Data Processing Agreement (DPA): Activento

§ 1 Subject Matter, Conclusion, Term and Order of Precedence

(1) This data processing agreement (“DPA”) specifies the data-protection rights and obligations of the parties arising from the contract on the use of the Activento platform (General Terms and Conditions, “Terms”). It governs the processing of personal data by Activento GmbH, Kolonnenstraße 8, 10827 Berlin, Germany (“Activento” or “Processor”) on behalf of its customer, the Operator within the meaning of the Terms (“Controller”), pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR).

(2) The DPA is concluded together with the Terms and forms part of the contract (§ 15 of the Terms). It is concluded in electronic form by express acceptance in the dashboard before the Platform is first used (§ 21 (1) of the Terms); no signature is required (Art. 28 (9) GDPR). Processing of personal data on the Operator’s behalf begins only upon that conclusion. Later versions are governed by § 15 (3). The DPA is offered as a standard document, uniformly for all Operators.

(3) The term of this DPA corresponds to the term of the main contract. Obligations which by their nature continue beyond the end of the contract (in particular confidentiality and deletion and return under § 14) remain in force.

(4) In the event of conflicts between this DPA and the Terms, this DPA prevails in matters of the processing of personal data on behalf of the Controller.

§ 2 Nature, Purpose and Location of the Processing

(1) The subject matter of the processing is the operation of the Activento platform for the Controller: the hosting, storage, organisation, display, transmission, analysis, backup and deletion of the data the Controller enters into the platform or that arises from its intended use.

(2) The processing comprises in particular the following operations:

collection and recording of booking and order data via the booking widget, the storefront, on-site sales and connected interfaces (including sales channels connected by the Controller),
storage and organisation of the data in tenant-separated databases,
generation and provision of documents (e.g. tickets, invoices, participant lists, reports),
sending of transactional e-mails to end customers on behalf of the Controller (e.g. booking confirmations),
provision of export and reporting functions,
blocking, anonymisation and deletion in accordance with this DPA and Annex 3.

(3) The processing takes place as a rule in data centres in the European Union (server location Germany). Transfers to third countries take place only in accordance with § 8 in conjunction with Annex 2. On request, Activento provides information on the storage locations.

(4) Activento may use data in irreversibly anonymised or aggregated form that no longer allows any reference to an identifiable person for statistical purposes and to improve the platform. The personal reference is not restored.

§ 3 Categories of Personal Data and Data Subjects

(1) The subject matter of the processing comprises in particular the following data categories:

end-customer data: master and contact data, booking and order data (booked services, dates, numbers and names of participants, prices), payment status data (no card data, payments run via the Controller’s own payment service providers), voucher and ticket data, communication data (e.g. booking confirmations, review requests),
end-customer data imported via sales channels (e.g. bookings from online travel agencies/OTAs), each with an indication of the channel of origin,
customer database/CRM data of the Controller (contact data, booking history, notes),
employee data of the Controller’s employees and agents (master data, roles and permissions, deployment and working times, wage and commission data, insofar as the corresponding modules are used),
billing and contact data of the Controller’s resellers, affiliates and other contractual partners.

(2) The categories of data subjects are in particular:

end customers and prospective customers of the Controller and participants of booked services,
employees and agents of the Controller,
resellers, affiliates and other contractual partners of the Controller and their contact persons.

(3) The platform is not intended for the processing of special categories of personal data (Art. 9 GDPR). If the Controller nevertheless enters such data (e.g. in free-text fields), it alone is responsible for the lawfulness of that processing.

§ 4 Responsibility and Right to Issue Instructions

(1) Within the scope of this DPA, the Controller is responsible for compliance with data-protection law, in particular for the lawfulness of the data processing (legal bases, required consents), informing the data subjects under Art. 13 and 14 GDPR, the accuracy of the data entered and safeguarding the rights of the data subjects.

(2) Activento processes the personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless Activento is required to process by Union or Member State law. In such a case, Activento informs the Controller of that legal requirement before processing, unless the law in question prohibits such information (Art. 28 (3) (a) GDPR).

(3) This agreement, the Terms and the Controller’s use of the platform functions (e.g. configuring products and e-mails, triggering exports, connecting services and sales channels) count as documented instructions. Individual instructions going beyond this require text form.

(4) If Activento is of the opinion that an instruction infringes the GDPR or other data-protection provisions, Activento informs the Controller without delay. Activento is entitled to suspend the execution of the instruction until the Controller confirms it.

(5) Activento implements instructions that go beyond the contractually agreed scope of services to the extent reasonable; reasonable remuneration may be agreed for this, insofar as statutory duties of assistance do not preclude it.

§ 5 Confidentiality

(1) Activento ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

(2) The confidentiality obligation continues after the end of the respective activity and after the end of the contract. The authorised persons are regularly instructed on data-protection requirements.

§ 6 Technical and Organisational Measures

(1) Activento implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. They take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk to the rights and freedoms of the data subjects.

(2) Activento may develop the measures further and replace them with equivalent or better measures; the agreed level of protection may not be reduced in doing so. Material changes are documented and Annex 1 is updated.

