Skip to content
AdventJoy
This page in GermanCreate my calendar

DPA (data processing)

Draft, not reviewed by a lawyer. Last updated: 23 October 2026, version 1.0

This English version is provided for convenience. In case of doubt, the German version applies.

between

the customer (business customer of AdventJoy, company name and address as stated in the order), hereinafter the "controller",

and

Daniel Narum, bydaniwp (AdventJoy), Stühlingerstr. 30, 79106 Freiburg im Breisgau, Germany, hereinafter the "processor".

The controller concludes this agreement in electronic form when purchasing a business plan (Starter, Business, Custom) by ticking the corresponding checkbox (Art. 28 (9) GDPR). The processor stores the time and version of conclusion with the order and sends this agreement with the order confirmation.

1. Subject matter and duration

  1. The subject matter is the processing of personal data by the processor on behalf of the controller when providing a digital business advent calendar via AdventJoy (main contract under the AdventJoy terms and conditions).
  2. This agreement applies for the term of the main contract and beyond until all data has been deleted or returned in accordance with section 10.

2. Nature, purpose and scope of processing
Nature of processing storing, hosting, delivering, analysing, sending confirmation emails, exporting, deleting
Purpose publishing the calendar, delivering content to visitors, visitor statistics without cookies, running prize draws with double opt-in (Business and Custom plans only), drawing winners and export
Categories of data subjects calendar visitors; prize draw entrants; people shown or named in content (for example employees)
Types of data Visitors: shortened hash of IP address and user agent with a daily changing salt, time zone, events (opens, copies, clicks), referring site, UTM parameters; technical server logs. Entrants: email address, hash of the email address, optionally name, answer to the question, language, times of entry, acceptance and confirmation, optional newsletter consent with its wording, shortened hash of the IP address. Content: texts, images, voice recordings, videos and logos uploaded by the controller
Special categories (Art. 9 GDPR) none intended; the controller does not upload such data

3. Instructions

  1. The processor processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by Union or German law; in that case the processor informs the controller of that legal requirement beforehand unless the law prohibits this.
  2. Instructions result from this agreement, the main contract and the settings the controller makes in the editor (for example enabling a prize draw, export, drawing winners). The controller gives further instructions in text form to hello@bydaniwp.dev.
  3. If the processor considers an instruction unlawful, it informs the controller without delay and may suspend its execution until clarified.

4. Obligations of the processor

  1. It ensures that all persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
  2. It implements the technical and organisational measures under Art. 32 GDPR set out in Annex 2 and adapts them to the state of the art without lowering the level of protection.
  3. It assists the controller with appropriate measures in responding to requests from data subjects (Art. 12 to 23 GDPR). If data subjects contact it directly, it forwards the request without delay.
  4. It assists the controller with the obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation).
  5. It notifies the controller of a personal data breach without undue delay, where possible within 24 hours of becoming aware of it, with the information under Art. 33 (3) GDPR as far as known.
  6. It processes the data exclusively within the European Union.
  7. It does not use the data for its own purposes, except for anonymous totals without personal reference for billing and service improvement.

5. Obligations of the controller

  1. The controller is responsible for the lawfulness of the processing, in particular for official rules, privacy notices, consents and informing data subjects.
  2. Before publication, it provides its name and address and links to its imprint and privacy notice; the processor displays them in the calendar.
  3. It informs the processor without delay if it detects errors or irregularities in the processing.

6. Sub-processors

  1. The controller gives general authorisation to engage sub-processors. The sub-processors engaged at the time of conclusion are listed in Annex 1 and are deemed approved.
  2. The processor informs the controller in text form at least 14 days in advance of any intended addition or replacement. The controller may object within this period for an important data protection reason. If the parties cannot agree, the controller may terminate the main contract without notice; fees already paid for the remaining term are refunded pro rata.
  3. The processor imposes the same data protection obligations as in this agreement on each sub-processor by contract and remains liable for their compliance.
  4. Ancillary services such as telecommunications or payment processing are not sub-processing. Stripe processes only the controller's own order and payment data as an independent controller and receives no data under section 2.

