Data processing agreement (DPA)

1. Parties and scope

The processor is 70six – Thomas Peter Webconsulting, owner: Thomas Peter, Odenwaldstraße 7, 63814 Mainaschaff, Germany, email: hallo@bleibt.app. The controller is the customer who selects “business, club, organisation” at purchase and confirms this agreement in the order process.

The agreement is concluded with this confirmation. We store the version, the customer and the time of confirmation. It applies to the processing of the event content that the customer collects with bleibt.app for their event. For bleibt's own purposes (account, billing, security) we are the controller ourselves; the privacy policy applies to that.

2. Subject matter and duration

The subject matter is the operation of the digital event album: receiving, storing, technically preparing (previews, playback versions), providing and exporting the content uploaded by guests and hosts.

The agreement lasts for the duration of the event album including the album period and any extensions. It ends with the deletion of the event content under section 10.

3. Nature, purpose and categories of data

The purpose is to provide the event album to the customer and their guests according to the event settings chosen by the customer.

Categories of data: uploaded photos, videos and voice messages including the image, audio and metadata they contain; file name, file type, size, upload time; optional guest names, categories and answers to audio questions; event data and invitation details; contact details of hosts (email address, display name).

Data subjects: guests and participants who upload content or are shown or heard in it, as well as hosts and their employees or members.

4. Instructions

We process the data only on the customer's documented instructions. The instructions result from this agreement and the settings and actions chosen by the customer in the dashboard (for example upload, display, export, deletion). Additional instructions can be given by email to hallo@bleibt.app where feasible.

We inform the customer if we consider an instruction unlawful. We do not use event content for our own purposes, for advertising profiles or to train AI models; no face recognition takes place.

5. Confidentiality

Persons with access to the data at our side are bound to confidentiality. Access takes place only where necessary for operation, support, security, technical processing or deletion requests.

6. Technical and organisational measures

Media is stored in private storage areas. Reading and downloading take place through time-limited links; there are no permanently public file addresses.

The host's access is restricted by sign-in, server-side authorisation checks and database access rules. Event links use hard-to-guess identifiers; the host can optionally enable a PIN.

Transmission is encrypted via HTTPS (TLS). For abuse protection and rate limiting only a hash value of connection details is used.

Access keys with broad privileges exist only on the server and not in the browser. No face recognition takes place and the content is not used to train AI models.

7. Sub-processors

The customer agrees to the use of the following service providers; Supabase, Hetzner and Resend are sub-processors.

Supabase – database, sign-in and private media storage. Processing location: project region Frankfurt am Main (EU); provider information at https://supabase.com/privacy.

Hetzner Online GmbH – hosting of the application and processing of media. Provider based in Gunzenhausen, Germany.

Resend – sending service emails (notices about storage, deadlines and export) where this sending is enabled. Processing location according to the provider's information.

Stripe – payment service provider for purchases, not a sub-processor for event content. Stripe does not receive event content and processes payment data partly under its own responsibility (see the privacy policy). Processing location according to the provider's information.

We inform the customer by email or in the dashboard before additional sub-processors are used or replaced. The customer may object for an important data protection reason within 14 days; without agreement, either side can end the agreement for the affected album.

8. Data subject rights and assistance

We support the customer with suitable means in answering requests from data subjects (access, rectification, erasure, restriction, portability, objection). Requests that reach us and concern the customer are forwarded to the customer. The host can delete and export individual content or the whole event in the dashboard.

Within our possibilities we also support the customer with data protection impact assessments and cooperation with supervisory authorities where they concern processing under this agreement.

9. Notification of breaches

We inform the customer without undue delay after becoming aware of a personal data breach in connection with this processing and provide the information known to us that the customer needs for their notification duties.

10. Deletion and return

The customer can export the content in the dashboard before the album ends. After the album period expires or on deletion by the customer, the event content is deleted unless a statutory retention duty applies. Deletion can take place with technical delay; details are in the privacy policy.

Purchase and invoice data subject to statutory retention duties contain no event content and are retained separately.

11. Evidence and audits

On request we provide the information necessary to demonstrate compliance with this agreement. Audits by the customer or an auditor appointed by the customer are possible after reasonable notice and during normal business hours, provided they do not impair operations or confidentiality towards other customers.

For questions about this agreement you can reach us at hallo@bleibt.app. The version of the agreement stored at confirmation applies.