Agreement under Article 28 GDPR · Version 2026-07. The German version is legally authoritative. This translation forms part of the organisation contract only together with the authoritative German text.
between the organisation identified in the offer (“controller” or “customer”) and PrismaWorks, proprietor Fabien Sombrofsky, Braune-Moor-Str. 1b, 49844 Bawinkel, Germany (“processor” or “contractor”).
The processor handles personal data for the controller where Equinora is used for club, stable, member, boarder, communication or finance administration. Subject matter, scope and duration follow the organisation contract, booked functions and this DPA. Processing normally lasts for the licence term plus an agreed export and deletion period.
The purpose is technical provision of Equinora on behalf of the controller. Data may include master and contact details, memberships, roles, contracts, applications, bookings, tasks, communications, horse and boarder assignments, fees, invoices, payments, reminders, accounting records, SEPA mandates and bank details, documents, images, notes, audit and security data.
Data subjects may include members, applicants, boarders, horse owners, guardians, board members, staff, helpers, contacts, payers and other users. Article 9 special-category data is not a regular purpose and may be entered only where necessary, lawful and intended for the specific function.
Data is processed only on documented instructions unless processing is required by law. The contract, this DPA, settings and actions of authorised administrators and instructions in text form are documented instructions. The processor informs the controller if it considers an instruction unlawful and may suspend it pending clarification.
The controller remains responsible for lawfulness, transparency, accuracy, consents and mandates and an appropriate permission concept. Access must be limited to authorised people, two-factor protection enabled according to risk and access removed promptly when responsibilities end.
The controller gives general authorisation for Annex 2. Material intended changes are normally announced at least 30 days in advance. The controller may object for an objective data-protection reason. If no reasonable solution is available, the affected service may be terminated. Sub-processors are contractually bound to comparable protection and the processor remains responsible for them.
Processing outside the EEA takes place only under Articles 44 et seq. GDPR, for example an adequacy decision, EU Standard Contractual Clauses or an applicable derogation. Regional statements concern configurable core services; authentication, support, security or metadata may be processed elsewhere under the provider terms.
The processor provides information needed to demonstrate compliance. With reasonable notice, the controller may audit once a year and additionally for justified cause, itself or through a confidential auditor. Audits must be proportionate, protect other customers and preferentially use existing evidence. Disproportionate additional effort may be charged after prior agreement.
Commissioned data is corrected, deleted or restricted on documented instruction where the controller cannot do so using the service. Available exports may be used during the announced transition period after termination. Data is then deleted or returned unless law requires retention. Backups are overwritten in the normal cycle and remain restricted until then.
The general portal help assistant and AI text suggestions are currently disabled; no data is currently sent to DeepSeek. Any later reactivation or future AI processing of personal commissioned data requires a renewed privacy review and, where necessary, a separate agreement, documented instruction and a provider and transfer framework compliant with Articles 28 and 44 et seq. GDPR.
Article 82 GDPR and the organisation contract apply. This DPA prevails for processing-on-behalf matters. Mandatory data-protection law remains unaffected.
The DPA may be concluded electronically; offer, order confirmation, organisation ID, accepted version and timestamp may serve as evidence. Changes to Article 28 duties are agreed in text form. Purely technical annexes may be updated if protection is not reduced and the controller is informed.
Currently not used: The API service of Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China, is technically disabled for AI help and generic text suggestions and currently receives no data. The requirements in section 10 apply before any reactivation.