We've revised our data processing agreement (AVV, short for the German "Auftragsverarbeitungsvertrag"). We did this in response to feedback from customers and their data protection officers, and because of changes at our service providers. Here's what changes and why.
You don't need to do anything. Nothing to print, sign or send back. The new version applies from 1 December 2026. If you don't agree with the changes, you can cancel your account by 30 November 2026. Otherwise, the new version also applies to you from 1 December. You can already read it at centralstationcrm.de/avv.
Please note: the AVV is only available in German, and the German text is the binding version. This post is a summary for your information.
Subprocessors (Annex 3)
Telekom Deutschland GmbH is no longer one of our subprocessors. We no longer store any data there.
New on the list is Schwarz Digits Cloud GmbH & Co. KG from Bad Friedrichshall with its cloud STACKIT. We plan to use STACKIT for storing files and backups, among other things. STACKIT's data centres are located in Germany, so your data stays here.
Also new is Scoria Labs GmbH from Hallbergmoos (Germany) with its service CaptchaFox, which protects web forms against spam. Data is only sent to CaptchaFox if you turn on this protection in one of your web forms.
Data export before cancellation (clause 10.2)
You've always been able to export your data yourself at any time. Until now, however, the agreement only said that we delete your data when the contract ends. Now it also describes the export. Nothing changes in practice.
You start the export in your account settings under Export all data. We can export file attachments for you on request via our support. Please export your data before you cancel: when you cancel, we deactivate your account immediately and delete it after three days. If you haven't exported anything by then, we delete your data.
Costs of audits (clause 9.5)
You can check whether we comply with the agreement. The agreement already said that you bear the costs of such an audit. What's new is that the amount is based on our price list, so you know in advance what to expect. We're happy to send you the price list on request.
Backups (clause 10.3)
Our backups are there for emergencies, such as a system failure or a cyberattack. In that case, we restore the entire system. We don't restore individual records or individual accounts from backups. The agreement now says this explicitly. We removed the commitment to use a separate deletion log to delete everything again after restoring a backup that you had deleted before. In an emergency, all changes since the last backup are missing anyway, and we can't reliably track deletions from exactly that period. If an entry you had deleted shortly before reappears afterwards, you can simply delete it again.
New data protection officer from 1 January 2027
From 1 January 2027, lawyer Jan Rübsteck will take over as our data protection officer. KINAST Rechtsanwaltsgesellschaft remains responsible until the end of 2026. Nothing changes for you. We'll update the contact details in Annex 4 at the turn of the year.
Other changes
- Annex 1 now explicitly lists our mobile apps as a way to access the CRM.
- Support with your obligations to inform data subjects is now in clause 5.6 instead of 11.1.3. The content stays the same.
- We corrected two wrong cross-references (clauses 9.4 and 9.6), fixed the GDPR reference in clause 1.1 ("Art. 28" instead of "§ 28") and removed a few typos.
If you have any questions about the AVV, just write to our support.