Data processing agreement

1. Parties and subject

This data processing agreement under Art. 28 GDPR applies between the business user who uses Verdaro Business and concludes this agreement in the app (controller, "you") and Süleyman Kaan Koc (BMT-Code), Verdaro, Neuherbergstraße 117, 80937 München, Germany (processor, "we").

It governs how we process personal data that you store in Verdaro about your customers and other third parties. It applies in addition to the terms of use and takes precedence over them in matters of data protection.

You conclude the agreement in the app by confirming it; we store the version and the time. You can download a copy with your business details there as a PDF at any time. The electronic form is sufficient (Art. 28(9) GDPR).

2. Nature, purpose and duration of the processing

We store the data, show it to you in the app, create your quotes, invoices and reminders from it as PDFs, send them by email to the address you give on your instruction, keep them, export them on your request and delete them. The sole purpose is to provide Verdaro Business to you.

The agreement applies as long as data of third parties is stored in your account, also after Business has ended, and ends when your account is deleted completely.

3. Data and data subjects

The data subjects are your customers, their contact persons and people who can be seen in your photos or appear in your notes. We process:

• names, addresses, email addresses and VAT identification numbers;
• notes and which gardens belong to which customer;
• the content of quotes, invoices, cancellation invoices and reminders, including services, amounts, dates and payment status;
• recipients and times of documents sent from Verdaro;
• photos of gardens and plants and the results of their analysis, insofar as they concern people.

Special categories of personal data (Art. 9 GDPR) are not intended; please do not store any.

4. Instructions

We process the data only on your documented instructions. Instructions are this agreement and what you do in the app, such as creating, changing, sending, exporting and deleting. You can give further instructions by email to info@bmt-code.de.

If the law requires us to process the data otherwise, we tell you beforehand unless the law forbids it. If we consider an instruction unlawful, we tell you without delay.

5. Confidentiality

Only the provider and persons bound to confidentiality have access to the data. We look at your data only when operation, troubleshooting or your request requires it.

6. Security of processing

We take technical and organisational measures under Art. 32 GDPR appropriate to the risk, in particular:

• operation on a server in data centres in Germany;
• encryption of all connections with TLS;
• passwords stored only as secure hashes, sign-in also with passkeys;
• every query is limited to the user's own account, so no one sees another account's data;
• database and files cannot be reached directly from the internet;
• administrative access to the server only for the provider and only with cryptographic keys;
• daily backups, kept for 14 days on the server and, encrypted, for at most 30 days off it;
• removal of all metadata from photos on upload;
• finished quotes, invoices and reminders are created once and kept unchanged with a checksum;
• server logs are deleted after 14 days at the latest.

We adapt the measures to the state of the art without lowering the level of protection.

7. Sub-processors

You agree to the use of these sub-processors:

• STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany: operation of the server in data centres in Germany, storage of all data and sending of emails;
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: keeping encrypted backups, which Amazon cannot read, in data centres in Frankfurt am Main;
• Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland: analysis of photos with the AI model Gemini via Vertex AI in data centres in the EU, only for identifications and health checks. No data from customers, quotes, invoices or reminders is transmitted.

An agreement under Art. 28(4) GDPR is in place with each sub-processor. Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR; our privacy notice describes possible access by Google group companies outside the EU.

Our payment provider Stripe processes only data about your own subscription, no data of your customers, and is therefore not a sub-processor under this agreement.

If we want to add or replace a sub-processor, we tell you by email at least four weeks beforehand. During that time you can object for an important reason of data protection law; if we cannot agree, you can terminate Verdaro Business as of the date of the change.

8. Assistance

If data subjects contact us, we forward the request to you and do not answer it ourselves. For access, rectification, erasure, restriction and data portability, the functions of the app help you, in particular editing, deleting and the export; where they are not enough, we assist you on request. Finished invoices and reminders cannot be deleted one by one because of record-keeping obligations.

We assist you with your obligations under Art. 32 to 36 GDPR with the information available to us.

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we inform you by email without undue delay, if possible within 24 hours, with the information under Art. 33(3) GDPR as far as it is available to us, and take the measures needed to limit its consequences.

10. Deletion and return

You can edit and delete your data yourself at any time; finished invoices and reminders are kept as long as your account exists. The export gives you your documents as PDFs and a table in CSV format.

If you delete your account, we delete all data permanently after 30 days; it disappears from the backups no later than 30 days after that. Before deleting, the app reminds you to export your documents first.

11. Evidence and audits

On request we show that we comply with this agreement, as a rule through written information and through evidence from our sub-processors, such as certificates. We agree on-site audits with reasonable notice; they must not disrupt operations disproportionately.

12. Liability and final provisions

Liability is governed by Art. 82 GDPR and the terms of use.

If we change this agreement, we present the new version to you in the app for confirmation.

German law applies. The German version is binding; the English and Turkish versions are translations.