Fischer & Habel GmbH, Am Kaiserkai 69, 20457 Hamburg, Germany, registered in the commercial register of the Hamburg Local Court (Amtsgericht Hamburg) under HRB 187689, represented by its managing directors Tobias Fischer and Matthias Habel.

This Data Processing Agreement applies between Fischer & Habel GmbH (the “Agency”) and the customer that has concluded an agreement for services with the Agency (the “Client”, the “Main Agreement”). It forms part of the Main Agreement.

Preamble

The Agency provides the Client with the services commissioned under the Main Agreement. Insofar as it processes personal data on behalf of the Client in doing so, this Agreement governs the rights and obligations of the parties under Art. 28 of the General Data Protection Regulation (GDPR). It requires no signature; electronic form is sufficient (Art. 28(9) GDPR).

§ 1 Subject matter, duration and scope

(1) This Agreement covers the processing of personal data by the Agency on behalf of the Client in the course of providing the services commissioned under the Main Agreement. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

(2) The term of this Agreement corresponds to the term of the Main Agreement. Obligations that by their nature continue after the end of the Agreement, in particular those under § 5 (confidentiality) and § 12 (deletion and return), remain in force until they have been fulfilled.

(3) Where the Agency processes personal data for its own purposes, such as the contact details of the Client’s contact persons for performing and invoicing the Main Agreement, it is itself the controller. This Agreement does not apply to that processing.

(4) In the event of any conflict between this Agreement and the Main Agreement, this Agreement prevails in matters of data protection.

§ 2 Client platforms

(1) The Agency predominantly provides its services within systems that the Client itself maintains with third parties (“Client Platforms”), in particular its shop system (e.g. Shopify), marketplaces (e.g. Amazon Seller Central, Vendor Central and Amazon Ads), advertising, analytics and tracking accounts (e.g. Meta Business Suite, Google Ads, Google Analytics, Google Tag Manager, Google Merchant Center, Google Search Console), email and SMS marketing systems (e.g. Klaviyo), and apps and services it uses there (e.g. consent management solutions and server-side tagging such as Stape).

(2) The providers of these platforms are contractual partners of the Client and not subprocessors of the Agency. The Client is responsible for concluding the agreements required under data protection law with them, for obtaining the necessary consents and fulfilling information obligations (for example through consent banners and its privacy policy), and for granting the Agency access with the required permissions and revoking it.

(3) The Agency uses the Client Platforms solely within the permissions granted to it and in accordance with the Client’s instructions. Where the platform allows, it works with personal user accounts rather than shared credentials.

(4) If, by way of exception, the Agency maintains such an account in its own name for the Client, its provider is a subprocessor under § 8 and is included in the list under § 8(2).

§ 3 Instructions

(1) The Agency processes personal data only on documented instructions from the Client, including with regard to transfers to a third country, unless it is required to do so by Union or Member State law. In that case, it informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Main Agreement and this Agreement constitute the initial instructions.

(2) The contact persons named in the offer or Main Agreement, or subsequently notified in text form, are authorised to issue instructions. Instructions are given in text form, for example by email or in the jointly used project management tool. The Client confirms oral instructions in text form without undue delay.

(3) If the Agency considers that an instruction infringes the GDPR or other data protection provisions, it informs the Client without undue delay. It may suspend the execution of the instruction until the Client confirms or amends it.

(4) Instructions that go beyond the services agreed in the Main Agreement are treated as change requests. Any additional effort is remunerated at the rates of the Main Agreement.

§ 4 Rights and obligations of the Client

(1) The Client is the controller within the meaning of Art. 4(7) GDPR. It is responsible for the lawfulness of the processing, in particular for the existence of a legal basis, for any required consents (for example for tracking, advertising audiences and newsletters) and for safeguarding the rights of data subjects.

(2) The Client provides the Agency only with the personal data required for the commissioned services. It provides special categories of personal data (Art. 9 GDPR) only after prior agreement in text form.

(3) If the Client identifies errors or irregularities in the processing, it informs the Agency without undue delay.

§ 5 Confidentiality

The Agency only involves persons in the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and who have been familiarised with the data protection provisions relevant to them. These persons process the data only on instructions from the Client, unless they are required to do so by law. The obligation continues after their engagement ends.

§ 6 Technical and organisational measures

(1) The Agency implements the technical and organisational measures described in Annex 3 in accordance with Art. 32 GDPR to ensure a level of security appropriate to the risk.

(2) The measures are subject to technical progress. The Agency may replace them with equivalent or more effective measures, provided the level of protection is not reduced. It documents material changes.

§ 7 Assistance to the Client

(1) The Agency assists the Client by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. If a data subject contacts the Agency directly, the Agency forwards the request to the Client without undue delay and does not respond to it itself unless instructed to do so by the Client.

