Zaarks Console

# Zaarks — Data Processing Agreement Concluded under Article 28 GDPR between: **Processor** — XSAVY GmbH, Otto-Heilmann-Straße 18 a, 82031 Grünwald, Germany (Amtsgericht München, HRB 276852), operating Zaarks; and **Controller** — the Customer named on the order. This DPA forms part of the contract for Zaarks and prevails over conflicting contract terms for the processing governed by it. ## 1 · Scope, subject matter and duration 1.1 We process personal data on your behalf only to provide, secure, support, maintain, back up, restore and terminate the subscribed Zaarks services and to carry out your documented instructions. 1.2 This DPA applies to **Customer Data** for which you are controller and we are processor. It does not govern account, contract, billing and security data for which we act as controller; our Privacy Notice governs that processing. 1.3 Processing lasts for the subscription and any limited period needed for export, deletion, backup expiry, legal hold or duties that survive termination. ## 2 · Processing details **Nature and purpose:** collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, transmission to authorised recipients, restriction, backup, restoration, export and deletion, as initiated by authorised users or required to operate Zaarks. **Data subjects:** as determined by you, typically your customers and contacts; prospects; staff, applicants and contractors; suppliers and their contacts; booking participants, beneficiaries and other persons whose details your business lawfully records. **Personal data:** as determined by you, typically identity and contact data; account and role data; booking, attendance and communication data; contractual, order, invoice and payment-related records; employment-related records where you use those modules; documents and correspondence; technical metadata and audit events; and content entered into configurable or free-text fields. **Special categories and criminal-offence data:** Zaarks does not require such data by default. You may process it only where the subscribed capability is documented for that purpose, you have a lawful basis and the required safeguards, and you give any additional documented instructions we reasonably require. You must not place such data in generic free-text fields merely because a field accepts text. We may refuse processing that would make the agreed measures manifestly inadequate. ## 3 · Documented instructions 3.1 The contract, your authorised configuration and use, support requests, and written instructions accepted by us are documented instructions. We process only on those instructions, including for international transfers, unless Union or Member State law requires otherwise. In that case we tell you before processing unless the law prohibits notice for important public-interest reasons. 3.2 If we believe an instruction infringes data-protection law, we inform you immediately and may suspend that instruction until it is clarified. We do not become responsible for deciding the purposes or legal bases of your business processing. ## 4 · Processor obligations We will: 1. ensure persons authorised to process Customer Data are committed to confidentiality; 2. maintain the measures in Article 32 GDPR and Annex 1; 3. comply with clauses 7 and 8 before engaging sub-processors or making restricted transfers; 4. taking account of the nature of processing, assist you through appropriate technical and organisational measures with data-subject requests; 5. assist with Articles 32–36 GDPR, taking account of the information and processing available to us; 6. notify you of a qualifying personal-data breach under clause 9; 7. at your choice return or delete Customer Data at the end of service, except where law requires retention, and provide the export described in the Service Description; 8. make available information reasonably necessary to demonstrate compliance and support audits under clause 10; and 9. maintain records required of us by Article 30(2) GDPR and cooperate with competent authorities. ## 5 · Controller obligations You determine the purposes and lawful means of your processing. You are responsible for lawful instructions, legal bases, transparency notices, data accuracy, retention decisions, rights management, configured access, and ensuring that your authorised users and connected third parties may lawfully use the data. You must not instruct processing outside the agreed service without first agreeing the necessary scope and safeguards with us. ## 6 · Security and changes 6.1 Annex 1 describes the current categories of technical and organisational measures. Measures are appropriate to the risk and the state of the art; they are not a promise that security incidents can never occur. 6.2 We may replace a measure with an equivalent or stronger measure as technology and risks change. We will not materially reduce the overall level of protection during the service. 