Between:
Controller: Customer
Processor: antegma GmbH, Germany
1. Subject Matter & Duration
This DPA governs the processing of personal data by antegma GmbH in connection with integrations and applications provided to the Controller.
Duration: valid as long as the main service agreement is active.
2. Nature & Purpose of Processing
Purpose: provision, maintenance, and improvement of integrations between third-party applications (e.g. Hootsuite, Adobe, Canto, Microsoft, etc.).
Processing activities: hosting, storage, transmission, and technical handling of personal data.
3. Types of Data & Categories of Data Subjects
Types of data: user IDs, login credentials, usage logs, content metadata, communication data (depending on the integration).
Categories of data subjects: Controller’s employees, customers, social media users, partners.
4. Obligations of Processor (antegma GmbH)
Process data only on documented instructions from the Controller.
Ensure confidentiality of personnel.
Implement appropriate technical and organizational measures (TOMs) (Annex 1).
Assist Controller with data subject rights (Art. 15–22 GDPR).
Support Controller in ensuring compliance with Art. 32–36 GDPR (security, breach notification, DPIA).
Delete or return all personal data after contract end.
Make audit reports available (upon request, subject to reasonable notice).
Controller authorizes Processor to use the following subprocessors:
Controller authorizes Processor to use the following subprocessors.
Microsoft Ireland Operations Ltd. – Microsoft Azure (hosting in Amsterdam, Netherlands, Europe West region).
Processor will inform Controller in advance of changes to the subprocessor list.
6. International Data Transfers
Data is hosted in the EU (Amsterdam, Netherlands).
If subprocessors transfer data outside the EU/EEA, Processor ensures appropriate safeguards (e.g. Standard Contractual Clauses, adequacy decisions).
7. Controller Obligations
Ensure lawful basis for processing.
Provide Processor with necessary instructions.
Maintain records of processing activities.
8. Liability
Each party is liable according to GDPR and applicable law.
Joint liability where applicable under Art. 82 GDPR.
9. Governing Law & Jurisdiction
This DPA is governed by German law.
Jurisdiction: Freiburg im Breisgau
Annex 1: Technical & Organizational Measures (TOMs)
Data encryption at rest and in transit.
Role-based access control, least privilege principle.
Multi-factor authentication for administrators.
Regular backups and disaster recovery plans.
Logging and monitoring of access.
Security patch management.
Annex 2: Subprocessor List
- Microsoft Azure (Europe West – Amsterdam).