Data processing agreement under Art. 28 GDPR

SiteLager processes personal data on behalf of the controller in order to provide the SiteLager software and the marketplace under the Terms Part A. The agreement runs for as long as the SiteLager contract and beyond it until SiteLager has deleted or returned the data under section 10.

SiteLager collects, stores, organises, displays, transmits (for example by email to tenants), analyses on instruction (reports, exports) and deletes data for the following purposes: managing sites and storage units, reservations and bookings, rental contracts and electronic signatures, invoices, payments, reminders and deposits, access data, tasks, inspections and damage reports, and communication with tenants and prospective tenants.

Data that SiteLager processes as a controller in its own right, such as user accounts and booking requests on the marketplace, reviews and reports of content, is not covered by this agreement; the privacy policy applies to it.

Data subjects are the controller's tenants and prospective tenants (consumers and businesses and their contact persons), payers and the controller's staff with access to the software.

The following is processed:

• contact data: name, address, email address, phone number, language,
• contract data: rental contracts, units, terms, prices, notices of termination, withdrawals, signatures,
• invoicing and payment data: invoices, credit notes, payments, reminders, deposits, SEPA mandates with IBAN and account holder,
• identity documents: ID copies and check results, where the controller requires an identity check for a site,
• access data: door codes and access events, where present,
• communication and log data: emails to tenants, notes, tasks, change log.

SiteLager does not by design process special categories of personal data (Art. 9 GDPR); the controller does not enter such data into the software.

SiteLager processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case SiteLager informs the controller of that legal requirement before processing, unless that law prohibits it (Art. 28(3)(a) GDPR). Instructions are this agreement, the terms and the controller's and its staff's use of the software; the controller gives further instructions in text form to info@sitelager.com. If SiteLager considers an instruction unlawful, it says so without delay and may suspend its execution until the controller confirms or changes it.

SiteLager ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). Only persons who need access for operation, maintenance or support are given it. SiteLager accesses the controller's dashboard only at the controller's request through a time-limited support session whose start is notified to the owners by email; every change made in such a session is logged.

SiteLager takes the measures described in Annex 1 under Art. 32 GDPR. They are subject to technical progress; SiteLager may replace them with equivalent or better measures without falling below the level of protection. Material changes are documented and published in the current version of this page.

The controller authorises the sub-processors listed in Annex 2. SiteLager informs the controller by email to the owners at least 30 days before engaging or replacing a sub-processor. Within this period the controller may object in text form on important data protection grounds; if the parties do not agree, the controller may terminate the SiteLager contract as of the date of the change. SiteLager imposes on every sub-processor by contract the same data protection obligations as set out in this agreement (Art. 28(4) GDPR) and is liable for their compliance. Payment service providers such as Mollie B.V. act as controllers in their own right under their own contracts with the controller and are not sub-processors.

SiteLager assists the controller with appropriate technical and organisational measures in fulfilling data subjects' rights (Art. 12 to 22 GDPR): the software offers per tenant a data export as a file, rectification, erasure by anonymisation, legal holds and exports. If a data subject contacts SiteLager, SiteLager forwards the request to the controller without delay. SiteLager also assists the controller with the obligations under Art. 32 to 36 GDPR (security of processing, notifications, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available.

SiteLager notifies the controller of a personal data breach without undue delay after becoming aware of it, as a rule within 24 hours, by email to the owners (Art. 33(2) GDPR). The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed and a contact point; missing information is provided as soon as it is available. Notifying the supervisory authority and communicating with data subjects is the controller's responsibility; SiteLager assists with it.

After the SiteLager contract ends, the controller may retrieve its data for 30 days with the export functions (return). SiteLager then deletes the data including existing copies unless Union or Member State law requires storage (Art. 28(3)(g) GDPR, Terms section A.10). Data in backups is deleted when these are overwritten in rotation. On request SiteLager confirms the deletion in text form. During the term of the contract SiteLager deletes data automatically according to the periods stated in the privacy policy and on the controller's instruction.

SiteLager makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for audits, including inspections, by the controller or an auditor mandated by it and bound to confidentiality (Art. 28(3)(h) GDPR). Audits are to be announced with reasonable notice, as a rule 14 days, and carried out during normal business hours without disrupting operations. For the data centre the hosting provider's evidence (certifications, audit reports) suffices. SiteLager may provide evidence primarily through information and documents. Each party bears its own effort.

Section A.9 of the Terms applies to the parties' liability towards each other, unless Art. 82 GDPR mandatorily provides otherwise. Towards data subjects the parties are liable under Art. 82 GDPR.

In the event of conflict this agreement prevails over the Terms as far as the protection of personal data is concerned. SiteLager announces changes to this agreement by email at least six weeks before they take effect; the new version is offered for acceptance in the dashboard. The law of the Federal Republic of Germany applies; the place of jurisdiction follows section A.17 of the Terms.

