DE EN
GDPR Art. 28 · Standard contract

Data Processing Agreement

Version: 2026-05-11 ·
Quick info: If you use UpdateKing to manage Joomla sites of end customers (e.g. as an agency), GDPR Art. 28 requires a Data Processing Agreement between you (the controller) and us (the processor). This document is the standard contract — print it, sign both copies, send one to us and keep the other.

§ 1 Subject Matter and Duration

(1) The subject of this contract is the processing of personal data by the processor (Odenwald-IT-Service UG, hereinafter "Processor") on behalf of the controller (hereinafter "Controller") within the scope of the UpdateKing.de service.

(2) The term of this contract corresponds to the term of the main contract (UpdateKing subscription). It ends automatically upon termination of the main contract.

§ 2 Nature and Purpose of Data Processing

(1) The Processor processes personal data on behalf of the Controller solely for the purpose of providing the UpdateKing service: centralized Joomla update management, uptime monitoring, site screenshots, update reports via email, audit logging.

(2) Processing for other purposes (e.g. profiling, advertising, sale to third parties) does not occur.

§ 3 Type of Personal Data and Categories of Data Subjects

(1) The following data categories are processed: Controller's data (name, email, company, billing address, IP, user agent), Joomla site metadata (URL, versions, installed extensions, update status), audit data (login times, triggered updates, IPs for security-relevant actions).

(2) Not processed: contents of the Controller's Joomla database, FTP/SSH/DB credentials. Communication is exclusively via the UpdateKing plugin using signed HTTPS API.

§ 4 Obligations of the Processor

The Processor commits to: processing personal data only on documented instructions; ensuring confidentiality of all authorized personnel; implementing appropriate TOMs per Art. 32 GDPR; immediate notification of data breaches; deletion or return of data after contract termination (excepting legal retention obligations).

§ 5 Sub-Processors

The Processor is authorized to engage the following sub-processors: Mittwald CM Service GmbH & Co. KG (hosting, Germany), PayPal Europe (payment processing, Luxembourg). Changes are announced at least 30 days in advance; the Controller has a right of objection.

§ 6 Rights of Data Subjects

The Processor supports the Controller in fulfilling data subject rights (access, rectification, erasure, portability, objection) and forwards related requests received directly.

§ 7 Technical and Organizational Measures

See German version § 7 for complete TOM specification (access control, encryption, audit logging, backups, availability targets).

§ 8 Audit Rights

The Controller has the right to audit compliance. On-site audits require at least 14 days notice and must occur during business hours.

§ 9 Data Breach Notification

The Processor reports any personal data breach immediately, no later than 24 hours after becoming aware, via email to the address registered in the account.

§ 10 Final Provisions

(1) In case of conflict, this DPA takes precedence over the main contract regarding personal data processing.

(2) German law applies. Place of jurisdiction is the Processor's registered office where legally permissible.

Signatures

Processor:

Odenwald-IT-Service UG (haftungsbeschränkt)
Andre Lehner, Managing Director
info@updateking.de

Place, Date (Controller)
Signature Controller

How to conclude the DPA

  1. Click "Print / Save as PDF" at the top of this page
  2. Fill in your company name, place, date and sign on the signature page
  3. Scan and email the signed copy to info@updateking.de – we countersign and return the final version
  4. Keep the countersigned copy for your records (10 years retention recommended)

See also: Privacy Policy · Terms · Imprint