Data processing agreement
This is a courtesy translation. The German version of this document is the legally binding one. Where the two differ, the German text prevails. You find it at the German page.
In short: you only need this agreement if you store access to your content management system or shop in the portal. If you only use the scan from outside, we see nothing that is not public anyway – then there is nothing to regulate here and this agreement does not apply.
1. Parties
| Controller | The holder of the portal account, hereinafter the “client”. |
|---|---|
| Processor | Studio Luy UG (haftungsbeschränkt), Norderreihe 21, 22767 Hamburg, info@websecureaudit.de, hereinafter the “contractor”. |
The agreement comes into being when the client stores access to their system in the portal and confirms this agreement in doing so. It applies in text form pursuant to Art. 28 (9) GDPR.
2. Subject matter and duration
The subject matter is the automated technical scan of the client's website and of the content or shop system behind it, to the extent that the stored access is used for it.
Duration: the agreement runs for as long as access is stored. It ends automatically as soon as the client removes the access, removes the domain or deletes their account.
3. Nature and purpose of the processing
The contractor signs in to the client's installation with the stored access and reads technical information there: installed extensions and their versions, pending updates, configuration values, and user accounts with their roles. The audit report is produced from this.
The processing is read-only. The contractor changes no content, installs nothing, deletes nothing and creates no users.
4. Type of data and categories of data subjects
| Type of personal data | Usernames, display names, email addresses, roles and permissions, and the times of last sign-in, from the client's installation. |
|---|---|
| Categories of data subjects | Employees, editors and other users holding a user account in the client's installation. |
From the installation the contractor collects no content data: no orders, no customer records, no payment data, no messages. It calls only the technical administration interfaces needed for the scan.
5. Right to issue instructions
The contractor processes the data solely on documented instructions from the client. The instruction follows from this agreement and from the settings the client makes in the portal – in particular which domain they store and at what interval they have it scanned. Further instructions are issued in text form to info@websecureaudit.de.
If the contractor considers an instruction unlawful, it says so and may suspend its execution.
6. Confidentiality
The contractor works without employees; processing is carried out solely by the owner named under number 1, who is bound to confidentiality. If people are brought in in future, the contractor will first bind them to confidentiality in writing pursuant to Art. 28 (3) (b) GDPR.
7. Technical and organisational measures (Art. 32 GDPR)
| Encrypted storage of credentials | The stored access exists in the database only as ciphertext (Fernet: AES-128/CBC with HMAC-SHA256). The key sits in the server environment, not in the database. Both would have to be captured separately. |
|---|---|
| No read-back | A stored secret is never output again through the interface and does not appear in the data export. |
| Access control | Sign-in with email and password, passwords stored only as a PBKDF2 check value with a random salt, lockout after five failed attempts, session tokens stored only as a check value. |
| Authorisation check | Access can only be stored for a domain whose ownership the client has previously proven. |
| Transmission control | HTTPS only, both in the portal and when calling the client's installation. |
| Input control | Forms are protected against cross-site request forgery (CSRF tokens). |
| Separation control | Every record belongs to exactly one account; queries are limited to the signed-in account. |
| Availability | Daily backup of the database and the result files by the hosting provider. |
| Deletion policy | Audit results are deleted automatically after 24 months; stored access immediately on request. |
The measures are subject to technical progress. The contractor may adapt them as long as the level of protection is not reduced.
8. Sub-processors
The client consents to the engagement of the following sub-processor:
| Mittwald CM Service GmbH & Co. KG | Königsberger Straße 4–6, 32339 Espelkamp, Germany – operation of server, database and mailbox. Server location Germany. |
|---|
The contractor engages further sub-processors only after informing the client in advance. The client may object to a change within 14 days for good cause; in that case either party may terminate the agreement.
9. Support for the client
The contractor supports the client, within what is reasonable, with:
- requests from data subjects under Art. 12 to 23 GDPR,
- the security of processing under Art. 32 GDPR,
- the notification of personal data breaches under Art. 33 and 34 GDPR,
- a data protection impact assessment under Art. 35 and 36 GDPR.
If a data subject approaches the contractor directly, the contractor forwards the request to the client without undue delay and does not answer it itself.
10. Notification of breaches
The contractor notifies the client of every personal data breach that comes to its attention without undue delay, at the latest within 24 hours of becoming aware, by email to the address stored in the account. The notification describes the nature and extent of the breach and the measures taken.
11. Deletion and return
The client can remove the stored access themselves in the portal at any time; it is deleted immediately. When the agreement ends, the contractor deletes all stored credentials. Return does not arise, because by design the secret is never output again and the client holds it anyway.
Audit reports are retained for the period of 24 months stated in the privacy policy, or deleted earlier at the client's request.
12. Evidence and audits
On request the contractor demonstrates compliance with this agreement in text form. The client is entitled to satisfy itself of compliance; audits must be announced with reasonable notice and must not unreasonably disrupt operations. The contractor's publicly available self-audit report counts as first evidence.
13. Third countries
No processing takes place outside the EU or the EEA.
14. Liability and final provisions
Art. 82 GDPR applies. In all other respects the portal's terms of use apply. Amendments require text form. Should any provision be invalid, the remainder of the agreement stays in force.
As of: 22. August 2026. Related pages: Privacy policy · Terms of use