Data Processing Agreement (DPA)
pursuant to Art. 28 DSGVO — Last updated: September 2026
1. Subject matter and duration
The subject matter of this agreement is the processing of personal data by the Processor (Jochen Schroeder, Reckenbergstr. 27, 35216 Biedenkopf) in connection with the use of the sektura SaaS platform. Processing takes place for the duration of the contractual relationship between the Controller (Customer) and the Processor.
2. Nature and purpose of processing
Processing includes storing and managing the Controller’s customer data, project data, appointments, invoices and documents on the sektura platform. The data is processed solely on behalf of and in accordance with the instructions of the Controller.
3. Types of personal data
Contact details (name, email, telephone, address), contract data, invoice data, appointments, project notes and industry-specific data depending on the industry desk used.
4. Categories of data subjects
The Controller’s customers and contact persons, employees, suppliers and business partners.
5. Technical and organisational measures (TOMs)
Encryption: TLS 1.3 for all data transfers, AES-256 for data at rest. Access control: Row-Level Security (RLS) in PostgreSQL, strict tenant isolation. Authentication: JWT with short-lived access tokens, rate limiting on login endpoints. Hosting: Hetzner Online GmbH, data centre in Germany (EU). Backups: daily automated backup with 7-day retention. Monitoring: Sentry error tracking, Prometheus metrics, structured logging.
6. Sub-processors
The following sub-processors are used:
Hetzner Online GmbH — server hosting, Industriestr. 25, 91710 Gunzenhausen, Deutschland
Stripe, Inc. — payment processing, 185 Berry Street, Suite 550, San Francisco, CA 94107 (EU standard contractual clauses)
Functional Software, Inc. (Sentry) — error tracking, San Francisco, CA (EU standard contractual clauses)
The Controller is informed of changes to sub-processors and has a right to object.
7. Obligations of the Processor
The Processor processes data only on documented instructions from the Controller, ensures that persons entrusted with processing are bound by confidentiality, implements all necessary technical and organisational measures pursuant to Art. 32 DSGVO, assists the Controller with data subject rights and data protection impact assessments, and deletes all data after the processing engagement ends unless a statutory retention obligation applies.
8. Contact
For questions about data protection and processing on behalf of the Controller: post@jschroeder.net