Data Processing Agreement
Last updated: November 1, 2026
under Art. 28 GDPR between the customer (controller) and Daniel Michael Andreas Hösele, MSc, BSc, trading as “revamped”, Ungerdorf 161, 8200 Gleisdorf, Austria (processor). It is part of the Terms and Conditions and applies once they are accepted.
1. Subject matter and duration
We operate the customer’s website and, in doing so, process personal data of visitors to their website on their behalf. This agreement applies for the term of the main contract.
2. Nature, purpose and data concerned
| Processing | Data | Data subjects |
|---|---|---|
| Delivering the website (hosting) | IP address, time, page requested, browser (technical logs) | Visitors to the website |
| Contact form (if booked) | Name, email address or phone number, message; delivery status and hashed IP address (seven days) | People who use the form |
| Visitor statistics (if booked) | Page views, referring page, country – without cookies and without personal reference | Visitors to the website |
| Website content | Personal data the customer shows on their website (e.g. names of employees, reviews) | People named by the customer |
3. Obligations of the processor
- We process the data only on the customer’s documented instructions; the functions of the booked services count as instructions.
- People with access to the data are bound to confidentiality.
- We take appropriate technical and organizational measures (Art. 32 GDPR), in particular: encrypted transmission (TLS), access only for authorized people with strong authentication, separation of different customers’ data in the database, regular backups, data minimization (form messages are not stored, IP addresses are hashed, short deletion periods).
- We support the customer with requests from data subjects, with reporting personal data breaches and with data protection impact assessments, and we notify the customer of any breach affecting their data without undue delay.
- When the contract ends, we delete or return the data unless a statutory retention obligation applies.
- We provide the customer with the information needed to demonstrate compliance with these obligations and allow audits after prior arrangement.
4. Sub-processors
The customer agrees to the use of the following sub-processors. We announce new or changed sub-processors by email at least 30 days in advance; the customer may object for an important reason relating to data protection and, in that case, terminate the contract. We have concluded a contract with each sub-processor that imposes equivalent data protection obligations.
| Provider | Location | Purpose | Basis for transfer |
|---|---|---|---|
| Internet Group AG | Widnau, Switzerland | Servers and database (accounts, website content, versions, billing status); visitor statistics (Umami, without cookies) | Switzerland: adequacy decision of the European Commission |
| Vercel Inc. | San Francisco, USA | Hosting of this website and the customer area; hosting of some customer websites | EU-US Data Privacy Framework or EU Standard Contractual Clauses |
| Cloudflare, Inc. | San Francisco, USA | Hosting of customer websites, bot protection (Turnstile), cookieless visitor statistics | EU-US Data Privacy Framework or EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | San Francisco, USA | Error reports from this website, the customer area and our servers (without IP address, cookies or content); stored in the EU (Frankfurt) | EU-US Data Privacy Framework or EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Dublin, Ireland | Payment processing, subscriptions, invoices and VAT | EU; onward transfer to Stripe, Inc. (USA) under the EU-US Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | San Francisco, USA | Sending emails (login codes, notifications, messages from contact forms) | EU Standard Contractual Clauses |
| Anthropic, PBC | San Francisco, USA | AI processing: designing and revising websites, translations, change requests | EU Standard Contractual Clauses; data not used for training |
| OpenAI, L.L.C. / OpenAI Ireland Ltd. | San Francisco, USA / Dublin, Ireland | AI processing (as above), when this provider is used | EU-US Data Privacy Framework or EU Standard Contractual Clauses; data not used for training |
5. Contact
The customer sends questions about data protection and instructions to hello@revamped.tech.