Legal

Data processing agreement (Art. 28 GDPR)

Version of 29 October 2026. For business customers whose SR Anywhere modules run on their websites: in delivering the modules we process the visitors' requests on the customer's behalf. This agreement forms part of the Terms of service and is concluded in electronic form (Art. 28 (9) GDPR) when the customer accepts them; no signature is needed. Annex 1 describes the processing, Annex 2 the technical and organisational measures, Annex 3 is the sub-processor list.

between the customer named in the SR Anywhere account ("Controller") and ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany, info@themepunch.com ("Processor"); the Processor's data protection contact is Dirk Gavor, partner, info@themepunch.com.

1. Subject matter and duration

1.1 The Processor provides SR Anywhere: a service to build animated modules and to deliver them to the Controller's websites (the "Service", governed by the Terms of service). In delivering modules to the visitors of the Controller's websites and in counting their views, the Processor processes personal data on behalf of the Controller. 1.2 This agreement applies for as long as the Controller holds an account with published modules, and until the data under 9 is deleted.

2. Nature, purpose, data, data subjects

As described in Annex 1. The Processor processes the data only for the delivery and the operation of the Service.

3. Instructions

3.1 The Processor processes personal data only on the Controller's documented instructions. The instructions are: the Terms of service, this agreement, and the settings the Controller makes in the account (the domains, the modules, the media, the consent tool and YouTube no-cookie settings, the fonts setting). Further instructions in text form. 3.2 The Processor informs the Controller without delay if an instruction in its view infringes the GDPR.

4. Confidentiality

Persons authorised to process the data are bound to confidentiality. Access to customer accounts by the Processor's staff happens only with the Controller's permission given in the account (support access), for a limited time, and is logged in the account.

5. Security (Art. 32)

The Processor implements the measures in Annex 2 and keeps them current with the state of the art; it may change them as long as the level of protection does not fall.

6. Sub-processors

6.1 The Controller authorises the sub-processors in Annex 3 (a general authorisation). The Processor informs the Controller of an intended new sub-processor or a replacement at least 30 days before it takes up work, on the processor page and by mail to every Controller who asked to be told (a mail to info@themepunch.com with the subject "Sub-processor updates" is enough); the Controller may object on reasonable grounds within that period, in which case the parties seek a solution and, failing that, the Controller may terminate the affected part of the Service. 6.2 The Processor imposes the obligations of this agreement on every sub-processor by contract and remains liable for its performance.

7. Data subjects' rights

The Processor supports the Controller with appropriate measures in answering data subjects' requests (Art. 12–22). As the Processor holds no data that identifies a visitor beyond the moment of delivery (Annex 1), such requests will in most cases be answered by the Controller alone; the Processor forwards requests it receives.

8. Personal data breaches, assistance

8.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning the Controller's data, with the information Art. 33 (3) requires as far as it is available. 8.2 The Processor assists the Controller with Art. 32–36 (security, breach notifications, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available.

9. Deletion and return

At the end of the Service (the account deleted, or a module unpublished) the Processor deletes the personal data processed on behalf of the Controller as set out in the privacy policy's retention table — view counts remain as aggregate numbers without personal reference — unless Union or Member State law requires storage. Copies in the backups (Annex 2) are gone about 30 days after the deletion. The Controller exports its own data at any time (Settings → Download my data).

10. Audits

10.1 The Processor makes available the information necessary to demonstrate compliance with Art. 28 and this agreement: this document, Annex 2, the sub-processors' certifications and audit reports (Cloudflare's, Brevo's and the AI provider's SOC 2 / ISO 27001 reports as they are published). 10.2 Where that is not sufficient, the Controller may audit once a year, or on the occasion of a breach, with 30 days' notice, during business hours, at its own cost, by itself or an independent auditor bound to confidentiality; audits of sub-processors are done through the sub-processors' own reports.

