Data Processing Agreement — Bambuddy Orders

Between the customer named in a Bambuddy Orders order ("Controller") and Martin Ziegler, Warschauer Str. 12, 10243 Berlin, Germany, email support@bambuddy.cool ("Processor"). It forms part of the Bambuddy Orders terms (Section 14(2)) once the Controller connects an Etsy shop, without needing to be signed. Deutsche Fassung

Section 1 — Subject matter and Principal Agreement

(1) This agreement governs the processing of personal data by the Processor on behalf of the Controller in providing the services under the following agreement (hereinafter "Principal Agreement"): the Controller's Bambuddy Orders subscription.

(2) The subject matter, nature and purpose of the processing, the type of data and the categories of data subjects are set out in Annex 1.

(3) The term of this agreement follows the term of the Principal Agreement. It does not end for as long as the Processor still processes personal data from the Principal Agreement.

(4) In case of conflict, this agreement prevails over the Principal Agreement in matters of data protection.

(5) For Bambuddy Orders, this agreement forms part of the Bambuddy Orders terms (Section 14(2) there) as soon as the Controller connects an Etsy shop, without needing to be signed. The Controller is the customer named in the order; the Principal Agreement is that customer's Bambuddy Orders subscription.

Section 2 — Principle: as little data as possible

(1) The software provided by the Processor is operated by the Controller. The Processor does not operate it and, as a rule, has no access to the data stored there.

(2) Personal data reaches the Processor only where the Controller transmits it to the Processor (in particular as a support bundle, log, screenshot or in a support request), where remote access has been separately agreed (Section 9), or where the Controller connects an Etsy shop to Bambuddy Orders (Annex 1, section D).

(3) The Controller transmits only what is necessary for handling the matter. The Processor points it out if it receives more than it needs, and deletes the excess.

Section 3 — Instructions

(1) The Processor processes the data solely on documented instructions from the Controller, unless required to do so by Union or Member State law; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information.

(2) The Principal Agreement and this agreement constitute the instructions. Individual instructions are given by the Controller in text form through the contacts named in the Principal Agreement.

(3) If the Processor considers that an instruction infringes data protection provisions, it informs the Controller without undue delay. It may suspend carrying out the instruction until the instruction is confirmed or changed.

Section 4 — Confidentiality

(1) The Processor performs the services personally. If it engages employees in future, it commits them to confidentiality before they begin their work, unless they are under a statutory obligation of confidentiality.

(2) This obligation continues after this agreement ends.

Section 5 — Security of processing

(1) The Processor implements the technical and organisational measures under Article 32 GDPR described in Annex 2.

(2) It may develop the measures further, provided the level of protection does not fall below the agreed level. It notifies the Controller of material changes in text form.

Section 6 — Sub-processors

(1) The Controller authorises the sub-processors listed in Annex 3.

(2) The Processor informs the Controller in text form at least four weeks before engaging or replacing a sub-processor. Within that period the Controller may object for good cause under data protection law. If no agreement is reached, either party may terminate the affected part of the Principal Agreement with effect from the date of the change.

(3) The Processor imposes on every sub-processor by contract the same data protection obligations that this agreement imposes on the Processor.

(4) Ancillary services that the Processor obtains from third parties and that do not involve access to the Controller's data, in particular telecommunications and payment services, do not constitute sub-processing within the meaning of this Section.

Section 7 — Assistance to the Controller

(1) The Processor assists the Controller by appropriate measures in fulfilling the rights of data subjects (Articles 12 to 22 GDPR). If a data subject contacts the Processor directly, it forwards the request to the Controller without undue delay and does not answer it itself.

(2) It assists the Controller with the obligations under Articles 32 to 36 GDPR to the extent its processing is concerned.

(3) It notifies the Controller of personal data breaches without undue delay, and at the latest within 48 hours of becoming aware of them, in text form to the contacts named in the Principal Agreement. The notification contains, as far as known, the information under Article 33(3) GDPR; missing information is supplied as soon as it becomes available.

(4) Assistance beyond the customary that does not result from a breach by the Processor may be charged on a time basis at the rate agreed in the Principal Agreement.

Section 8 — Deletion and return

(1) The Processor deletes support bundles, logs and other material transmitted by the Controller 90 days after the relevant support case is closed, unless the Controller requests earlier deletion.

(2) After the Principal Agreement ends, it deletes all personal data of the Controller still held within 30 days, unless a statutory retention obligation applies. On request it confirms the deletion in text form.

(3) Backups are overwritten after seven days; deleted data is therefore removed from the backups no later than seven days after deletion. Until then backups are not restored, except to restore operation after a failure.

(4) A return is normally not necessary, since the original data remains with the Controller (Section 2(1)).

(5) Not covered are contract, invoicing and correspondence data that the Processor stores as a controller in its own right in order to comply with statutory retention obligations.

Section 9 — Remote access

(1) Remote access to the Controller's systems takes place only if it has been separately agreed in the Principal Agreement or in text form.

(2) Where it has been agreed, the following also applies:

1. access is enabled for the individual support case and closed again afterwards, unless permanent access has been expressly agreed,
2. the Processor accesses only the systems necessary for the support case,
3. it copies no data from the Controller's system unless this is necessary for fault analysis; copies are subject to Section 8,
4. access is logged with time and purpose; the log is handed to the Controller on request.

(3) Data subject to export-control or special confidentiality provisions must be identified before access is enabled. The Controller remains responsible for ensuring that remote access does not make such data accessible where its disclosure to the Processor is not permitted.