§ 7 Sub-processors (Further Processors)

(1) The Controller grants Activento general authorisation to engage further processors (sub-processors) for the processing (Art. 28 (2) GDPR). The sub-processors engaged at the time of conclusion of the contract are listed in Annex 2; Activento additionally publishes the current list on its website.

(2) Activento informs the Controller of the addition of new or the replacement of existing sub-processors at least 30 days before the intended engagement in text form (e-mail to the stored address or announcement in the dashboard). The Controller may object to the change for an important data-protection reason. If no reasonable solution is reached in the event of an objection, each party is entitled to terminate the main contract as of the date of the intended engagement of the new sub-processor.

(3) Activento imposes on each sub-processor, by contract, the same data-protection obligations as set out in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28 (4) GDPR). If a sub-processor fails to fulfil its data-protection obligations, Activento remains liable to the Controller for the performance of the sub-processor’s obligations.

(4) Services that the Controller itself selects, commissions and connects via the platform are not sub-processors of Activento, in particular the Controller’s own accounts with payment service providers, accounting connections, own cloud-storage destinations, outgoing webhooks configured by the Controller and connected sales channels. In that respect Activento transmits data solely on the Controller’s instructions; the legal relationship with these services is solely the Controller’s concern.

§ 8 Transfers to Third Countries

(1) Processing in a country outside the European Union or the European Economic Area takes place only if the special requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission or the EU standard contractual clauses, supplemented by additional measures where necessary.

(2) The sub-processors with a third-country connection and the respective transfer basis are set out in Annex 2. Activento continuously assesses the legal situation for third-country transfers and documents the assessment (transfer impact assessment) where necessary.

(3) If a transfer mechanism in use becomes invalid through legislation or an official or court decision, Activento switches the affected transfer without delay to a permissible replacement mechanism or suspends it until one is available.

§ 9 Assistance with Data Subject Rights

(1) Activento assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects (Art. 12 to 23 GDPR) (Art. 28 (3) (e) GDPR). For this purpose the platform provides in particular access, export, rectification and deletion functions as self-service functions.

(2) If a data subject from the Controller’s area of responsibility (e.g. an end customer) contacts Activento directly, Activento forwards the request to the Controller without delay and does not answer it itself unless it has a legal obligation of its own. Answering is the Controller’s responsibility.

§ 10 Notification of Personal Data Breaches

(1) Activento notifies the Controller without undue delay after becoming aware of a personal data breach affecting data processed on the Controller’s behalf. The notification contains, insofar as available at the time of notification, the information under Art. 33 (3) GDPR (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed); information not available is provided without undue delay afterwards.

(2) Activento assists the Controller in fulfilling its notification and communication obligations under Art. 33 and 34 GDPR (Art. 28 (3) (f) GDPR), documents breaches including their circumstances, effects and remedial measures, makes this documentation available to the Controller on request insofar as it concerns the Controller’s data, and takes appropriate measures without delay to secure the data and mitigate possible adverse effects.

(3) Activento does not make notifications to supervisory authorities or communications to data subjects within the Controller’s area of responsibility without the Controller’s instruction, unless it has a legal obligation of its own.

§ 11 Data Protection Impact Assessment and Further Duties of Assistance

(1) Taking into account the nature of the processing and the information available to Activento, Activento assists the Controller in complying with the obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations of the supervisory authority (Art. 28 (3) (f) GDPR), and to a reasonable extent in responding to enquiries from supervisory authorities concerning the processing on behalf of the Controller.

(2) Activento maintains a record of all categories of processing activities carried out on behalf of the Controller in accordance with Art. 30 (2) GDPR and provides the Controller on request with the information required for its own record (Art. 30 (1) GDPR).

§ 12 Rights to Evidence and Audit

(1) Activento makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28 (3) (h) GDPR). Evidence is provided as a rule by appropriate documentation, in particular the description of the technical and organisational measures (Annex 1), current attestations and certifications of the data centre and infrastructure providers used (e.g. ISO/IEC 27001), audit reports and self-assessments.

(2) If the evidence under paragraph 1 is justifiably insufficient in an individual case, the Controller may conduct a review, including in the form of an inspection, or have it conducted by an auditor bound to confidentiality who does not compete with Activento. Inspections take place after prior notice with a reasonable lead time (as a rule at least 14 days), during normal business hours, without disproportionate disruption of operations and without access to data of other Activento customers.

(3) Each party bears its own costs arising from an audit. For more than one audit without specific cause per calendar year, Activento may demand reasonable reimbursement of expenses; audits for a specific reason (e.g. after a data breach or by official order) remain unaffected.

§ 13 Access by Activento Staff (Support and Troubleshooting)

(1) Activento employees may access data in the Controller’s account on a case-by-case basis to resolve disruptions, to handle support requests and to ensure secure operation. Such access constitutes processing on behalf of the Controller within the scope of this DPA.

(2) Access is granted under technical control: it requires an individual, server-side verified approval, is tied to two-factor authentication and is logged. Support staff have no permanent, unconditional full access to customer data.

