Data processing agreement
Parties and scope
This agreement under Art. 28 GDPR applies between the customer who has an account with Trayyce (controller) and Kevin Feiler Einzelunternehmen, trading as Trayyce, Königstraße 5, 70173 Stuttgart, Germany (processor, “we” below).
It is part of the terms of use and applies as soon as the customer uses tools with which we process personal data on the customer's behalf. In matters of data protection it takes precedence over the terms of use. Electronic form is sufficient (Art. 28(9) GDPR).
Subject matter, nature and purpose
We process personal data only to provide the tools the customer uses, and only as described in the privacy policy, section “Tools in the customer area”. Currently these are the privacy tool (searching for data of a person who has consented, with findings and draft requests), the contact form for the customer's website, the customer's Telegram bots (inbox and bot contacts) and any other tool for which the privacy policy names the customer as controller.
Processing comprises collecting, storing, querying the services named below, displaying to the customer's users and deleting.
Types of data and data subjects
Data: names, email addresses, phone numbers, postal addresses and usernames, findings and draft requests, contact form requests with website, email address, optional company name and consent text, and for Telegram bots the person's first name, @username, Telegram ID and messages with replies, suggested replies, status and notes.
Data subjects: people for whom the customer creates a case in the privacy tool, people who fill in the customer's contact form, people who write to one of the customer's Telegram bots, and the customer's users.
Duration
The agreement runs as long as the customer's account exists. How long individual data are kept is stated in the privacy policy; cases in the privacy tool remain until the customer deletes them.
Instructions
We process the data only on documented instructions from the customer. Instructions are the customer's settings and actions in the customer area; further instructions are given in text form to [email protected]. If we consider an instruction unlawful, we tell the customer without delay. Where EU or German law requires processing, we inform the customer beforehand unless that law prohibits it.
Confidentiality
Everyone at our end with access to the data is bound to confidentiality or under a statutory obligation of secrecy.
Technical and organisational measures
The data are stored on a server in a data centre in Germany and only transmitted encrypted. We store passwords only as salted hashes, session keys and access links only as hashes.
Each customer's data belong to its company; users of other companies cannot see them, and within the company roles and permissions govern who sees what. Only we and people we commission have access to the server.
Logs contain no IP addresses and are deleted after 14 days. Before every update we create a backup; the five most recent are kept, older ones are deleted after 14 days. Requests are rate-limited against abuse.
We adapt the measures to the state of the art without lowering the level of protection.
Sub-processors
The customer allows us to use sub-processors. Currently these are Cloudflare, Inc., USA (network, DNS and tunnel to our server; certified under the EU-US Data Privacy Framework, with standard contractual clauses in addition) and the landlord of our server in a data centre in Germany, whose name we give the customer on request.
We announce a new or different sub-processor by email at least four weeks in advance. The customer may object for an important data protection reason and then terminate the agreement as of the change. We bind sub-processors to the same data protection obligations (Art. 28(4) GDPR).
Services the customer has queried
When the customer starts a search in the privacy tool, we query these services on the customer's instruction: Gravatar (checksum of the email address; Automattic Inc., USA, standard contractual clauses), GitHub (username; GitHub, Inc., USA, certified under the EU-US Data Privacy Framework), crt.sh (domain; Sectigo Limited, United Kingdom, adequacy decision) and Pwned Passwords (only the first five characters of a checksum, not personal data; Superlative Enterprises Pty Ltd, Australia). These services are not sub-processors but recipients to which the customer has the data transferred. We do not query services in countries without an adequacy decision and without safeguards under Art. 46 GDPR.
Assisting the customer
We assist the customer with requests from data subjects (Art. 12 to 23 GDPR) where the customer cannot handle them in the customer area, for example by deleting a case. If such a request reaches us, we forward it to the customer. We also assist the customer with security of processing, personal data breach notifications, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR).
We notify the customer of a personal data breach concerning its data without undue delay, where possible within 48 hours of becoming aware of it, with the information the customer needs for its own notification (Art. 33(3) GDPR).
Deletion and return
After the agreement ends, we delete the customer's data within 30 days unless a law obliges us to retain them. On request we hand them over beforehand in a common format. Backups expire according to the periods in the privacy policy.
Evidence and audits
We provide the customer with the information needed to demonstrate compliance with these obligations. We allow audits by the customer or an auditor commissioned by it and bound to confidentiality, after notice with a reasonable lead time.
Liability
Liability is governed by Art. 82 GDPR and otherwise by the section “Liability” of the terms of use.
Last updated
26 October 2026