When do I need a commissioned processing agreement (GDPR)?

We check which data you send us, not which products you select:

Pure postal addresses (street, house number, postcode, city and country) are not personal data and do not require an order processing agreement. The same applies to the VAT identification number.

However, as soon as a name, an e-mail or a telephone number is transmitted to us, we require an agreement.

For the purposes of this Regulation, the term:

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Source: https://dsgvo-gesetz.de/art-4-dsgvo/ (excerpt. Translated by DeepL.com)

The data protection principles should apply to any information relating to an identified or identifiable natural person. Personal data subject to pseudonymisation which could be attributed to a natural person by reference to additional information should be considered as information relating to an identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of any means reasonably likely to be used by the controller or by any other person to identify the natural person, directly or indirectly, such as singling out. 

In determining whether means are generally likely to be used to identify the natural person, all objective factors, such as the cost of identification and the time required for it, should be taken into account, taking into account the technology and technological developments available at the time of the processing. 

The principles of data protection should therefore not apply to anonymous information, that is to say, information which does not relate to an identified or identifiable natural person, or personal data which has been rendered anonymous in such a way that the data subject cannot be identified or can no longer be identified. This Regulation therefore does not concern the processing of such anonymous data, including for statistical or research purposes.

Source: https://dsgvo-gesetz.de/art-4-dsgvo/ (excerpt. Translated by DeepL.com)

* This title is an unofficial description of the recital.

What is clear: Adresslabor is the contractor of a commissioned processing. You as the client outsource the verification of your data to an external service provider.

Now it depends on whether you send us personal data for verification or only anonymised data. In the first case, we need a commissioned processing agreement with you. In the case of anonymised data, however, not necessarily.

The decisive factor is the transmission to us, not the chosen test. We may only process personal data with an agreement. 

At the moment, we assume that a pure address check (you only transmit street, postcode and city) does not process any personal data. Just as little as a pure VAT ID number check. We do not need an order processing agreement for this.

Everything else is personal data, i.e. e-mail, telephone and name.

It is not always clear when the GDPR applies and when it does not. Therefore, in case of doubt, we will insist on the conclusion of a commissioned processing agreement and block our services for you as long as this is not available.

We ask for your understanding in this regard. 

We have always been and will continue to be a reliable partner for your order processing and uphold data protection in the process. If you have any questions, suggestions, tips or further information, please do not hesitate to contact us.

Ihr Adresslabor

Rolf Paschold

prof@adresslabor.de

Mobil: +49 (0) 170 3 55 22 01

If you would now like to conclude our contract processing agreement electronically, you can do so here. Afterwards, you will receive an email with the contract documents including our technical-organisational measures (TOM). In addition to the brief instructions there, we have provided detailed instructions.

Alternatively, you can send us your version of the agreement. We will check it promptly and return it signed. You can download our TOM here, which saves paper and postage and is environmentally friendly.