↓
Data Processing Agreement (DPA)
Art. 28 GDPR, with annexes on data categories, TOMs, sub-processors and the revocable approval for product improvement (§ 11).
PDF ↓ Processing on behalf
Data processing cleanly documented.
This page provides a traceable basis under Art. 28 GDPR. It does not replace a data processing agreement or a privacy assessment of the specific hosting plan.
Contract documents
DPA and Terms for download.
The contractual basis for using myERP24 as PDF.
↓
General Terms and Conditions
SaaS software provision: availability, rights of use, data export, GoBD responsibility, liability, term.
PDF ↓i
Note
Drafts for legal review. Convenience translations – the signed or in-app accepted German version is binding.
Note: This translation is provided for convenience. Only the German version is legally binding. Deutsch →
1. Subject of processing
Technical operation of the myERP24 application for the respective tenant and of the static product website, including delivery of HTML, CSS, JavaScript, image and SVG files and the technically necessary server communication.
2. Categories of data
- Technical connection and log data in the course of hosting
- The tenant's master, case and posting data in the application
- Contact and company data from demo or pilot requests
- No production data of the application on the marketing web space
3. Data subjects
Visitors, prospects, contacts of the tenant's customers and suppliers, the tenant's employees and technical users.
4. Sub-processors and third-country transfer
[Add current sub-processors, data centre locations, third-country transfers and safeguards from the contract documents.] AI processing takes place exclusively via the riebotec AI API in the EU.
5. Deletion and return
After the end of the contract, data is exported, returned or deleted within the agreed periods; documents subject to retention remain exportable. Responsibility and evidence are documented.
Roles involved
| Role | Details |
|---|---|
| Controller | The respective tenant (customer) or, for the website: riebotec UG (haftungsbeschränkt) |
| Processor | riebotec UG (haftungsbeschränkt), Wuppertal, Germany |
| Hosting sub-processor | [Data centre in Germany, company and address] |
| Contractual basis | [DPA version, date, reference] |
| Privacy contact | anfragen@myerp24.de |
Technical and organisational measures
| Area | Measure |
|---|---|
| Transmission | HTTPS; certificate status and renewal monitored |
| Access | Role matrix, server-side enforcement, individual accounts, MFA where available |
| Encryption | Data vault AES-256-GCM, key rotation, access log |
| Changes | Versioning, review and backup before every release |
| Backups | Purpose, location, access and deletion period documented |
| Incident response | Contact channel, assessment and notification process (Art. 33 GDPR) defined |
Release check
- Hosting plan and DPA reviewed
- Privacy page reconciled with actual operation
- Contact, backup and incident process named
- No production data in the marketing web root
- Release by operator/privacy lead documented