Data processing agreement

This agreement under Art. 28 GDPR (“DPA”) applies between you as the controller (“you”) and MSGP GmbH, Stallburggasse 2/37, 1010 Vienna, Austria, as the processor (“we”). It is part of the contract about Johnny under our terms and comes about with your order; no separate signature is needed. It exists in German and in English; the German version is the binding one.

1. Subject matter and duration

1.1 We move your website, host and run it, and change it on your instruction, as the terms describe. In doing so we process personal data on your behalf.

1.2 The DPA runs as long as the contract about Johnny. Duties that continue after the end (deletion, confidentiality) remain.

2. Nature and purpose of the processing, data and data subjects

2.1 Services your website embeds (analytics, maps, videos, bookings) process data for you as your own processors or as controllers in their own right. We only carry over the embedding as it was on your old website. Your cookie banner stays as it was and keeps asking: the visitor’s choice is made in their browser and stored there in a cookie of your website (jr_consent, 182 days); analytics and embedded videos and maps load only after their consent. We keep no record of consents. That cookie belongs in your website’s privacy policy.

2.2 Special categories of personal data (Art. 9 GDPR, such as health data) are not intended. Design your forms so they do not ask for such data, or talk to us first.

3. Instructions

3.1 We process personal data only on your documented instruction. Instructions are this DPA, the terms, the settings in your account, and your messages to Johnny and to our team. You give further instructions by email to hello@telljohnny.com.

3.2 If we consider an instruction unlawful, we tell you and may suspend it until you confirm it.

3.3 If Union or Austrian law requires us to process data, we inform you beforehand, as far as the law allows.

4. Our duties

4.1 Confidentiality. Everyone at our end with access to your data is bound to confidentiality and trained in data protection.

4.2 Security. We take the technical and organisational measures in annex 1 (Art. 32 GDPR). We may develop them further as long as the level of protection does not drop.

4.3 Data subject rights. If data subjects contact us, we forward the request to you. We support you with the means we have, such as information about data in logs or forms and deletion, as far as you cannot do it yourself through Johnny.

4.4 Support. We support you with your duties under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment), as far as the nature of the processing and the information we have allow.

4.5 Data breaches. If we learn of a personal data breach affecting your data, we inform you without undue delay, so that you can keep your 72-hour deadline, with what we know: the nature of the breach, the data and persons concerned as far as known, the likely consequences and the measures we have taken.

4.6 Evidence and audits. On request we give you the information you need to check our duties: a description of the measures, and the certificates and reports of our providers. If that is not enough, you or an auditor you appoint who is bound to secrecy may audit once a year, with at least 14 days’ notice, during our business hours. The audit does not disturb operations, and you bear its costs unless it reveals a material breach.

4.7 We keep the record of processing activities under Art. 30(2) GDPR.

4.8 For data protection you reach us at hello@telljohnny.com.

5. Sub-processors

5.1 You give us general authorisation to engage sub-processors. The current ones are in annex 2.

5.2 If we want to add or replace one, we tell you by email at least 30 days beforehand. You may object for an important reason of data protection. If we then find no solution, either side may terminate the contract about Johnny for the day the change takes effect; we refund paid periods not used.

5.3 We bind every sub-processor by contract to data protection duties equivalent to those in this DPA, and we remain responsible to you for its performance.

5.4 Third countries. Where a provider processes data outside the European Economic Area, this happens only with a safeguard under chapter V GDPR: an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses. Annex 2 names the safeguard for each provider.

6. Your duties

6.1 You are responsible for the lawfulness of the processing: for the legal basis, for your website’s privacy policy and cookie notices, and for what your forms ask.

6.2 Before ordering, you check whether the measures in annex 1 are sufficient for your data.

6.3 You inform us without delay if you notice errors or irregularities in the processing.

7. End of the processing

7.1 You receive the entries from your forms by email as they come; they are with you. You can take your content from your website at any time while it is online.

7.2 When the contract about Johnny ends, we delete within 30 days all personal data we processed for you, including versions and backups, and confirm this on request. If you want personal data back beforehand that only we hold, tell us before the contract ends; we give it to you in a common format. Section 12 of the terms stays unaffected: there is no copy of the website, its code or its files.

7.3 Statutory retention duties stay unaffected; we restrict such data.

8. Liability and final provisions

8.1 Section 14 of the terms governs liability, as far as Art. 82 GDPR does not mandatorily provide otherwise.

8.2 Where this DPA and the terms differ, this DPA prevails for data protection.

8.3 Austrian law applies; the place of performance and jurisdiction are those of the terms.

8.4 If a provision of this DPA is invalid, the others remain valid.

8.5 If the contract about Johnny passes to another company under section 18.3 of the terms, this DPA passes with it; from then on that company is your processor with all duties under this DPA.

8.6 This DPA exists in German and in English. The German version is binding; the English version is for understanding.

Annex 1: Technical and organisational measures

• Access to your website: only through your account. You log in with a code sent to your email address or with a passkey; there are no passwords that could be stolen.
• Separation: every website runs apart from all others, in its own environment with its own storage. One website cannot reach another’s data.
• Encryption: your website is delivered over TLS (SSL). Stored data is encrypted at our providers.
• Versions and backups: every published version of your website is kept. Backups allow restoration.
• Access at our end: only people who need it to run the service, with their own accounts and two-factor login at our providers. Access is logged.
• Providers: we use only providers audited to recognised standards (such as ISO 27001 or SOC 2) and with whom we have a data processing agreement.
• Forms: entries are forwarded to your email address and not collected at our end.
• Data minimisation: logs hold only what delivery and protection need, and are deleted after a short time.
• Incidents: we have a process to detect, contain and fix incidents and to inform you.
• People: everyone with access is bound to confidentiality and trained.
• Review: we review these measures regularly and adjust them.

Annex 2: Sub-processors

Our payment provider Stripe is not on this list: it processes your payment details for us as the controller, not your website’s data (see the privacy policy).