Section 10 — Place of processing

(1) Processing takes place in the European Union.

(2) A transfer to a third country takes place only under the conditions of Articles 44 et seq. GDPR and only to the sub-processors identified as such in Annex 3.

Section 11 — Evidence and inspections

(1) On request, the Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement, primarily by written information and the annexes to this agreement.

(2) The Controller may carry out inspections itself or have them carried out by an auditor bound to confidentiality. They must be announced at least four weeks in advance, take place during service hours and must not disrupt operations disproportionately. An on-site inspection is limited to cases with specific cause or to at most once per calendar year. The data centres of sub-processors are assessed on the basis of their own evidence, not on site.

(3) Each party bears its own costs of an inspection, unless the inspection reveals a not insignificant breach by the Processor.

Section 12 — Liability

Liability is governed by Article 82 GDPR. Otherwise the liability provisions of the Principal Agreement apply.

Section 13 — Final provisions

(1) Amendments and additions require text form.

(2) German law applies. The place of jurisdiction is that of the Principal Agreement.

(3) Language versions. This agreement exists in a German and an English version. The version in which the Principal Agreement was concluded governs.

Annex 1 — Subject matter of the processing

For Bambuddy Orders, sections A to D apply.

A. Support (Service Agreement, Business subscription, Bambuddy Orders)

Nature and purpose. Receiving, storing and evaluating the material transmitted by the Controller in order to narrow down and answer support requests; correspondence on the support case.

Type of data.

• Contact details of the contacts (name, email address, role)
• Content of requests and correspondence
• Support bundles from the software. A Bambuddy support bundle contains system information, the state of the connected printers, and logs. IP addresses and known credentials are removed when it is generated. The following may remain: user names, printer names, file and project names, times of print jobs
• Logs and screenshots additionally transmitted by the Controller

Data subjects. Employees and agents of the Controller; users of the Controller's installation.

B. Remote access (only if separately agreed, Section 9)

Nature and purpose. Inspection of the Controller's installation for fault analysis and fault resolution in the individual case.

Type of data. All data stored in the installation at the time of access, in particular user accounts, print jobs, files, print history and — for Bambuddy Orders — order data.

Data subjects. Users of the installation; for Bambuddy Orders, also the Controller's buyers.

C. Bambuddy Orders: order data

Bambuddy Orders is operated by the Controller. For an order it stores neither the buyer's name nor email address nor postal address, but it does store the destination country, the amount and the personalisation fields of the order line entered by the buyer. These fields may contain personal data, such as a name for an engraving. They reach the Processor only by way of section A, B or D.

The Bambuddy Orders licence check transmits a random installation identifier, an installation token, the program version and the domain of the first connected shop. The Processor processes this data as a controller in its own right to perform the licence agreement; it is not the subject matter of this agreement.

D. Bambuddy Orders: Etsy Gateway

Nature and purpose. A Bambuddy Orders installation reaches Etsy with the Processor's Etsy app, whose key Etsy requires on every request, and therefore through the Processor's Etsy Gateway. The Etsy Gateway passes each request of the installation on to Etsy with the Processor's app key, and Etsy's answer back to the installation. It only permits the requests Bambuddy Orders needs: reading the shop, its listings and its orders, and reporting a shipment.

Type of data.

• Passed through without being stored: Etsy orders as Etsy provides them, with the buyer's name, postal address and the order's contents and personalisation; the carrier and tracking number of a shipment; the Controller's Etsy access tokens when they are issued or renewed
• Stored: per licence, the number of each Etsy shop reached through the Etsy Gateway and when it was first and last used

Data subjects. The Controller's buyers on Etsy; the Controller as the Etsy seller.

Annex 2 — Technical and organisational measures (Article 32 GDPR)

Organisation. The Processor is a sole trader and performs the services personally. There are no other persons with access to the data.

Physical access control. The servers are located in the data centre of the sub-processor under Annex 3. Physical access is governed by that sub-processor; evidence is provided on request. Workstations are located on the Processor's business premises.

System access control.

• Access to servers exclusively by SSH with key, not by password
• Support system: personal accounts, no self-registration, customers see only their own cases
• Two-factor authentication for the support system's administrator account

Data access control. Support bundles and requests are held exclusively in the support system and the support mailbox, not in public systems. A public bug report in the project repository contains no data of the Controller, no logs and no files; it is written by the Processor in its own words.

Transfer control. Transfers to and from the support system and to the licence service and, for Bambuddy Orders, through the Etsy Gateway are exclusively encrypted (TLS). Email is transmitted between mail servers via TLS where the other side supports it.

Input control. The support system logs changes to cases with time and user. Remote access is logged under Section 9(2)(d).

Separation control. The support system has its own database, separate from the other services. Data of different customers is separated by organisation.

Availability and resilience.

• Daily full backup of the entire server, including the support system, the support mailbox and the licence service, to an external storage medium; backups are kept for seven days
• Incoming support mail is first held in a mailbox separate from the support system

Data minimisation.

• When generating a support bundle, Bambuddy removes IP addresses and known credentials; a support bundle can only be generated with diagnostic logging switched on
• Bambuddy Orders stores no names, email addresses or postal addresses of buyers
• The Bambuddy Orders Etsy Gateway passes orders through without storing them, and permits only the requests Bambuddy Orders needs
• Deletion periods under Section 8

Review. The Processor reviews these measures at least once per calendar year and whenever the systems change materially.

Annex 3 — Sub-processors

Where remote access has been agreed (Section 9) and the chosen method uses a relay service, that service is named in the agreement on remote access.

Last updated: November 11, 2026