privacy

Data protection

(1) The parties shall comply with all applicable data protection regulations. For the purpose of this contract, it is agreed that if stick's GbR obtains access to the personal data of the Principal (including the Ordering Party), stick's GbR shall be a processor pursuant to Art. 4 No. 8, Art. 28 DSGVO. As a processor, stick's GbR will process the personal data of the Principal that is necessarily relevant for the performance of the contractual relationship. In this relationship, the client is then the responsible party within the meaning of Art. 4 No. 7, 24 DSGVO.

(2) To the extent required by law, the parties shall enter into a separate order processing agreement ("AVV") in accordance with Art. 28 DSGVO. In this context, stick's GbR shall also indicate to the Principal whether and to what extent stick's GbR in turn uses third parties in the context of subcontracting the processing of personal data of the Principal and shall name these third parties accordingly to the Principal. In the event of such subcontracting of third parties, stick's GbR shall ensure that corresponding GPCs have also been concluded with these third parties and shall ultimately assure the Client of compliance with at least equivalent data protection standards in accordance with the GDPR in any case of subcontracting.

(3) The Parties shall take appropriate precautions to prevent unnecessary access to or transfer of personal data to the other Party, including to authorized third parties. For this purpose, the parties shall reduce the use to an absolutely necessary minimum (principle of data minimization).

(4) Within the scope of all data processing, stick's GbR guarantees the implementation of appropriate technical and organizational measures in its organization and the organization of third parties used by the Contractor to fulfill its contractual obligations. So that, in particular, sensitive information (personal data, business secrets, financial information, etc.) received from the Client is adequately protected from access by unauthorized third parties. In particular, consideration shall be given to encrypting sensitive information to an appropriate extent.