For consumer (B2C) use of WTFB, KROMA UG (haftungsbeschränkt) acts as the data controller for your account, payment, and report data. A separate Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag) is normally not required in that case — see our Privacy Policy and Subprocessors list instead.
When a DPA is needed
A DPA / AVV is required when a business customer uses WTFB to process personal data on behalf of its own end users — for example, when a company connects internal tools, uploads customer data into a private project, or runs structured testing of products that contain third-party personal data. In that scenario KROMA UG (haftungsbeschränkt) acts as a processor under GDPR Art. 28.
What our DPA covers
- Subject matter, duration, nature and purpose of processing.
- Categories of data subjects and personal data.
- Controller / processor responsibilities and instructions.
- Current subprocessor list and change-notification process (see Subprocessors).
- Technical and organisational measures (TOMs), incl. encryption in transit, access controls, and audit logging.
- Assistance with data-subject requests, breach notification, DPIAs, and deletion / return on termination.
- International-transfer safeguards (Standard Contractual Clauses) where applicable.
How to request the DPA
Email [email protected] from a verifiable business address with: legal entity name, registered address, signatory, the WTFB product / workspace name, and a short description of the data you intend to process. We will return the current AVV template for review and signature.
Final wording is subject to legal review before signature. This page summarises scope; it is not itself an agreement.