Agreement on joint responsibility according to Art. 26 DSGVO between Digistore 24 GmbH and the Vendor

Preamble

Digibiz24 is a page and member area builder with which the contractual partner (hereinafter referred to as "Vendor") of Digistore24 GmbH, St.-Godehard-Str. 32, 31139 Hildesheim (hereinafter referred to as "Digistore") can build an entire online business without any prior technical knowledge.

Digibiz24 is operated by Digital Assets AG, Digital Assets AG, Birkenstrasse 47, 6343 Rotkreuz, Switzerland, which provides the technical infrastructure.

In order to use this infrastructure, it is necessary for the Vendor to enter into a separate service and order processing agreement with Digital Assets AG.

Digistore24 manages for the Vendor as a full service provider the Vendor's account created in Digibiz24 and the member accounts created in this context for the Vendor's end customers (hereinafter referred to as "Members").

At the same time, Digistore24 becomes the direct contractual partner of the Members in connection with the performance of contracts.

In this regard, both Digistore24 and the Vendor jointly determine the purposes of and means for processing the Members' personal data.

Digistore24 and the Vendor are thus joint data controllers under data protection law within the meaning of Article 26 of the GDPR.

With the following agreement, Digistore24 and the Vendor (hereinafter jointly "the Contracting Parties") determine which of them fulfills which obligation pursuant to Art. 26 DSGVO.

1. Subject Matter of the Agreement

The Vendor creates its Digibiz24 account itself. He is responsible for the operational support of his Digibiz24-Account. The Vendor determines the contents of the member area and makes them available. In addition, the Vendor determines which of the members can access which content and to what extent.
The legal relationships and mutual rights and obligations as well as the associated responsibilities in connection with the use of the services and functions available in the Member Area between the Member and the Vendor as operator of the Member Area are regulated in separate terms of use, which the Member must accept before registering and/or logging in to the Member Area.

2. Joint responsibility (Art. 26 DSGVO)

Within the scope of the use of the provided services of the Digibiz24 account by the Members, personal data of the Members are processed by both Digistore24 and the Vendor. Digistore24 and the Vendor jointly determine the means and purposes of the processing activities described in more detail below. In this context, Digistore24 and the Vendor are jointly responsible persons under data protection law within the meaning of Art. 26 DSGVO.
Within the scope of joint responsibility, Digistore24 is responsible for the processing of personal data of Members in the context of registration for use, in Digibiz24 and the availability of the Services. The subject of the processing, the legal basis of which is the Terms of Use (Art. 6 I No. 1b) DSGVO), is the master data of the Members, IP addresses, log files and data on usage activities and payment data of the Members.
Within the scope of joint responsibility, the Vendor is responsible for the processing of the Members' personal data within the scope of the allocation of access authorizations in accordance with the authorization concept for the Members, as well as the provision of services and content in Digibiz24. The subject of the processing, the legal basis of which is a contractual relationship between Digistore24 and the Vendor as vicarious agent for the Member (Art. 6 I No. 1b DSGVO), is the master data of the Members.
Digistore24 and the Vendor shall ensure that the personal data is collected which is absolutely necessary for the lawful process handling. In all other respects, the Joint Controllers shall observe the principle of data minimization within the meaning of Art. 5 I c DSGVO.
The Vendor undertakes to provide the Members free of charge with the information required under Art. 13 and 14 of the GDPR in precise, transparent, comprehensible and easily accessible forms of clear and simple language.
The Members may assert the rights to which they are entitled under Art. 15-22 DSGVO against Digistore24 as well as against the Vendor.
The Vendor undertakes to provide the Members concerned with the information to which they are entitled under Article 15 of the GDPR upon request. For this purpose, Digistore24 will provide the Vendor with the necessary information from its areas of operation without delay, if required.
Insofar as a Member contacts Digistore24 in order to exercise his/her rights as a data subject in connection with the use of the Member Account, in particular with regard to information or correction and deletion of data, Digistore24 shall be obliged to provide this information without delay.
If personal data is to be deleted, the contractual partners shall inform each other in advance. The other contracting party may object to the deletion for a justified reason, for example if it has a legal obligation to retain the data.
The Contractual Partners shall inform each other immediately and in full if they discover errors or irregularities with regard to data protection provisions when checking processing activities.
Digistore24 and the Vendor are obliged to report and notify the supervisory authority and the persons affected by a violation of the protection of personal data resulting from Art. 33, 34 DSGVO for the specified areas of effect. The contractual partners shall inform each other without undue delay about the notification of personal data breaches to the supervisory authority and shall forward to each other without undue delay the information required to carry out the notification.
Documentation within the meaning of Art. 5 Para. 2 DSGVO, which serves as proo fof proper data processing, shall be retained by the contractual partners inaccordancewiththelegalpowers and obligations beyond the end of the contract.
The contractual partners shall each ensure that all employees involved in data processing maintain the confidentiality of the data in accordance with Art. 28 Para. 3, 29 and 32 DSGVO for the duration of their activity as well as after termination of the employment relationship and that they are appropriately obligated to maintain data secrecy before commencing their activity and are instructed in the data protection provisions relevant to them.
The contractual partners shall independently ensure that they comply with all statutory data retention obligations. They shall take appropriate data security precautions for this purpose.
Without prejudice to the provisions of this Agreement, Digistore24 and the Vendor shall be jointly liable vis-à-vis the data subjects for any damage caused by processing that does not comply with the GDPR. In the internal relationship, the Contractual Partner shall, without prejudice to the provisions of these Terms of Use, only be liable for damage caused within its respective sphere of activity.
As long as the contractual relationship is active and lived, the Vendor alone is responsible for deleting the data of Members assigned to him. If an account is blocked or closed, for whatever reason, this obligation is transferred to Digistore24.

3. Confidentiality/Duty of Secrecy

The contractual partners undertake to use all content of which they gain knowledge via the accounts only to further the purposes of fulfilling the contracts and to treat it confidentially, in particular to disclose confidential information only to those representatives who are dependent on knowledge of this information for the purpose, to secure the confidential information against unauthorized access by third parties by means of appropriate confidentiality measures and to comply with legal and contractual regulations when processing the confidential information.
Confidential information in the sense of this Agreement is all information (whether written, electronic, oral, digitally embodied or in any other form) published in Digibiz24, confidential information being in particular trade secrets, products, manufacturing processes, know-how, inventions, business relationships, business strategies, business plans, personnel matters.
No confidential information is such information which was known or generally accessible to the public before publication in Digibiz24 or which becomes so at a later point in time without violation of this obligation of secrecy, which was obtained by a Contractual Partner itself without use of or reference to confidential information or which was handed over or made accessible to the Contractual Partner by an authorized third party without violation of an obligation of secrecy.
The contractual partners shall be liable for any culpable breach of confidentiality by their employees or other vicarious agents.

4. Final Provisions

These terms of use are subject to the law of the Federal Republic of Germany.
If one or more clauses collide with provisions from the existing service contract, the provisions of this agreement shall take precedence.
Changes to this contract must be announced to the Vendor in text form at the latest. The user is released from the obligation to react to the change. The change will come into effect upon the expiry of the period noted in the announcement.
Any ineffectiveness of individual provisions does not affect the validity of the remaining provisions.
The contract language is German. Should one or more clauses of this contract conflict with clauses of the German version, the provisions agreed in the German version of this contract shall prevail. The German version is to be found here: https://www.digibiz24.com/de/agreement