Data Processing Agreement

(Article 28 GDPR)

The Buffalo Company

Version: 1.0
Document date: 12 November 2026
Related document: Managed Services Agreement
Provider / Processor: Obed Klein, trading as The Buffalo Company
Customer / Controller: As identified in the applicable Service Confirmation

---

1. Purpose and scope

1.1. This Data Processing Agreement ("DPA") governs the processing of personal data by the Provider on behalf of the Customer where the Provider acts as a processor within the meaning of Article 4(8) of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.2. This DPA forms part of the Managed Services Agreement ("Agreement") between the Parties.

1.3. This DPA applies only to processing activities in which the Provider processes personal data on behalf of the Customer as a processor.

1.4. It does not automatically apply to processing for which the Provider independently determines the purposes and means, including certain billing, accounting, contractual administration and business communication activities for which the Provider acts as an independent controller.

1.5. The processing activities covered by this DPA, including the subject matter, duration, nature and purpose of processing, the categories of data subjects and the categories of personal data, are described in Section 3. Customer-specific details are completed in the applicable Service Confirmation.

1.6. The Provider will process personal data only to the extent necessary to perform the services commissioned by the Customer and in accordance with this DPA, the Agreement and the Customer's documented instructions.

1.7. If the GDPR does not apply to a particular service or processing activity, the Parties may nevertheless agree to apply the contractual safeguards in this DPA to that activity. Such agreement does not itself establish that the GDPR applies.

2. Definitions

2.1. Terms used in this DPA have the meanings assigned to them in the GDPR.

2.2. In particular:

• Controller: The Party that determines the purposes and means of processing personal data.
• Processor: The Party that processes personal data on behalf of the Controller.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, alteration or deletion.
• Subprocessor: Another processor engaged by the Provider to carry out specific processing activities on behalf of the Customer.
• Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

3. Processing details

3.1. The table below summarises the processing details required by Article 28(3) GDPR: the subject matter, duration, nature and purpose of processing, the categories of data subjects and the categories of personal data. Customer-specific entries are completed in the applicable Service Confirmation or in a subsequent written instruction.

Element	Description
Subject matter	Processing of personal data necessary to provide the services commissioned in the Service Confirmation.
Duration	For the duration of the relevant commissioned services, including the applicable offboarding, return and deletion periods.
Nature and purpose	Provision of technology services such as website and server availability monitoring, security and file-integrity monitoring, website and infrastructure administration, backup and restoration, and related technical support, so that the Customer can operate, secure and maintain its systems.
Categories of data subjects	Customer employees and contractors; Customer website users and visitors; Customer clients and business contacts; Customer account holders and registered users; other individuals whose personal data is contained in the systems covered by the services.
Categories of personal data	Names and contact details; account identifiers and usernames; technical identifiers, IP addresses and device information; website access and server log information; user-generated content stored in Customer systems; customer records or database entries contained in covered systems; file and configuration metadata; other personal data contained in the systems expressly covered by the Service Confirmation.
Special categories and criminal offence data	Not expected. May be included. Details: [Specify]. The Customer must inform the Provider before such data is included in the processing and agree any additional safeguards required.
Processing systems and locations	Provider monitoring platform hosted on Hetzner infrastructure in Germany. Microsoft Azure Blob Storage in the German region identified in the applicable Service Confirmation, where backup services are commissioned. Other authorised service providers identified in the applicable Subprocessor Schedule. Relevant Customer systems are identified in the applicable Service Confirmation.
Retention	Retention periods depend on the service commissioned and the applicable technical configuration. Standard periods: availability monitoring history 30 days; routine file-integrity scan summaries 30 days; individual file-integrity detected-change records 90 days; backup data as specified in the Backup and Restoration Schedule and Service Confirmation; active Customer data following termination generally deleted within 30 days after the effective termination date, subject to applicable legal and technical limitations.
Return or deletion choice	Upon termination, the Customer selects return/export followed by deletion, or deletion, or another expressly agreed arrangement. If no option is selected, the standard arrangements in this DPA and the Managed Services Agreement apply.
Customer instructions and special conditions	[Record any specific processing instructions, restrictions, security requirements, data-residency conditions or other relevant arrangements.]

