Back to website

Data Processing Agreement (DPA)

pursuant to Art. 28 General Data Protection Regulation (GDPR)
Version: October 2026

Between

the Customer / Tenant
(hereinafter referred to as the “Controller”)

and

CreativeBytes e.U. — Owner: Michael Fichtinger
Industriestraße 9, 6841 Mäder, Austria
(hereinafter referred to as the “Processor”)

(individually a “Party” and collectively the “Parties”)

1. Subject Matter and Term of the Agreement

1. The Processor provides Software-as-a-Service (SaaS) virtual queue management services under the name EntraLane to the Controller as specified in the Main Agreement (Terms of Service). 2. Within the scope of this Agreement, the Processor processes personal data on behalf of and under the instructions of the Controller pursuant to Art. 4(8) and Art. 28 GDPR. 3. The term of this Agreement corresponds to the term of the Main Agreement. Termination of the Main Agreement automatically terminates this Agreement.

2. Nature and Purpose of Processing, Types of Data, and Categories of Data Subjects

2.1 Nature and Purpose of Processing

Provision of the cloud-based EntraLane queuing, kiosk, TV call screen, and desk terminal platform, including hosting, data storage, real-time synchronization (SignalR/WebSockets), and operational analytics.

2.2 Categories of Data Subjects

  • check_circleEmployees, operators, and authorized agents of the Controller (Administrators, Desk Operators).
  • check_circleVisitors, customers, or patients of the Controller obtaining a queue ticket (pseudonymized ticket records).

2.3 Types of Personal Data

  • check_circleController Staff Data: Name / pseudonym of desk operator, cryptographic PIN hash (PBKDF2 with salt), administrator login email, timestamps of service desk activity (logins, calls, service duration).
  • check_circleVisitor and Queue Ticket Data: Phonetic random mnemonic token (e.g., Silver Fox #42), queue service category, timestamps (wait time, call time, completion time), ephemeral web push subscription tokens (if opted-in by the visitor).
  • check_circleNote: The system by design collects no real names, no email addresses, and no phone numbers for waiting visitors (Privacy by Design).

3. Obligations of the Processor

1. Instruction-bound Processing: The Processor processes personal data exclusively on documented instructions from the Controller (Art. 28(3)(a) GDPR). 2. Confidentiality: The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). 3. Security of Processing (Art. 32 GDPR): The Processor implements all required technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk (see Schedule 1). 4. Assistance to the Controller: The Processor assists the Controller in responding to data subjects exercising their rights under Chapter III GDPR (Art. 12–23) and in ensuring compliance with Art. 32 to 36 GDPR. 5. Breach Notification: The Processor notifies the Controller without undue delay, and at the latest within 48 hours, upon becoming aware of a personal data breach. 6. Deletion or Return of Data: Upon termination of the processing services, the Processor shall, at the choice of the Controller, delete or return all personal data, unless applicable EU or Member State law requires retention.

4. Sub-Processors

1. The Controller grants the Processor general written authorization to engage sub-processors pursuant to Art. 28(2) GDPR. 2. The following sub-processors are approved: - Hetzner Online GmbH (Gunzenhausen, Germany): Cloud hosting, core infrastructure, relational database storage (EU / Germany). - Cloudflare, Inc. (San Francisco, USA): Content Delivery Network (CDN), DDoS mitigation, bot defense (Turnstile), and encrypted object storage (R2) for organization logos (EU-US Data Privacy Framework / Standard Contractual Clauses). - Stripe Payments Europe, Ltd. (Dublin, Ireland): Payment processing and subscription management. - World4You Internet Services GmbH (Linz, Austria): Transactional SMTP email delivery for account verifications, password resets, and operator invitations (EU / Austria). - Apple (APNs), Google (FCM), Mozilla (Autopush), Microsoft (WNS): Transient relay of end-to-end encrypted (RFC 8291), pseudonymous Web Push notification payloads when a visitor explicitly opts into browser push alerts. 3. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other sub-processors. The Controller has the right to object on reasonable data protection grounds.

5. Audits and Inspections

1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR. 2. The Controller has the right to conduct audits or inspections during regular business hours upon reasonable prior notice, either directly or through an independent auditor bound by confidentiality.

Schedule 1: Technical and Organizational Measures (TOMs)

The Processor maintains the following technical and organizational security measures:

1. Physical and Infrastructure Access Control: - Hosting in ISO 27001 certified state-of-the-art data centers operated by Hetzner Online GmbH in Germany. - Strict multi-factor authentication (MFA) required for administrative SSH and database access. 2. Logical Access Control and Tenant Isolation: - Strict logical multi-tenant separation enforced at the database layer via TenantId with automated Global Query Filters in the ORM framework. - Cross-tenant data leakage is structurally prevented. - Role-Based Access Control (RBAC) enforced via digitally signed JWT tokens. 3. Encryption (Art. 32(1)(a) GDPR): - End-to-end transport encryption (HTTPS / TLS 1.3 with HSTS) across all web and WebSocket connections. - Operator PINs are hashed using PBKDF2 with individual per-operator salts. 4. Resilience and Availability: - Automated daily offsite backups with point-in-time recovery. - Distributed denial-of-service protection and global edge distribution via Cloudflare.