{"id":3093,"date":"2026-11-03T15:09:58","date_gmt":"2026-11-03T14:09:58","guid":{"rendered":"https:\/\/www.gasyco.com\/?page_id=3093"},"modified":"2026-11-03T15:09:58","modified_gmt":"2026-11-03T14:09:58","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/www.gasyco.com\/en\/auftragsverarbeitungsvereinbarung\/","title":{"rendered":"Data Processing Agreement pursuant to Art 28 GDPR"},"content":{"rendered":"<p class=\"rechtstext__intro wp-block-paragraph\">Annex to the General Terms and Conditions and Annex 1 to the Connect \u2013 Service and Terms of Use of Gasyco GmbH<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">between the Customer as controller (\u201cCustomer\u201d) and Gasyco GmbH, Hauptstra\u00dfe 122, 1140 Vienna, as processor (\u201cGasyco\u201d).<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">1. Subject Matter and Duration<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">1.1 This Agreement governs the processing of personal data carried out by Gasyco on behalf of the Customer, namely (a) in the context of the Connect Services (Connect, Connect Plus, Connect Enterprise) and (b) in the case of remote fault diagnosis, troubleshooting, maintenance and support on devices that the Customer has connected to the internet, pursuant to the clause \u201cDevice Data and Remote Service\u201d of the GTC (\u201cremote service\u201d), even where there is no contract for Connect Services. It is based on the respective contract between the parties, i.e. the contract for Connect Services together with the Connect Terms, or the supply or service contract together with the GTC (\u201cMain Contract\u201d).<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">1.2 This Agreement applies for as long as Gasyco processes personal data of the Customer on its behalf and, in the case of the Connect Services, in particular also during the retrieval period pursuant to clause 20.3 of the Connect Terms.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">1.3 Where Gasyco processes personal data for its own purposes, for example for contract performance, invoicing or compliance with legal obligations, Gasyco is itself the controller to that extent; this Agreement does not apply to such processing.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">2. Nature, Purpose and Scope of the Processing<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.1 Gasyco processes personal data exclusively for the provision of the Connect Services and the remote service, in particular for<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>the provision of the cloud dashboard and the management of user accounts,<\/li>\r\n\r\n<li>login, including two-factor authentication and single sign-on,<\/li>\r\n\r\n<li>the sending of quality reports, calibration certificates and alarm notifications,<\/li>\r\n\r\n<li>the logging of access and changes, for example to limit values,<\/li>\r\n\r\n<li>remote access, support, fault diagnosis and the installation of updates, and<\/li>\r\n\r\n<li>data backup and IT security.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.2 Categories of data subjects and data:<\/p>\r\n\r\n\r\n\r\n<figure tabindex=\"0\" class=\"wp-block-table\"><table><thead><tr><th>Data subjects<\/th><th>Data categories<\/th><\/tr><\/thead><tbody><tr><td>Users of the Customer (employees, commissioned third parties; in the case of rented-out devices, also employees of the operator)<\/td><td>Name, e-mail address, user role, login credentials, two-factor credentials, times and IP addresses of logins, logs of actions and changes<\/td><\/tr><tr><td>Recipients of reports and alarms<\/td><td>Name, e-mail address, mobile phone number, content and time of notifications sent<\/td><\/tr><tr><td>Contact persons of the Customer<\/td><td>Name, contact details, function<\/td><\/tr><tr><td>Persons who can be associated with a device or location<\/td><td>Location information of the device, operating actions on the device, insofar as they can be attributed to a person<\/td><\/tr><\/tbody><\/table><\/figure>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.3 Measurement and operating data of the devices are generally not personal data. Where, in individual cases, they can be attributed to a person, this Agreement also applies to them.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.4 Special categories of personal data within the meaning of Art 9 GDPR are not processed. The Customer shall ensure that it does not enter such data into the Connect Services or the devices.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.5 Processing in the context of the Connect Services takes place on Gasyco servers in Austria. In the case of remote service, Gasyco employees access the device remotely and store data only insofar as this is necessary for handling and documenting the service case. Gasyco uses the sub-processors listed in Schedule B for individual processing steps.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">2.6 If the Customer provides the device to a third party for use, for example by renting it out (\u201coperator\u201d), the Customer shall ensure that it has a legal basis for the processing of personal data of employees or agents of the operator and that these persons have been informed in accordance with Art 13 and 14 GDPR; where necessary, the Customer shall conclude a separate agreement with the operator for this purpose. Gasyco shall follow instructions from the operator only insofar as the Customer has authorised the operator to give them.