OKConsent · version 216149e79c214483

DRAFT – do not publish – pending legal review (TAS-793)

Draft of 2026-10-28 for TAS-792. English translation of ../de/avv.md. OKConsent processes data of visitors to its customers' websites (consent records, script delivery, scans) on behalf of the customers; OKConsent is the processor. Legal basis: Art. 28 GDPR, Art. 32 GDPR. Annexes: Annex 2: TOMs, Annex 3: Subprocessors. Open questions: open-questions.md.

Data Processing Agreement (DPA)

between the Customer (the "Controller") and Dipl.-Ing. Samir Alibabic – Online Marketing (sole proprietorship), Klugstraße 99, 80637 München, Germany (the "Processor" or "OKConsent").

It forms part of the contract of use under the Terms (the "Main Contract") and is concluded with it. [How the DPA comes into being (acceptance at registration, confirmation in the dashboard) is to be decided, see open-questions.md.]

§ 1 Subject matter, duration

1. The Processor processes personal data on behalf of the Controller to the extent the Controller uses the OKConsent service for its websites. The subject matter, nature and purpose of the processing, the types of data and the categories of data subjects are in Annex 1 (at the end of this agreement).
2. The duration corresponds to the term of the Main Contract. The duties of deletion and confidentiality continue as long as the Processor still holds data of the Controller.
3. Delimitation. This agreement does not cover data that the Processor processes as a controller in its own right, in particular account data of the Customer's users (email address, display name, sign-in data), billing and payment data, and logs for the security of the service. The privacy policy applies to those.
4. This agreement applies to Customers who are controllers within the meaning of the GDPR for the processing of their website visitors' data. Where a Customer processes data exclusively for personal or household purposes (Art. 2(2)(c) GDPR), the GDPR does not apply to them; the agreement then does no harm.

§ 2 Instructions

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in that case it informs the Controller of that legal requirement beforehand, unless the law prohibits this (Art. 28(3)(a) GDPR).
2. Instructions are the Main Contract, this agreement and the settings the Controller makes in the dashboard, through the API, the command-line tool or the MCP server (for example switching consent records on or off and setting the retention). The Controller gives further instructions in text form.
3. The Processor informs the Controller without delay if it believes an instruction infringes the GDPR or other data protection provisions (Art. 28(3) last subparagraph GDPR). It may suspend carrying out the instruction until the Controller confirms or changes it.

§ 3 Confidentiality

The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). [At present only the operator processes data on behalf; provide for a written undertaking if others are involved.]

§ 4 Technical and organisational measures

1. The Processor takes the technical and organisational measures described in Annex 2 (Art. 28(3)(c), Art. 32 GDPR).
2. The measures may be adapted to technical progress as long as the level of protection is not reduced. The Processor documents material changes and provides the current version on request.

§ 5 Subprocessors

1. The Controller gives the Processor general authorisation to use the subprocessors named in Annex 3 (Art. 28(2) GDPR).
2. The Processor informs the Controller at least 30 days in advance in text form (email to the organization's owners) of any intended addition or replacement of a subprocessor. The Controller may object within 14 days for an important data protection reason. If it objects, the parties look for a solution. If none is found, the Controller may terminate the Main Contract as of the time of use, where the service cannot be provided without the subprocessor; a pro-rata refund for consumers follows the cancellation terms, and for businesses the unused part of the paid licence year is refunded pro rata.
3. The Processor imposes on every subprocessor by contract the same data protection duties as in this agreement (Art. 28(4) GDPR) and is liable to the Controller for its performance.

§ 6 Processing outside the EU and the EEA

1. Hosting, database and backups are in the European Union (Annex 1, no. 5). The CDN serves from Europe only; no transfer to nodes outside the EU takes place for the CDN.
2. A transfer to a third country takes place only if the conditions of Art. 44 et seq. GDPR are met (adequacy decision, standard contractual clauses or another safeguard), and only within Annex 3.

§ 7 Assistance with data subjects' rights

1. The Processor assists the Controller by appropriate technical and organisational measures, as far as possible, in meeting data subjects' rights (Arts. 12 to 22 GDPR) (Art. 28(3)(e) GDPR). In particular it provides the CSV export of consent records and the deletion of sites.
2. If a data subject contacts the Processor directly, it forwards the request to the Controller without delay and does not answer itself unless instructed.
3. Matching to persons. Consent records contain a random consent ID but no IP address and no name. The Processor therefore cannot readily match a record to a person (Art. 11 GDPR). A data subject can be found only through the ID that their browser stored on the Controller's website.

§ 8 Assistance with obligations under Arts. 32 to 36 GDPR

1. The Processor assists the Controller with security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority (Art. 28(3)(f) GDPR).
2. The Processor notifies the Controller of a personal data breach affecting it or its subprocessors without undue delay, as a rule within 48 hours of becoming aware (Art. 33(2) GDPR), with the information known to it under Art. 33(3) GDPR, as far as available. The notification goes to the email addresses of the organization's owners.

