
General Terms and Conditions
Here you will find the current General Terms and Conditions of DOCUNIZE GmbH as a web version – including the Service Level Agreement (SLA), the Data Processing Agreement (DPA), and all annexes. As of: May 2025 · Version 1.0.
Download GTC as PDFContents of this document
General Terms and Conditions
1. Preamble
1.1 DOCUNIZE GmbH, Neuöttinger Straße 5, 84503 Altötting (hereinafter: Provider) is a software manufacturer and offers software for creating, managing, and automating templates, documents, and email signatures.
1.2 These General Terms and Conditions (hereinafter: GTC) govern the terms for individual contracts that the Provider concludes with customers via offers. In the event of conflicts, the provisions of the offer prevail.
2. Definitions
2.1 An authorized user is a person who is contractually entitled to obtain access to the software, to use the software to the contractual extent, and to create or manage content with the software, and who (a) may be the customer or an affiliated company itself if the customer or the affiliated company is a natural person and/or (b) may be an employee of the customer or of an affiliated company and/or (c) may be a contractor of the customer who is to obtain access to the software on behalf of the customer in the course of providing services to the customer.
2.2 Digital assets are elements in digital form, including applications, for which the customer has a right of use, regardless of the contractual relationship with the Provider.
2.3 Exportable data means all input and output data including metadata that are generated directly or indirectly through the customer's use of the software, including all of the customer's digital assets, with the exception of assets or data of the Provider or third parties that are protected by intellectual property rights or constitute a trade secret.
2.4 Microsoft products are the products of the provider Microsoft in connection with which the Provider's software can be used, in particular Microsoft Word and Microsoft Outlook as well as further products specified on the Provider's website.
2.5 The Provider's software is the software developed by the Provider for creating, managing, and automating templates, documents, and email signatures in connection with Microsoft products and with the functional scope defined on the Provider's website (https://docunize.com) and/or in documentation and user manuals and/or in any service descriptions, together with any additional functions described therein. These descriptions do not constitute warranties of characteristics.
2.6 An affiliated company under this contract means any company affiliated with the customer within the meaning of Sections 15 et seq. of the German Stock Corporation Act (AktG) that directly or indirectly controls the customer or is controlled by the customer or is under joint control with the customer, by virtue of control of management or ownership of more than fifty (50)% of the voting shares or a similar interest in said company, provided that the affiliated company uses the same server instance as the customer.
2.7 Additional functions are functions that extend the functional scope of the software and that can be put into operation with or after the grant of the software license.
3. Conclusion of contract
3.1 Transmission of the offer constitutes the Provider's binding offer to conclude a contract with the customer in accordance with the provisions of these GTC. The customer is entitled, but not obliged, to accept this offer. Acceptance is declared by the customer's signature on the offer and electronic or postal transmission of the signed offer. Alternatively, acceptance may also be effected by a confirmation email without return of a signed copy.
3.2 The term of this contract begins upon conclusion of the contract, unless a different date is agreed in the offer.
3.3 The Provider will only make a binding offer to conclude this contract or accept the customer's binding offer if the customer is a company or a person acting in the exercise of their trade or profession.
4. Scope of license
4.1 Upon conclusion of the contract, the Provider grants the customer a non-exclusive, non-transferable, non-sublicensable right to use the software, limited in time to the term of the contract, within the license terms set out in the contract.
4.2 The license is limited to the number of authorized users agreed in the offer and to use for the customer's or the affiliated company's own business purposes.
4.3 The customer may not in any way copy or modify the software and may not alter, merge, edit, improve, adapt, decompile, disassemble, translate, otherwise create derivative works from the software or parts thereof, or redistribute, rent, otherwise sublicense, publicly perform by wire or wireless means, make publicly available, or make the software available to third parties for a fee or free of charge, unless this is permitted by law within the meaning of Sections 69d(2) or 69e of the German Copyright Act (UrhG) or expressly permitted in writing by the Provider. Transfer of licenses to affiliated companies under 2.6 is permitted.
4.4 The software may only be used in connection with an active Microsoft Azure ID or Microsoft Entra ID and in connection with Microsoft 365 products.
4.5 Additional functions may be booked at or after conclusion of the contract for the agreed number of authorized users. Use of additional functions requires a software license for the authorized user. Licenses for further authorized users may be booked after conclusion of the contract.
