011. Subject and validity
This contract processing agreement in accordance with Art. 28 GDPR applies to the extent that AEGIS-SECURITAS processes personal data on behalf of a corporate customer within the framework of AEGIS OS. It supplements the main contract and takes precedence over the general contractual conditions in the event of data protection contradictions.
The respective corporate customer is responsible. The processor is AEGIS-SECURITAS, Hansaring 7, 63843 Niedernberg, Germany, email: [email protected].
022. Duration, type and purpose of processing
Processing takes place for the duration of the main contract and a required processing, security or retention period.
The type and purpose include in particular hosting, storage, structuring, retrieval, transmission, backup, support, error analysis, import, export, automation, communication, appointment and process management as well as expressly approved AI and integration functions. The specific scope depends on the configuration activated by the customer and his documented instructions.
For cloud services booked directly, order processing only begins with manual technical provision. The mere ordering, payment processing and contract review initially only processes the contact person and company data required to initiate and process the contract. The selected storage quota limits the technical capacity, but does not change the customer's data protection obligations.
032a. Cloud storage, backups and special requests
The customer determines which personal data may be processed within the booked cloud quota. Before the technical release, AEGIS-SECURITAS checks the necessary access, role, storage and security configuration without thereby assuming the customer's responsibility for legal bases, purposes and deletion periods.
Cloud storage, backup, versioning, archiving and recovery are separate processing operations. Additional backups, retention periods, data regions or recovery tests are only considered instructions and services if they have been expressly documented and confirmed.
Special requests, new integrations, migrations or changed data categories are checked for their impact on data protection, sub-processors and technical protective measures before implementation. There are no instructions for productive implementation until documented release.
043. Types of data and data subjects
Depending on the use, in particular master, contact, communication, contract, appointment, employee, customer, supplier, project, document, invoice, usage, log, support, file and integration data can be processed.
Affected persons may in particular be employees, applicants, customers, interested parties, suppliers, service providers, contact persons, partners and other persons whose data the customer lawfully processes in AEGIS OS.
Special categories of personal data may only be processed if the customer lawfully requests this, is expressly necessary and appropriate technical and organizational protection measures have been activated.
054. Customer instructions
AEGIS-SECURITAS processes personal data exclusively on documented instructions from the customer, unless there is a legal obligation to process it. In particular, the main contract, this agreement, released configurations, roles, integrations and comprehensible support instructions are considered instructions.
If AEGIS-SECURITAS considers an instruction to be unlawful, the customer will be informed immediately. Execution may be suspended until clarification. Changes to the object of processing may require additional technical or economic agreements.
065. Obligations of AEGIS-SECURITAS
AEGIS-SECURITAS undertakes in particular to
• to only process data to the agreed extent,
• to use people who are obliged to maintain confidentiality and have been appropriately trained,
• maintain appropriate technical and organizational measures,
• to support the customer to the extent required by law with data subject rights, security incidents, data protection impact assessments and inquiries from authorities,
• delete or return personal data after the end of the contract in accordance with this agreement,
• provide evidence necessary to comply with this Agreement.
076. Customer Obligations
The customer is in particular responsible for legal bases, information obligations, purpose limitation, data minimization, accuracy, authorization concepts, deletion periods and the legality of his instructions.
He may only use AEGIS OS for processing that is covered by the agreed scope of protection and functions. Security incidents, misconfigurations or unauthorized access within your own area of responsibility must be reported immediately.
087. Technical and organizational measures
The measures are risk-oriented and designed in accordance with the state of the art. Depending on the service, they include in particular encrypted transmission, role and client-related access controls, authentication, logging, protection of secrets and access data, data backup and recovery processes, security updates, availability and integrity measures as well as regulated authorization and support processes.
The measures may be further developed as long as the agreed level of protection is not fallen short of. A more detailed TOM description can be provided to customers via Support or the Trust Center.
098. Sub-processors
Customer grants general permission to use sub-processors necessary for platform, hosting, storage, email, support, identity, security, AI, or expressly enabled integrations. The current overview is available under /subprocessor.
Key categories include, in particular, the server and container infrastructure operated by AEGIS-SECURITAS, any hosting, data-center or network service providers used for that infrastructure, transactional email sending via Resend and other services activated by the customer. Payment service providers such as Stripe can be independently responsible for parts of their services.
The customer will be appropriately informed about any significant new sub-processors. He can object for important data protection reasons. If no reasonable alternative is possible, either party can terminate the affected part of the service.
109. Third country transfers
Processing outside the European Economic Area only takes place if the requirements of Article 44 ff. GDPR are met. These may include adequacy decisions, EU standard contractual clauses and necessary additional safeguards.
The customer will be informed about relevant transmission mechanisms within the framework of the available documentation. Third-party integrations it activates may trigger additional standalone submissions.
1110. Rights of those affected and inquiries from authorities
If a data subject asserts their rights directly against AEGIS-SECURITAS and the customer is responsible, the request will generally be forwarded to the customer. AEGIS-SECURITAS supports the customer with available search, export, rectification, restriction and deletion functions as well as appropriate technical support.
Inquiries from supervisory or investigative authorities will be communicated to the customer to the extent legally permissible.
1211. Personal Data Breaches
AEGIS-SECURITAS will immediately inform the customer to the extent required by law upon becoming aware of a confirmed security incident affecting their order data. The notice shall contain available information on the nature, scope, likely consequences and measures taken or proposed.
The customer remains responsible for his own reporting and notification obligations. Both parties cooperate appropriately in the investigation.
1312. Evidence and controls
Upon reasonable request, AEGIS-SECURITAS will provide Customer with the information necessary to review this Agreement. Standardized documentation, test reports, safety evidence and written information are primarily used.
On-site inspections are only necessary if other evidence is not sufficient, there is a specific reason and the security, confidentiality and operations of other customers are not affected. They must be coordinated in good time. Additional effort may be subject to reimbursement if the audit does not reveal a significant violation for which AEGIS-SECURITAS is responsible.
1413. Return and Deletion
After the end of the order processing, AEGIS-SECURITAS deletes or anonymizes the order data at the customer's discretion, provided that there are no legal obligations or legitimate interests in providing evidence to the contrary. The customer must request required exports in a timely manner or carry them out themselves.
Backup copies are overwritten as part of regular backup cycles and are protected against productive use until then.
1514. Ranking and Liability
Otherwise, the liability provisions of the main contract apply, unless Art. 82 GDPR or other mandatory regulations provide for different liability.
Changes to this agreement must be made in writing. The German version is authoritative.