3.2. The processing activities depend on the services commissioned in the applicable Service Confirmation and may include:

• Website and server availability monitoring.
• Security monitoring and file-integrity monitoring.
• Website maintenance and administration.
• Managed infrastructure administration.
• Backup and restoration services.
• Related technical support and operational activities.

3.3. The Provider will not process personal data for unrelated purposes or use Customer personal data for its own commercial purposes.

3.4. The Provider will not sell Customer personal data or use it for advertising or unrelated profiling.

3.5. The Customer is responsible for ensuring that the processing instructions, data supplied and purposes of processing are lawful.

4. Customer instructions

4.1. The Provider will process personal data only on documented instructions from the Customer, including instructions concerning international transfers.

4.2. This DPA, the Agreement, the Service Confirmation and the applicable service schedules constitute the initial documented instructions.

4.3. The Customer may issue additional instructions in writing, including by email, through an authorised contact.

4.4. The Provider will inform the Customer if, in the Provider's opinion, an instruction infringes the GDPR or other applicable data protection provisions.

4.5. The Provider may suspend the affected instruction while the Parties clarify its lawfulness where continued processing would create a material legal or security risk.

4.6. If the Provider is required by Union or Member State law to process personal data otherwise than on the Customer's instructions, the Provider will inform the Customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

4.7. The Customer is responsible for ensuring that its instructions are sufficiently clear, lawful and consistent with the agreed services.

4.8. Secure exchange of Customer information

The Provider designates its secure information exchange portal at https://secret.thebuffalocompany.com/ as the preferred channel for the transfer of Customer credentials, access information, sensitive technical information, personal data and other confidential information in connection with the commissioned services.

The Customer will use the designated secure exchange portal for such information where reasonably practicable and in accordance with the Provider's instructions.

Ordinary business correspondence, administrative communications and service notifications may continue to be exchanged by email.

The Provider may request that information received through an unsuitable communication channel be resubmitted through the designated secure exchange portal where appropriate.

The use of the secure exchange portal does not replace the Parties' respective obligations under this DPA or applicable data protection law.

5. Confidentiality and authorised persons

5.1. The Provider will ensure that persons authorised to process Customer personal data:

a. Are subject to appropriate confidentiality obligations, whether contractual or statutory.

b. Access personal data only where necessary for the performance of the services.

c. Process personal data only in accordance with the Customer's documented instructions and applicable law.

5.2. The Provider will limit access to personal data to persons who require it for the relevant processing activities.

5.3. The Provider will take reasonable steps to ensure that authorised persons understand their data protection and security responsibilities.

5.4. Independent external specialists may receive temporary access where reasonably necessary for the commissioned services.

5.5. The Provider will notify the Customer in advance when an independent specialist is expected to access Customer systems, data or infrastructure, where reasonably practicable. Emergency access may be notified afterward where advance notice is not reasonably practicable.

5.6. Such access will be limited to the necessary scope and duration and subject to appropriate confidentiality and security obligations.

5.7. Where the specialist acts as a subprocessor, the authorisation and objection provisions in Section 10 also apply.

6. Technical and organisational measures

6.1. The Provider implements and maintains appropriate technical and organisational measures in accordance with Article 32 GDPR, taking account of the nature, scope, context and purposes of processing, the state of the art, the costs of implementation and the risks to the rights and freedoms of natural persons.

6.2. The measures in this Section 6 are the technical and organisational measures implemented or committed to by the Provider. They are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access control and authentication 6.3. Access to systems containing Customer personal data is restricted to persons who require access to perform the commissioned services. Administrative access uses dedicated, individual user accounts; for Linux servers a separate non-root account with sudo privileges is used where technically feasible, and a separate passphrase-protected SSH key pair is maintained on each server. Access credentials and keys are revoked or removed when no longer needed, including when a service ends. Customer administrative credentials are not intentionally shared between unrelated Customer environments.