7. Audit rights

  1. The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for audits, including inspections, by the controller or an auditor mandated by it who is bound to confidentiality.
  2. Audits are announced with reasonable notice, normally 14 days, and carried out during normal business hours without disrupting operations. Evidence may also be provided through current self-assessments and certificates of sub-processors (for example ISO/IEC 27001 of the data centre).

8. Liability

Art. 82 GDPR applies to liability. Otherwise, the liability provisions of the main contract apply.

9. Data subject rights in the editor

The controller can view entries via the export. The processor carries out deletion of individual entries and access requests on instruction in text form within seven days.

10. Deletion and return

  1. After the end of the main contract, the processor deletes all data under section 2, at the latest on 15 February of the year following the season (for the 2026 season on 15 February 2027), unless Union or German law requires storage. Until then, the controller can export entries as CSV.
  2. On instruction, the processor deletes data earlier, for example entries of non-winners after the draw.
  3. Backups are overwritten in the regular cycle after 14 days at the latest.
  4. On request, the processor confirms deletion in text form.

11. Final provisions

  1. In the event of conflict, this agreement takes precedence over the main contract in matters of data protection.
  2. Amendments must be made in text form.
  3. German law applies. The place of jurisdiction is Freiburg im Breisgau, Germany, to the extent permitted by law.
  4. If any provision is invalid, the remaining provisions remain valid.

Annex 1: Sub-processors

Company Service Place of processing Safeguards
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany hosting of server, database and backups; media storage (Hetzner Object Storage, private bucket) data centres in Germany DPA under Art. 28 GDPR, ISO/IEC 27001
Sendinblue GmbH (Brevo), Köpenicker Str. 126, 10179 Berlin, Germany sending confirmation emails (double opt-in) to entrants European Union DPA under Art. 28 GDPR

No other services are used. In particular, there is no content delivery network, no analytics or advertising service and no embedding of external fonts or scripts.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality

  • Physical access control: servers in data centres of Hetzner Online GmbH in Germany with access control, video surveillance and ISO/IEC 27001 certification. No own server room.
  • System access control: server access only via SSH with keys, no password login. Workstations with encrypted disks and screen lock. Secrets (keys for payment and mail providers, signing key) are kept only in configuration files with restricted permissions, never in source code; every code version is checked with a secret scanner (gitleaks).
  • Data access control: access to production data only by the processor personally. The controller reaches its calendar only via secret editing keys or its account; statistics and export are tied to the editing key and the plan. Media are stored in a private bucket without public access. Uploads only via signed links valid for 15 minutes and bound to file type and size; the server then checks size and file type and deletes non-matching files. Media are delivered only via signed links valid for six hours, and only once the door is unlocked.
  • Separation control: each calendar has its own identifiers; media are stored under a separate path per calendar. Development and testing only with test data.
  • Pseudonymisation: visitor statistics only with a shortened hash using a daily changing salt; the salt is deleted after one day. IP addresses of entrants and sessions only as a hash with a secret additional value. Sign-in and confirmation tokens only as SHA-256 hashes, passwords and PINs only as scrypt hashes.

2. Integrity

  • Transfer control: transmission exclusively encrypted via HTTPS (TLS); emails are handed to the mail provider via TLS. No disclosure to third parties other than the sub-processors in Annex 1. Export only as CSV by the controller itself, confirmed entries only, newsletter column only where consent was given.
  • Input control: times of entry, acceptance, confirmation and consent together with wording and version are stored. Prize draws are logged with time, door, number of valid entries and result.
  • Input validation: all input is validated on the server; uploads are checked for file type, images are re-encoded and stripped of metadata (EXIF).

3. Availability and resilience

  • Daily backup of the database during operation via a consistent backup copy, retention 14 days, additional copy outside the server.
  • Rate limits for sign-in, PIN entry and prize draw entry to prevent abuse.
  • Availability monitoring; new versions are deployed without interruption with the option of immediate rollback.
  • Security updates of the operating system and dependencies are applied regularly.

4. Procedures for regular review

  • Review of the measures with every significant change to the service and at least once a year.
  • Privacy by default: no cookies except for sign-in, no embedding of third-party servers, newsletter consent never pre-ticked, entries valid only after double opt-in.
  • Deletion concept under section 10; retention periods are configured in the service.

Back to home