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">3. Instructions<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">3.1 Gasyco processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless Gasyco is required to carry out the processing by Union law or Austrian law. In such a case, Gasyco shall inform the Customer of that legal requirement before the processing, unless that law prohibits such information.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">3.2 The instructions are set out in the Main Contract, this Agreement and the settings made by the Customer in the Connect Services and, in the case of remote service, result from the Customer\u2019s request or approval in the individual case. The Customer shall issue individual instructions in writing; e-mail is sufficient. Instructions that go beyond the agreed scope of services shall be deemed a request for a change to the services.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">3.3 If Gasyco considers that an instruction infringes the GDPR or other data protection provisions, Gasyco shall inform the Customer without undue delay. Gasyco may suspend the execution of the instruction until the Customer confirms or amends it.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">4. Confidentiality<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Gasyco shall ensure that all persons authorised to carry out the processing have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in particular pursuant to \u00a7 6 DSG. This obligation continues to apply after the end of their work for Gasyco.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">5. Security of Processing<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">5.1 Gasyco shall take the technical and organisational measures required under Art 32 GDPR. The measures in place at the time the contract is concluded are described in Schedule A.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">5.2 Gasyco may adapt the measures to technical progress, provided that the level of protection is not reduced. Gasyco shall document material changes and notify them to the Customer upon request.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">6. Sub-processors<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">6.1 The Customer grants Gasyco general authorisation to engage sub-processors. The sub-processors engaged at the time the contract is concluded are listed in Schedule B and are deemed approved.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">6.2 Gasyco shall inform the Customer by e-mail at least 30 days in advance of any intended addition or replacement of a sub-processor. The Customer may object to the change within this period on important data protection grounds. If Gasyco is unable to remedy the objection, either party may terminate the Main Contract with effect from the date on which the change takes effect.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">6.3 Gasyco shall contractually impose on each sub-processor the data protection obligations set out in this Agreement, in particular sufficient guarantees for appropriate technical and organisational measures. Gasyco shall be liable to the Customer for compliance with these obligations by the sub-processor.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">6.4 Services that Gasyco uses as purely ancillary services, such as telecommunications and mobile communications services for the mere transmission of data, or postal services, do not constitute sub-processing within the meaning of this Agreement. Gasyco shall take appropriate measures to protect the data in this respect as well.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">6.5 Gasyco may also have service and maintenance performed by the sales partner from which the Customer purchased or rented the device (\u201cservice partner\u201d, paragraph 7 of the clause \u201cDevice Data and Remote Service\u201d of the GTC). To that extent, the service partner is a sub-processor of Gasyco. It shall be given access only to the data of the devices it looks after, and only for service and maintenance. If the service partner is itself the Customer under this Agreement, for example because it rents out the device and has itself concluded the Connect subscription, it is the controller for those devices and not a sub-processor.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">7. Transfers to Third Countries<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Personal data shall be transferred to a country outside the European Economic Area, including by way of access from such a country, only if the conditions of Art 44 to 49 GDPR are met, in particular on the basis of an adequacy decision of the European Commission or of standard contractual clauses. The basis for each sub-processor is stated in Schedule B.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">8. Assistance to the Customer<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">8.1 Gasyco shall assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. If a data subject contacts Gasyco directly, Gasyco shall forward the request to the Customer without undue delay and shall not respond to it itself unless the Customer instructs otherwise.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">8.2 Taking into account the nature of the processing and the information available, Gasyco shall assist the Customer in ensuring compliance with the obligations pursuant to Art 32 to 36 GDPR, in particular with regard to data protection impact assessments and consultations with the data protection authority.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">8.3 Gasyco may charge for assistance services that go beyond the functions provided for in the Connect Services and are not attributable to a breach by Gasyco on a time-and-materials basis at the rates applicable at the time.