Data processing agreement

This is a translation for information only. Only the German version of this agreement is binding.

Last updated: 14 October 2026

Data processing agreement under Art. 28 GDPR between the customer as controller ("customer") and Spotstar, owner Luca-Matheo Rohrbach, Mainluststraße 17, 60329 Frankfurt am Main, Germany, as processor ("Spotstar"). The agreement is part of the General Terms and Conditions (terms) and is concluded together with them.

§ 1 Subject matter and duration

(1) Spotstar processes personal data on behalf of the customer to provide the services under § 3(1) no. 3 of the terms: fetching reviews from the customer's Google Business Profile, drafting and publishing replies, analysing reviews, and suggesting profile details and posts and sending them to Google after approval.

(2) The agreement applies for as long as the contract under the terms exists and Spotstar still processes the customer's data afterwards.

(3) This agreement does not cover data that Spotstar processes as a controller in its own right: the customer account and its users, billing, the counting of card taps, and the log of approvals that Spotstar keeps as a record towards Google and the customer. The privacy policy applies to these. [please confirm: classification of the approval log as Spotstar's own responsibility.]

§ 2 Nature and purpose of processing, data and data subjects

Data	Data subjects	Processing
Reviews from the Google profile: stars, text, date, existing reply. Spotstar does not store the reviewers' names.	Authors of the reviews; people named in reviews, such as the customer's staff	fetch, store, analyse, send to the AI service to create replies and analyses
Replies to reviews and drafts	as above, insofar as replies relate to them	draft, store, send to Google according to the customer's setting or approval
Details in the Business Profile: description, phone numbers, website, opening hours, special hours	Owner and staff of the customer, insofar as the details concern them (for example for sole traders)	fetch, store, create suggestions, send to Google after approval
Posts for the profile: text, title, period, coupon code, terms, link	as above, insofar as the posts concern individuals	draft, store, send to Google after approval

Spotstar does not deliberately process special categories of personal data (Art. 9 GDPR). They may, however, appear in review texts written by third parties on Google.

§ 3 Instructions

(1) Spotstar only processes the data on documented instructions from the customer, including with regard to transfers to third countries, unless Spotstar is required to do so by law. In that case, Spotstar informs the customer of that legal requirement before processing, unless the law prohibits this.

(2) Instructions are the terms, this agreement and the customer's settings and approvals in the dashboard. The approvals are documented in the log in the dashboard. The customer gives further instructions in text form to info@getspotstar.com.

(3) If Spotstar considers an instruction to be unlawful, Spotstar informs the customer without undue delay and may suspend its execution until it is confirmed or changed.

§ 4 Confidentiality

Spotstar only uses people who have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Only people who need access for their work have access to the data.

§ 5 Security of processing

Spotstar takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. Spotstar may adapt them to the state of the art as long as the level of protection does not decrease.

§ 6 Sub-processors

(1) The customer approves the sub-processors listed in Annex 2.

(2) Spotstar informs the customer in text form at least 30 days in advance of any intended new or replaced sub-processor. The customer may object in text form within this period for a legitimate reason. If Spotstar cannot resolve the reason, the customer may terminate the contract under the terms with effect from the date of the change.

(3) Spotstar contractually binds every sub-processor to the same data protection obligations as set out in this agreement and is liable to the customer for their compliance.

(4) Google is not a sub-processor of Spotstar. Google operates the Business Profile under its own responsibility; the customer has its own relationship with Google. Spotstar only transfers data to Google in accordance with the customer's instructions under § 3.

§ 7 Data subject rights

Spotstar supports the customer with appropriate measures in responding to requests from data subjects under Art. 12 to 23 GDPR. If Spotstar receives such a request directly, it forwards it to the customer without undue delay. Only Google or the review's author can delete a review itself on Google; on instruction, Spotstar deletes the copy stored at Spotstar.

§ 8 Assistance, notification of data breaches

(1) Spotstar assists the customer with its obligations under Art. 32 to 36 GDPR (security, notification and communication of data breaches, data protection impact assessment, consultation of the supervisory authority), insofar as processing by Spotstar is concerned.

(2) Spotstar notifies the customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it. The notification contains, as far as known, the information under Art. 33(3) GDPR.