6.3 You are responsible for measures within your control, including user lifecycle, least-privilege role assignment, device security, lawful configuration, credential protection and reviewing audit and security notices made available to you. ## 7 · Sub-processors 7.1 You give general written authorisation for the sub-processors in Annex 2. We will give at least 30 days' notice before an intended addition or replacement where reasonably possible. For an urgent security or continuity replacement, we may give notice without that lead time and explain why. 7.2 You may object during the notice period on reasonable, documented data-protection grounds. We will work in good faith on a reasonable alternative. If none is reasonably available, either party may terminate the affected service, and we refund prepaid recurring fees for the period after termination. 7.3 We bind each sub-processor by written data-protection obligations providing substantially the same protection required by Article 28 GDPR and remain responsible for its performance as required by Article 28(4). ### Annex 2 — authorised sub-processors at version 1.3 | Sub-processor | Processing | Primary processing location | |---|---|---| | DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, Colorado 80021, USA | Application hosting, managed PostgreSQL, object storage, infrastructure logs and backups | Frankfurt, Germany; limited support, security and group access may occur elsewhere subject to clause 8 | | Amazon Web Services EMEA SARL and relevant AWS group entities | Transactional service email through Amazon SES | `eu-central-1`, Frankfurt, Germany; limited global support/security access may occur | Stripe and banking providers process Zaarks account and payment data for XSAVY's own commercial purposes and are disclosed in the Privacy Notice. They are not listed here merely because you pay for Zaarks. A payment gateway that **you** connect for your own customers is a controller decision and is not our sub-processor unless the integration documentation expressly says otherwise. ## 8 · International transfers 8.1 Operational Customer Data is configured for primary processing in Germany. A German region does not by itself guarantee that no remote support, security or group access can occur elsewhere. 8.2 Where a transfer governed by Chapter V GDPR occurs, we use an applicable adequacy decision or the European Commission's Standard Contractual Clauses, complete any required transfer assessment, and apply supplementary measures where appropriate. On request we provide information about the relevant mechanism, subject to confidentiality and security limits. ## 9 · Personal-data breaches 9.1 We notify your designated contact without undue delay after becoming aware of a personal-data breach affecting Customer Data. We do not wait for a complete investigation before giving an initial notice where material facts are available. 9.2 As information becomes available, notice includes the nature of the breach, affected categories and approximate numbers, likely consequences, contact point, and measures taken or proposed. We cooperate so you can meet your obligations. Notification is not an admission of fault or liability. 9.3 You remain responsible for notifications to authorities and data subjects unless law assigns that duty to us. We assist as required by Article 28(3)(f). ## 10 · Information and audits 10.1 We provide information reasonably necessary to demonstrate Article 28 compliance, including relevant policies, summaries, certifications or independent reports where available. 10.2 You may audit once per calendar year and additionally after a material incident or where a supervisory authority or substantiated compliance concern requires it. Audits require reasonable notice, must protect other customers and security, and should use remote evidence first where it answers the question. An on-site auditor must be independent, competent, bound by confidentiality and not our competitor. 10.3 Each party bears its ordinary audit costs. If an audit identifies our material breach, we bear our reasonable remediation costs. This clause does not restrict a supervisory authority's powers. ## 11 · Return, deletion and evidence 11.1 During the service you may export Customer Data with the contractually supported export; export before you delete an Instance. When you delete an Instance, access to it ends at once and its Customer Data is deleted seven days later; during those seven days its owners and administrators are warned every day, and you may ask support to stop the deletion or to restore access so that you can export. An Instance ended because it was not used or because its paid plan ended is deleted on the date given in the warnings stated in the Terms. Deletion covers the Instance's database, stored files and remaining active copies, unless Union or Member State law requires storage: the accounting records that tax and commercial law require you to keep are retained for that statutory period in a sealed archive, with personal data they do not need pseudonymised, and then deleted. 