Data Processing Agreement (DPA)

1. Subject Matter and Roles

This agreement governs the processing of personal data by Bactericayana GmbH (Processor), Jakominiplatz 14, 8010 Graz, on behalf of the Client (Controller). Both parties commit to full compliance with the General Data Protection Regulation (GDPR/DSGVO) and the Austrian Data Protection Act (DSG).

Bactericayana GmbH is managed by Verena Steiner (Share Capital: 10,000 €).

2. Nature and Purpose of Processing

The processing involves data necessary for the creation of laser-cut or engraved products. This specifically includes:

• Contact details of the designated representative (name, e-mail, phone).
• Address data for the delivery of finished goods.
• Content of provided vector files or layouts, provided they contain personal data.

The purpose is the execution of individual production orders, layout coordination, and logistics. Any use beyond these purposes is strictly prohibited.

3. Obligations of the Processor

Bactericayana GmbH undertakes to process personal data only upon documented instruction from the Client. We ensure that all persons authorized to process the data have committed themselves to confidentiality.

Supplementary conditions for cooperation can be found in our Terms and Conditions.

4. Sub-processors

To provide the services, the Processor utilizes the following sub-processors:

• easyname GmbH (Canettistraße 5/10, 1100 Wien) for the provision of hosting infrastructure.
• FormSubmit (USA) for the technical transmission of contact requests.

The transmission to FormSubmit is carried out in accordance with the data protection regulations detailed in our Privacy Policy.

5. Data Security and Incidents

We implement appropriate technical and organizational measures (TOM) to protect data against unauthorized access, alteration, or loss. In the event of a personal data breach, we will notify the Client without undue delay.

6. Deletion and Return of Data

Upon completion of the order and the expiration of statutory retention periods, all personal data will be deleted or returned in an anonymized form, unless a legal obligation to store the data exists. Specific regulations regarding contract duration are complemented by the provisions in our Terms.

7. Audit Rights and Final Provisions

The Controller is entitled to verify compliance with this agreement through audits. In case of disputes, the competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde - DSB), Barichgasse 40-42, 1030 Wien (https://www.dsb.gv.at).

The place of jurisdiction for all disputes arising from this agreement is Graz. The laws of the Republic of Austria shall apply.