5. Rights and obligations of the Provider
5.1 The Provider is the owner of all rights in and in connection with the software.
5.2 After conclusion of the contract, the Provider provides the customer with access to use the software via the Internet with the agreed functionalities and restrictions. After authentication with their Microsoft Azure ID or Entra ID, the customer receives a software component for download that they must install and integrate into the respective Microsoft product in order to use the software.
5.3 If the customer breaches applicable law or this contract, in particular if the customer is in default of payment of the contractually agreed fee or, pursuant to Clause 8, the actual use of the software differs from the contractually permitted use, the Provider may immediately block the customer's access to the software.
5.4 The Provider is entitled to engage subcontractors in the course of providing all services under this contract.
5.5 The Provider is entitled to name the customer, including company name and logo, for reference purposes on the Provider's website and in offline marketing materials such as flyers and product presentations.
5.6 Part of the service is a newsletter that informs about news and can be unsubscribed from at any time via a link in the email.
6. Rights and obligations of the customer
6.1 Upon conclusion of the contract and during the term of the contract, the customer must always provide the Provider with accurate information about their company and the use of the software and must inform the Provider if the information provided changes.
6.2 The customer is obliged to properly integrate the software and always to use the latest version made available on a system that meets the system requirements. Necessary adaptations to the customer's software and hardware are to be provided by the customer and are not the subject of this contract.
6.3 The customer is obliged to back up imported or generated content and data also outside the software.
6.4 When importing and generating content or data, the customer must observe any third-party rights.
6.5 The customer shall indemnify the Provider on first demand against all third-party claims asserted against the Provider on the grounds that an action taken by the customer and/or content or data provided by the customer infringes their rights.
6.6 If claims are asserted against the customer due to the actual or alleged infringement of third-party rights as a result of the contractual use of the software for which the Provider may be liable, the customer must inform the Provider without delay. The parties will coordinate the defense of such claims in close consultation, with the Provider taking the lead as far as possible and permissible. The customer shall support the Provider. If, despite a reminder, the Provider does not issue instructions regarding the appropriate defense within a reasonable period, the customer is entitled to deal with the claims asserted against them at their discretion without further consultation with the Provider.
6.7 Upon termination of the contract, the customer is obliged to destroy installation files of the software and all copies thereof and to remove the software from the system so completely that it can no longer be recovered.
7. Support and service level
The Provider provides support and availability in accordance with the Service Level Agreement (SLA) in Annex 1.
8. License audit
8.1 The Provider is entitled to verify, on the basis of the information available to it, whether the customer's use of the software is covered qualitatively and quantitatively by the scope of the contractual license granted.
8.2 In addition, the customer is obliged to provide the Provider, upon request, with all information or data that the Provider needs in order to make this assessment.
8.3 If there are doubts about the contractual conformity of the use of the software, the Provider or a third party engaged by the Provider and bound to confidentiality (e.g. attorney, auditor, sworn accountant) is entitled to inspect the hardware and software environment on site for accuracy and completeness of the information and for use of the software. This inspection takes place during normal business hours. The Provider will ensure that the customer's business operations are disturbed as little as possible by its on-site activities. If there is no concrete suspicion of intentional misconduct by the customer, the customer will be informed in advance.
8.4 The Provider undertakes to use the information and data obtained through an audit only to enforce claims under this contract or under industrial property rights.
8.5 The costs incurred by an audit will be reimbursed to the Provider if deviations of the actual use from the contractually permitted use are established.
9. Term
9.1 This contract has the initial term agreed in the offer in each case and renews for a further term of the same duration unless the contract is terminated with three (3) months' notice to the end of the term.
9.2 If additional functions or access for further authorized users are booked after conclusion of the contract, their term begins on the day of confirmation by the Provider. The additional functions or access for further authorized users thereafter share the term of the software.
9.3 Additional functions or access for authorized users may be terminated at any time with the notice period pursuant to paragraph 1 of this clause. Termination of individual additional functions or individual access rights for authorized users leaves the term of the contract itself unaffected.
9.4 Any termination must be in writing to be effective. Text form (e.g. email) satisfies the written form requirement in this respect.
9.5 The right of both contracting parties to terminate the agreement for good cause remains unaffected by the foregoing provisions.
10. Termination assistance
10.1 After termination of the contract, upon corresponding request, the Provider will transfer all exportable data to the customer, provided that such transfer does not endanger or disclose the Provider's intellectual property or trade secrets or endanger the security and integrity of the exportable data.
