Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR
Controller (Client): the respective customer (name, address, email).
Processor: Noor Aldeen Wisam Kareem, trading as Operos, Otto-Siffling-Straße 16, 68305 Mannheim, Germany, email: info@operos.de.
1. Subject Matter and Duration
This agreement governs the processing of personal data by the Processor on behalf of the Controller within the agreed services (in particular hosting, email, cloud storage, websites, time tracking, appointment booking and administration software). The duration corresponds to the term of the main contract.
2. Nature, Scope, Purpose and Means of Processing
The Processor processes personal data exclusively to provide the agreed services, for maintenance, to ensure availability and security and on documented instructions of the Controller. Processing takes place only to the extent necessary.
3. Categories of Data Subjects and Data
Data subjects may be employees, customers and other contacts of the Controller. Processed data includes in particular master data (name, contact details), access and usage data, communication data and content entered or uploaded by the Controller. Special categories of personal data are processed only where legally permissible and expressly agreed.
4. Obligations of the Processor
The Processor processes the data only on documented instructions of the Controller, complies with statutory data protection requirements, secures the data appropriately and supports the Controller in fulfilling data subject rights and in data protection impact assessments where required.
5. Instructions
Instructions of the Controller are given in text form (e.g. by email). If the Processor considers an instruction to violate data protection law, it informs the Controller without delay and may suspend execution until the instruction is confirmed or amended.
6. Confidentiality
The Processor commits itself and the persons it uses to confidentiality and ensures that processing is carried out only by authorized persons.
7. Technical and Organizational Measures (TOMs)
The Processor takes appropriate technical and organizational measures pursuant to Art. 32 GDPR, in particular encryption (TLS), access controls, logging of security-relevant events, data backups to the agreed extent and protection against unauthorized access. The measures are adapted to risks and technical developments.
8. Sub-processors
The Controller grants general authorization for the use of sub-processors. The Processor informs about intended changes so the Controller can object. Sub-processors are contractually bound to the same data protection obligations.
9. Support of the Controller
The Processor supports the Controller to a reasonable extent in fulfilling access, rectification, erasure, restriction and portability requests as well as in reporting data breaches.
10. Reporting of Data Breaches
The Processor reports breaches of the protection of personal data to the Controller without delay after becoming aware of them, so the Controller can fulfill any statutory reporting obligations.
11. Deletion and Return
After termination of the main contract, the Processor deletes or returns the data processed on behalf, unless statutory retention obligations or other lawful grounds conflict.
12. Audit Rights
The Controller has the right to verify compliance with the agreed data protection obligations to a reasonable extent, for example through information, evidence or, if necessary, joint reviews at reasonable effort.
13. Liability
The liability of the parties is governed by the main contract and statutory provisions, in particular Art. 82 GDPR. Liability under Art. 82 GDPR remains unaffected.
14. Final Provisions
German law applies. Should a provision be invalid, the remaining provisions remain valid; the statutory provisions take the place of the invalid provision.
Processor: Noor Aldeen Wisam Kareem, trading as Operos, Otto-Siffling-Straße 16, 68305 Mannheim, Germany
Contact: info@operos.de · Phone: +49 160 8309306
As of: October 2026