Agreement on the processing of personal data on behalf of a controller

Parties

Controller ("customer"): the company given at registration, represented by the registering person. The information from the registration form — company name, street and number, postal code and city, name and e-mail address of the contact person and the chosen address of the environment — forms part of this agreement. The customer keeps this information up to date and reports changes to info@optware.de.

Processor ("OptWare"):
OptWare GmbH, Prüfeninger Straße 20, 93049 Regensburg, Germany
Data protection officer: Robert Heindl, Projekt 29 GmbH & Co. KG, Ostengasse 14, 93047 Regensburg; requests through info@optware.de
Contact for data protection matters: info@optware.de

1. Subject matter, duration, order of precedence

1.1 The subject matter of this agreement is the processing of personal data that OptWare carries out on behalf of the customer in the course of providing and operating the customer's environment <firma>.swp.optware.de, including the associated identity and access management.

1.2 The agreement is concluded upon acceptance at registration and runs for as long as the usage contract exists. It ends with the usage contract; the deletion obligations under section 11 survive.

1.3 OptWare processes the data exclusively within the European Union or the European Economic Area. Processing in a third country takes place only to the extent set out in annex 3 and only on the basis of a valid transfer instrument under Chapter V GDPR. This does not cover the delivery of push notifications under section 5.5: the push service that the recipient's browser or operating system prescribes may have its seat or its servers outside the EU or the EEA; it receives the notification only in encrypted form.

1.4 In matters of data protection law this agreement takes precedence over the terms of use. It does not apply to processing for which OptWare is itself the controller (registration, portal, audience measurement, defence against abuse — see Part A of the privacy policy).

2. Nature, scope and purpose of the processing; data subjects and categories of data

The subject matter, nature and purpose of the processing, the categories of data subjects and the types of data processed are set out in annex 1.

3. Instructions

3.1 OptWare processes the data exclusively within this agreement and in accordance with the customer's documented instructions. The customer's use of the application and the configuration they make count as instructions.

3.2 Instructions are given in written form to info@optware.de. Oral instructions must be confirmed in written form without delay.

3.3 Instructions may be given by the registering person and by any person the customer names to OptWare in written form.

3.4 If OptWare considers an instruction unlawful, it informs the customer without delay and may suspend the execution until the instruction is confirmed or amended.

3.5 OptWare carries out instructions within the functions provided by the application, in particular export, deletion and the settings of the environment. OptWare may refuse instructions that go beyond this — such as individually built reports, special deletion runs or changes to the application — because the use is free of charge and offered without support with committed deadlines (section 3.5 of the terms of use). Instructions that OptWare is obliged to carry out under Art. 28 GDPR are unaffected; it carries those out even where no function is available for them.

4. Obligations of OptWare

OptWare

1. processes the data only for the purposes set out in annex 1,
2. implements the technical and organisational measures set out in annex 2 and maintains them for the term of the contract,
3. obliges the persons involved in the processing to maintain confidentiality and informs them of the applicable data protection obligations (Art. 28 (3) (b), Art. 29, Art. 32 (4) GDPR),
4. has appointed a data protection officer (see above),
5. supports the customer in fulfilling data subject rights in accordance with section 6,
6. supports the customer in complying with the obligations under Art. 32 to 36 GDPR, in so far as such support is possible for OptWare and the information is available to it,
7. reports personal data breaches in accordance with section 7,
8. rectifies, deletes or restricts the data only on the customer's instructions or in accordance with this agreement,
9. informs the customer without delay if a supervisory authority takes measures against OptWare that may affect the processing carried out for the customer,
10. informs the customer without delay if an authority or a court demands access to the customer's data, in so far as this is legally permitted, and discloses no data without a legal obligation,
11. maintains a record of all processing activities carried out on behalf of controllers under Art. 30 (2) GDPR.