10.2 Where agreed between the parties, the Provider will comply with open interoperability specifications or harmonized interoperability standards applicable to the software in order to ensure compatibility with services of other providers, but will at least make the exportable data available to the customer in a structured, commonly used, and machine-readable format.
10.3 The Provider transmits the data using the following transfer methods and file formats: Transfer is effected by making the data available for download (e.g. via an FTP server and/or another interface). Data may be transferred in SQL or CSV format. Templates may be transferred in .dotm, .xltm, or .potm format.
10.4 The following categories of exportable data may be transmitted, including the internal links specific to the functioning: company/name of the customer, organizational unit e.g. location, user profiles assigned to the customer including custom metadata such as names, language, custom templates including content such as text modules/snippets, logo, footers, linking of specific languages to modules, linking of specific modules to templates, linking of specific languages to templates, linking of specific templates to organizational units
10.5 No categories of exportable data that are specific to the internal functioning of the Provider's software are excluded from transmission with regard to the risk of infringement of trade secrets.
10.6 The Provider will make the exportable data available for a maximum of 30 days after the end of the contract and will delete all of the customer's exportable data still in its possession and data relating to the customer, unless the Provider and the customer have mutually agreed a longer period or a switch pursuant to Clause 11 has not yet been successfully completed.
10.7 Data transmission and deletion pursuant to this clause are without additional charge. All further services in the context of termination assistance will be charged by the Provider on a time-and-materials basis.
11. Initiation of the switching phase and early termination for provider switching
11.1 Irrespective of the requirements of Clause 9, the contract ends in accordance with the provisions of this clause if the customer has requested a provider switch pursuant to the requirements of this clause. Provider switching includes both switching to the customer's own ICT infrastructure and switching to another provider.
11.2 To initiate the switching phase, the customer must notify the Provider in writing or in text form at least two (2) months before the start of the switching phase desired by the customer (hereinafter: switching request). The switching request must clearly express that a switch under the provisions of this clause is intended and should include the declaration that the customer wishes to carry out a provider switch, to which other provider the customer wishes to switch, whether they wish to switch to their own ICT infrastructure, or whether they request deletion of their data. This declaration may also be made after the start of the switching phase.
11.3 During the switching phase, the Provider will provide the following services to the customer and/or a third party authorized by the customer:
11.3.1 The Provider will transmit all exportable data pursuant to Clause 10.
11.3.2 The Provider will provide support to a reasonable extent during the switch in order to maintain continuity of the customer's business operations and to continue providing the contractual services until the end of the contract.
11.3.3 Upon request, the Provider will support the customer with their exit strategy to a reasonable extent if the customer informs the Provider in writing or in text form about this strategy and the services to be provided by the Provider in this regard.
11.3.4 The Provider will inform the customer of known risks to the uninterrupted provision of the services and will ensure a high level of data security during the switch.
11.4 The switching phase is generally thirty (30) days. The switching phase ends upon expiry of this period or upon actual completion of the switch, whichever occurs earlier. If the customer requests deletion of their data, the switching phase ends immediately after it begins.
11.5 By way of derogation from Clause 9(1), the end of the switching phase is deemed to be the termination of the contract.
11.6 The Provider will notify the customer of the end of the contract.
11.7 If the Provider determines that the switching phase pursuant to Clause 11.4 is insufficient because the switch is not technically feasible within that period, it may inform the customer thereof within fourteen (14) business days of the switching request, stating the reasons, and extend the switching phase by a reasonable period of up to seven (7) months.
11.8 If the customer determines that the switching phase is insufficient, the customer may extend the period pursuant to Clause 11.4 once by a reasonable period.
11.9 If the contract is terminated under this Clause 11 before the end of the agreed term, the fees already accrued for that term remain unaffected. If the switching phase extends beyond the end of a term, a further term begins pursuant to Clause 9.1 unless the customer has terminated the contract pursuant to Clause 9.
11.10 Where applicable, the Provider will provide the customer with information about the software that makes switching very complicated or costly or impossible without significant interference with the data, digital assets, or service architecture.
12. Fees
12.1 The fee stated in the offer for the respective service is payable.
12.2 To the extent that the fee is a license fee payable for a term, it becomes due for payment in advance for the respective term.
