Data processing agreement (draft)
between the customer (Controller) customer name and address and connect – Media & Teledienst, Marienstraße 54, 26452 Sande, Germany (Processor) on the processing of personal data on behalf of the controller under Art. 28 GDPR when using hostily Captcha.
§ 1 Subject matter and duration
The Processor processes personal data of visitors to the Controller’s websites on the Controller’s behalf for the purpose of protecting forms from automated submissions. Duration: term of the main contract.
§ 2 Types of data, data subjects
Types of data: IP address (stored as a hash only), domain of the embedding page, timestamps, technical check data, hashes of form values, where applicable form content passed by the application (see Annex 1). Data subjects: visitors and users of the Controller’s websites.
§ 3 Instructions
The Processor processes the data only on documented instructions from the Controller (the main contract and the settings in the management area count as instructions), unless required to do so by law. If it considers an instruction unlawful, it will say so.
§ 4 Confidentiality
Persons authorised to process the data are bound to confidentiality.
§ 5 Technical and organisational measures
The Processor implements the measures in Annex 2 and develops them further. Material deterioration is not permitted.
§ 6 Sub-processors
The Controller agrees to the sub-processors listed in Annex 3. The Processor announces changes notice period, e.g. 30 days in advance; the Controller may object for good cause.
§ 7 Assistance
The Processor assists the Controller with data subject requests, security of processing, notification of personal data breaches (prompt information) and data protection impact assessments. Because only hashes are stored, assignment to individuals is usually not possible.
§ 8 Erasure and return
Event data is deleted automatically after 14 days. After the end of the contract the Processor deletes project data period, e.g. 30 days and confirms this on request.
§ 9 Evidence and audits
The Processor provides the information needed to demonstrate compliance and allows audits define scope/notice.
§ 10 Final provisions
German law applies. In case of conflict this agreement prevails over the main contract regarding data protection. regulate liability and jurisdiction
Annex 1: Details of processing
| Purpose | Spam protection for forms (proof-of-work, content rules, honeypot, minimum time, IP block) |
|---|---|
| Types of data | IP hash (HMAC-SHA256, secret key changing daily), domain/origin, timestamps, token/challenge data, honeypot flag, hash of form values; where applicable form content of rejected submissions – to clarify |
| Data subjects | Visitors to the Controller’s websites |
| Retention | 14 days (events, IP counters, submission hashes) |
Annex 2: Technical and organisational measures
- Data centre: hosting at Hetzner in Germany; physical access protection by the data centre operator.
- Encryption: transmission exclusively via TLS.
- Pseudonymisation: IP addresses are stored only as an HMAC-SHA256 hash with a secret key that changes daily (128 bits); form values for duplicate detection only as HMAC; secrets only as a SHA-256 hash.
- Erasure: automatic deletion run; events after 14 days.
- Access control: access to the management area and servers only for administrators with two-factor authentication; projects are separated from each other (tenant separation by project and customer account).
- Availability: daily backup enter retention period and location of backups.
- Origin check: requests are checked against the project’s allowed domains; rate limiting and IP block.
- Organisation: staff commitments, incident process, data protection officer – add where applicable
Annex 3: Sub-processors
| Company | Service | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Data centre, servers | Germany |
| add others |