11. International transfers

The modules and media are stored in the European Union: the Service's database and file storage, and the backup of the files, are kept at Cloudflare with its EU jurisdiction set. Processing takes place in the EU and the UK, and at Cloudflare's edge worldwide where a visitor is (delivery, its cache, the short key records the edge reads to deliver a module, which Cloudflare replicates worldwide, and the view counts in Cloudflare's analytics store); the language model on Amazon Bedrock in AWS's EU Regions, or at OpenAI Ireland Ltd when the AI service uses its second engine. Transfers outside the EEA rest on adequacy decisions (UK, Israel), the EU-US Data Privacy Framework for certified providers (Cloudflare), or the Standard Contractual Clauses (Commission Decision 2021/914) in the sub-processors' agreements, as listed in Annex 3.

12. Liability, precedence

The Parties' liability under this agreement follows the liability provisions of the Terms of service; nothing in this agreement limits either Party's liability towards data subjects under Art. 82 GDPR. This agreement prevails over the Terms in matters of data protection. German law applies; where the Controller is a merchant, a legal entity under public law or a special fund under public law, the venue is Köln. The rights of data subjects under Art. 79 GDPR stay unaffected.

Annex 1 — The processing

Subject: delivery of the Controller's modules (scripts, content, media, fonts) to visitors of the Controller's websites; counting of views. Nature: transmission at request; counting; storage of the modules and media the Controller created (the Controller's own data, not visitors'). Purpose: performance of the Service as agreed in the Terms. Data subjects: visitors of the Controller's websites; the Controller's users of the Service (the account's members). Categories of data: for visitors — the IP address and the browser request (user agent, page referrer) at the moment of delivery, processed at Cloudflare's edge and not stored by the Processor; the host name of the page a module was shown on and the count of views per module and month (no personal reference). For members — the e-mail address, sign-in times, the modules and media they create, help requests. Special categories: none intended; the Controller ensures its modules carry no special categories of data. Duration: the life of the account; visitors' request data only for the moment of delivery.

Annex 2 — Technical and organisational measures

• Hosting and delivery on Cloudflare (ISO 27001, SOC 2 Type II): DDoS protection, WAF, TLS 1.2+ in transit on every route; storage encrypted at rest (D1, R2, KV); the database (D1) and the file storage (R2) with Cloudflare's EU jurisdiction, stored only in the EU; the delivery's key records (KV) and the edge network worldwide.
• Access to systems: personal staff logins only (no shared password since 2026-09-24); the Cloudflare account is held by the partners; secrets are set outside the code and never in the repository; deployments only on the responsible partner's go.
• Access to customer data: staff sees an account's master data only; module content only with the customer's permission (support access: time-limited, read only unless "may change", revocable, every step logged for the customer); AI preparation of help requests reads module content only under that permission and logs it.
• Authentication: sign-in by single-use mailed links (60 minutes), only hashes stored; sessions as HttpOnly cookies; rate limits per address and per network (hashed IPs, one day).
• Data minimisation: view counts are aggregates per module, host and month; no cookies or identifiers in visitors' browsers; fonts served from the edge so visitors' browsers do not contact Google; help requests are pseudonymised before any AI provider sees them.
• Separation: every database query is scoped to the account; tenant isolation is part of the automated test suites run before every deployment.
• Retention: the schedule of the privacy policy, enforced by daily jobs (help requests anonymised after 24 months, attachments deleted after 90 days, mail logs after 180 days, rate-limit hashes after a day).
• Backups and recovery: the database (Cloudflare D1) can be restored to any minute of the last 30 days (D1 Time Travel); modules and media in Cloudflare R2 are stored redundantly by Cloudflare and copied every night into a separate backup bucket, also in the EU. Deleted data stays in the backups for about 30 days, the files of an erased account included; the backup keeps only the newest copy of each object, no older versions. The services are deployed from a version-controlled repository and can be redeployed at any time. Published modules keep rendering when the portal is unavailable.
• Logging: Worker logs with technical data for a short period; support actions logged in the account.
• Sub-processor management: the list in Annex 3, contracts under Art. 28, notice before changes.
• Confidentiality: everyone we authorise to process personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.
• Review: the measures are reviewed at least once a year and on every change of the architecture.

Annex 3 — Sub-processors

The processors and sub-processors list, as current on the date of acceptance and as updated under section 6.