(2) Taking into account the nature of the processing and the information available to it, the Agency assists the Client in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of personal data breaches, data protection impact assessment, prior consultation).

(3) For assistance that goes beyond minor effort and does not result from a breach of this Agreement by the Agency, the Agency may charge remuneration at the rates of the Main Agreement.

§ 8 Subprocessors

(1) The Client grants the Agency general authorisation to engage other processors (“Subprocessors”) (Art. 28(2) GDPR).

(2) The service providers listed at https://fischer-habel.com/subprocessors as at the conclusion of the contract are authorised.

(3) If the Agency intends to add or replace a Subprocessor, it informs all active clients at least 14 days in advance by email to the contact address most recently notified in text form and updates the list. The Client may object to the change in text form within this period if there is an important reason relating to data protection. If the parties cannot reach agreement, the Client may terminate the Main Agreement with regard to the affected services for cause, effective as of the date the change takes effect. If no objection is made in time, the change is deemed approved.

(4) The Agency contractually imposes on each Subprocessor data protection obligations that substantially correspond to those of this Agreement, in particular sufficient guarantees that appropriate technical and organisational measures are implemented (Art. 28(4) GDPR). For standardised services, their data processing terms are sufficient insofar as they meet these requirements. Where a Subprocessor fails to fulfil its data protection obligations, the Agency remains liable to the Client for the performance of that Subprocessor’s obligations.

(5) Ancillary services provided by third parties that do not involve access to the Client’s personal data, such as telecommunications, postal and transport services, do not constitute subprocessing. Client Platforms (§ 2) are not Subprocessors.

§ 9 Transfers to third countries

(1) Processing outside the European Union or the European Economic Area only takes place if the conditions of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for recipients certified under it) or the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

(2) The basis for each Subprocessor is stated in the list under § 8(2). Where necessary, the Agency agrees Standard Contractual Clauses with the Subprocessor and assesses supplementary measures.

§ 10 Notification of personal data breaches

(1) The Agency notifies the Client of a personal data breach affecting the Client’s data without undue delay and no later than 48 hours after becoming aware of it. The notification is sent to the contact address most recently notified by the Client in text form or, failing that, to the contact person named in the Main Agreement.

(2) The notification contains, insofar as known, the information under Art. 33(3) GDPR. The Agency provides information that is not yet available without undue delay as it becomes available. It takes appropriate measures without undue delay to contain the breach and mitigate its consequences, in coordination with the Client.

(3) The Client makes notifications to the supervisory authority and communications to data subjects; the Agency assists it in doing so. A notification under paragraph 1 is not an acknowledgement of fault.

§ 11 Evidence and audits

(1) On request, the Agency makes available to the Client all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, in particular a current description of the technical and organisational measures and available evidence from its Subprocessors, such as certifications or audit reports.

(2) If this information is not sufficient, the Client may carry out audits, including inspections, itself or through an auditor it appoints who is bound to confidentiality and is not a competitor of the Agency. Audits must be announced at least four weeks in advance, take place during normal business hours, must not disrupt business operations disproportionately and take place no more than once per calendar year, unless a specific reason, in particular a personal data breach or an order by a supervisory authority, requires a further audit.

(3) The Client bears the costs of an audit unless it reveals a material breach of this Agreement by the Agency.

(4) The Agency informs the Client without undue delay of inspections and measures by a supervisory authority insofar as they relate to the processing under this Agreement.

§ 12 Deletion and return

(1) After the end of the services, the Agency, at the Client’s choice, deletes or returns all of the Client’s personal data that it has stored in its own systems, such as exports, copies and files, unless Union or Member State law requires storage. If the Client does not make a choice within 14 days after the end of the services, the Agency deletes the data. Deletion or return takes place within 30 days after the end of the services.

(2) Data in backups is removed in the course of regular deletion cycles and is no longer actively processed until then.

(3) Data in the Client Platforms (§ 2) remains with the Client. The Agency ends its use of these platforms; the Client revokes the access granted to it.

(4) On request, the Agency confirms deletion in text form.

§ 13 Liability

The liability of the parties is governed by the provisions of the Main Agreement, insofar as Art. 82 GDPR does not provide otherwise.

§ 14 Amendments to this Agreement

(1) The Agency announces amendments to this Agreement in text form at least four weeks before they take effect. If the Client does not object within this period, the amendment is deemed accepted. The announcement expressly points out this consequence.

(2) If the Client objects, the previous version continues to apply, and either party may terminate the Main Agreement for cause.

(3) Amendments must not reduce the level of protection of this Agreement.

(4) Amendments that are mandatory by law or by order of an authority apply from their announcement.

(5) The current and every previous version of this Agreement are permanently available at https://fischer-habel.com/dpa/archive.

