EU GENERAL DATA PROTECTION REGULATION

agreement
over a

Order processing according to Art. 28 GDPR

Responsible: The processor:

Peitler advertising agency
Flurweg 24, 6912 Hörbranz

(hereinafter client) (hereinafter contractor)

1. SUBJECT OF THE AGREEMENT
(1) The subject of this order is the implementation of the following tasks:
[Advertising shoots, universal advertisements, ordering and organization of
Promotional items, creation of individual websites and web designs as well as commercials
of all kinds. Special requests from the client are also included.
This agreement is an addition to [add contract, etc. including date].
to understand.
(2) The following data categories are processed: contact data, contract data,
billing data, order data, payment data, etc.].
(3) The following categories of data subjects are subject to processing: customers,
Interested parties, suppliers, contact persons, employees, etc.]
2. DURATION OF AGREEMENT
{One-time execution} The agreement ends with a one-time execution of the
To work.
{Limited term} The agreement is concluded for a limited period and ends with [end of period
register]
{Indefinite Term} The Agreement is for an indefinite period and may
be terminated by both parties with a notice period of one month to the end of the month.
The possibility of extraordinary termination for good cause remains unaffected.

3. CONTRACTOR OBLIGATIONS
(1) The contractor undertakes to use data and processing results exclusively
to be processed as part of the client's written orders. Receives the
contractor an official order to release data of the client,
he has - insofar as this is legally permissible - to notify the customer immediately
inform and refer the authority to them. Likewise requires one
Processing of the data for the contractor's own purposes of a written
order.
(2) The contractor declares in a legally binding manner that he is responsible for all data processing
commissioned persons to maintain confidentiality before commencing work
or those of an appropriate statutory obligation of confidentiality
subject. In particular, the confidentiality obligation remains with the
persons commissioned with data processing even after the end of their work and
Resignation from the contractor.
(3) The contractor declares in a legally binding manner that he has taken all necessary measures
to ensure the security of processing in accordance with Art. 32 GDPR
(Details can be found in Appendix ./1).
(4) The contractor takes the technical and organizational measures to
the client the rights of the data subject according to Chapter III of the GDPR
(Information, information, correction and deletion, data portability,
Objection, as well as automated decision-making in individual cases) within the
statutory deadlines at any time and leaves everything to the client
necessary information. If a corresponding request to the contractor
directed and this shows that the applicant mistakenly for the
The contractor holds the client of the data processing operated by him
to forward the application immediately to the client and to do so
communicate to the applicant.
(5) The contractor supports the client in complying with the provisions of Article 32
to 36 GDPR (data security measures, reports from
violations of personal data protection to the supervisory authority,
Notification of a Personal Data Breach
data subject, data protection impact assessment, prior consultation).
(6) The contractor is advised that he is responsible for the present
Order processing to set up a processing directory in accordance with Art. 30 GDPR
Has.
(7) With regard to the processing of the data provided by him, the customer is
the right to inspection and control at any time, whether by him or her
commissioned third parties, granted to the data processing facilities. Of the
The contractor undertakes to make the information available to the client
to provide the means to monitor compliance with those set forth in this Agreement
commitments are necessary.
(8) After the end of this agreement, the contractor is obliged to
Processing results and documents containing data to the client
handed over / destroyed on his behalf 1 . If the contractor saves the data in
processed in a special technical format, he is obliged to post the data
Termination of this Agreement either in this format or at the option of the
Client in the format in which he received the data from the client or
published in a different, common format.
(9) The contractor must inform the client immediately if he
Is of the opinion that an instruction from the client violates data protection regulations
the Union or the Member States.


Data processing activities are carried out, at least in part, outside the EU or the
EEA carried out. The appropriate level of data protection
results from
 an adequacy decision by the European Commission in accordance with Article 45 GDPR.
 an exception for the specific case according to Art. 49 para. 1 DSGVO.
 Binding internal data protection regulations according to Art 47 in conjunction with Art 46 Para 2 lit b
GDPR.
 Standard data protection clauses according to Art 46 Para 2 lit c and d GDPR.
 Approved rules of conduct according to Art. 46 Para. 2 lit e in conjunction with Art. 40 GDPR.
 an approved certification mechanism according to Art. 46 Para. 2 lit f in conjunction with Art. 42
GDPR.
 Contractual clauses approved by the data protection authority in accordance with Article 46 Paragraph 3 lit a
GDPR.
 an exception for individual cases according to Art. 49 para. 1 subparagraph 2 DSGVO.
5. SUB-CONTRACTOR PROCESSOR 4
The contractor can call in sub-processors, for example for photo shoots.
He has informed the client of the intended use of a sub-
to inform the processor in good time that he may prohibit this
can. The contractor concludes the necessary agreements within the meaning of Article 28
Paragraph 4 GDPR with the sub-processor. It must be ensured that the sub
Processor enters into the same obligations as the contractor
subject to this agreement. If the sub-processor comes
If the data protection obligations are not met, the contractor is liable to the
Client for compliance with the obligations of the sub-processor.