Data Processing Agreement (Art. 28 GDPR)

As soon as you process other people's data through KENJTEC — the members of your login area, the answers to your forms, the orders in your shop, the recipients of your invoices — you are the controller for it within the meaning of the GDPR and we are your processor. This agreement governs what we may do in that role and what we owe you. It applies in addition to the terms of service and becomes part of the contract when you accept them.

It does not cover your own account and billing data. For those we are the controller ourselves; what happens to them is set out in the privacy policy.

1. Subject matter, duration, nature and purpose

The subject matter is the provision of the KENJTEC services, to the extent that you enter personal data of third parties or have it collected in the process. The purpose is solely the provision of those services for you — we do not pursue any purposes of our own with it.

Duration: this agreement runs for as long as your contract for the respective service runs, and ends with it.

Nature of the processing: collecting, storing, displaying, sending, modifying and erasing — to the extent provided for by the features you use.

2. Data subjects and types of data

Which data arises is something you decide through the features you use. As things stand today, these are:

• Members of your login area: e-mail address, name (optional), the groups you assign, status (requested/member/blocked), and the times of admission, invitation, confirmation and last access.
• People who fill in your forms: every field you created yourself, as well as uploaded files and signatures.
• Buyers in your shop: name, e-mail address, delivery and billing address, order and payment status. The payment details themselves never reach us — they run directly through your own payment account.
• Recipients of your invoices and quotes: name, address, e-mail address, document details.
• Visitors to your pages: IP address and technical details, to the extent required for delivery.

Which file belongs where. The media library (MediaStudio) is built for publishing: whatever it holds is delivered over a public address — fast, cached and readable by search engines; the only protection is an unguessable file name. That is by design, not a gap. Confidential business documents therefore belong in BusinessCloud storage, which sits behind your sign-in. We point this out in the tool before every upload.

3. Instructions

We process the data solely on your documented instructions. This agreement, the terms of service and the settings you make in your account count as such — every setting is an instruction.

Where we are required to carry out processing under Union law or German law, we will inform you beforehand, unless the law prohibits it.

If we consider an instruction to be unlawful, we will tell you and may suspend its execution.

4. Confidentiality

Everyone at our end who has access to this data is bound to confidentiality. KENJTEC currently operates without employees; access is held solely by the management and by expressly commissioned service providers, who are themselves bound by contract.

5. Security of processing (Art. 32)

We take the following measures. What is listed is what is actually in place — not what sounds customary:

• Encrypted transmission only. All requests run over TLS; unencrypted connections are redirected.
• Passwords are never stored in plain text, only as the hash of a procedure designed for that purpose (bcrypt).
• Separation by account. Every query is bound to the account the data belongs to; records belonging to others behave as if they did not exist.
• Restricted access. Administrative accounts require a second factor.
• Access links to the member area are valid for one hour, sessions for thirty days; both can be revoked at any time.
• Volume limits against misuse: at most 30 new members per hour and 5,000 members per website; if the hourly limit is reached, the system automatically switches admission over to approval by you.
• Backup and restorability. The database is backed up daily (14 versions, stored across several EU regions), plus point-in-time recovery over seven days; the instance runs with a secondary node in a different zone.
• Secrets (keys, credentials) are kept in a dedicated vault, never in the source code.

To be honest about it: the data is encrypted on the providers' storage media, but not additionally at application level. Anyone at our end with authorised access to the database sees the addresses in plain text. Access by the management to member lists is currently not logged separately.

6. Sub-processors

You consent to the use of the following sub-processors. We conclude contracts with them that impose on them the same obligations we bear towards you, and we will inform you before any change in good time for you to object.

