Data Processing Agreement

1. Parties and incorporation

This agreement under Art. 28 GDPR is entered into by the company registered with 1stlevel as controller (“Customer”) and NG IT-Projekte, proprietor Nikolas Gottschalk, Sonnenhof 150, 53119 Bonn, Germany, as processor (“Provider”). Electronic acceptance at registration incorporates it into the service contract.

It prevails over conflicting data-protection provisions in the Terms. The Terms, including liability provisions, otherwise apply unless mandatory data-protection law prevents this.

2. Subject matter, duration, nature and purpose

The processing concerns provision and operation of the web-based ticket system, including email processing, attachments, search, knowledge content, teams, export, API and webhooks. It lasts for the service term plus agreed return, backup and deletion periods.

Operations particularly include collection, recording, organisation, storage, retrieval, transmission, restriction, backup and erasure solely to provide, secure, maintain and support the service and on documented Customer instructions.

3. Data and data subjects

• Identity, contact and organisational data of the Customer’s staff, service providers, customers and other requesters.
• Communication and ticket content, email metadata, attachments, internal notes, status, assignment and timestamps.
• Usage, log, device and identifier data required for operation and security.
• Data subjects particularly include Customer users, employees, clients, prospects, suppliers and other communication partners.

4. Instructions and Customer responsibility

The Provider processes Customer Data, including transfers to third countries, only on documented instructions unless legally required otherwise. In that case, the Provider informs the Customer of the requirement before processing unless the law prohibits this on important grounds of public interest. Configuration, use, support requests and this agreement are documented instructions. Additional instructions may be sent in text form to kontakt@1stlevel.tech and may be charged where outside the agreed service.

The Customer is responsible for lawfulness, transparency, minimisation, accuracy, legal bases and data-subject rights. If an instruction appears unlawful, the Provider informs the Customer without undue delay and may suspend it pending clarification.

5. Provider obligations

• Persons authorised to process Customer Data are bound to confidentiality or an appropriate statutory duty and receive access only on a need-to-know basis.
• Appropriate technical and organisational measures under Art. 32 GDPR, regularly reviewed.
• Taking account of the nature of processing, reasonable assistance through technical and organisational measures with data-subject requests, and assistance with the Customer’s obligations under Arts. 32 to 36 GDPR, particularly security, notifications, communications, impact assessments and prior consultations.
• Notification without undue delay of known Customer Data breaches. Where available, the notice states the nature of the incident, categories and approximate numbers of affected persons and records, likely consequences, measures taken or proposed, and a contact point. Missing details are supplied without undue delay; legal notifications to authorities and data subjects remain the Customer’s responsibility.
• Required processing records and cooperation with competent supervisory authorities.

6. Sub-processors

The Customer generally authorises the sub-processors below. Intended additions or replacements are announced by email or in the service at least 30 days in advance. The Customer may object within that period on material data-protection grounds. If no reasonable alternative exists, either party may terminate the affected service for cause.

The Provider contractually imposes at least the same data-protection obligations and appropriate security measures on every sub-processor. The Provider remains responsible to the Customer for the sub-processor’s performance. On justified request, it provides available evidence of those obligations unless third-party rights or security interests prevent disclosure.

• Laravel Holdings Inc. / Laravel Cloud – hosting, database, runtime, queue, sessions, private object storage, backups and infrastructure; Frankfurt region with possible US transfer; Laravel DPA, EU Standard Contractual Clauses and/or EU-US Data Privacy Framework; current sub-processors in the Laravel Trust Center.
• Hostinger International Ltd., Cyprus, and the affiliates and sub-processors named in Hostinger’s Data Processing Addendum – mailbox, SMTP and email infrastructure; EU/EEA and possibly third countries under Hostinger’s DPA and stated transfer safeguards.

7. International transfers

Customer Data is primarily processed in the Frankfurt region. Where a documented instruction, sub-processor or its support location requires processing in a third country, the Provider ensures a valid transfer mechanism, particularly an adequacy decision including the EU-US Data Privacy Framework or EU Standard Contractual Clauses, plus supplementary measures where required.

8. Return and deletion

Until the end of the read-only retrieval period of no more than 60 days, the Customer may choose between return by self-service export and deletion. An administrator may trigger tenant deletion during the term. If the Customer makes no other documented choice after termination, deletion is the instruction. The Provider then erases or anonymises all Customer Data and existing copies unless Union or German law requires further storage; in that case, the data is restricted and processed only for the statutory purpose.

Complete private deletion exports are access-restricted for no more than 30 days and then removed automatically. Infrastructure backup copies remain restricted until overwritten within the configured backup window and are not restored or processed for other purposes. On request, the Provider confirms deletion in text form.

9. Evidence and audits

The Provider supplies information and suitable available evidence required for review. For cause, or ordinarily once per year, the Customer may audit with reasonable notice itself or through a confidentiality-bound auditor. Operations, security and third-party tenant data must not be impaired.

The Provider contributes to audits and permits inspections to the extent required to demonstrate compliance with Art. 28 GDPR. Additional effort for audits that go beyond this, are unreasonably frequent or lack cause may be reasonably charged after notice, unless the audit identifies a material breach attributable to the Provider.

10. Final provisions

Changes require text form or demonstrable electronic acceptance. Otherwise the service contract governs term, law, venue and liability without limiting data-subject rights or mandatory responsibility under Art. 82 GDPR.