Confidentiality obligations 6.4. Persons authorised to process Customer personal data are subject to appropriate confidentiality obligations and access personal data only where necessary for the relevant processing activities, in accordance with the Customer's documented instructions and applicable law.

Encryption and secure transmission 6.5. The Provider's KeePassXC credential database is encrypted; backups of it are encrypted and stored through Tresorit. SSH private keys are passphrase-protected. Multi-factor authentication is used on critical administrative accounts where supported (currently Hetzner, Microsoft/Azure, Tresorit and the Provider's primary business email account). Credentials are not intentionally included in routine monitoring reports or file-integrity scan results. File paths and technical metadata are treated as potentially sensitive technical information.

Infrastructure security 6.6. The Provider's monitoring platform is hosted on Hetzner infrastructure in Germany. Administrative access to relevant Linux servers is controlled through individual user accounts and SSH key authentication. The Provider regularly updates relevant workstation and server software within the scope of its responsibilities. Where the Provider administers Customer infrastructure, security configuration and hardening measures are assessed and agreed in the applicable Service Confirmation. Physical and environmental security for infrastructure outside the Provider's direct control is managed by the relevant hosting providers.

Backup and recovery 6.7. Where backup services are commissioned, the Provider applies the arrangements in the Backup and Restoration Schedule and the applicable Service Confirmation. Backup storage is intended to be located in Germany. Backup jobs are checked for failed or incomplete executions; material failures are reviewed and communicated to the Customer. Restoration tests are performed at onboarding and quarterly thereafter. Before potentially destructive or high-risk work, the Provider verifies that an appropriate backup or snapshot exists where technically possible.

Logging and monitoring 6.8. Relevant SSH and administrative activity logs are retained for no more than 90 days where technically feasible. Availability monitoring history is generally retained for 30 days; routine file-integrity scan summaries for 30 days and individual detected-change records for 90 days. The file-integrity scanner does not routinely read or copy file contents, database contents, website visitor information, customer records, passwords, tokens or credentials.

Vulnerability and security management 6.9. The Provider regularly installs operating system and software updates, applies access restrictions and credential-management practices to reduce the risk of unauthorised access, and periodically reviews the suitability of these measures.

Incident response 6.10. The Provider takes reasonable steps to identify, investigate and respond to security incidents affecting systems and personal data within its control, and to contain, investigate and mitigate incidents within the scope of its services. Incident information may be documented using available logs, monitoring records and other technical evidence. Extensive forensic investigation, major incident response, recovery or remediation may require a separate agreement unless expressly included in the Service Confirmation.

Data deletion and retention 6.11. The Provider applies the agreed retention periods and returns or deletes Customer data following termination in accordance with Section 14. Active Customer personal data is generally deleted within 30 days after the effective termination date, subject to applicable legal retention requirements and technical limitations. Backup copies may remain temporarily in accordance with the agreed backup retention and deletion mechanisms. Data retained for legal, accounting, contractual or security purposes is restricted to the relevant purpose and retained only for the period required or permitted by applicable law.

Access restriction and revocation 6.12. Access credentials and keys are revoked or removed when no longer needed, including when a service ends. Access granted to external specialists is limited to the necessary scope and duration and revoked when the task is completed or the access is no longer required.

6.13. The Provider will review the measures periodically and update them where reasonably necessary, provided the overall level of protection is not materially reduced, and will inform the Customer of material changes that significantly affect the protection of Customer personal data.

6.14. These measures describe what is actually implemented or committed to; they do not constitute a guarantee that security incidents or data breaches can never occur.

7. Personal data breaches

7.1. The Provider will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf.

7.2. The Provider aims to provide an initial notification within 24 hours after becoming aware of the breach, including outside standard support hours where reasonably practicable.

7.3. The initial notification may contain, to the extent then available:

• A description of the nature of the breach.
• The categories of personal data and data subjects potentially affected.
• The approximate number of affected individuals or records, where known.
• The likely consequences of the breach, where reasonably assessable.
• Measures taken or proposed to address the breach.
• Measures recommended to mitigate possible adverse effects.
• Contact information for further communication.