§ 9 Deletion and return

(1) After the end of the services, Spotstar deletes or returns all data under § 2, at the customer's choice. If the customer does not choose within 30 days of the end of the contract, Spotstar deletes the data.

(2) If the customer disconnects Google in the dashboard or deletes their account, Spotstar deletes the data under § 2 immediately. Anyone who wants a copy first requests it in text form before disconnecting. The data is returned as a file in a common machine-readable format (JSON or CSV).

(3) Copies in backups are overwritten after seven days. Backups are stored encrypted at the hosting provider (Annex 2).

(4) On request, Spotstar confirms deletion or return to the customer in text form.

§ 10 Evidence and audits

(1) Spotstar provides the customer with all information necessary to demonstrate compliance with this agreement.

(2) The customer or an auditor appointed by them and bound to confidentiality may verify compliance after giving at least two weeks' notice during business hours, as a rule once a year and additionally where there is a specific reason. The customer bears the costs of an audit unless it reveals a breach by Spotstar.

§ 11 Transfers to third countries

Data is only transferred to a country outside the EU or EEA if the conditions of Art. 44 to 49 GDPR are met. The transfers and their legal basis are listed in Annex 2.

§ 12 Liability and final provisions

(1) Art. 82 GDPR applies to liability. Otherwise, the liability rules of the terms apply.

(2) Changes to this agreement require text form; § 13 of the terms applies accordingly.

(3) In matters of data protection, this agreement prevails over the terms in case of conflict.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Last updated: 14 October 2026. Spotstar reviews the measures at least once a year.

Confidentiality

• Operated through Sliplane GmbH in data centres of Hetzner Online GmbH in Germany (Germany region selected). Physical access control by the data centre operator.
• Access to server, database and hosting account only for the owner of Spotstar, with two-factor sign-in. [please confirm]
• Separation of customers: every query is limited to the business of the signed-in user; the business identifier never comes from user input.
• User passwords are only stored as a hash (scrypt). Sessions and links from emails are only stored in the database as a SHA-256 hash.
• The access key for the Google profile is stored encrypted with AES-256-GCM. The key for this is only held in the server environment, not in the database.
• Data minimisation: names and profile pictures of review authors are not stored.

Integrity

• Transmission only encrypted (HTTPS with TLS, HSTS).
• Every change to the Google profile and every post is logged with the suggestion, the approving user, the time, the request to Google and Google's response. Changes are only sent to Google after approval.
• Input is validated on the server; protection against abuse through rate limits on sign-in and actions.

Availability and resilience

• Continuous database backups through Sliplane with restore to any point in the last seven days, encrypted with customer-specific keys, stored at Impossible Cloud GmbH in Frankfurt. Restores are tested at least once a year.
• Database and application run separately; new versions are built and checked before release.

Deletion and regular review

• Automatic daily deletion of expired sessions, links and sign-ups as well as old card taps and reports.
• When Google is disconnected, the data under § 2 is deleted immediately.
• Review of these measures at least once a year and on significant changes.

Organisation

• Spotstar is a sole proprietorship. Other people only get access after committing to confidentiality.
• Notification of data breaches to the customer within 48 hours (§ 8).

Annex 2: Sub-processors

Company	Service	Place of processing	Basis for third-country transfer
Sliplane GmbH, c/o ECOSIA, Gerichtstraße 23, Innenhof 4, 13347 Berlin, Germany	Operation of the application and database, backups	Germany. Sliplane uses: Hetzner Online GmbH, Gunzenhausen (servers and database, data centres in Germany); Impossible Cloud GmbH, Hamburg (encrypted backups, Frankfurt location)	no third-country transfer
Anthropic Ireland, Limited, Dublin	AI service Claude: drafts for replies, descriptions and posts, analysis of reviews. No use for training. Deletion within 30 days, up to two years if a breach of the usage policy is suspected	USA (Anthropic, PBC); Anthropic does not offer processing in the EU for the direct API	EU-US Data Privacy Framework; additionally EU standard contractual clauses in Anthropic's data processing agreement [please confirm: Anthropic's listing on dataprivacyframework.gov]
Resend, Inc., USA	Sending emails to the customer's users, such as confirmations after approvals	Sent via servers in the EU (Ireland); company based in the USA	[please confirm: EU-US Data Privacy Framework or standard contractual clauses in Resend's DPA]