Data Processing Agreement (DPA)

This is a translation of the German Auftragsverarbeitungsvertrag (AVV). If the versions differ, the German version prevails.

pursuant to Art. 28(3) GDPR

between the BrickConnect customer (the "Controller") and Gödecke Reich GmbH, De-Saint-Exupéry-Straße 10, 60549 Frankfurt am Main (the "Processor").

This agreement is concluded when the Terms of Service are accepted at sign-up and forms part of the service contract. No separate signature is required. On request, the Processor provides a countersigned copy in text form.

1. Subject matter and duration

1. The subject matter is the processing of personal data by the Processor in providing BrickConnect: retrieving, storing, synchronising and displaying inventory and order data from the sales platforms connected by the Controller, creating pick lists and shipping labels, and related support.
2. The duration corresponds to the term of the service contract including the trial.

2. Nature, purpose, data and data subjects

Special categories of personal data (Art. 9 GDPR) are not processed as a matter of course.

3. Instructions

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by law (Art. 28(3)(a) GDPR). The instructions are set out in this agreement, the Terms of Service and the Controller's configuration of the Service.
2. The Processor informs the Controller without delay if it considers an instruction to be unlawful.

4. Obligations of the Processor

1. Persons authorised to process the data are committed to confidentiality.
2. The Processor implements the technical and organisational measures under Art. 32 GDPR set out in Annex 1 and keeps them up to date with the state of the art without lowering the level of protection.
3. The Processor assists the Controller with appropriate measures in responding to data subject requests (Art. 12–23 GDPR), in particular through export and deletion functions, and with the obligations under Art. 32–36 GDPR. Requests from data subjects addressed to the Processor are forwarded without delay.
4. The Processor notifies the Controller of personal data breaches without undue delay, where possible within 48 hours of becoming aware, with the information under Art. 33(3) GDPR as far as available.
5. Data protection contact: support@ledfoto.de.

5. Sub-processors

1. The Controller grants general authorisation to engage sub-processors. The sub-processors listed in Annex 2 are authorised when the contract is concluded.
2. The Processor informs the Controller in text form at least 30 days in advance of any intended changes. The Controller may object within this period for an important data protection reason. If no agreement can be reached, the Controller may terminate the contract with effect from the change.
3. The Processor imposes the same data protection obligations on sub-processors by contract. Transfers to third countries only take place in accordance with Art. 44 et seq. GDPR.
4. The sales platforms connected by the Controller (e.g. BrickLink, BrickOwl, eBay, Shopify, the Controller's own WooCommerce store) and the shipping providers chosen by the Controller are not sub-processors of the Processor but recipients engaged by the Controller.

6. Audits

On request, the Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement and allows for audits, including inspections, by the Controller or an auditor mandated by the Controller and bound to confidentiality, with reasonable notice (usually 30 days), during normal business hours and without disrupting operations. Compliance may primarily be demonstrated by self-assessments or suitable certificates.

7. Deletion and return

After the contract ends, the Controller can export their data for 30 days. The Processor then deletes all data processed on behalf of the Controller, including existing copies, unless there is a legal obligation to retain it. Backups are overwritten in the regular rotation cycle (no more than 30 additional days).

8. Liability and final provisions

Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the Terms of Service. In the event of conflict between this agreement and the Terms of Service, this agreement prevails with regard to data protection. Otherwise the final provisions of the Terms of Service apply.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

• Encryption: transmission exclusively via TLS (HTTPS); platform API credentials and OAuth tokens are stored encrypted in the database.
• Physical access control: operation in a data centre of the hosting provider with physical access protection; no servers in office premises.
• System access control: server access only via SSH keys for named administrators; firewall with only required ports open; user sign-in via one-time link or OAuth, short-lived access tokens.
• Data access control and tenant isolation: every record is assigned to a customer account; every query is restricted server-side to the signed-in account. Administrative access is separate from user access.
• Transfer control: transmission to platforms and shipping providers only via their official encrypted interfaces and only when initiated by the Controller.
• Input control: logging of synchronisation and stock changes (movement log) and of administrative access.
• Availability control: regular encrypted backups; service monitoring; prompt installation of security updates.
• Separation: separate development and production systems; production data is not used for testing.
• Organisation: confidentiality commitments, a procedure for reporting data breaches, regular review of these measures.

Annex 2: Authorised sub-processors

Last updated: Oktober 2026