Data processing agreement

1. Parties

The controller is the organisation using Orgazee. The processor is Dennis Braß, sole proprietorship, Rudolfstr. 105, 42285 Wuppertal, Germany.

2. Subject and duration

Orgazee processes personal data on behalf of the controller to operate club and federation administration. Processing continues for the duration of the main contract and, where required, for statutory retention, return or deletion periods.

3. Data and data subjects

Depending on use, processing includes master and contact data, credentials, roles, permissions, memberships, contributions, invoices, payments, calendars, tasks, minutes, documents and communications.

Data subjects may include members, board members, employees, volunteers, invited users, contacts, donors, participants and representatives of connected organisations.

4. Instructions

Orgazee processes personal data only on the controller’s instructions, particularly through use and configuration of the platform or documented support and contractual instructions.

5. Confidentiality

People with access to personal data are bound by confidentiality obligations or a statutory duty of confidentiality.

6. Technical and organisational measures

Encrypted transmission; role-based access control; separation between organisations; server location in Nuremberg, Germany; logging of security-related events; regular backups; administrative access limited to what is necessary.

7. Subprocessors

Netcup for hosting in Germany; Stripe for payments; Zoho or other SMTP providers for email; Google Analytics only with consent; Dropbox, Google Drive, Microsoft OneDrive, Nextcloud/WebDAV and S3-compatible storage only when activated by the controller.

8. Assistance and notifications

Within reasonable limits, Orgazee assists the controller with data subject rights, security incidents, evidence, return and deletion. Relevant security incidents are communicated to the controller without undue delay.

9. Contract end

At the end of the contract, data is returned, made available for export or deleted as instructed by the controller, unless statutory retention duties prevent this.