Data Processing Agreement

Agreement on data processing under Art. 28 GDPR (German: DSGVO) between the customer as controller (hereinafter the “Customer”) and

Steven Braun
Widget Fox
Voltastraße 1
30165 Hannover
Deutschland
Email: info@widget-fox.com

as processor (hereinafter the “Processor”).

§ 1 Subject matter and duration

The Processor provides the services of Widget Fox to the Customer under the Terms (main contract). In doing so, it processes personal data on behalf of the Customer. This agreement sets out the obligations of both sides in this respect.

The agreement applies for as long as the main contract exists, and beyond that for as long as the Processor processes data of the Customer.

§ 2 Nature, purpose, types of data and data subjects

Delivery of the widgets

• Purpose: delivery of the widget files to visitors of the Customer’s website and counting of the views for the limits of the plan.
• Data subjects: visitors of the Customer’s website.
• Types of data: IP address, date and time, file requested and browser details (user agent) in the server logs of the CDN.
• Nature of processing: delivery through the CDN; once a day, reading out the requested files from the logs and storing the number of views per widget and day. The Processor does not store IP addresses.

Reviews and Instagram posts

• Purpose: display of the reviews of the Google profile connected by the Customer, or of the posts of the Instagram account connected by the Customer, in the widget on the Customer’s website.
• Data subjects: authors of reviews, owners who reply to reviews, and persons who can be seen in images in reviews or posts.
• Types of data: displayed name, profile photo, stars, text, date and photos of a review, reply of the owner; for Instagram, image or preview image, caption, date and link of a post.
• Nature of processing: retrieval of the publicly accessible content (sync), storing, copying the images to the storage of the CDN, creating and delivering the widget file, removing content that no longer appears at the source.

If several customers connect the same profile or account, the Processor retrieves and stores it only once for technical reasons. It does not use the data for its own purposes.

§ 3 Instructions

The Processor processes the data only on documented instructions from the Customer, including with regard to transfers to a third country, unless it is required to do so by Union or Member State law; in that case it informs the Customer of this requirement before processing, unless that law prohibits this.

Instructions are this agreement, the main contract and the settings the Customer makes in the dashboard, in particular connecting a profile or account and the filters of a widget. The Customer gives further instructions by email.

If the Processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the Customer without undue delay.

§ 4 Confidentiality

The Processor ensures that all persons authorised to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

§ 5 Security of processing

The Processor takes the technical and organisational measures under Art. 32 GDPR described in the annex. It may adapt them to the state of the art as long as the level of protection does not fall.

§ 6 Sub-processors

The Customer authorises the use of the following sub-processors:

• Bunny.net (BunnyWay d.o.o., Slovenia): CDN and storage for widget files and copied images, delivery to visitors.
• Apify (Apify Technologies s.r.o., Czech Republic): retrieval of the public reviews and Instagram posts. According to Apify, processing is also possible in the USA and other countries; the basis is standard contractual clauses.
• Supabase (Supabase Inc., USA): database, region Frankfurt am Main. The basis for processing outside the EU is standard contractual clauses.
• Cloudflare (Cloudflare, Inc., USA): operation of the dashboard and of the processing on the server. The basis is the EU-US Data Privacy Framework and standard contractual clauses.

The Processor grants the Customer a general authorisation for further sub-processors in the following form: it informs the Customer by email in advance of every intended addition or replacement. The Customer can object within 14 days of receipt. If the parties do not reach an agreement, the Customer can terminate the main contract at the time of the change.

The Processor binds every sub-processor by contract to the same data protection obligations that are laid down in this agreement. It is liable to the Customer for the sub-processor’s compliance with these obligations.

Stripe and Link are not sub-processors; they process the Customer’s payment data as controllers in their own right.

§ 7 Assistance with the rights of data subjects

The Processor assists the Customer with appropriate measures in responding to requests from data subjects for access, rectification, erasure, restriction, objection and data portability. If a data subject contacts the Processor directly, it forwards the request to the Customer without undue delay, as far as it can be attributed to the Customer. If a reviewer demands that their review, name or photo no longer be shown, the Processor removes this content from the widget after consulting the Customer.

§ 8 Assistance with security, notifications and impact assessment

The Processor assists the Customer in complying with the obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to it. It notifies the Customer of a personal data breach without undue delay after becoming aware of it, with the information the Customer needs for its own notification.

§ 9 Deletion after the end of the contract

After the end of the services, the Processor deletes the Customer’s data processed on its behalf, unless there is an obligation to store it under Union or Member State law. If the Customer deletes their account, the Processor removes the widget files from the CDN and deletes the Customer’s widgets and the figures of their views. Reviews and posts of a profile or account that widgets of other customers also use stay stored for them.

If the Customer demands that the data be handed over before the end of the contract, the Processor provides it to them in a common format by email.

§ 10 Evidence and audits

The Processor makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer. The Customer announces inspections with reasonable notice; they take place during normal business hours without disproportionately disrupting operations. As evidence, the Processor may also present self-disclosures and documents of its sub-processors.

§ 11 Final provisions

This agreement is concluded electronically together with the main contract (Art. 28 para. 9 GDPR). In the event of contradictions between this agreement and the main contract, this agreement takes precedence on matters of data protection. For liability, the main contract applies, unless Art. 82 GDPR provides otherwise.

Annex: Technical and organisational measures

Confidentiality

• Access to the dashboard only after logging in through a link that is sent to the Customer’s email address; the link leads only to the fixed address of the dashboard.
• Separation of the data per customer through row level security in the database: a customer can read only the data of their own widgets.
• Write access to profiles, reviews, posts, subscription data and views only through the server role; customers cannot change this data themselves.
• Access keys to the services are stored only in the settings of the respective providers, not in the source code.

Integrity

• All connections between browser, dashboard, database, CDN and the services are encrypted with TLS.
• Notifications from Stripe and Apify to the server are accepted only if their signature or secret is correct.

Availability and resilience

• The widgets are delivered as finished files from the CDN and also work when the dashboard cannot be reached.
• If a sync fails, the last successful state stays in the widget.

Data minimisation

• No storage of visitors’ IP addresses; only the number of views per widget and day is stored.
• The widgets set no cookies and use no storage in the visitors’ browser.
• Content that no longer appears at the source is removed from the widget at the next sync.

Review

• The Processor reviews these measures regularly and adapts them when technology or risks change.

Version as of: 12 October 2026