Vertragssprache ist Deutsch. Maßgeblich ist ausschließlich die deutsche Fassung.
pursuant to Article 28 GDPR — Paragogoi by FlyDropGlobal
Conclusion: This agreement is concluded between the Provider and the Producer as soon as the Producer confirms it in text form when setting up access. The Controller's details are those held in the customer account (name or company, legal form, address, contact e-mail).
Processor: Michail Frantzeskakis, trading as “Paragogoi by FlyDropGlobal”, Am Hackenbruch 68e, 40231 Düsseldorf, Germany.
Controller: the Producer who confirms this agreement when setting up access.
1.1 This agreement governs the rights and obligations of Controller and Processor in the context of processing personal data on behalf within the meaning of Article 28 GDPR.
1.2 It applies to all activities in which the Processor, its staff or sub-processors engaged by it process the Controller's personal data.
1.3 Terms used are to be understood as defined in the GDPR. Where declarations must be made “in writing”, written form under section 126 BGB is meant. Otherwise declarations may also be made in text form (e.g. by e-mail), provided adequate evidence is ensured.
2.1 The Processor operates the B2B SaaS platform “Paragogoi” (paragogoi.com), through which end customers can address order or product enquiries to the Controller. The Processor performs the following processing on the Controller's behalf: collection and storage of enquiry/order data entered by end customers; transmission of that data to the Controller via the producer panel; making the data available for retrieval in the producer panel; sending receipt, confirmation and decline messages by e-mail to enquiring end customers. The processing is based on the platform usage contract (“main contract”).
2.2 Processing begins when the producer's access is activated and runs for an indefinite period until the main contract or this agreement is terminated by either party.
3.1 The Processor operates a digital platform and thereby obtains access to personal data of end customers who address enquiries to the Controller.
3.2 Processing takes the form of collection, storage, transmission and display of the relevant enquiry data. The Controller is an agricultural or commercial producer receiving end-customer enquiries via the platform.
3.3 The processing serves the initiation and handling of transactions between end customers and the Controller.
3.4 The following categories of personal data are processed: master data (end customer's name); contact data (e-mail address, telephone number where applicable); content of the enquiry or order; delivery or collection details where applicable. No payment data, health data or special categories of personal data within the meaning of Article 9 GDPR are processed. No tracking of open or click behaviour of e-mail recipients takes place.
3.5 Data subjects are the Controller's end customers who submit an enquiry via the platform, and persons interested in the Controller's services who make contact via the platform.
4.1 The Processor processes personal data exclusively as contractually agreed or as instructed by the Controller, unless legally obliged to a particular processing. Where such obligations exist, it informs the Controller before processing unless notification is legally prohibited. The Processor does not use the data for any other, in particular not for its own, purposes.
4.2 The Processor confirms that it is familiar with the relevant data protection provisions and observes the principles of proper data processing.
4.3 The Processor undertakes to maintain strict confidentiality in processing.
4.4 Persons who may obtain knowledge of the data must be bound to confidentiality, unless already subject to a statutory duty of secrecy.
4.5 The Processor warrants that persons engaged in processing were familiarised with the relevant data protection provisions and this agreement before processing began.
4.6 The Processor supports the Controller in creating and maintaining the record of processing activities and in carrying out a data protection impact assessment. Required information is provided without undue delay on request.
4.7 If the Controller is subject to supervisory authority checks or data subjects assert rights against it, the Processor provides support to the extent necessary.
4.8 The Processor provides information to third parties or data subjects only with the Controller's prior consent. Enquiries addressed directly to it are forwarded without undue delay.
4.9 The Processor is a small business and currently not legally obliged to appoint a data protection officer. Responsible for data protection enquiries is Michail Frantzeskakis (info@paragogoi.com). Should an obligation to appoint arise in future, the Controller will be informed without undue delay.