12.3 For additional functions or subsequently booked access for further authorized users, the fee agreed in the offer or before booking is charged. The fee is calculated pro rata to the duration of the first term.
12.4 If the customer exceeds the scope of the agreed license within the meaning of Clause 8, they must pay the fee corresponding to the use for the period of the excess.
12.5 To the extent that the fee relates to a service charged on a time-and-materials basis, it becomes due upon performance and is invoiced after performance. An hourly rate of EUR 150 applies unless expressly otherwise agreed.
12.6 Unless otherwise agreed, all fees are payable within 14 days of the invoice date without any deduction.
12.7 The Provider is entitled to issue invoices electronically, e.g. by email.
12.8 All prices of the Provider are plus the applicable statutory VAT.
13. Confidentiality
13.1 The parties agree to maintain secrecy regarding confidential information. Confidential information means all information and documents of the other party that are marked as confidential, constitute a trade secret within the meaning of the German Trade Secrets Act, or are to be regarded as confidential from the circumstances, and of which the parties have become aware in the course of the contractual cooperation, in particular information about finances, operational processes, sequences of events, business relationships, know-how, and internal affairs.
13.2 Exempt from this obligation is such confidential information
(a) that was demonstrably already known to the recipient upon conclusion of this contract or subsequently becomes known from a third party without thereby breaching a confidentiality agreement, statutory provisions, or official orders;
(b) that is publicly known upon conclusion of this contract or is subsequently made public, insofar as this is not based on a breach of this contract; or
(c) that must be disclosed due to statutory obligations or by order of a court or authority. To the extent permissible and possible, the recipient obliged to disclose will inform the other party in advance and give them the opportunity to oppose the disclosure.
13.3 The parties will grant access to confidential information only to such advisors as are subject to professional secrecy or who have previously been subjected to obligations corresponding to the confidentiality obligations of this contract. Furthermore, the parties will disclose the confidential information only to those employees who need to know it for the performance of this contract and will oblige these employees to confidentiality also for the period after they leave, to the extent permissible under employment law. Otherwise, the confidential information will not be disclosed.
13.4 The parties are obliged to carefully store all documents, information, and data containing confidential information that they have received from the other party and to protect them against any inspection by unauthorized third parties, and to return them to the other party upon request at any time, at the latest upon termination of this contract.
14. Data protection and data security
14.1 When processing personal data in the context of this contract, the parties will observe the statutory provisions and process personal data only for the purpose of this contract or as otherwise permitted.
14.2 An integral part of the contract is the data processing agreement (DPA) contained in Annex 2.
14.3 The Provider also takes appropriate technical, organizational, and contractual measures to secure non-personal data, in particular to prevent international governmental access/transfers contrary to Union law or national law. These include encryption, access restrictions, monitoring of access attempts, training, internal policies, and contractual obligations for service providers.
15. Limitation of liability
15.1 Under this contract, the Provider is liable in principle only for damage (a) that the Provider or its legal representatives or vicarious agents have caused intentionally or by gross negligence and/or (b) that has arisen from injury to life, body, or health through a breach of duty by the Provider or through a breach of duty by its legal representatives or vicarious agents. The Provider is further liable (c) if the damage has arisen from the breach of an obligation of the Provider whose fulfillment makes the proper performance of this contract possible in the first place and on whose observance the customer regularly relies and may rely (cardinal obligation).
15.2 In the cases of paragraph 1 of this clause, letters (a) and (b), the Provider is liable as to amount within the scope of statutory liability. Otherwise, the claim for damages is limited to the damage typically foreseeable under the contract. The parties agree that damage of a maximum of EUR 100,000 per damaging event is typically foreseeable under the contract. If the customer faces a risk of damage that may exceed this amount, they are obliged to draw the Provider's attention to this without delay.
15.3 In cases other than those stated in paragraph 1, the Provider's liability is excluded regardless of the legal basis.
15.4 The liability provisions in the foregoing paragraphs also apply to personal liability of the Provider's corporate bodies, employees, and vicarious agents.
15.5 To the extent that liability under the German Product Liability Act, arising from the assumption of a guarantee, or due to fraudulent misrepresentation comes into consideration, it remains unaffected by the foregoing liability provisions.
16. Final provisions
16.1 The Provider does not accept conflicting, opposing, or supplementary general terms and conditions of the customer. This also applies if it does not expressly object to their inclusion.