The platform runs on a virtual server (droplet) at DigitalOcean in the Frankfurt am Main data centre (region FRA1), which SiteLager shares with one other application of its owner. Database (PostgreSQL), document store (MinIO) and the applications run there in separate containers. Physical access, power supply, cooling and fire protection of the data centre are DigitalOcean's responsibility, which publishes its own evidence (certifications, audit reports) for them.

Administrative access exists only via SSH with a key; password login is disabled. A firewall (ufw) allows only SSH, HTTP and HTTPS, fail2ban blocks addresses after repeated failed attempts. Only SiteLager's owner has access to the server. The database cannot be reached from the internet; from the document store only the public listing photos and the facility-map backgrounds can be retrieved directly.

Login is with email address and password (at least 10 characters from three character classes, checked against commonly used passwords, stored only as a bcrypt hash). A second factor by email code is available; the controller can make it mandatory for all staff. After repeated failed attempts, login is temporarily blocked. Sessions use short-lived access tokens and revocable refresh tokens in HttpOnly cookies.

Roles (owner, accounting, site manager, staff) have defined rights; staff can be restricted to individual sites and do not see data of other sites. Each organisation sees only its own data; the assignment is checked on the server with every request. API keys receive only the rights chosen when they are created.

SiteLager staff open a controller's dashboard only at its request through a justified, time-limited support session. Its start is recorded in the organisation's change log and the owners are informed by email; every change in the session is recorded in the change log and as a security event. Consequential actions are blocked in support sessions: inviting and removing team members and changing their role or site restriction; connecting, changing and disconnecting the payment account and changing the organisation's bank details and SEPA creditor identifier; refunds of any kind, that is every repayment through the payment provider, refunding an overpayment, voiding an invoice on which payments have been made, processing a withdrawal, completing a move-out with the deposit settlement, and recording a deposit repayment or an account for a refund; erasing personal data; taking out, changing and cancelling the SiteLager plan; deleting sites and units; creating and deleting API keys and webhooks; requiring a sign-in code for all staff; and requesting and withdrawing termination. Every such attempt is refused and logged as a security event. Only an owner in person can accept this agreement.

Data is only transmitted encrypted (TLS, HTTP Strict Transport Security). Tenants’ IBANs (direct debit mandates, refund accounts) and access codes are additionally encrypted per field in the database with AES-256-GCM; the key is kept separately from the database in the server configuration. Files in the document store are not public and can only be retrieved through signed links with a short validity. Additional server-side encryption of the document store is not set up at present.

Changes to contracts, invoices, payments, customers, settings and permissions are recorded with time, acting person and content of the change in a change log that the database protects against later modification and deletion. Server and access logs are kept for 90 days. Error reports to Sentry (processing in the EU) contain no request contents, cookies, headers, user data or IP addresses.

The database is backed up daily on the server. The document store is mirrored daily to a second location as soon as one is set up; backups of the entire server via DigitalOcean are added as soon as they are set up. SiteLager states the current status on request. Recovery follows a documented procedure and is tested. Availability and state of the server are monitored; SiteLager's owner is alerted in the event of disruption.

Only PDF files and common image formats (JPEG, PNG, WebP, HEIC) are uploaded to the document store; listing and inspection photos and facility-map backgrounds only as JPEG, PNG or WebP. Every such file is checked against its actual content and not just the extension or the type the browser states, at most 15 MB per file. Bank statements and tenant lists uploaded for an import are only read and not stored. Files are served with their checked file type: PDFs and images for viewing in the browser, other files for download only; executable content such as HTML or scripts is not accepted. There is currently no malware scan; SiteLager accepts this residual risk deliberately and will review using a scanner as usage grows.

All persons with access are bound to confidentiality; access is granted only as far as needed for the task. There is a documented procedure for personal data breaches including notification of the controller. SiteLager reviews these measures at least once a year and after every material change to the platform.

• Service: hosting of the servers, the database and the document store
• Place of processing: Frankfurt am Main data centre, Germany (region FRA1)
• Data: all platform data
• Safeguards: DigitalOcean's data processing agreement with the EU Commission's standard contractual clauses; for possible access from the USA the EU-US Data Privacy Framework, where DigitalOcean is certified under it

• Service: sending emails (booking confirmations, invoices, reminders, notifications)
• Place of processing: European Union
• Data: recipients' email address and name, content of the emails including attachments, delivery status
• Safeguards: Brevo's data processing agreement; established in the EU

• Service: recording program errors, where enabled
• Place of processing: European Union (Sentry's EU region)
• Data: kind and place of an error and the address requested; no request contents, cookies, headers, user data or IP addresses
• Safeguards: Sentry's data processing agreement with the EU Commission's standard contractual clauses; EU-US Data Privacy Framework

• Service: map tiles for site maps and turning site addresses into coordinates
• Place of processing: Switzerland and European Union
• Data: IP address when a map loads, site addresses; no tenant data
• Safeguards: EU Commission adequacy decision for Switzerland; MapTiler's data processing terms