Data Processing Agreement

Annex to the Terms and Conditions of RHINEC UG (haftungsbeschränkt). Last updated: August 24, 2026.

Preamble and Scope

This Data Processing Agreement (hereinafter the "Agreement") is an annex to the Terms and Conditions (T&C) of RHINEC UG (haftungsbeschränkt) and becomes effective upon their acceptance. It specifies the data protection obligations of the parties pursuant to Art. 28 of the General Data Protection Regulation (GDPR), insofar as the customer uses a RHINEC service and thereby processes personal data of third parties as a controller, which RHINEC processes on the customer's behalf. The processing specifically covered by this is set out in Annex 1 (currently the guest data in the EventApp).

• The controller is the customer, who decides on the purposes and means of the processing (in the case of the EventApp: the user or host).
• The processor is RHINEC UG (haftungsbeschränkt), Hauptstraße 57, 99192 Nesse-Apfelstädt (hereinafter "RHINEC").

If the customer uses a service exclusively for personal or household purposes (household exemption, Art. 2(2)(c) GDPR), they are not a controller within the meaning of the GDPR; this Agreement then has no effect.

This Agreement does not cover processing for which RHINEC is itself the controller (account, billing, security, provision of the platform, AI assistant). The privacy policy provides information on this.

1. Subject Matter and Duration

1.1 The subject matter is the processing of the guest data by RHINEC on behalf of the controller within the framework of the services described in Annex 1.

1.2 The Agreement runs for the duration of the customer's use of the respective service. It ends upon termination of the underlying contractual relationship; the deletion obligations (Section 8) remain unaffected.

2. Nature, Purpose and Scope of the Processing

The nature, purpose and scope of the processing, the type of data and the categories of data subjects are set out conclusively in Annex 1. RHINEC does not process the guest data for its own purposes.

3. Bound by Instructions

3.1 RHINEC processes the guest data exclusively on documented instructions from the controller, including with regard to transfers to third countries, unless required to do otherwise by EU or Member State law.

3.2 The configuration and use of the service by the controller (in the case of the EventApp, for example, creating invitations, defining the response fields and deleting individual responses) constitutes their instruction.

3.3 If RHINEC is of the opinion that an instruction infringes data protection provisions, RHINEC informs the controller without undue delay.

4. Confidentiality

RHINEC ensures that the persons authorised to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to the guest data is limited to what is necessary. Access to the responses to an invitation is technically restricted to the respective controller (host).

5. Technical and Organisational Measures

RHINEC implements the technical and organisational measures required for the security of the processing pursuant to Art. 32 GDPR. These are described in Annex 3 and are continuously adapted in line with the state of the art.

6. Sub-processors

6.1 The controller grants RHINEC general authorisation to engage the sub-processors listed in Annex 2.

6.2 RHINEC informs the controller of intended changes (engagement or replacement) by updating Annex 2 with reasonable prior notice. The controller may object to a change within 14 days on important data protection grounds; in that case the parties shall seek an amicable solution, failing which the controller may terminate the affected service.

6.3 RHINEC contractually obliges each sub-processor to data protection obligations equivalent to those of this Agreement and remains fully liable to the controller for the sub-processor's compliance.

7. Assistance to the Controller

7.1 RHINEC assists the controller, insofar as technically possible, in fulfilling requests from data subjects (access, rectification, erasure, restriction, data portability, objection). In the case of the EventApp, the controller can also delete individual responses themselves at any time.

7.2 RHINEC assists the controller in complying with the obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment), taking into account the nature of the processing and the information available to RHINEC.

7.3 If a data subject contacts RHINEC directly, RHINEC forwards the request to the controller without undue delay.

8. Notification of a Personal Data Breach

RHINEC notifies the controller without undue delay after becoming aware of a breach of the security of the guest data and provides the information necessary for the controller to fulfil its notification and communication obligations (Art. 33, 34 GDPR).

9. Deletion and Return

9.1 The guest data is deleted automatically in accordance with the periods defined in the application (in particular responses and attendance data one week after the event date). The controller may delete responses, individual invitations or their entire account at any time.

9.2 After the end of the processing, RHINEC deletes the guest data or returns it at the controller's choice, unless a statutory retention obligation applies.

10. Records and Audits

10.1 RHINEC makes available to the controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

10.2 The controller may satisfy itself of compliance, primarily by obtaining corresponding information and evidence. Further checks are carried out with reasonable prior notice, without disproportionately disrupting operations and without jeopardising the security of other users.

11. Liability

Liability is governed by the statutory provisions, in particular Art. 82 GDPR, as well as by the liability provisions of the T&C.

12. Final Provisions

12.1 In the event of contradictions between this Agreement and the T&C, the provisions of this Agreement shall prevail in matters of data protection.

12.2 German law applies. Should individual provisions be invalid, the validity of the remaining provisions shall remain unaffected.

Annex 1 – Description of the Processing

This annex lists the processing activities covered by this Agreement. Currently, this concerns the following processing:

EventApp – Guest Data

• Subject matter: processing of guests' responses and attendance data within the framework of the invitation and access-control features of the EventApp.
• Nature and purpose: receiving and storing guest responses to an invitation, making these responses available to the host, and – where access control is used – recording attendance on site.
• Duration: for the duration of use; automatic deletion one week after the event date.
• Type of personal data: guest's name, response status (accept/decline/maybe), number of accompanying persons, optional free-text comment, check-in token and check-in time.
• Categories of data subjects: guests invited by the controller.
• Special categories of personal data: not envisaged; the controller ensures that they do not collect any special categories (Art. 9 GDPR) via the free-text fields for which no legal basis exists.

Annex 2 – Sub-processors

The following sub-processors are engaged for the processing activities described in Annex 1 (currently the EventApp guest data):

Other services used by RHINEC (Auth0, Stripe, object storage, AI service, Apple Wallet) do not process guest data and are therefore not part of this list.

Annex 3 – Technical and Organisational Measures (Art. 32 GDPR)

• Access control: access to responses exclusively for the respective host; authentication via signed tokens (JWT); administrative access role-based and restricted.
• Unguessable access keys: random, non-derivable tokens for invitation links and check-in (no sequential identifiers or identifiers derivable from timestamps).
• Transmission security: TLS encryption throughout.
• Data separation and deletion: automatic, time-limited deletion of responses (database TTL); complete deletion chains upon deletion of a card or account.
• Data minimisation in logs: server logs without plain-text email addresses and without visitors' IP addresses; retention of 7 days.
• Availability and resilience: rate limiting to prevent misuse; operation in secured data centres of the engaged sub-processors.
• Review: regular review and adaptation of the measures in line with the state of the art.