§ 9 Deletion and return

1. Consent records of the Controller's sites are deleted automatically after the configured retention (Annex 1, no. 4).
2. If the Controller deletes a site, the site's data is deleted; backup copies expire after 35 days at most (Annex 2). Deleting a whole organization is done by hand at launch, on request by email.
3. When a paid licence ends, § 7(3) of the Terms applies to records beyond the free plan (hidden and exportable for 30 days, then deleted).
4. Before the end the Controller can export its data itself (CSV). No further return takes place.
5. The Processor's statutory retention duties are unaffected.

§ 10 Evidence and audits

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28(3)(h) GDPR). These annexes, the description of the measures and, where available, current certificates and audit reports of the subprocessors serve this purpose first.
2. The Controller may carry out, or allow, audits, including inspections, by itself or by an auditor it mandates who is bound to confidentiality. The Processor contributes to them. They must be announced at least 14 days in advance, take place during normal business hours, must not unreasonably disrupt operations and are, as a rule, limited to once a year unless an incident gives cause. The Controller bears the costs unless the audit reveals a breach.

§ 11 Controller's obligations

1. The Controller is responsible towards data subjects for the lawfulness of the processing, in particular the legal basis, information duties (its website's privacy policy) and the decision whether and for how long consent records are kept.
2. It informs the Processor without delay if it finds errors or irregularities in the processing.
3. It ensures it may control the domains it creates in the service (§ 8(1) of the Terms).

§ 12 Liability

Art. 82 GDPR and, between the parties, the liability rules of the Main Contract (§ 13 of the Terms) apply. [Check whether the limitation of liability in the Main Contract can be effective for data protection infringements between the parties.]

§ 13 Final provisions

1. This agreement may be concluded in electronic form (Art. 28(9) GDPR).
2. In case of conflict between this agreement and the Main Contract, this agreement prevails on matters of data protection.
3. German law applies. Place of jurisdiction and choice of law follow § 15 of the Terms.
4. If individual provisions are invalid, the rest of the agreement remains valid.

Annex 1: Description of the processing

1. Subject matter and purpose

The Processor operates the hosted OKConsent service. It processes personal data in order, for the Controller,

• to manage visitors' consent on its websites and, on request, to prove it (consent records);
• to deliver the consent script and its rules through a content delivery network;
• to scan and verify the Controller's websites;
• to generate legal texts from the Controller's details.

2. Types of personal data

3. Categories of data subjects

• visitors to the Controller's websites;
• natural persons whose contact details the Controller enters in the details for legal texts (for example authorised representatives, data protection officers);
• persons whose details incidentally appear on public pages that the scanner visits.

4. Deletion periods

5. Places of processing

6. Contact

Data protection questions: support@okconsent.com. The Processor has not appointed a data protection officer.

DRAFT – do not publish – pending legal review (TAS-793)

Draft of 2026-10-28 for TAS-792. English translation of ../de/avv-anlage-2-toms.md. Sources: docs/security-review.md, docs/architecture.md, docs/operations.md, docs/deployment.md, deploy/postgres, docs/specs/saas.md. Nothing is in production yet. The "Status" column therefore says what is built and tested in the software (Software), what operations must set up at go-live and has not set up yet (Operations, planned), and what is still to be clarified (to confirm). Before publication, every "Operations, planned" and "to confirm" row must be checked against the running environment.

Annex 2 to the DPA: Technical and organisational measures (Art. 32 GDPR)

As of: [date] · Version [1.0]

1. Confidentiality

1.1 Physical access control

1.2 System access control

1.3 Access control (permissions)

1.4 Separation control

1.5 Pseudonymisation and data minimisation

2. Integrity

2.1 Transfer control

2.2 Input control

3. Availability and resilience

4. Regular review, assessment and evaluation

5. Data protection by design and by default

6. Order control

7. Organisational measures

DRAFT – do not publish – pending legal review (TAS-793)

Draft of 2026-10-28 for TAS-792. English translation of ../de/avv-anlage-3-unterauftragsverarbeiter.md. Sources: docs/operations.md, docs/architecture.md, docs/decisions.md. Nothing is in production yet: the service is not deployed; according to operations.md accounts exist at Scaleway and Bunny, and contracts and data processing agreements still have to be checked. The list describes what the decisions provide for; check it against the actual contracts before publication. Open questions: open-questions.md.

Annex 3 to the DPA: Subprocessors

As of: [date]

Part A: Subprocessors

These providers process personal data on behalf of the Processor. The Controller authorises them under § 5 of the DPA.

Part B: Other services that do not process the Controller's visitor data

These providers are not subprocessors for data under Annex 1. They are named for transparency.

Part C: Under review (not used yet or still to be clarified)

Changes

We announce additions and replacements of subprocessors under § 5 of the DPA.