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">9. Personal Data Breaches<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">9.1 Gasyco shall notify the Customer of a personal data breach without undue delay, where possible within 48 hours after becoming aware of it.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">9.2 The notification shall contain, insofar as known, the information referred to in Art 33(3) GDPR, in particular the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences and the measures taken or proposed to address the breach. Gasyco shall provide any information not yet available subsequently, without undue delay.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">9.3 Gasyco shall without undue delay take the measures necessary to contain the breach and to mitigate its possible adverse effects. Notification to the data protection authority and communication to the data subjects are the responsibility of the Customer.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">10. Deletion and Return<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">10.1 The Customer may download the raw data directly from the device via USB at any time. It may download quality reports and calibration certificates via the cloud dashboard. After the end of the Main Contract, this applies in accordance with clause 20.3 of the Connect Terms. Gasyco shall not return any data beyond this.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">10.2 After expiry of the retrieval period, Gasyco shall delete the Customer\u2019s personal data within 60 days, unless there is an obligation to store the data under Union law or Austrian law. Data in backups are overwritten in the course of the regular backup cycle, at the latest after 30 days, and are no longer processed until then.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">10.3 Gasyco shall confirm the deletion to the Customer in writing upon request.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">10.4 Clauses 10.1 and 10.2 do not apply to remote service without Connect Services. Gasyco shall delete personal data from a service case as soon as they are no longer required for handling and documenting that case and no statutory retention obligation precludes deletion.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">11. Evidence and Audits<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">11.1 Gasyco shall make available to the Customer upon request all information necessary to demonstrate compliance with the obligations under Art 28 GDPR.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">11.2 The Customer, or an auditor commissioned by it who is bound by confidentiality and is not a competitor of Gasyco, may verify compliance with this Agreement. On-site audits shall be announced at least 30 days in advance, shall take place during business hours and shall not disrupt operations disproportionately. They are limited to a maximum of one audit per calendar year, unless a personal data breach or an order by a public authority gives cause for a further audit.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">11.3 Gasyco may also provide evidence by means of suitable certifications, audit reports from independent bodies or a written self-assessment, insofar as this is reasonable for the Customer. The Customer shall bear the costs of an audit unless it reveals a material breach by Gasyco.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">12. Liability<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Art 82 GDPR applies to claims by data subjects. As between the Customer and Gasyco, the liability provisions of the Main Contract apply, unless Art 82 GDPR precludes this.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">13. Contact and Final Provisions<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">13.1 At Gasyco, the point of contact for data protection matters and notifications under this Agreement is: Maximilian Fischer\/ Managing Director, maximilian.fischer@gasyco.com, 0676 595 11 17. The Customer shall designate a corresponding point of contact to Gasyco.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">13.2 In the event of any conflict between this Agreement and the Main Contract, this Agreement shall prevail with regard to the processing of personal data on behalf of the Customer.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">13.3 Amendments and additions must be made in writing; e-mail is sufficient. Schedules A and B are adapted in accordance with clause 5.2 and clause 6.2 respectively.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">13.4 Should any provision be invalid, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by a provision that meets the requirements of Art 28 GDPR.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">13.5 The provisions of the Main Contract apply with regard to governing law and place of jurisdiction.