Data processing

This is a translation for information purposes. The German version is the legally binding one.

For all personal data that a customer and the persons it has invited process in Feldkontor, the customer is the controller. ALR Consulting UG (haftungsbeschränkt) is the processor. The basis is the following agreement, which is concluded together with the usage contract. The details of the controller that have to be filled in are added when the contract is concluded.

§ 1 Subject matter and duration

The Processor operates the web application “Feldkontor” for the Controller on the basis of the usage contract. This agreement applies for the term of the usage contract and beyond, as long as the Processor processes data of the Controller.

§ 2 Nature, purpose, data and data subjects

§ 3 Instructions

The Processor processes the data only on documented instructions from the Controller, unless it is required to process it under Union law or the law of a Member State; in that case it notifies the legal requirement before the processing, unless the law prohibits this.

Instructions are given in writing. The Controller confirms oral instructions in writing without delay. If the Processor considers an instruction unlawful, it says so without delay and may suspend its execution until the matter is clarified.

§ 4 Duties of the Processor

It obliges all persons who have access to the data to maintain confidentiality.

It takes the technical and organisational measures under Art. 32 GDPR in accordance with Annex 1 and adapts them to the state of the art without lowering the level of protection.

It supports the Controller with reasonable measures in meeting the rights of data subjects under Art. 12 to 23 GDPR. If a data subject approaches the Processor directly, it forwards the request to the Controller without delay and does not answer it itself.

It supports the Controller with the duties under Art. 32 to 36 GDPR, to the extent that the required information is not otherwise available to the Controller.

It reports personal data breaches without delay, as a rule within 48 hours of becoming aware of them, with the details under Art. 33(3) GDPR as far as these are known.

It keeps a record of processing activities under Art. 30(2) GDPR.

Support services that go beyond the statutory scope or that are prompted by circumstances within the Controller's sphere of responsibility are paid for by the Controller on a time basis at the agreed hourly rate ⟨hourly rate⟩; the Processor gives notice of this beforehand.

§ 5 Sub-processors

The Controller gives general authorisation for sub-processors to be engaged and approves the following:

The Processor informs the Controller of intended changes at least four weeks in advance in writing. The Controller may object for important data protection reasons. If it objects, the Processor may terminate the agreement in respect of the service concerned with one month's notice.

The Processor contractually obliges sub-processors to the same data protection duties and is liable to the Controller for their compliance.

Telecommunications, postal, transport and cleaning services as well as other ancillary services with no connection to the processing of the data do not count as sub-processing.

Weather display. The server retrieves the weather details for the daily site report from Open-Meteo and transmits only the coordinates of the site, no personal data; the result is cached for one hour. In server operation the user's browser does not call the service directly, so the service receives no IP addresses of the users.

§ 6 Audit rights

The Controller may satisfy itself that this agreement is being complied with. It announces audits at least two weeks in advance and carries them out during normal business hours without disrupting operations, as a rule once per calendar year and whenever there is specific cause.

The Processor provides the required information and evidence, in particular on the measures under Annex 1 as well as evidence from its sub-processors, to the extent that it holds this.

For the effort of an audit that goes beyond information given in writing, the Processor may charge remuneration on a time basis.

§ 7 Deletion and return

After the services end the Processor either hands over the data as a data export or deletes it, at the Controller's choice, at the latest 30 days after the end of the contract, unless a statutory retention obligation applies.

Data backups are deleted when their retention period of 120 days expires. Until then they are blocked against restoration and are stored further only in order to meet this deletion duty.

Entries deleted in the application stay in the archive for up to 120 days and are then deleted for good.

§ 8 Liability and final provisions

Art. 82 GDPR applies to liability. Between the parties each party is liable for the part of the damage that it caused; Art. 82(5) GDPR remains unaffected.

Otherwise the provisions of the usage contract apply, in particular its liability provisions. In the event of conflict this agreement takes precedence over the data protection provisions of the usage contract.

Amendments must be in writing. German law applies. Should a provision be invalid, the validity of the remaining provisions is not affected.

Annex 1: technical and organisational measures under Art. 32 GDPR

The measures describe the state of version 1.6.3 of the application of 21 October 2026. The detailed version of this annex exists as a separate document; in the event of discrepancies the detailed document applies.

We make the agreement available as a document for signature on request: kontakt@feldkontor.com