5. Sub-processors

5.1 The customer consents to the engagement of the sub-processors named in annex 3.

5.2 OptWare may engage further sub-processors or replace existing ones. It informs the customer at least 30 days in advance, in written form or by e-mail to the address of the contact person on file. The customer may object within 14 days of that information for an important reason relating to data protection. If the customer objects, OptWare may terminate the usage contract with effect from the planned date of the change where the service cannot be provided without the sub-processor concerned.

5.3 OptWare obliges every sub-processor to a level of protection equivalent to that of this agreement and remains responsible towards the customer.

5.4 Ancillary services that OptWare obtains from third parties and that do not involve the processing of the customer's data (for example telecommunications services, cleaning, maintenance by auditors) do not count as sub-processing. In those cases OptWare ensures the protection of the data.

5.5 Nor does the delivery of push notifications to users who have switched them on for their device in the installed app count as sub-processing. It runs through the push service that the browser or operating system of that device prescribes (annex 3, section B). OptWare does not choose that service, does not engage it, concludes no contract with it and integrates neither a program nor an account of any push provider. It hands the notification over exclusively end-to-end encrypted under RFC 8291, so that the push service cannot read its content.

6. Data subject rights

6.1 OptWare forwards requests from data subjects to the customer where it is apparent that they concern the customer; OptWare does not answer them itself.

6.2 OptWare supports the customer in answering them within the functions of the application and, where necessary, by providing information about the data processed, by deletion and by providing an export.

6.3 The customer can export the data of their environment themselves at any time through the settings. This excludes the push subscriptions, the notifications queued for delivery and the application's key for push notifications (annex 1): they contain key material of the devices and of the application and serve delivery alone. Deletions and information requests that go beyond the functions of the application, and the deletion of the entire environment, are carried out by OptWare on instruction.

7. Personal data breaches

7.1 OptWare informs the customer without delay, at the latest within 48 hours of becoming aware, of any personal data breach affecting the customer's data. The period runs from OptWare's awareness, not from the occurrence of the incident; it is set so that the customer still has time for their own notification under Art. 33 GDPR.

7.2 The report contains, where available, a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. OptWare provides missing information in stages.

7.3 Notifications to the supervisory authority under Art. 33 GDPR and communications to data subjects under Art. 34 GDPR are the customer's responsibility. OptWare supports them in doing so.

7.4 The report is addressed to the e-mail address of the contact person on the registration record. The customer keeps that address up to date.

8. Evidence and audit rights

8.1 OptWare demonstrates compliance with the obligations under this agreement in written form, in particular through the description of the measures in annex 2, through evidence from its sub-processors (such as the ISO/IEC 27001 certificates and the document on technical and organisational measures of Hetzner Online GmbH) and through self-assessment. OptWare answers the customer's questions about these measures within a reasonable period.

8.2 Where the evidence under section 8.1 is not sufficient in an individual case, the customer may carry out an on-site audit for an important reason — in particular after a personal data breach, where there are concrete indications of a breach of this agreement, or at the request of a supervisory authority. Such an audit is possible with at least four weeks' notice, during normal business hours and without disrupting operations. The customer bears the cost of their audit; OptWare may charge a reasonable fee for its own effort on a time-spent basis. The restriction to cases with an important reason reflects the fact that the use is free of charge; it does not exclude the customer's right of review under Art. 28 (3) (h) GDPR.

8.3 Audits must not affect the environments of other customers or their data. The persons carrying out an audit must not be competitors of OptWare and must be bound to confidentiality.

9. Place of processing

The processing takes place exclusively in the Nuremberg (nbg1) data centre of Hetzner Online GmbH in Germany. A relocation within Germany or the EU is permitted and is communicated to the customer. Annex 3 applies to the sending of e-mail. Push notifications are also created and encrypted there; only the encrypted notification leaves the data centre, for delivery under section 5.5.

10. No backup in the free tier

10.1 OptWare creates no backup of the content of the customer's environment. The customer is informed of this limitation (section 5 of the terms of use) and takes their own measures to ensure availability under Art. 32 (1) (b) and (c) GDPR.

10.2 OptWare backs up the platform components it needs in order to operate the service, in particular the database of the identity service; those backups are kept for 14 days and are located in Germany.