§ 15 Final provisions

(1) This Agreement takes effect upon acceptance of the offer or conclusion of the Main Agreement.

(2) Amendments and additions require text form unless § 14 provides otherwise.

(3) Should any provision of this Agreement be or become invalid, the validity of the remaining provisions remains unaffected. The invalid provision is replaced by a provision that meets the requirements of Art. 28 GDPR and comes closest to the purpose of the invalid provision.

(4) This Agreement is governed by the laws of the Federal Republic of Germany. Jurisdiction is determined by the Main Agreement.

(5) This Agreement is available in German and English. In the event of any discrepancy, the German version prevails.

(6) The Client directs data protection enquiries to privacy@fischer-habel.com.

Annex 1 – Description of the processing

The modules of the services commissioned under the Main Agreement apply. No module provides for the processing of special categories of personal data (§ 4(2)). For all modules: coordination, project organisation and documentation take place via the tools named in the list under § 8(2).

Module A: Shopify support and development

Nature and purpose: Setting up, configuring, developing and maintaining the Client’s Shopify shop, including themes, apps, interfaces and data migrations; technical support and troubleshooting.
Types of data: Contact and master data (name, address, email address, telephone number), customer account and order data (orders, items, amounts, payment and shipping status, no full payment card data), content of customer enquiries, technical data such as IP addresses and log data, insofar as stored in the shop.
Data subjects: The Client’s customers and prospects, newsletter subscribers, the Client’s employees and contact persons.

Module B: Email and SMS marketing (Klaviyo)

Nature and purpose: Setting up and managing the Client’s email and SMS marketing, building lists and segments, creating and sending campaigns and automated flows, performance analysis.
Types of data: Contact data (email address, telephone number, name), consent and unsubscribe status, profile and preference data, order and purchase history, interaction data (opens, clicks, activity in the shop), segment membership.
Data subjects: The Client’s subscribers, customers and prospects.

Module C: Amazon management (Seller Central, Vendor Central, Amazon Ads)

Nature and purpose: Maintaining product data and offers, inventory and price management, planning and managing advertising campaigns (Amazon Ads), reporting.
Types of data: Order and buyer data that Amazon provides in the Client’s account and that is visible when working in the account (such as order number, items, name and delivery address); campaign and performance data, predominantly in aggregated form. The Agency does not use buyer data for its own purposes and complies with Amazon’s data protection requirements for sellers and service providers.
Data subjects: The Client’s buyers and prospects on Amazon.

Module D: Performance marketing, tracking and analytics

Nature and purpose: Setting up and managing advertising campaigns (for example with Meta and Google), configuring tracking, conversion measurement and server-side tagging, integrating consent management, maintaining product feeds, analysing campaign and website data, matching customer lists for advertising audiences.
Types of data: Online identifiers (such as cookie, device and click IDs), IP addresses, usage and interaction data, conversion and transaction data, hashed contact data (email address, telephone number) for audience matching; predominantly pseudonymised or aggregated.
Data subjects: Visitors to the Client’s websites and shops, its customers and prospects, recipients of advertising.

Annex 2 – Subprocessors

The current list is available at https://fischer-habel.com/subprocessors.

Annex 3 – Technical and organisational measures

The Agency does not operate its own servers. Its systems are cloud services of the Subprocessors named in Annex 2, which implement their own, regularly audited security measures for their infrastructure. In addition:

1. Confidentiality

Access to systems: Personal user accounts; two-factor authentication for all services that support it; credentials stored exclusively in the password manager (1Password); automatic screen lock; encrypted storage on all work devices; up-to-date operating systems and software.
Access to data: Permissions on a need-to-know basis per client and project; access to Client Platforms as personal users with the necessary roles; regular review of permissions; revocation of all access no later than the last working day of departing persons.
Separation: Each client’s data kept separate, for example in dedicated vaults in the password manager and dedicated projects and folders; development and testing without real data where possible.
Pseudonymisation: Customer lists for advertising audiences are only transmitted in hashed form; analyses are aggregated where possible.

2. Integrity

Transfer: Transmission exclusively encrypted (TLS); no transfer of personal data on removable media; data exports only where necessary, deleted after use.
Input: Traceability of changes through the activity and version logs of the systems used and the task history in project management.

3. Availability and resilience

Data stored with cloud providers with redundant infrastructure and regular backups; version control of source code; error and availability monitoring of own applications.
Restoration from the providers’ backups and versions.

4. Regular review

All staff committed to confidentiality and data protection; awareness training at the start of their engagement and regularly thereafter.
Defined procedure for personal data breaches, including notification under § 10.
Selection of Subprocessors according to data protection and security criteria; data processing agreements with all Subprocessors.
Review of these measures at least once a year.

Data Processing Agreement (DPA)