16.2 All contracts between the Provider and the customer may be concluded in the German language. The contract texts are stored by the Provider. The contract texts are sent to the customer once upon conclusion of the contract or made available for download before conclusion of the contract.
16.3 German law applies to the exclusion of the provisions of private international law and of the UN Convention on Contracts for the International Sale of Goods.
16.4 For all disputes arising out of or in connection with this contract (including those concerning its validity), the courts in Munich have exclusive jurisdiction in the first instance.
16.5 Amendments and supplements to this contract as well as a waiver of a right under this contract require written or text form to be effective. This also applies to a waiver of the written or text form requirement.
16.6 Should a provision of this contract be wholly or partially invalid or unenforceable or later lose its validity or enforceability, or should a gap in the provisions become apparent, the validity of the remaining provisions shall not be affected thereby. The parties undertake to agree, in place of the invalid or unenforceable provision or to fill the gap, an appropriate provision that, to the extent legally permissible, comes closest to what the parties intended or would have intended according to the meaning and purpose of the contract if they had known of the invalidity or the gap. If the invalidity or unenforceability of a provision is based on a measure of performance or time (deadline or date) specified therein, the legally permissible measure closest to the provision shall be agreed. It is the express will of the parties that this paragraph does not result in a mere reversal of the burden of proof, but that Section 139 of the German Civil Code (BGB) is waived in its entirety.
Service Level Agreement (SLA)
1. Subject matter
The following provisions of this annex specify the services contractually owed by the Provider. All performance specifications relate to the quality of the software owed by the Provider.
2. Support and support hours
2.1 The Provider provides support and assistance in the event of errors occurring in the software, in connection with integration and configuration as well as operation of the software, and in connection with integration of updates on the basis of this annex during support hours on business days (at the Provider's registered office) between 8:00 a.m. and 5:00 p.m. (CET).
2.2 Support is provided by email, via a ticket system in the ServiceCenter on the Provider's website, or by remote maintenance.
2.3 The provision of support and assistance outside the support hours pursuant to paragraph 1 of this clause is not the subject of this contract, but may in individual cases be commissioned as a service on terms to be agreed in advance.
2.4 The creation, migration, and maintenance of templates/content for the software, training and consulting (e.g. for process optimization, on-site workshops), project management (e.g. in update projects), the development, maintenance, and integration of customer-specific adaptations, extensions, or additional functions, the necessary adaptations to the customer's software and hardware, or interface programming and adaptation are not the subject of this contract, but may in individual cases be commissioned as a service on terms to be agreed in advance.
3. Updates
3.1 The Provider will continuously update the software during the term of the contract and make updated versions available to the customer. The Provider provides new versions as major releases (program versions with additional functions), service releases (bundling of bug fixes and optimizations), and patches (individual bug fixes).
3.2 The Provider informs the customer about the release and scope of an update in the ServiceCenter on the Provider's website or via a newsletter.
4. Documentation
The Provider provides a user manual and documentation for the software in digital form.
5. Availability
5.1 The Provider offers availability of 98% on an annual average. In the case of shorter terms, availability relates to the respective term.
5.2 The software is available when no error of error class 1 exists.
5.3 When calculating actual availability, downtimes not attributable to the Provider or downtimes due to maintenance work are treated as available time. Unavailability of the software during these downtimes is disregarded when calculating contractual availability. These harmless downtimes are:
(a) maintenance or other services coordinated with the customer as a result of which access to the software is not possible;
(b) unforeseen necessary maintenance work due to e.g. force majeure, unforeseeable hardware failures, strikes, natural events, etc., if such work was not caused by a breach of the Provider's duties to provide the services;
(c) downtimes due to virus or hacker attacks, insofar as the Provider has taken the agreed protective measures or, in the absence of agreement, the customary protective measures;
(d) downtimes for installing urgently necessary security patches;
(e) downtimes caused by third parties (persons not attributable to the Provider); and
(f) downtimes for scheduled maintenance work if this is carried out between 9:00 p.m. and 7:00 a.m. (CET) and was announced to the customer at least seven (7) days before the work is carried out. The announcement may be made in text form or as a dialog message in the front-end system.
5.4 The Provider is not obliged to establish and maintain an Internet connection between the web server and the customer's Internet access point.
5.5 The software is not fault-tolerant and was not designed for and is not suitable for use in connection with safety-critical environments and fail-safe systems.