10.3 So that the customer can meet their own obligation under Art. 32 (1) (b) and (c) GDPR, OptWare provides an export in a structured, machine-readable format in the settings of the environment, available at any time. It is for the customer to decide how often they use that export and where they keep it.

11. Deletion and return

11.1 OptWare processes the data only for as long as it is necessary for the agreed purposes.

11.2 After the usage contract ends, OptWare deletes the customer's data: the database and the database user of the environment, the containers and the configuration of the environment, and the associated user accounts and organisation data in the identity service. The deletion takes place at the latest 30 days after the end of the contract.

11.3 At the customer's request, to be made at the latest 14 days after the end of the contract, OptWare provides an export in a structured, commonly used and machine-readable format before the deletion.

11.4 In the event of inactivity the environment is paused after 30 days without a sign-in and deleted with all data 30 days later; before each step OptWare informs the contact person on file 7 days in advance. The customer hereby instructs OptWare to delete in that case.

11.5 Backups of the platform components under section 10.2 expire in the ordinary course within 14 days; log data expires according to the periods set out in annex 2. A targeted deletion inside an existing backup is technically impossible and is achieved by the expiry of the cycle.

11.6 OptWare may retain documentation that serves as evidence of proper processing beyond the end of the contract in accordance with the applicable retention periods.

12. Liability

12.1 Art. 82 GDPR applies to liability. Otherwise section 10 of the terms of use applies.

12.2 As the controller, the customer is responsible for the lawfulness of the processing, for the legal basis and for informing the data subjects.

13. Final provisions

13.1 Amendments to this agreement must be made in written form. Section 13 of the terms of use applies accordingly where an adjustment is necessary because of changed legal requirements.

13.2 Should individual provisions be invalid, the validity of the remaining provisions is unaffected.

13.3 German law applies.

Subject matter: provision and operation of a multi-tenant web application for workforce and shift planning ("Smart Workforce Planning") together with identity and access management.

Nature of the processing: collection, storage, organisation, retrieval, alteration, transmission within the environment and, for push notifications that have been switched on, in encrypted form to the push service of the device (section 5.5), restriction and erasure in the course of operation, troubleshooting, maintenance, security and the rollout of new versions.

Purpose: use of the application by the customer to plan and manage the deployment of staff, notification of users about published plans where they have switched push notifications on, access of planned persons to their own assignments, also without a user account of their own through a join link that a planner of the customer has switched on for a plan, and authentication and authorisation of the customer's users.

Categories of data subjects:

• employees of the customer whose deployment is planned
• users of the environment (administrators, planners, invited persons, and persons who joined a plan through a join link without a user account of their own)
• where applicable, further persons the customer records in the application (for example external staff, temporary workers, contact persons)

Types of personal data:

• master data: first name, last name, e-mail address, where applicable a personnel number, assignment to an organisational unit or team
• credentials: password only as a hash, roles, organisation membership, time of the last sign-in, session data
• planning data: availability, shifts, assignments, working times, qualifications and roles, absences exclusively without a reason
• communication data: system messages sent to the users (invitation, confirmation of the e-mail address, setting a password) and push notifications about the publication or change of a plan and test notifications the user asks for; their content is limited to the period of the plan, the number of the recipient's own shifts or of their new, moved and cancelled shifts and a link to the plan in the environment, without names of other people and without free text from the planners
• push subscriptions, only where a user has switched push notifications on: identifier of the user account, delivery address assigned by the push service (endpoint), public key and authentication secret of the device, language of the notifications, display mode of the app, browser identifier (user agent, truncated to 255 characters), time of the last confirmation by the installed app and of the last test notification, and the times of creation and change
• joins without a user account, only where a planner has switched on a join link for a plan: the plan's join link; for each joined device the identifier of the person, a check value (SHA-256) of the random value the device holds as a cookie, the plan through which the person joined, and the times of joining and of the last retrieval
• log data: access times, IP address, requested addresses, sign-in and security events, technical errors
• files the customer uploads voluntarily, in so far as the application provides for it

Excluded data: special categories of personal data under Art. 9 GDPR (in particular health data, information about religion or trade union membership) and data under Art. 10 GDPR are not the subject matter of this agreement and must not be entered into the environment (section 7.2 of the terms of use). Absences are marked in a neutral way only, without a reason. OptWare sets the application up so that it can be used without such information; the customer instructs the planning staff accordingly.

