Data Processing Agreement (Template)

Last updated: November 4, 2026

This is a translation of our German template (Vertrag zur Auftragsverarbeitung). In case of doubt, the German version prevails.

This template governs how Stark Social processes personal data on behalf of its customers. It is filled in and signed together with the offer.

Parties

Client (controller)

Name / company: ______________________________

Address: ______________________________

Contact person and email: ______________________________

Contractor (processor)

Daniel Lassak, Stark mit Daniel, Montfortstr. 6, 88515 Langenenslingen, Germany, mail@starkmitdaniel.de

1. Subject matter and duration

The contractor operates a separate instance of the social media cockpit Stark Social for the client under the main contract (offer and Terms of Service). This agreement applies for the term of the main contract and beyond for as long as the contractor processes the client’s data.

2. Nature and purpose of processing

• connecting the client’s social media accounts (currently Facebook, Instagram, TikTok),
• regularly retrieving and storing statistics and the accounts’ own posts,
• display in the cockpit, creation of reports and their delivery by email,
• optionally: creating an AI assessment for reports, if the client switches it on,
• hosting, backups, maintenance and support.

3. Types of data and data subjects

Types of data:

• credentials for the platforms (tokens, stored encrypted) and the instance password,
• profile data of the connected accounts (e.g. account IDs, name, username, profile picture, profile link, profile description, verification status),
• statistics (e.g. followers, likes, reach, views, interactions, number of videos),
• the client’s own posts (text, link, type, date) and their statistics,
• reports and assessments as well as brand information (e.g. name, colors, logos, style guidelines),
• email addresses of report recipients.

Data subjects:

• owners and employees of the client who use the cockpit or whose accounts are connected,
• people mentioned or shown in the client’s posts,
• recipients of the reports.

No data about individual followers and no comments are collected, only aggregated platform figures.

4. Instructions

The contractor processes the data only on documented instructions from the client, unless required to do so by law; in that case, the contractor informs the client beforehand unless the law prohibits this. Instructions result from this agreement, the main contract and the settings the client makes in the cockpit; further instructions are given in text form. If the contractor considers an instruction unlawful, it informs the client without delay.

5. Obligations of the contractor

• It commits all persons with access to the data to confidentiality, unless they are under a statutory obligation of confidentiality.
• It takes the technical and organizational measures under Art. 32 GDPR (Annex 1).
• It supports the client in fulfilling data subjects’ rights and the obligations under Art. 32 to 36 GDPR.
• It notifies the client of personal data breaches without undue delay after becoming aware of them, with the information the client needs for a notification under Art. 33 GDPR.
• It processes the data only in Germany, except for the services listed in Annex 2.

6. Technical and organizational measures

The measures in Annex 1 are binding. The contractor may adapt them to the state of the art as long as the level of protection does not decrease. It documents significant changes.

7. Sub-processors

The client consents to the sub-processors listed in Annex 2. The contractor informs the client in text form at least 30 days before adding or replacing a sub-processor. The client may object for an important reason relating to data protection; if no agreement can be reached, either party may terminate the main contract. The contractor contractually binds every sub-processor to a level of protection equivalent to this agreement.

Platforms such as TikTok and Meta are not sub-processors: the contractor retrieves the client’s data from them on the client’s behalf.

8. Data subjects’ rights

If a data subject contacts the contractor, the contractor forwards the request to the client without delay and does not answer it itself unless instructed to do so. It supports the client with appropriate measures, for example with access requests or erasure.

9. Evidence and audits

On request, the contractor provides the client with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. On-site audits are possible during normal business hours after timely notice, insofar as written evidence is not sufficient.

10. Deletion and return

After the end of the main contract, the contractor provides the client with the reports as an export on request and then deletes the instance with all data within 30 days. Database backups are kept for 14 days and then overwritten. Longer storage only takes place where required by law. On request, the contractor confirms the deletion in text form.

11. Liability and final provisions

• Liability is governed by Art. 82 GDPR; otherwise the rules of the main contract apply.
• In the event of contradictions, this agreement takes precedence over the main contract in data protection matters.
• Amendments and additions must be made in text form.
• Should any provision be invalid, the remaining provisions remain valid.
• The law of the Federal Republic of Germany applies.

Signatures

Client

Place, date: ______________________________

Signature: ______________________________

Contractor

Place, date: ______________________________

Signature: ______________________________

Annex 1: Technical and organizational measures

Confidentiality

• separate instance per customer: separate container, separate database, own login,
• password login with a temporary lock after several failed attempts,
• platform tokens stored encrypted (AES-256-GCM),
• server administration only with SSH keys, no password login, no direct root login,
• data center of Hetzner Online GmbH with access control.

Integrity

• transmission only encrypted via TLS (Let’s Encrypt),
• signed session cookies and protection of the platform login against forgery (CSRF),
• logging of data retrievals in the instance’s job log.

Availability and resilience

• daily database backup, kept for 14 days,
• firewall that only opens ports 22, 80 and 443,
• Fail2Ban against repeated attack attempts,
• automatic security updates of the operating system.

Review

• regular review of the measures and adaptation to the state of the art,
• server location in Germany (Nuremberg, Germany).

Annex 2: Sub-processors