6. Error remediation and error classes
6.1 The Provider will remedy errors occurring in the software. In doing so, it will begin error remediation within the following time windows depending on the severity of the error (hereinafter: response time):
| Error class | Response time |
|---|---|
| Error class 1 – Severe error: Use of the software is no longer possible overall or is only possible to a severely limited extent with significant delays or other disruptions. | 4 hours |
| Error class 2 – Medium error: Use of the software is restricted but possible with certain limitations. | 8 hours |
| Error class 3 – Minor error: All errors that cannot be assigned to another error class. | Within the next update cycle |
6.2 The response time pursuant to paragraph 1 of this clause begins upon receipt of a proper error report. If this time does not fall within support hours, the response time begins at the start of the next support period. An error report is proper if it is so specific that a reasonable third party can understand the error and reproduce it on the basis of the error report, and if it is made by a named authorized user.
6.3 The Provider is entitled to remedy errors by making a modified version of the software available to the customer or by temporarily providing the customer with a workaround.
6.4 The remediation of errors and damage caused by improper handling by the customer, by the influence of third parties, or by force majeure, e.g. by incorrect network, security, database, interface, or client configuration or third-party applications, is not the subject of this contract, but may in individual cases be commissioned as a service on terms to be agreed in advance.
7. Customer cooperation
7.1 The customer must properly report errors occurring without delay in text form or in the ticket system in the ServiceCenter on the Provider's website and must support the Provider in investigating and remedying errors to a reasonable extent.
7.2 The customer must provide the Provider with all information and access necessary to properly investigate and process the support request or errors that occur and are reported.
8. Legal consequences
The legal consequences in the event of failure to meet availability times and response times are governed by the statutory provisions unless otherwise agreed.
Data Processing Agreement (DPA)
1. Subject matter
1.1 The following provisions of this annex specify the data protection obligations of the contracting parties arising from the processing by the Provider as processor (hereinafter: Processor) for the customer as controller (hereinafter: Controller) on the basis of the contract concluded between the parties.
1.2 The specified obligations apply to all activities connected with the commissioned processing and in which employees of the Processor or third parties engaged by the Processor may come into contact with personal data of the Controller.
2. Subject of the commission and specification of the commission content by instructions
2.1 The Processor processes personal data on behalf of the Controller. The nature and purpose of this data processing as well as the data subjects of this data processing including the types of data concerned arise from Appendix 1 to this agreement as well as from the contract.
2.2 The contractually agreed data processing takes place exclusively in a Member State of the European Union (EU), in another contracting state of the Agreement on the European Economic Area (EEA), or in a third country with an adequacy decision. Any relocation of data processing to a third country without an adequacy decision requires prior information of the Controller and may only take place if the special requirements of Art. 44 et seq. GDPR are met.
2.3 The Controller is entitled to issue instructions to the Processor regarding data processing. Instructions are generally to be issued in text form. If instructions are exceptionally issued orally, they must be documented subsequently by the Controller in writing in text form without delay. The Processor and any person subordinate to the Processor who has access to personal data may process the data subject to the contract exclusively in accordance with the Controller's instructions including the powers granted in this agreement, unless they are legally obliged to process. The Processor must inform the Controller without delay if it is of the opinion that an instruction violates data protection provisions. The Processor is entitled to suspend performance of the relevant instruction until it is confirmed or amended by the Controller.
2.4 If the Processor determines the purposes and means of processing in breach of the GDPR, it is itself a controller with regard to the processing regulated in this agreement and is liable accordingly pursuant to Art. 82 GDPR.
3. Obligations of the Processor
3.1 Within its area of responsibility, the Processor will organize its internal operations so that they meet the requirements of data protection. It will take technical and organizational measures for the appropriate protection of the Controller's data that satisfy the requirements of the General Data Protection Regulation, in particular Art. 32 GDPR.
3.2 In performing the work, the Processor will only deploy employees whom it has familiarized with the data protection provisions applicable to them and whom it has suitably obligated to confidentiality (Art. 28(3) sentence 2 lit. b and Art. 29 GDPR).
3.3 The Processor has documented the implementation of the required technical and organizational measures prior to the start of processing with regard to the specific performance of the commission in Appendix 2. These technical and organizational measures are known to the Controller, and the Controller bears responsibility for ensuring that they provide an appropriate level of protection for the risks of the data to be processed.