4.10 Data processed on behalf is stored exclusively on servers within the European Union. For sending receipt, confirmation and decline messages to end customers, a sub-processor established in the United States of America and named in Annex 2 is used; the transmission and processing required for this also takes place in the United States. This transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, for which the sub-processor is certified, and additionally on the EU Standard Contractual Clauses agreed with it (Implementing Decision (EU) 2021/914, Modules 2 and 3). Any further transfer to a third country requires the Controller's consent and compliance with Chapter V GDPR.
5.1 The measures described in Annex 1 are binding and define the minimum owed.
5.2 The measures may be adapted to technical developments as long as the agreed level is not undercut. Material changes are notified without undue delay.
5.3 If the security measures no longer meet the Controller's requirements, the Processor notifies without undue delay.
5.4 The Processor warrants that the data processed on behalf is kept strictly separate from other data sets (see Annex 1, point 8).
5.5 Copies or duplicates are not created without the Controller's knowledge, except for technically necessary temporary copies (e.g. backups).
5.6 Processing of data on behalf in private homes or on private devices is not permitted.
5.7 The Controller is entitled to check performance of the obligations upon reasonable prior notice.
6.1 The Processor will rectify, erase or restrict data processed under the assignment only in accordance with the agreement or on the Controller's instruction.
6.2 The Processor will comply with such instructions at any time, including beyond termination of this agreement.
7.1 Engaging sub-processors is permitted. The Processor provides information about engaged sub-processors at any time on request.
7.2 The responsibilities of Processor and sub-processor are clearly delineated.
7.3 Further sub-processing by the sub-processor is permitted in accordance with point 7.1.
7.4 The Processor selects sub-processors with particular regard to their technical and organisational measures.
7.5 Engaging sub-processors outside the EU/EEA is permitted only under the conditions of point 4.10.
7.6 The Processor regularly reviews compliance by sub-processors and documents the results.
7.7 If a sub-processor fails to meet its data protection obligations, the Processor is liable to the Controller.
7.8 At the time of conclusion, the sub-processors named in Annex 2 are entrusted with the processing.
7.9 Sub-processing covers only services directly connected to the main service. Ancillary services (e.g. maintenance, telecommunications) are not covered.
8.1 The Controller alone is responsible for assessing the lawfulness of the commissioned processing and for safeguarding data subjects' rights.
8.2 The Controller issues instructions in documented form, e.g. in text form by e-mail. In urgent cases instructions may be given orally and are confirmed in documented form without undue delay.
8.3 The Controller informs the Processor without undue delay if it discovers errors or irregularities.
8.4 The Controller is entitled to check compliance with the contractual and data protection requirements to a reasonable extent.
8.5 Checks take place without avoidable disruption of business operations, upon reasonable prior notice and at most once every 12 months unless there is urgent cause.
9.1 The Processor notifies personal data breaches without undue delay, at the latest within 24 hours of becoming aware, to info@paragogoi.com or the address designated by the Controller. The notification contains at least: the nature of the breach, the categories and approximate number of data subjects and records concerned, contact details for queries, likely consequences and the measures taken or proposed.
9.2 Significant disruptions in performance and breaches of data protection provisions or this agreement are also notified without undue delay.
9.3 The Processor informs without undue delay about supervisory authority checks or measures relating to the processing.
9.4 The Processor supports the Controller in its obligations under Articles 33 and 34 GDPR.
10.1 The Controller reserves a comprehensive right to issue instructions.
10.2 The persons authorised to give and receive instructions are named in Annex 3.
10.3 If the named persons change, successors are notified to the other party without undue delay.
10.4 The Processor points out without undue delay if, in its opinion, an instruction infringes legal provisions. It is entitled to suspend execution until the instruction is confirmed or amended.
10.5 The Processor is not obliged to carry out a substantive legal review of instructions.
11.1 On termination of the assignment or at any time at the Controller's request, the Processor must, at the Controller's choice, erase or hand over the data processed on behalf. Existing copies must also be erased.
11.2 The Processor is obliged to arrange erasure at the engaged sub-processors without undue delay. The Processor points out that the actual erasure periods of sub-processors are governed by their own contractual terms; for the e-mail dispatch provider named in Annex 2 the erasure period is up to 90 days after termination of the account there.