7.4. The Provider may provide information in stages where all relevant details are not immediately available.

7.5. The Provider will reasonably cooperate with the Customer's investigation and response, taking account of the nature of the processing and information available to the Provider.

7.6. The Provider will take reasonable steps to contain, investigate and mitigate a breach within its control and the scope of its services.

7.7. The Provider will not notify supervisory authorities or affected data subjects on behalf of the Customer unless instructed or legally required to do so.

7.8. The Customer remains responsible for determining whether notification to a supervisory authority or affected data subjects is required under Articles 33 and 34 GDPR.

7.9. The 24-hour target is a contractual operational target and does not replace or modify statutory notification deadlines.

8. Assistance with data subject rights

8.1. Taking account of the nature of the processing, the Provider will assist the Customer through appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from data subjects exercising their rights under the GDPR.

8.2. Such rights may include requests for:

• Access.
• Rectification.
• Erasure.
• Restriction of processing.
• Data portability.
• Objection.
• Other applicable rights under data protection law.

8.3. If the Provider receives a request directly from a data subject relating to Customer personal data, the Provider will forward it to the Customer without undue delay.

8.4. The Provider will not independently respond to the request unless instructed by the Customer or required by law.

8.5. The Customer remains responsible for determining the legal basis and scope of any response to a data subject.

8.6. Assistance beyond ordinary technical and organisational support may be subject to reasonable additional charges where the request requires substantial work outside the agreed service scope. This does not limit any mandatory statutory assistance obligation.

9. Assistance with compliance obligations

9.1. Taking account of the nature of the processing and the information available to the Provider, the Provider will reasonably assist the Customer with:

a. Security obligations under Article 32 GDPR.

b. Personal data breach notifications under Articles 33 and 34 GDPR.

c. Data protection impact assessments under Article 35 GDPR.

d. Prior consultation with supervisory authorities under Article 36 GDPR.

9.2. The Provider will make available relevant information reasonably necessary for the Customer to assess the security and compliance of the processing.

9.3. The Customer remains responsible for its own compliance obligations as Controller, including determining the lawful basis for processing and conducting any required impact assessment.

9.4. Assistance requiring substantial additional technical investigation or consultancy may be separately quoted, subject to mandatory statutory obligations.

10. Subprocessors

10.1. The Customer grants the Provider general written authorisation to engage the subprocessors identified in the applicable Subprocessor Schedule.

10.2. The Provider may add or replace subprocessors where reasonably necessary to provide the commissioned services, subject to the notification and objection procedure in this section.

10.3. The Provider will give the Customer at least 30 calendar days' advance notice of an intended addition or replacement of a subprocessor involved in processing Customer personal data under this DPA.

10.4. The notice will identify the intended subprocessor and describe the relevant processing activities and, where available, the processing location.

10.5. The Customer may object within 30 calendar days after receiving the notice where it has reasonable, specific data protection grounds for doing so.

10.6. The objection must identify the relevant data protection concern and, where possible, the processing activity affected.

10.7. The Provider will consider the objection in good faith and assess whether an alternative provider, technical arrangement or additional safeguard can reasonably address the concern.

10.8. If no workable solution can be agreed, either Party may terminate the affected processing service in accordance with the Agreement, without an additional termination penalty.

10.9. The Provider will impose data protection obligations on each subprocessor that are no less protective than the relevant obligations in this DPA, to the extent applicable to the processing performed by that subprocessor.

10.10. The Provider remains responsible to the Customer for the performance of its subprocessors' data protection obligations as required by Article 28(4) GDPR.

10.11. The Provider will maintain an up-to-date Subprocessor Schedule and make it available to the Customer.

10.12. The Provider will not appoint a subprocessor to process Customer personal data before the applicable authorisation and notification requirements have been satisfied.

11. International transfers

11.1. The Provider will not transfer Customer personal data to a third country or international organisation, or authorise a subprocessor to do so, unless:

a. The Customer has provided documented instructions or the transfer is otherwise covered by the agreed processing arrangements; and

b. The requirements of Chapter V GDPR are satisfied.