Version of 9 October 2026. OptWare may develop the measures further as long as the level of protection does not fall.

Pseudonymisation and encryption

• Transport encryption: TLS for all publicly reachable connections, certificates renewed automatically through ACME; HTTP is redirected to HTTPS.
• Push notifications: content end-to-end encrypted under RFC 8291 (aes128gcm) with the keys of the receiving device; towards the push service the application identifies itself with its own key pair (VAPID, RFC 8292), which it generates in the environment's database. The private key does not leave that database and is not part of the export.
• Encryption in the identity service: directly identifying user attributes are stored encrypted in the database; lookups use HMAC tokens, plain text exists only at runtime.
• Passwords only as a hash. The method is fixed in the identity service's realm policy (Argon2id, five iterations) and not merely inherited as a default.
• The server's disk is not encrypted as a whole. Data at rest is protected by the encryption of the identifying user attributes in the database, by password hashes and by the physical access control of the data centre.
• Key material and credentials exclusively in the central password store (Vaultwarden) and in files with permissions 600 on the server.

Confidentiality — physical access, system access, data access and separation

• Physical access: data centres of Hetzner Online GmbH in Germany with access control, video surveillance and logging in accordance with Hetzner's current document on technical and organisational measures, which is attached to this annex.
• Server access: exclusively over SSH with a key pair; password and keyboard-interactive login are disabled, root login is possible only with a key. Repeated failed login attempts are blocked by fail2ban. Three independent firewall layers protect the ports: the provider's cloud firewall, the host firewall and the rule set for the container networks.
• Administrative interfaces (the identity service's admin console, internal operations pages, the analytics interface) are reachable only from OptWare's VPN; all other access is refused.
• Container management: OptWare manages the containers through a Portainer instance it operates itself, which also runs on Hetzner Online GmbH infrastructure in Germany. The management agent on the server accepts connections only from the defined IP addresses of that instance; the restriction is anchored in the host firewall and in the rule set for the container networks. No third party gains access through it.
• Data access: role model in the identity service; administrative roles are assigned to named persons, currently to one person. Sign-in events are logged for 90 days.
• Separation of tenants: one database with its own database user per environment, its own container network, its own OAuth client and its own address. The environment is reachable only through that address; the application service is not reachable directly from the internet.
• Devices: the installable app stores nothing on the device but a static offline page without any content of the environment; responses of the application are not cached there. Push notifications can be switched on only in the installed app, and signing out on a device removes its subscription.
• Access without a user account: only through a join link that a planner switches on for a published plan and can replace or switch off at any time; the link contains a random value of 256 bits. Whoever opens it sees only the name of the plan and the names of the persons planned in it. A device that connects to a person receives a cookie with a random value of its own of 256 bits (HTTPS only, not readable by scripts, not sent from other websites, only for the environment's programming interface); the database holds only its check value (SHA-256). The cookie entitles the device only to read that person's own assignments in published plans. A person can be connected to at most one device; the connection can be ended at any time on the device and by the planner.
• Separation of test and production; no use of real customer data for tests.
• All staff are bound to confidentiality and trained in data protection.

