155 lines
4.6 KiB
Markdown
155 lines
4.6 KiB
Markdown
# Netcup DPA Annex 3 - Processing Specifications Guide
|
|
|
|
This guide helps you fill out Annex 3 of the Netcup Data Processing Agreement.
|
|
|
|
## Your Specific Situation
|
|
|
|
Based on your infrastructure:
|
|
- **Hosting Provider**: netcup GmbH (Germany)
|
|
- **CDN/Security**: Cloudflare
|
|
- **Newsletter**: Listmonk (self-hosted on Netcup)
|
|
- **Analytics**: Vercel Analytics
|
|
|
|
---
|
|
|
|
## Section 1: Subject (Nature & Purpose) of the Processing
|
|
|
|
**Recommended text to enter:**
|
|
|
|
```
|
|
Web hosting and delivery of websites and web applications. This includes:
|
|
- Serving static and dynamic web content to visitors
|
|
- Processing contact form submissions
|
|
- Managing newsletter subscriptions (via self-hosted Listmonk)
|
|
- Collecting anonymized website analytics
|
|
- Storing user-generated content where applicable
|
|
```
|
|
|
|
---
|
|
|
|
## Section 2: Duration of the Processing
|
|
|
|
This is automatically determined by your contract term with Netcup.
|
|
|
|
---
|
|
|
|
## Section 3: Location of the Processing
|
|
|
|
The location is determined by your Netcup server location. For your RS 8000 G12 Pro:
|
|
- **Primary Location**: Nuremberg, Germany (EU)
|
|
- **Additional Processing**: Via Cloudflare's global network (with EU data residency options)
|
|
|
|
---
|
|
|
|
## Section 4: Categories of Data Subjects
|
|
|
|
**Check the following boxes:**
|
|
|
|
- [x] **Customers** - if you have any e-commerce or client portals
|
|
- [x] **Interested parties** - potential customers visiting your sites
|
|
- [ ] **Suppliers** - only if you process supplier data
|
|
- [x] **Visitors to the website** - all website visitors
|
|
- [ ] **Employees of the Client** - only if you have employee data on the sites
|
|
- [ ] **External employees** - only if applicable
|
|
- [ ] **Data processors, other processors** - only if you subcontract
|
|
- [x] **Newsletter subscribers** - you use Listmonk
|
|
|
|
**Additional data subjects (if any):**
|
|
```
|
|
Event attendees (if you host events/conferences)
|
|
Community members (if you have user accounts)
|
|
```
|
|
|
|
---
|
|
|
|
## Section 5: Categories of Personal Data
|
|
|
|
**Check the following boxes:**
|
|
|
|
- [x] **Name data** - contact forms, newsletter signups
|
|
- [ ] **Date of birth** - only if you collect this
|
|
- [ ] **Bank and payment data** - only if you handle payments directly
|
|
- [ ] **Location and geographic information data** - only if you track location
|
|
- [ ] **Education data** - only if relevant to your sites
|
|
- [ ] **Traffic data** - only if you log detailed traffic
|
|
- [ ] **Data relevant to criminal law** - NO
|
|
- [x] **Contact and address data** - contact forms
|
|
- [ ] **Customer contract data** - only if you have customer portals
|
|
- [ ] **Login and authentication** - only if you have user accounts
|
|
- [ ] **Preference and behavior data** - only if you track preferences
|
|
- [ ] **Motion profile data** - NO
|
|
- [ ] **Photo, video, or audio data** - only if you store media
|
|
|
|
**Additional data types:**
|
|
```
|
|
Email addresses
|
|
IP addresses (anonymized for analytics)
|
|
Browser/device information (anonymized)
|
|
Cookie consent preferences
|
|
```
|
|
|
|
---
|
|
|
|
## Special Categories of Data (Art. 9 GDPR)
|
|
|
|
**IMPORTANT**: Select the first option unless you specifically process sensitive data.
|
|
|
|
- [x] **No special categories of personal data ("sensitive data") according to Art 9 GDPR are processed.**
|
|
|
|
If any of your sites deal with health, religion, political opinions, biometric data, etc., you would need to check the second option and specify which categories.
|
|
|
|
---
|
|
|
|
## Complete Form Example
|
|
|
|
Here's how your completed Annex 3 should look:
|
|
|
|
### 1. Subject Matter
|
|
```
|
|
Web hosting and content delivery for multiple websites and web applications including:
|
|
- Static and dynamic website hosting
|
|
- Newsletter subscription management (Listmonk)
|
|
- Contact form processing
|
|
- Anonymized web analytics collection
|
|
- Content management systems
|
|
```
|
|
|
|
### 4. Data Subjects (check these):
|
|
- [x] Interested parties
|
|
- [x] Visitors to the website
|
|
- [x] Newsletter subscribers
|
|
- [x] Customers (if applicable)
|
|
|
|
### 5. Personal Data Categories (check these):
|
|
- [x] Name data
|
|
- [x] Contact and address data
|
|
|
|
**Additional data:**
|
|
```
|
|
Email addresses
|
|
IP addresses (anonymized)
|
|
Browser user agent information
|
|
Cookie consent preferences
|
|
Website usage data (anonymized)
|
|
```
|
|
|
|
### Special Categories:
|
|
- [x] No special categories of personal data are processed
|
|
|
|
---
|
|
|
|
## After Submitting
|
|
|
|
1. **Save a copy** of the completed agreement for your records
|
|
2. **Date it** when you submit
|
|
3. **Review annually** to ensure it still accurately reflects your processing activities
|
|
|
|
---
|
|
|
|
## Tips
|
|
|
|
1. **Be conservative** - only check categories you actually process
|
|
2. **When in doubt, exclude** - you can always add categories later
|
|
3. **Keep it updated** - if you add new features that collect data, update the DPA
|
|
4. **Document everything** - maintain your own Records of Processing Activities (ROPA)
|