3.4 The technical and organizational measures are subject to technical progress and further development. In this respect, the Processor is permitted to implement alternative adequate measures. In doing so, the security level of the specified measures must not be undercut. Material changes must be documented.
3.5 The Processor will support the Controller in complying with its duty to respond to requests for the exercise of data subjects' data protection rights and will support it in complying with its data protection obligations under Art. 32–36 GDPR and make available to it all information necessary for compliance with the obligations set out in Art. 28 GDPR.
3.6 The Processor will at any time upon request inform the Controller of the identity and contact details of the Processor's company data protection officer or of the contact person for data protection matters.
4. Audits by the Controller and by supervisory authorities
4.1 Should audits of the technical organizational measures with regard to the data subject to the contract by the Controller be necessary in individual cases, these will be carried out during normal business hours without disruption of business operations after prior registration, taking into account a reasonable lead time.
4.2 The Processor may make the conduct of audits dependent on the signing of a confidentiality declaration with regard to the data of other customers and the technical and organizational measures implemented, unless the Controller engages an auditor who is bound to confidentiality by law and/or professional rules to conduct the audit.
4.3 Should the auditor engaged by the Controller be in a competitive relationship with the Processor, the Processor has a right of objection against that auditor.
4.4 Should a data protection supervisory authority or another sovereign supervisory authority of the Controller wish to conduct an audit of the data processing subject to the contract, the Processor will support the Controller in this. The foregoing paragraphs apply accordingly.
4.5 The Processor may demand reimbursement of the effort incurred by it through an audit for cooperating in an audit, which it will invoice to the Controller on the basis of an hourly rate of EUR 150. For clarification: This remuneration arrangement is intended to ensure that the Processor can also after conclusion of the contract meet the Controller's individual customer needs in the area of data protection and can also provide service-oriented support to the Controller during an audit appointment.
5. Rectification, restriction, and erasure of data
5.1 The Processor may only erase data processed on commission or restrict their processing if this is provided for in the contract or in this data processing agreement or if the Controller issues a corresponding instruction. If a data subject contacts the Processor directly with an erasure request, the Processor will forward this request to the Controller without delay.
5.2 After the end of this agreement, the Processor will either erase or return all personal data subject to the contract at the Controller's choice, unless there is an obligation under Union law or German data protection law to retain the personal data.
5.3 Copies or duplicates of the data will not be created without the Controller's knowledge. Exempt from this are security copies insofar as they are necessary to ensure proper data processing, as well as data that are necessary with regard to compliance with statutory retention obligations.
6. Subprocessing relationships
6.1 Subprocessing relationships within the meaning of this provision are services that relate directly to the provision of the main service. This does not include ancillary services that the Processor uses e.g. as telecommunications services, postal/transport services, maintenance and user service, cleaning staff, auditors, or disposal of data carriers as well as other measures to ensure the confidentiality, availability, integrity, and resilience of the hardware and software of data processing systems. However, the Processor is obliged, to ensure the data protection and data security of the Controller's data, also in the case of outsourced ancillary services to take appropriate and lawful contractual agreements as well as control measures.
6.2 The Processor may engage subprocessors (further processors) only after prior express written or documented consent of the Controller or after information of the Controller that meets the requirements of Art. 28(2) sentence 2 GDPR.
6.3 Engagement of subprocessors in third countries without an adequacy decision may only take place if the special requirements of Art. 44 et seq. GDPR are additionally met.
6.4 Upon conclusion of the contract, the Controller consents to the subprocessors named in Appendix 3.
6.5 If the Controller refuses consent or objects to the engagement of the subprocessor, the Processor is entitled to terminate the contract early with one (1) month's notice.
7. Remuneration
7.1 If an instruction necessitates measures to which the Processor is not obliged on the basis of the contract or this agreement, it may make implementation of the instruction dependent on agreement on appropriate remuneration for the corresponding measure on the basis of an hourly rate of EUR 150. The additional costs do not apply to all other obligations of the Processor under this agreement, in particular not to the fulfillment of information obligations and cooperation obligations. For clarification: This remuneration arrangement is intended to ensure that the Processor can also after conclusion of the contract meet the Controller's individual customer needs in the area of data protection and therefore applies only to such cases in which the Controller commissions additional measures in the area of data protection to which the Processor was not already obliged on the basis of the contract or this agreement.