11.2 Backup copies age out through the published Backup, Retention and Deletion Policy and remain protected and unavailable for ordinary use until overwritten or deleted. A legal hold or binding retention duty may delay deletion only for the affected data. 11.3 Deletion of Customer Data does not require deletion of our controller-side contract, acceptance, invoice or security evidence. We do not keep operational Customer Data under that label merely because we have a separate controller retention duty. ## 12 · Liability and final provisions Article 82 GDPR governs liability toward data subjects. Between the parties, the Terms of Business apply only to the extent GDPR and other mandatory law permit. If this DPA conflicts with the Terms on processor obligations, this DPA controls. --- # Annex 1 — Technical and organisational measures These measures describe the protection categories operated for Zaarks. Product-specific details may vary by documented deployment model without reducing the overall level of protection. ## A · Governance and personnel - production access is limited to individually authenticated, authorised personnel with a defined operational purpose; - confidentiality obligations apply to personnel and contractors with access; - access is reviewed and removed when no longer required; - security and privacy incidents follow recorded triage, containment, recovery and notification procedures; and - material administrative and provisioning actions produce attributable evidence. ## B · Identity and access control - Zaarks Account identity is separate from operational Instance identity; - passwords are stored as one-way adaptive hashes, never recoverable plaintext; - sessions are audience- and surface-bound and have finite validity; - privileged functions require explicit role or permission checks; and - runtime database credentials are purpose-separated, encrypted in storage using authenticated encryption, and are not placed in logs or customer-facing responses. ## C · Customer and Instance separation - **BMS Instance:** one logical PostgreSQL database per Instance, with an Instance-specific runtime credential and governed routing from the control plane; - **Work Apps Instance:** a shared PostgreSQL data plane with mandatory immutable Instance scope, scoped accessors and adversarial cross-Instance isolation tests; - **Zaarks Console:** a separate commercial control-plane database; Console identity or payment authority does not by itself grant operational Instance authority; and - routing and session context fail closed when the Instance cannot be resolved or authorised. ## D · Transmission, storage and secrets - supported public endpoints use TLS in transit; - provider-managed encryption at rest is used where the contracted infrastructure service supplies it; we do not represent an unverified provider control as our own; - application secrets and sensitive runtime credentials are held in restricted secret stores or sealed with authenticated encryption; and - full card numbers and card verification values do not enter Zaarks systems. ## E · Integrity and change control - schema changes are versioned migrations with state-zero and drift verification; - database constraints, triggers and exclusion rules that sit outside ORM visibility are covered by independent object-drift checks; - governed commands and transactions protect material business mutations, with direct-write guards for declared authorities; and - changes are tested and promoted through controlled version and deployment records. ## F · Availability, backup and recovery - production infrastructure uses provider backup and recovery capabilities configured for the applicable service; - logical database restore and neighbour-isolation drills are exercised and recorded; - recovery objectives are contractual only where expressly stated—no unverified RPO or RTO is created by this Annex; and - incident recovery preserves auditability and verifies service health before a change is called restored. ## G · Logging, monitoring and confidentiality - security-relevant authentication, provisioning and administrative events are logged with minimised context and attributable actors where available; - bearer tokens, passwords, full payment credentials and runtime database secrets are prohibited from ordinary logs; - logs and evidence are access-restricted and retained according to documented operational and legal needs; and - failures surface as explicit refusals or operational errors rather than silently authorising or reporting success. ## H · Deletion and media handling - active Customer Data is deleted or irreversibly anonymised after the contractual export period, subject to legal hold and binding retention duties; - backup copies expire under their lifecycle and are not restored into ordinary service except for recovery; - object storage and database data are included in deletion procedures according to the subscribed data plane; and - reusable infrastructure is re-provisioned without exposing a prior customer's credentials or data. ## I · Testing and review - automated tests cover authentication, authorisation, Instance isolation, migration integrity and key business invariants; - security-sensitive controls include negative or mutation proofs showing that the test fails when the protection is removed; - vulnerability and dependency findings are assessed and remediated according to risk; and - the measures are reviewed when the service, threat model or processing materially changes.

Data processing agreement

What this text is

The text, as published