Data Processing Agreement (DPA)

1. Parties and subject matter

This agreement under Art. 28 GDPR and the UK GDPR applies between you as controller ("Customer") and Sun Media Brands LLC, 2880 W Oakland Park Blvd, Suite 225C, Oakland Park, FL 33311, United States, as processor ("we") as soon as you use a calendar on adventcalendarmaker.com that processes personal data of third parties. It forms part of the Terms of Service and the Terms for Premium and Enterprise; no signature is needed. If you need a signed copy, write to [email protected].

We process the data only to provide the calendar: showing doors, counting opens, storing entries from giveaways, surveys and quizzes and showing them to you or providing them as an export.

2. Types of data and data subjects

The data subjects are the visitors of your calendars. We process hashed IP addresses, times of visits and door opens, device and referrer details, and the data visitors enter themselves, such as name, email address and answers in giveaways or surveys. You should not collect special categories of data under Art. 9 GDPR through the calendar.

3. Instructions

We process the data only on your documented instructions. The instructions are this agreement and your settings in the editor. If we believe an instruction is unlawful, we tell you without delay.

4. Confidentiality and security

Everyone with access to the data on our side is bound to confidentiality. We take appropriate technical and organisational measures under Art. 32 GDPR, in particular encrypted transfer via HTTPS, hashed passwords and IP addresses, server and database access only for authorised persons, regular backups and timely security updates.

5. Assistance and notifications

We help you with data subject requests, data protection impact assessments and notifications to authorities as far as our processing is concerned. We notify you of a personal data breach without undue delay and at the latest within 48 hours after becoming aware of it.

6. Sub-processors

You agree to the use of these sub-processors: Hetzner Online GmbH, Germany (servers and storage), Cloudflare, Inc., USA (delivery and protection against attacks), Stripe, Inc. or Stripe Payments Europe Ltd. (payments, Customer's billing data only) and Postmark, ActiveCampaign LLC, USA (sending emails). We announce new sub-processors by email at least 30 days in advance; you may object for good reason and then terminate as of the change.

We bind every sub-processor by contract to an equivalent level of protection.

7. International transfers

We are based in the United States. Transfers of personal data from the EU, the EEA, Switzerland and the United Kingdom are covered by the European Commission's Standard Contractual Clauses (module 2 or 3) together with the UK Addendum, which are deemed agreed with this agreement, or by a certification under the EU-US Data Privacy Framework where available.

8. Audits

On request we provide the information you need to demonstrate compliance with Art. 28 GDPR. On-site audits are possible by arrangement with reasonable notice, at most once a year unless there is a specific reason.

9. Deletion and return

After the end of the contract we delete the data of your calendars within 30 days once you delete your account or ask us to, unless the law requires us to keep it. Before that you can export the data or request it from us. Backups are overwritten in the normal cycle.

10. Liability and term

Liability follows Art. 82 GDPR; otherwise the rules of the Terms of Service and the subscription terms apply. This agreement runs as long as we process data on your behalf.