Data processing agreement (Art. 28 GDPR)
This translation is provided for information only. Only the German version is legally binding.
Agreement pursuant to Art. 28 GDPR between the firm that uses Crewtender (“controller”) and Benjamin Schiffer, WP Digital Ranger (“processor”). It applies upon use of Crewtender. Version of 03.11.2026.
1. Subject matter
The processor operates the Crewtender software for the controller in accordance with the terms of use: tender search and evaluation, bids, personnel management, deployment planning, time recording, invoicing, applicant management, customer management with customer portal, patrols and guard book as well as team chat. Duration: as long as Crewtender is used.
2. Type of data and data subjects
- Data: names, contact details and roles of users; firm and location data, notes and processing statuses; uploaded tender documents (possibly containing contact details of contact persons at contracting authorities); personnel data (master data, trades, qualifications and certificates with expiry date, pay grade and hourly wage, absences without reason, shifts, timesheets, clock-in times with “at the place of work yes/no”, expenses, safety briefings, protective equipment, ratings by customers, signatures, temporary agency assignments under the AÜG); applicant data; customers and places of work; invoices and receipts; patrol scans and guard book entries; chat messages. Special categories (Art. 9 GDPR) and criminal record data (Art. 10 GDPR) are not to be entered; for certificates of good conduct and health certificates Crewtender stores only the date of inspection.
- Data subjects: employees, temporary agency workers and applicants of the controller, users, customers and their contact persons, contact persons at contracting authorities and partner firms.
- Purpose: searching for, rating and evaluating tenders, preparing bids, personnel and deployment planning, time recording, invoicing and collaboration in the team.
3. Obligations of the processor
- It processes the data only on documented instructions from the controller; use of the functions of Crewtender counts as an instruction. If it considers an instruction to be unlawful, it informs the controller without delay (Art. 28(3), second subparagraph, GDPR).
- Persons with access are bound to confidentiality.
- It takes the technical and organisational measures set out in section 6.
- It assists the controller with requests from data subjects and with the obligations under Art. 32 to 36 GDPR.
- It reports personal data breaches without delay, if possible within 24 hours.
- After the end of the engagement it deletes the data within 30 days or, on request, hands it over beforehand in common formats (CSV, Excel, Word, XRechnung, original files); it disappears from the encrypted backups after one year at the latest.
- It provides all information necessary to demonstrate compliance with these obligations and allows audits after prior notice.
4. Sub-processors
The controller approves these sub-processors. The processor contractually binds them to the same data protection obligations (Art. 28(4) GDPR). It informs the controller of new ones in advance by email; the controller may object for good cause within 14 days.
| Service provider | Purpose | Basis for the transfer |
|---|---|---|
| Cloudflare, Inc., San Francisco (USA) | Operation of the website, storage of uploaded documents (data centres in the EU), conversion of files into text | EU-US Data Privacy Framework, standard contractual clauses |
| Supabase, Inc., San Francisco (USA) | Sign-in and database (firms, members, tenders); servers in Frankfurt am Main | Standard contractual clauses |
| Anthropic, PBC, San Francisco (USA) | AI model Claude: reads tender notices and uploaded tender documents, creates firms' search profiles with a limited web search (firm name, website text, registered office), reads photos of receipts (amount, date, supplier), expiry dates on company certificates and lots from fact sheets, and writes ratings and fact sheets. No data from the personnel file. According to the provider, API data is not used for training and is stored only for a limited time | Standard contractual clauses |
| Namecheap, Inc., Phoenix (USA) | Mailbox kontakt@wpdigitalranger.com: sign-in links, invitations and messages | Standard contractual clauses |
| GitHub, Inc. (Microsoft), San Francisco (USA) | Daily evaluation of public tenders against the firms' search profiles; nightly encrypted backup | EU-US Data Privacy Framework, standard contractual clauses |
5. Third countries
Transfers to the USA take place only on the basis of the guarantees stated in the table (Art. 44 et seq. GDPR).
6. Technical and organisational measures
- Encrypted transmission (HTTPS), storage of documents in data centres in the EU.
- Sign-in with a password (stored only in encrypted form, at least 8 characters) or via an email link; session cookies only over HTTPS and not readable by scripts.
- Rights at database level: everyone sees only the data of their own firm and their own areas.
- Uploaded documents are deleted automatically after 30 days.
- Change log: changes to staff, locations, access and tenders are recorded with person and time, are visible only to owners and are deleted after 12 months.
- Access to the service providers is restricted to the processor and protected by strong authentication.
- Nightly encrypted backup of the database (AES-256) in Cloudflare storage with data centres in the EU; daily backups 14 days, monthly backups one year.
7. Final provisions
In the event of contradictions, this agreement takes precedence over the terms of use insofar as data protection is concerned. Anyone who needs a signed agreement can write to kontakt@wpdigitalranger.com.
WP Digital Ranger · 🌐 Deutsch · Français · Polski · Español · Italiano · Legal notice · Help · Contact · Privacy · Terms of use · Data processing agreement