be treated as trusted for 30 days. Sessions end after 12 hours or on signing out. The session cookie cannot be read by scripts (HttpOnly) and, in operation over HTTPS, is transmitted only in encrypted form (Secure).

Data access control: roles (administrator, adviser) and permissions for projects and groups determine who sees and changes which data. Advisers see only the projects released to them and the clients they look after. Only administrators can download data backups.

Separation control: each company's data is kept separate; every request is checked against the company of the signed-in user. With every change to the program, an automated test calls up all pages with the identifiers of another company and fails if that company's data can be reached. The demo account is a separate company.

Transfer control: operation only over HTTPS (TLS encryption), with HSTS. A content security policy (CSP) allows only scripts from the application's own server; immonum does not embed any third-party services in the browser (no analytics, advertising or font services) and cannot be embedded in other websites. Client links contain a long random key, expire after 7, 30 or 90 days, can be revoked and are not indexed by search engines.

Input control: a log records security-relevant events with the time and the acting user: sign-ins, account locks, creation and modification of users, password resets, access by the Provider to a company, downloads of backups and permanent deletions. IP addresses and passwords are not logged. Administrators see the entries for their company. The entries are deleted after 2 years.

Availability and recovery: once a day, immonum automatically creates a backup of the database, checks it for errors and keeps the 7 most recent. Before every change to the database structure during an update, a checked copy is created first (kept for 30 days); if this fails, the update is not installed. The Provider is warned if the last automatic backup is more than 36 hours old. Administrators can download a company backup and CSV exports at any time; a company can be restored individually from its company backup.

Regular review: every change to the program goes through automated checks (formatting, static analysis, automated tests including the separation test). The Provider installs updates promptly.

Organisational measures: the persons engaged are bound to confidentiality (§ 5); the Provider accesses a company's data only for operation and support, with each access logged and visible to the company's administrators.

Annex 2: Sub-processors

1. Hosting: Host Europe GmbH, Hansestr. 111, 51149 Köln. Service: operation of the server in the data centre, storage of the database, the files and the backups. Place of processing: EU or EEA.

2. Email delivery: the Provider sends notifications from immonum (such as follow-up reminders, call-back requests from client links and password reset links) via its mail server – at the hosting provider under no. 1 or at another service provider in the EU, which the Provider will name on request. The messages may contain names of end clients.

The following are not sub-processors of the Provider: – Location maps: for the location maps of projects, the server sends only the project address to the geocoding service photon.komoot.io (Photon by komoot, data from OpenStreetMap) and retrieves map tiles from the OpenStreetMap Foundation (tile.openstreetmap.org). No personal data of end clients is transmitted. – Users' calendar and email providers: if a user subscribes to their follow-ups as a calendar or receives emails, the content reaches the providers chosen by the Customer and its users themselves. These do not act on behalf of the Provider.

As of: October 2026