Data Processing Agreement (AVV / DPA)

Agreement under Art. 28 GDPR for customers of the NISD2.eu platform.

What this is

When you use the NISD2.eu platform, we process personal data on your behalf (e.g. names of your employees in compliance forms, evidence you upload). Art. 28 GDPR requires a written data processing agreement (DPA, in German AVV) between you as controller and us as processor.

On request, we provide a DPA and sign it individually for your organisation - typically within one business day.

Contents of the DPA

The DPA we provide meets Art. 28 GDPR requirements and includes:

  • Subject and duration of processing
  • Nature and purpose of processing, types of data, categories of data subjects
  • Processor acts only on documented instructions
  • Confidentiality obligations of personnel
  • Technical and organisational measures (Art. 32 GDPR) - see TOMs document
  • List of sub-processors and approval procedure
  • Assistance with data subject rights (Art. 15-22 GDPR)
  • Audit rights of the controller
  • Deletion or return of data on termination
  • Liability and cooperation obligations
Request a DPA

Send an email to contact@nisd2.eu with the following information:

  • Full company name and registered address
  • Commercial register number (if applicable)
  • Authorised representative
  • Data protection contact person

We typically return the signed DPA within one business day by email. A signed paper copy by post is available on request.

Request DPA by email

Sub-processors

The following sub-processors are used to operate the platform:

  • Hetzner Online GmbH (Falkenstein/Nuremberg, Germany) - hosting of application servers and database
  • Amazon Web Services EMEA SARL - storage of uploaded evidence documents (S3, EU region)
  • Google Ireland Limited - OAuth authentication
  • Resend, Inc. (USA) - delivery of transactional emails
  • xAI Corp. (USA) - AI-assisted form prefill (optional, can be disabled)

Changes to the sub-processor list will be announced in advance. You have the right to object to changes.

Technical and organisational measures

The technical and organisational measures relevant to this DPA under Art. 32 GDPR are described in our TOMs document.

View TOMs document