11.2. Where a transfer requires an adequacy decision under Article 45 GDPR, the Provider will rely on that decision where applicable.

11.3. Where no applicable adequacy decision exists, an appropriate transfer mechanism under Article 46 GDPR must be implemented, such as the applicable Standard Contractual Clauses, together with any required supplementary measures.

11.4. The Provider will inform the Customer of relevant international transfer arrangements and provide reasonably available information about the applicable safeguards.

11.5. The Customer's approval of a subprocessor under Section 10 does not, by itself, constitute approval of a transfer that requires separate authorisation or safeguards under Chapter V GDPR.

11.6. The storage-location requirements agreed for backup services are governed by the Backup and Restoration Schedule and applicable Service Confirmation.

12. Audit and compliance information

12.1. The Provider will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

12.2. The Provider will allow for and contribute to audits and inspections conducted by the Customer or an auditor mandated by the Customer, subject to this section.

12.3. The Customer will normally request relevant documentation, explanations or other compliance information before requiring an on-site inspection.

12.4. Audits must:

a. Be conducted during normal business hours, unless a serious incident justifies otherwise.

b. Be subject to reasonable advance written notice, normally at least 30 calendar days.

c. Be limited to processing activities relevant to the Customer.

d. Protect the confidentiality and security of the Provider and other customers.

e. Avoid unreasonable disruption to the Provider's business or other customers' services.

12.5. The Provider may require auditors to sign reasonable confidentiality undertakings and comply with relevant security requirements.

12.6. The Provider may satisfy reasonable audit requests through relevant documentation, security descriptions, certifications where available, independent audit reports or other suitable evidence.

12.7. An on-site inspection may be conducted where reasonably necessary and where relevant compliance concerns cannot adequately be addressed through other evidence.

12.8. The Customer will bear its own audit costs and the Provider's reasonable costs of assisting with an audit, except where the audit identifies a material breach of this DPA by the Provider or applicable law requires otherwise.

12.9. The Provider will not be required to disclose:

• Other customers' personal data or confidential information.
• Credentials, private keys or security details that would create an unreasonable risk.
• Information protected by legal privilege.
• Information that the Provider is legally prohibited from disclosing.

12.10. Such limitations do not remove the Provider's obligation to provide sufficient information to demonstrate compliance.

13. Records and cooperation with authorities

13.1. The Provider will maintain records of processing activities where required under Article 30(2) GDPR.

13.2. The Provider will cooperate with competent supervisory authorities where legally required.

13.3. The Provider will promptly inform the Customer of relevant supervisory authority enquiries concerning the processing of Customer personal data, unless legally prohibited.

13.4. The Provider will not respond on the Customer's behalf to regulatory enquiries concerning the Customer's role as Controller unless instructed or legally required.

14. Return and deletion of personal data

14.1. Upon termination or expiry of the relevant processing services, the Provider will, at the Customer's choice, return or delete Customer personal data processed on the Customer's behalf, subject to this section and applicable law.

14.2. The Customer's chosen option must be recorded in Section 3 or in a subsequent written instruction.

14.3. Unless otherwise agreed, the Provider will provide one reasonable export of Customer-owned data in an existing or commonly usable format, where technically available.

14.4. The standard export and basic preparation and provision are included without a separate charge.

14.5. Additional data conversion, restructuring, migration, reconstruction or extensive transition assistance may be separately quoted.

14.6. Active Customer personal data held in the Provider's systems will generally be deleted within 30 days after the effective termination date, subject to the Customer's export or return choice, applicable legal retention requirements and technical limitations.

14.7. Where the Customer chooses return, the Provider will provide the agreed export within the applicable offboarding period and delete the relevant active copies thereafter, unless the Customer expressly agrees otherwise or applicable law requires retention.

14.8. Where the Customer chooses deletion, the Provider will delete the relevant active copies within the applicable deletion period.

14.9. Backup copies and residual copies may remain temporarily in accordance with the normal backup retention and deletion mechanisms. Such copies will remain protected under this DPA and will not be restored or otherwise processed except where necessary for security, legal compliance or recovery obligations.

