Data processing agreement (Art. 28 GDPR)

This English translation is provided for convenience only. Only the German version is legally binding; in case of any discrepancy, the German version prevails.

As of: 12 October 2026

This agreement applies between the customer of CBAMfix (“controller”) and GambTec, owner Toni Gambino, Meldenweg 18, 12357 Berlin, Germany (“processor”). It forms part of the user agreement and is concluded upon registration. We will send a signed version on request.

1. Subject matter and duration

The processor operates the CBAMfix application and in doing so processes personal data on behalf of the controller. The agreement runs for as long as the user agreement.

2. Nature, purpose, data and data subjects

• Purpose: recording and evaluating imports for the Carbon Border Adjustment Mechanism (CBAM), reading uploaded import documents, monitoring the quantity threshold, notifications.
• Data subjects: employees of the controller who have access; contact persons at suppliers, forwarders and customs agencies, insofar as they are named on documents.
• Documents: uploaded files (customs notices, customs declarations, invoices) with the information they contain, such as names, addresses and contact details of contact persons.
• Import data: date, CN code, description, net mass, country of origin, supplier, registration number of the customs declaration, notes.
• Employee accounts: name, e-mail address, password as a hash, time of last login.

3. Instructions

The processor processes the data only on documented instructions from the controller. This agreement and the settings the controller makes in the application are deemed instructions. If the processor considers an instruction to be unlawful, it will point this out.

4. Obligations of the processor

• Persons with access to the data are bound to confidentiality.
• It takes the technical and organisational measures set out in Annex 1 and keeps them state of the art.
• It supports the controller within reasonable limits with requests from data subjects (access, rectification, erasure) and with notification obligations and data protection impact assessments.
• It reports personal data breaches without undue delay after becoming aware of them, by e-mail to the owner's registered address.
• If a data subject contacts the processor directly, it forwards the request to the controller.

5. Sub-processors

The controller consents to the sub-processors listed in Annex 2. The processor announces new or replaced sub-processors by e-mail at least four weeks in advance. The controller may object for good cause; if no solution can be found, it may terminate the user agreement with effect from the date of the change. Sub-processors are contractually bound to an equivalent level of protection.

6. Transfers to third countries

For reading, an uploaded document is transmitted to Anthropic, PBC (USA), based on the EU Standard Contractual Clauses. The content is not used there to train models. All other data remains in Germany.

7. Audit rights

On request, the processor demonstrates compliance with this agreement by providing appropriate information and documents. If these are not sufficient, the controller may carry out an audit itself or through an auditor bound to confidentiality, after giving reasonable notice, at most once a year and without disproportionately disrupting operations.

8. Deletion and return

After the end of the contract, the processor deletes the data processed on behalf of the controller after 90 days at the latest, earlier on request, unless there is a statutory obligation to retain it. Backups are overwritten on a rolling basis. The controller can export import data as a CSV file beforehand.

9. Liability

The liability provisions of the terms and conditions apply; Art. 82 GDPR remains unaffected.

Annex 1 – Technical and organisational measures

• Location: servers of Hetzner Online GmbH in data centres in Germany.
• Physical and system access: data centre with access control by the operator. Access to the server only for the owner, only with a personal key; firewall, only the necessary services reachable from outside; automatic blocking of suspicious access; daily security check with reporting.
• Access within the application: personal accounts, passwords only as a hash, two-factor login (authenticator app) and passkeys available, roles (owner and employee), revocable sessions, limitation of failed attempts.
• Separation: each customer's data is assigned to its organisation; every query is restricted to the customer's own organisation.
• Encryption: transmission exclusively via TLS. Two-factor login secrets are stored encrypted (AES-256-GCM) in the database. Documents are stored outside the public web area and are only delivered to logged-in users of the respective customer.
• Availability: daily data backup, encrypted and additionally stored outside the server; operational monitoring.
• Deletion: the controller can delete documents and imports itself at any time; deletion of all data after the end of the contract.
• Maintenance: regular security updates of the operating system and application; changes to the application are versioned and deployed in a traceable manner.

Annex 2 – Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen – server and storage for the encrypted backups (Germany).
• Strato AG, Otto-Ostrowski-Str. 7, 10249 Berlin – e-mail delivery (notifications, invitations, password links).
• Anthropic, PBC, San Francisco, USA – reading uploaded documents (EU Standard Contractual Clauses; no use for training).

The payment service Stripe is not a sub-processor; the controller has its own contract with Stripe for payment.