8. Term
This agreement applies from conclusion of the contract and ends upon complete performance of the measures described in Appendix 1, without the need for termination by either party, or upon termination of the contract underlying this agreement.
List of commissioned services (scope, nature, purpose of collection, processing, use of data, types of data, categories of data subjects)
| Type of service | Type of processing | Types of data | Categories of data subjects |
|---|---|---|---|
| Provision of a software solution for creating, managing, and automating templates, documents, and email signatures in connection with Microsoft products |
| First and last names, company name, customer type, contact details (e.g. address, email, telephone number), payment data, job title, position in the company, communication content | Employees, potential customers of the customer, suppliers of the customer |
Technical and organizational measures
Technical measures
1. Tenant separation:
- Tenant data are logically separated from each other. Each database is linked to a unique tenant ID.
2. Access management:
- Access rights are granted according to the principle of least privilege. User roles are managed via a role-based access control system (RBAC).
- Multi-factor authentication (MFA) is mandatory for all users.
3. Network security:
- Access to the SaaS platform is exclusively via TLS-encrypted connections (HTTPS).
- An application firewall (WAF) protects the service against unauthorized or harmful access by checking incoming traffic for known attack patterns such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 security risks and blocking them.
4. Monitoring and logging:
- A central monitoring system monitors the availability and performance of the SaaS solution in real time. Anomalies such as unusually high latencies or system failures are automatically detected and reported.
- An automated alert system notifies the IT team of critical events, such as failed login attempts or resource bottlenecks.
5. Data backup and recovery:
- Daily backups are created automatically and stored in a geo-redundant data center.
- The recoverability of backups is tested quarterly.
6. Scalability and availability:
- The SaaS solution is designed so that it automatically adds additional server resources through horizontal scaling in order to handle peak loads.
- A load balancer distributes incoming requests evenly across multiple servers to ensure high availability and optimal performance.
- The infrastructure is designed for high availability, with redundant servers to minimize downtime. Guaranteed availability is 98% pursuant to the SLA.
7. Patch management:
- A centralized patch management system ensures that all operating systems, middleware, and applications are regularly checked for security updates and updated.
- Critical security updates are installed within 24 hours of publication in order to close potential vulnerabilities.
- Before updates are installed, they are tested in an isolated test environment to ensure the stability and compatibility of the SaaS solution.
Organizational measures
1. Data protection and compliance:
- The processing of personal data takes place in accordance with the requirements of the GDPR. A data processing agreement (DPA) is concluded with every customer.
- A data protection officer monitors compliance with data protection policies.
2. Training and awareness:
- All employees receive annual training on IT security and data protection.
- New employees must complete mandatory security training before starting work.
3. Risk management:
- Regular risk analyses are carried out to identify and assess potential vulnerabilities in the SaaS solution. The results are documented and prioritized.
- For identified risks, suitable measures are defined, implemented, and regularly reviewed in order to ensure security and availability requirements.
4. Access policies:
- Access rights are granted according to the principle of least privilege so that users can only access the resources they need for their tasks.
- All access rights are reviewed quarterly and adjusted as needed to ensure that no unauthorized access is possible.
- Administrator and privileged access is protected by multi-factor authentication (MFA) and monitored in real time.
5. Contract management:
- A data processing agreement (DPA) is concluded with every customer, ensuring compliance with the GDPR and other relevant data protection laws.
- Service Level Agreements (SLAs) define clear requirements for availability, response times, and responsibilities. These are regularly reviewed and adjusted as needed.
- Transparency regarding data processing is ensured through detailed contractual documents that are available to customers at any time.
6. Incident management:
- An incident management process is established that governs the detection, reporting, analysis, and remediation of security incidents. All incidents are documented and evaluated.
- Security incidents are reported to the responsible bodies and processed within 24 hours of discovery.
- After each incident, a root cause analysis is carried out in order to develop measures to prevent similar incidents in the future.
Subprocessors
| Subprocessor | Address | Purpose of engagement | Place of processing |
|---|---|---|---|
| Microsoft | Microsoft Deutschland GmbH Walter-Gropius-Strasse 5 80807 München | Hosting | EU and Switzerland |
| Microsoft | Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA | Hosting | EU and Switzerland |
GTC as PDF document
The web version corresponds to the PDF document “AGB_DOCUNIZE-20250501-V1.0” (as of: 01 May 2025, Version 1.0). You can download the document here for your records.
Download GTC (PDF, as of May 2025)