• Google Cloud (Google Cloud EMEA Limited, Ireland) — operation and database in the europe-west1 region (Belgium), backups in several EU regions. All data covered by this agreement, unless stated otherwise below. In addition, the AI via Vertex AI (Gemini) in the EU multi-region: what you give the AI is transmitted — that may include texts, images and, when they are analysed, form responses.
• Cloudflare (Cloudflare, Inc., USA) — delivery and protection of all requests (worldwide network) as well as storage of the media files under EU jurisdiction (R2). Processes visitors' IP addresses and the stored files.
• Anthropic (Anthropic Ireland, Limited, Ireland; parent company Anthropic, PBC, USA) — the AI features that do not run via Google (such as generating a website, form or shop), and the fallback when Google does not respond. What you give the AI is transmitted; that may include form content and images. This transfer goes to the USA; the responses may also be computed in other countries.
• Mistral AI (Mistral AI SAS, France) — AI features via the European endpoint, processing in the EU. What you give the AI is transmitted; that may include form content and images.
• OpenAI (OpenAI Ireland Limited, Ireland) — AI features. What you give the AI is transmitted; that may include form content and images. This transfer goes to the USA.
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg), region eu-central-1 (Frankfurt) — automated checking of images for abusive content on receipt: in the media library (including PDF files, plus keywords for search), in forms (including images and signatures uploaded by your visitors), on websites and as a logo on invoices and quotes. A downscaled copy (at most 1,024 pixels on the longest edge) is transmitted, not the original. Under AWS's terms, AWS may store such inputs and use them to improve its services, including in another region, as long as this has not been objected to; whether this objection has been set up for our account is to be added.
• Mailjet (Mailjet SAS, France) — sending the system and notification e-mails. Processes the recipients' addresses, and therefore those of your members, buyers and invoice recipients as well.
• Stripe — billing of your KENJTEC contract. Payments in your shop run through your own Stripe account and not through us.
• Tucows (OpenSRS), Canada — domain registration. Processes the registrant details you provide for a domain. This transfer goes to Canada.
• Bunny Fonts (BunnyWay d.o.o., Slovenia) — serving the fonts. Your visitors' browsers connect to fonts.bunny.net for this.

Transfers to third countries: to Anthropic (USA) on the basis of the European Commission's standard contractual clauses contained in Anthropic's data processing agreement; to OpenAI (USA) on the basis of the standard contractual clauses contained in OpenAI's data processing agreement; to Tucows (Canada) on the basis of the adequacy decision for Canada; to the extent that Google, Cloudflare and Amazon Web Services transfer data to the USA, on the basis of the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback. Some of the AI tasks run via Google in the EU; the remaining tasks and the fallback run via Anthropic (storage in the USA) — the AI features currently cannot be restricted to the EU. They run solely at your request: without a click from you, no content reaches an AI service — there is no background processing and none on upload. The only thing that runs by itself on upload is the image checking by Amazon Web Services in Frankfurt.

7. Assistance with data subject rights

If a data subject approaches us instead of you, we refer them to you and do not respond ourselves.

For access, rectification and erasure, the features of your account are at your disposal: you can change and delete members individually, download the entire list as a spreadsheet, and output form responses as a spreadsheet and delete them individually. Where those features are not enough, we will assist you on request.

Members can remove themselves from your list via the link in every access e-mail. That erasure takes effect immediately.

8. Assistance with breaches and impact assessments

If we become aware of a personal data breach affecting your data, we will inform you without undue delay and give you the details you need for your notification under Art. 33 GDPR. Notifying the supervisory authority and, where applicable, the data subjects is your responsibility.

For a data protection impact assessment and a prior consultation, we will assist you with the information available to us.

9. Erasure and return

After the end of the processing we erase the data or return it to you — the choice is yours.

Return: you can download the member list of a website as a spreadsheet at any time; the same goes for form responses. You take the document of your website together with its images with you via “Take the site with you”.

Erasure: if you delete a website, its member list goes with it. The end of a plan erases nothing. If you have your account deleted, your websites together with their member lists, your media, shops and WordPress installations go with it — no earlier than 30 days after the end of the term.

As long as you do not delete anything, we store the data indefinitely, including after a plan ends — there is no automatic erasure once a period expires. Statutory retention obligations (in particular for accounting documents) remain unaffected; we keep such documents for the statutory period even after a cancellation.

To be honest about it: when your account is deleted, we currently do not automatically instruct our sub-processors to erase the data. Data that has flowed to Mailjet (e-mail delivery) or Stripe (billing) is subject to their own retention periods there. If you want it erased there as well, write to us — we will initiate it.

10. Evidence and audits

On request we make available to you the information necessary to demonstrate compliance with these obligations, and we allow for audits. You announce audits with reasonable notice; they must not unreasonably disrupt operations and must not touch other customers' data.

11. Final provisions

German law applies. Should any provision be invalid, the remainder remains in effect.

We will notify you of changes; if you do not object within four weeks, they are deemed accepted. We point this consequence out separately in the notification.