14.10. Backup services are additionally governed by the 30-day post-termination access and deletion provisions in the Backup and Restoration Schedule.

14.11. The Provider may retain personal data where required by Union or Member State law. Any such retained data will be restricted to the legally required purpose and protected in accordance with this DPA for as long as it remains stored.

14.12. The Provider may retain contractual, accounting, security and other records where permitted or required by law, provided that such retention is not used to justify unnecessary retention of Customer personal data processed on the Customer's behalf.

14.13. On reasonable request, the Provider will confirm completion of the applicable deletion process, subject to technical and legal limitations.

15. Customer responsibilities

15.1. The Customer warrants that it has an appropriate legal basis and authority to provide the personal data to the Provider for the agreed processing purposes.

15.2. The Customer is responsible for:

• Providing lawful and documented processing instructions.
• Providing accurate information about the processing activities.
• Informing data subjects as required by law.
• Determining appropriate retention periods.
• Ensuring the lawfulness of the data collected and supplied.
• Identifying any special categories of personal data or other sensitive data included in the processing.
• Ensuring that its instructions and requirements comply with applicable law.
• Maintaining appropriate records and conducting any required data protection impact assessments.

15.3. The Customer must not instruct the Provider to process personal data in a manner that would violate applicable data protection law.

15.4. The Customer must promptly inform the Provider of material changes to the processing scope, data categories, purposes or relevant legal requirements.

15.5. The Customer must not provide unnecessary personal data or credentials for the performance of the commissioned services.

15.6. Secure information exchange

The Customer will use the Provider's designated secure information exchange portal for transferring credentials, passwords, access tokens, sensitive technical information and other confidential information relating to the commissioned services.

The Customer should not transmit such information through ordinary email or other communication channels unless expressly agreed with the Provider or where necessary in an emergency.

The Customer will promptly notify the Provider if sensitive information is inadvertently transmitted through an unsuitable channel.

16. Liability

16.1. Each Party remains responsible for its own obligations under applicable data protection law.

16.2. The Parties' contractual liability is governed by the Managed Services Agreement, subject to mandatory statutory provisions.

16.3. Nothing in this DPA excludes or limits rights of data subjects under Article 82 GDPR or the liability of either Party where such limitation is prohibited by law.

16.4. The Provider remains responsible for the obligations imposed on it as a processor under the GDPR and this DPA.

16.5. Nothing in this DPA transfers the Customer's statutory responsibilities as Controller to the Provider.

17. Term and termination

17.1. This DPA becomes effective when accepted by both Parties and applies for as long as the Provider processes personal data on behalf of the Customer under the relevant services.

17.2. Termination of the Managed Services Agreement terminates this DPA for the affected services, subject to the provisions concerning return, deletion, confidentiality and any legally required retention.

17.3. Where a material breach of this DPA cannot reasonably be remedied, or where continued processing would be unlawful, the affected processing may be suspended or terminated in accordance with the Agreement and applicable law.

17.4. Sections concerning confidentiality, security, audit rights, return and deletion, liability and legally required retention survive termination to the extent necessary to fulfil their purpose.

18. Relationship with the Agreement

18.1. This DPA forms part of the Managed Services Agreement.

18.2. In matters concerning the processing of personal data, this DPA prevails over conflicting provisions of the Agreement or other contractual documents, subject to mandatory law.

18.3. The Service Confirmation and Section 3 specify the processing activities to which this DPA applies.

18.4. The technical and organisational measures in Section 6 and the Subprocessor Schedule form integral supporting documents to this DPA.

18.5. Amendments to this DPA must be agreed in writing. Email is sufficient unless mandatory law requires a stricter form.

---

Acceptance

By accepting this DPA, the Parties agree to the processing arrangements and obligations described in this DPA, including the processing details in Section 3, the technical and organisational measures in Section 6, and the applicable Subprocessor Schedule. The Customer-specific acceptance details are completed in the signed copy issued with the applicable Service Confirmation.

---

End of Data Processing Agreement