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Schedule A: Technical and organisational measures<\/h2>\r\n\r\n\r\n\r\n<figure tabindex=\"0\" class=\"wp-block-table\"><table><thead><tr><th>Area<\/th><th>Measures<\/th><\/tr><\/thead><tbody><tr><td>Physical access control<\/td><td>Server in a locked server cabinet in Gasyco\u2019s warehouse in Austria; keys held only by the two Managing Directors; video surveillance of the two main entrances<\/td><\/tr><tr><td>System access control<\/td><td>Personal, password-protected user accounts; passwords of at least 8 characters, stored only as a salted hash (PBKDF2-SHA256); initial passwords assigned by the administrator must be changed at first login; login is temporarily locked after repeated failed attempts; two-factor authentication (authenticator app) technically enforced for all Gasyco administrators, optional for customer users; automatic logout after 30 minutes of inactivity; server administration only with a personal SSH key, root login and password login disabled<\/td><\/tr><tr><td>Data access control<\/td><td>Role and authorisation concept: customer users see only the devices of their company, and only for the period during which the device belongs to their company; sales partners see only the devices of their customers; user management, logs and device set-up only for Gasyco administrators; database accessible only within the server\u2019s internal network, the application operates with a database user without administrator rights<\/td><\/tr><tr><td>Transfer control<\/td><td>Dashboard accessible only via HTTPS (TLS 1.2 or 1.3, HSTS); devices with a current modem via an encrypted WireGuard VPN tunnel, legacy devices via Gasyco\u2019s own remote maintenance server (Secomea) with certificate verification; remote access to the user interface only via these connections and only after verification of authorisation; engineering access only with time-limited approval; access secrets such as two-factor keys, VPN keys and modem passwords are stored in encrypted form<\/td><\/tr><tr><td>Input control<\/td><td>Logging of all successful and failed logins (user, time, IP address only as a hash value), retention 365 days; change history of limit values with editor and time; logging of remote access to devices (user, device, type and start of access), retention three years; logs of SMS and e-mail dispatch, retention 365 days<\/td><\/tr><tr><td>Availability and resilience<\/td><td>Uninterruptible power supply to bridge short power outages; daily automatic backup of user, configuration, alarm and log data with a copy on a second server, retention 14 days; measurement data can be restored from the device files; restoration tested and documented; automatic security updates of the operating system; application updates by Gasyco, weekly automatic check of the software components used for known vulnerabilities; monitoring of services; blocking of repeated login attempts on the server<\/td><\/tr><tr><td>Separation control<\/td><td>Logical separation of data per customer by means of a central authorisation check on every access, safeguarded by automated tests; test environment with its own database, separate from the production environment; development using demo data<\/td><\/tr><tr><td>Organisation<\/td><td>Confidentiality undertaking by all employees with data access; briefing before access is granted; supervision by a person responsible for Connect; documented procedure for security incidents and recovery<\/td><\/tr><\/tbody><\/table><\/figure>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Schedule B: Sub-processors<\/h2>\r\n\r\n\r\n\r\n<figure tabindex=\"0\" class=\"wp-block-table\"><table><thead><tr><th>Sub-processor<\/th><th>Service<\/th><th>Place of processing<\/th><th>Basis where third countries are involved<\/th><\/tr><\/thead><tbody><tr><td>Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland<\/td><td>Sending of e-mail reports and e-mail alarms via Microsoft 365 (Microsoft Graph)<\/td><td>EU (Microsoft EU Data Boundary)<\/td><td>Access from the USA, for example in support: EU-US Data Privacy Framework and standard contractual clauses in the Microsoft Data Protection Addendum<\/td><\/tr><tr><td>The sales partner from which the Customer purchased or rented the device (service partner); name and address are stated in the quotation or order confirmation<\/td><td>Service and maintenance of the devices it has sold or rented out (service partner, clause 6.5): read access to device data and service data in the dashboard, remote access to the device only with the Customer\u2019s approval<\/td><td>Gasyco servers in Austria; access from the service partner\u2019s registered office<\/td><td>None, provided that the service partner has its registered office in the EEA; otherwise standard contractual clauses pursuant to clause 7<\/td><\/tr><\/tbody><\/table><\/figure>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">SMS alarms are sent by the device directly via the mobile network. The mobile network operator merely transmits the message and is therefore not a sub-processor (clause 6.4).<\/p>","protected":false},"excerpt":{"rendered":"<p>Anlage zu den Allgemeinen Gesch\u00e4ftsbedingungen und Anlage 1 zu den Connect \u2013 Leistungs- und Nutzungsbedingungen der Gasyco GmbH zwischen dem Kunden als Verantwortlichem (\u201eKunde\u201c) und der Gasyco GmbH, Hauptstra\u00dfe 122, 1140 Wien, als Auftragsverarbeiter (\u201eGasyco\u201c). 1. Gegenstand und Dauer 1.1 Diese Vereinbarung regelt die Verarbeitung personenbezogener Daten, die Gasyco im Auftrag des Kunden durchf\u00fchrt, und [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_seopress_titles_title":"","_seopress_titles_desc":"Auftragsverarbeitung der Gasyco GmbH nach Art 28 DSGVO f\u00fcr Connect Services und Fernservice: Weisungen, Sicherheit, Unterauftragsverarbeiter und L\u00f6schung.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","footnotes":""},"class_list":["post-3093","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/pages\/3093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/comments?post=3093"}],"version-history":[{"count":1,"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/pages\/3093\/revisions"}],"predecessor-version":[{"id":3095,"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/pages\/3093\/revisions\/3095"}],"wp:attachment":[{"href":"https:\/\/www.gasyco.com\/en\/wp-json\/wp\/v2\/media?parent=3093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}