11.3 The Processor demonstrates proper erasure on request.
11.4 Documentation evidencing proper data processing is retained in accordance with the applicable retention periods, including beyond the end of the contract.
No separate remuneration is payable for this agreement; it is covered by the remuneration agreed in the main contract.
13.1 For compensation of damage suffered by a person due to unlawful or incorrect data processing, Controller and Processor are jointly and severally liable unless otherwise provided by law.
13.2 The Controller bears the burden of proof that damage is not the result of a circumstance for which it is responsible, insofar as data was processed under its responsibility.
13.3 The Processor is liable for damage culpably caused by it, its staff or sub-processors engaged by it.
13.4 Point 13.3 does not apply where the damage arose from the correct implementation of a Controller instruction.
14.1 The Controller may extraordinarily terminate the main contract and this agreement in the event of a serious breach by the Processor, failure to carry out a lawful instruction, or a contractually improper refusal of audit rights.
14.2 A serious breach exists in particular where the Processor substantially fails to implement the agreed technical and organisational measures.
14.3 For minor breaches the Controller sets a reasonable remedy period; if this expires without remedy, extraordinary termination is permitted.
15.1 Both parties treat knowledge obtained about trade secrets and data security measures as confidential, including beyond termination.
15.2 If the Controller's property held by the Processor is endangered by third-party measures, the Processor notifies without undue delay.
15.3 Ancillary agreements require text form.
15.4 The right of retention under section 273 BGB is excluded with regard to the data and data carriers processed on behalf.
15.5 Should individual parts of this agreement be invalid, this does not affect the validity of the remainder.
The Processor operates no physical server infrastructure of its own. Servers are operated by the sub-processors named in Annex 2 and are subject to their physical access controls.
Access to the platform database is exclusively via authenticated accounts (Supabase Auth). Complex, individual credentials are used. Administrative access to the infrastructure is limited to the Processor.
Access to producer and end-customer data is role-based (Row Level Security): producers see only the enquiries addressed to them. Database-side permissions strictly separate producer, admin and public access.
All data transfers between device, platform and database are TLS-encrypted. No disclosure to third parties outside the sub-processors named in Annex 2 takes place.
Enquiries are captured exclusively via the platform's validated forms; system logs (audit events) document security-relevant operations.
Compliance with this agreement and by the engaged sub-processors is reviewed regularly, at least once a year. For this purpose the Processor monitors the sub-processor lists and audit reports published by the sub-processors.
Database backups are performed automatically at infrastructure level by the sub-processor. Current security mechanisms of the platform infrastructure are used.
Data of different producers is stored logically separated within the database by means of appropriate data structure and access rules.
Erasure takes place at the end of the contract or on the Controller's instruction and covers both the database level — by irreversible removal of the relevant records — and the object storage, by deleting the associated files. After completion the Processor verifies that no remnants remain and documents the result.
No remote maintenance by third parties outside the sub-processors named in Annex 2 takes place.
Service: hosting and platform infrastructure (operation of paragogoi.com). Seat and place of processing: Sweden (EU).
Service: database, authentication, data storage. Place of processing: eu-central-1, Frankfurt am Main (EU).
Address: 2261 Market Street #5039, San Francisco, CA 94114, USA. Service: sending transactional e-mails to end customers (receipt, confirmation and decline messages relating to enquiries). Place of processing: United States of America. Basis of transfer: EU-US Data Privacy Framework (certified) and EU Standard Contractual Clauses, Implementing Decision (EU) 2021/914, Modules 2 and 3; data processing agreement concluded.
Changes to this list are notified to the Controller in accordance with point 7.
Processor (Paragogoi): Michail Frantzeskakis, info@paragogoi.com.
Controller (Producer): the contact person and contact e-mail address held in the customer account.
Unofficial translation provided for reading convenience only. This is not a certified legal text; only the German version is legally binding.