Integrity — input, disclosure and instruction control

• Logging of sign-ins, password changes, invitations and administrative operations in the identity service.
• Logging of every provisioning, change and deletion of an environment in the orchestrator (request, approval, change of settings, invitations, stop, export, deletion); invited people are recorded there only by their internal identifier, not by their e-mail address.
• Retention of log data: access logs of the reverse proxy 14 days, sign-in and administration events of the identity service 90 days, the platform's own administration log of an environment's lifecycle 90 days, enforced by a daily deletion run, container logs until rotation, at most 14 days.
• A second store of IP addresses besides the access log: the block list of the HTTP-level ban layer is kept in its own database on the server (/var/lib/fail2ban/fail2ban.sqlite3) and holds the blocked IP address with a timestamp. It is retained for the duration of the block and removed afterwards.
• Retention of push data: a subscription is deleted when the installed app has not confirmed it for 30 days, when the push service reports it as invalid, when the user signs out on the device, when the login is detached from the person or the person is deleted, and with the environment. A notification queued for delivery is deleted once it has been delivered or dropped, at the latest after 7 days.
• Retention of join data: a plan's join link is deleted when the planner switches it off, and with the plan. A device's connection is deleted when the person chooses “Das bin nicht ich” (that's not me) on the device, when the planner ends it, when the person is deleted, and with the environment.
• No disclosure of data to third parties other than the sub-processors named in annex 3, section A and, for push notifications that have been switched on, in encrypted form to the push services named in annex 3, section B.
• The application opens outgoing connections for push notifications only over HTTPS and only to the addresses of the push services named in annex 3, section B; it does not accept subscriptions with any other delivery address. The push service holds a notification for delivery for at most 24 hours.
• Data is transferred only in encrypted form; internal connections between the services run in container networks that are not publicly reachable.
• Sub-processors are selected after a due diligence check, with agreements under Art. 28 GDPR.

Availability and resilience

• Redundancy at infrastructure level according to the provider's standard (power, cooling, network connectivity).
• Backup of the platform components: daily backup of the identity service's database, kept for 14 days; server backups at the provider.
• No backup of the content of the customer environments (see section 10); instead an export available to the customer at any time.
• Resource limits per environment, a limit on the number of environments per server, a limit on the log size per container.
• Protection against overload and abuse: rate limits on the registration and sign-in addresses and on the join link's addresses reachable without signing in, counted there per IP address in the application's memory only, IP block lists at HTTP level as well, brute-force detection in the identity service, an emergency switch for provisioning.
• A ban layer at HTTP level, to defend the sign-in and registration pages against automated attacks: fail2ban evaluates the reverse proxy's access log named above; no new categories of data are collected for it. If an IP address exceeds a threshold of failed or rate-limited requests, it is refused at network level for a limited time. IP addresses are not compared against an external reputation database (such as CrowdSec) and are not passed to any third party.
• Software is updated by rolling out new, versioned images; a return to the previous version is provided for.

Procedures for review, assessment and evaluation

• A data protection officer is appointed; a record of processing activities is maintained.
• A process for handling security incidents with notification under section 7.
• Review of the recoverability of the platform components: at least once a year and after material changes to the platform, a backup of the identity service's database is restored into a fresh environment and the sign-in is verified.
• Review of administrative permissions and of third-party software for available security updates: at least once a year and after material changes to the platform. Security updates for the operating system are applied automatically and continuously.

A. Sub-processors

No further sub-processors are used. In particular no captcha service, no third-party content delivery network and no service that sends push notifications on OptWare's behalf is used; OptWare operates the container management (Portainer) itself on its own infrastructure at Hetzner Online GmbH in Germany, see annex 2.

B. Push services of the devices — not sub-processors (section 5.5)

Where a user has switched push notifications on in the installed app, the application delivers them through the push service that the browser or operating system of their device prescribes. These are:

Which service is responsible is determined by the browser or operating system of the device alone. The push service receives: the delivery address it assigned to the device itself; the notification encrypted under RFC 8291, its size and its time; the delivery parameters (held for at most 24 hours, normal urgency, and a random identifier of the plan with which a later notification replaces one not yet delivered); the application's access token with its public key and a contact address of OptWare; the IP address of the server. It cannot read the content of the notification. The push services may process data outside the EU or the EEA as well.

OptWare keeps the current list on this page. Changes are also communicated in accordance with section 5.2.

Questions about this: info@optware.de