This translation is provided for convenience only. The German version is legally binding.
§ 1 Parties and conclusion
(1) This agreement applies between the farm that uses PROLandwirt (“Controller”) and PROLandwirt GmbH, Kasernenstraße 11, 4063 Hörsching, Austria, company register no. FN 480097a (“Processor”).
(2) The agreement is concluded when the Controller accepts it when signing up for the free trial or when ordering. It supplements the terms and conditions. In the event of conflicts on data protection matters, the provisions of this agreement prevail.
§ 2 Subject matter, duration, nature and purpose
(1) The Processor provides the Controller with the PROLandwirt software. In doing so, it processes personal data that the Controller or the Controller’s customers enter in PROLandwirt.
(2) Nature of processing: storing, organising, displaying, analysing, transmitting (e.g. order confirmations, invoices and messages by email), making data available for route planning, and erasing.
(3) Purpose of processing: order management, customer portal, route planning and delivery, subscriptions, invoicing, credit and deposit management, and communication with the Controller’s customers.
(4) The agreement applies for as long as PROLandwirt is used, including the free trial, and ends when the data has been erased or returned in accordance with § 10.
§ 3 Types of data and data subjects
(1) Data subjects: the Controller’s customers and prospective customers; the Controller’s employees who are given a login (e.g. a driver login).
(2) Types of data: name, company, billing and delivery address, phone number, email address, customer portal login details, orders, subscriptions, deliveries and delivery notes, invoices, payment method and payment status, credit, deposits, messages, and login details of employee accounts.
(3) Special categories of personal data (Art. 9 GDPR) are not processed. The Controller does not enter such data in PROLandwirt.
§ 4 Instructions
(1) The Processor processes the data solely on documented instructions from the Controller, unless it is legally required to process it; in that case it informs the Controller in advance, unless the law prohibits this.
(2) This agreement, the terms and conditions and the Controller’s use of the features of PROLandwirt constitute instructions. The Controller gives further instructions by email to info@pro-landwirt.com.
(3) If the Processor considers an instruction to be unlawful, it informs the Controller immediately.
§ 5 Confidentiality
The Processor only uses persons who are bound to confidentiality or subject to a statutory duty of confidentiality (§ 6 DSG, Austrian Data Protection Act). This obligation continues after their work has ended.
§ 6 Security of processing
(1) The Processor takes appropriate technical and organisational measures in accordance with Art. 32 GDPR, in particular:
- encrypted transmission of all data (HTTPS/TLS),
- access only with personal login details and password,
- graded access rights (e.g. driver logins without prices, invoices or business data),
- separation of the data of the individual farms,
- hosting in a data centre in Austria with physical and logical access control,
- regular backups and a recovery procedure,
- timely security updates of the software used.
(2) The Processor may adapt the measures to technical progress, provided the level of protection is not reduced.
§ 7 Sub-processors
(1) The Controller approves the use of the following sub-processors:
- easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria – hosting of the software and data, sending of emails.
(2) The Processor may engage additional sub-processors or replace existing ones. It informs the Controller of this by email at least 30 days in advance. Within this period the Controller may object for an important data protection reason; in that case either party may terminate the contract as of the date of the change.
(3) The Processor contractually binds every sub-processor to the same data protection obligations as in this agreement.
(4) If the Controller uses card payments via Stripe for its own customers, it concludes the contract with Stripe itself. To that extent Stripe is not a sub-processor of the Processor.
§ 8 Assistance to the Controller
(1) The Processor assists the Controller with appropriate measures in responding to requests from data subjects (access, rectification, erasure, restriction, data portability, objection). If a data subject contacts the Processor directly, it forwards the request to the Controller immediately.
(2) It also assists the Controller with the security of processing, notifications of personal data breaches and data protection impact assessments (Art. 32 to 36 GDPR), insofar as it has the necessary information.
§ 9 Personal data breaches
The Processor informs the Controller without undue delay, where possible within 48 hours, after becoming aware of a personal data breach. It provides the information available to it pursuant to Art. 33(3) GDPR and takes the necessary measures to limit the consequences.
§ 10 Erasure and return
(1) If the free trial ends without a contract being concluded, the Processor erases the data 30 days after the trial ends.
(2) When the contract ends, the Controller can export its data until the end of the contract; within 30 days after the contract ends, the Processor provides the data on request in a common format (e.g. CSV). After that it erases the data.
(3) Data is not erased insofar as there is a statutory obligation to retain it. Data in backups is overwritten in the course of the usual backup cycles.
§ 11 Evidence and audits
(1) On request, the Processor provides the Controller with all information necessary to demonstrate compliance with this agreement.
(2) The Controller, or an auditor appointed by it who is bound to confidentiality, may verify compliance during business hours after giving reasonable notice (usually 14 days), generally once per calendar year and additionally where there is a specific reason. The Controller bears the costs of the audit.
§ 12 Place of processing
Processing takes place in Austria. Processing is only moved to a country outside the European Economic Area if the requirements of Art. 44 et seq. GDPR are met and the Controller has been informed in accordance with § 7(2).
§ 13 Liability and final provisions
(1) Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the terms and conditions apply.
(2) Austrian law applies. The place of jurisdiction is the court in Linz, Austria, that has subject-matter jurisdiction.
(3) This agreement is available in German, English and Italian. In the event of discrepancies, the German version prevails.