(3) For conversations with Activento AI (the AI assistant in the help chat), two cases are distinguished. First: questions about using the Platform and the conversations about them are support data that Activento processes as controller in its own right (section 12 of the privacy policy). Second: where the Controller's account owner has enabled data lookups by Activento AI, the assistant looks up the Controller's booking, order and customer data when a user asks, and only within the permissions of the user asking. Activento processes these data, and the parts of a conversation that contain them, on behalf of the Controller under this DPA; the enablement is an instruction within the meaning of § 4. The account owner can withdraw the enablement at any time in the settings; from the next message on, the assistant no longer looks up any data. In both cases, every individual read access by Activento staff to a conversation is logged (who, when, which conversation), and the conversations are automatically and permanently deleted 7 days after the conversation began (Annex 3). Where a user hands a conversation over to the support team, it becomes part of the resulting support request and is kept with it.

§ 14 Deletion and Return after the End of the Processing

(1) Data is returned via the platform’s export functions: the Controller can export its data itself at any time in structured, commonly used and machine-readable formats during the entire term of the contract and, after the end of the contract, during the read-only period of 30 calendar days (extended once by up to 30 further calendar days on timely request, § 19 of the Terms).

(2) After the export/retrieval period has expired, Activento deletes or anonymises the personal data processed on behalf of the Controller in the production systems (Art. 28 (3) (g) GDPR). In the event of termination of free accounts for inactivity, the grace period of 90 days under § 18 (4) of the Terms applies. Annex 3 summarises the individual periods.

(3) Backups are kept on a rolling basis and deleted automatically after 30 days. Data deleted from the production systems is therefore removed from the backups no later than 30 days after deletion. Until then, backups are used exclusively for recovery after disruptions; no targeted restoration of deleted data for other purposes takes place.

(4) On request, Activento confirms the deletion in text form.

(5) Activento’s statutory retention obligations (e.g. for its own billing records vis-à-vis the Controller) remain unaffected; to that extent the data is retained in blocked form and deleted after the period expires. The Controller is itself responsible for fulfilling its own commercial and tax retention obligations (e.g. §§ 238, 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)); timely export before the periods under paragraphs 1 and 2 expire is its responsibility.

§ 15 Liability and Final Provisions

(1) The liability provisions of the Terms (§ 14 of the Terms) apply to the liability of the parties towards each other. Liability towards data subjects under Art. 82 GDPR remains unaffected.

(2) The law of the Federal Republic of Germany applies. § 22 of the Terms applies accordingly to the place of jurisdiction and disputes.

(3) Amendments and additions to this DPA require text form. For amendments by Activento, the procedure under § 21 of the Terms applies accordingly: a new version is notified to the Controller in text form and presented in the dashboard for express consent; it takes effect only with that consent, and deemed consent through silence or continued use is not provided for. Until consent is given, including after expiry of the decision period under § 21 (4) of the Terms, the version last accepted by the Controller continues to apply unchanged and forms the basis of the processing under Art. 28 (3) GDPR; access to the Platform is neither restricted nor blocked because a consent is outstanding. Where a new version widens the scope of the processing, in particular by new processing purposes, new categories of personal data or of data subjects, or longer storage periods, Activento processes only within the scope of the version last accepted until consent is given; the functions concerned are enabled for the Controller only upon its consent. The addition or replacement of sub-processors is governed exclusively by § 7 (2), and the further development of the technical and organisational measures exclusively by § 6 (2); neither triggers the procedure under this paragraph. Should individual provisions be or become invalid, the validity of the remaining provisions remains unaffected.

(4) Notices under this DPA are given in text form: to the Controller at the e-mail address stored in the account or by announcement in the dashboard, to Activento via the contact channels named in the imprint.

(5) Translations of this DPA are for information only. The German version alone is authoritative.

Annex 1: Technical and Organisational Measures (Art. 32 GDPR)

The following measures describe the actual state of the Activento infrastructure. They are continuously developed further (§ 6 (2) DPA).

1. Confidentiality, physical and system access control:

operation in data centres of Hetzner Online GmbH in Germany; the data centres are certified to ISO/IEC 27001 and physically secured (access control systems, video surveillance, the operator’s security staff),
administrative server access only via encrypted connections with key-based authentication, restricted to a narrowly limited group of persons,
personalised user accounts; passwords are stored exclusively as cryptographic hashes; two-factor authentication is mandatory for all platform accounts including Activento staff and is set up at first login before the account can be used,
central, access-restricted management of credentials and secrets; no credentials in source code.

2. Confidentiality, data access and separation control:

role-based permission concept (RBAC) with granular rights per user and function,
strict tenant separation: every database query is restricted to the respective tenant; the separation is enforced at application level and continuously checked by automated tests in the development pipeline,
access by Activento staff to customer data only on a case-by-case basis via individually granted, server-side verified and logged approvals with mandatory two-factor authentication (§ 13 DPA),
pseudonymisation where possible: IP addresses are stored only where security and evidence require it (Annex 3); for abuse and rate limiting only briefly with automatic expiry; statistics functions work with daily changing, non-reversible identifiers instead of IP addresses; error reports pass through automatic removal of personal data.

3. Integrity, transfer and input control:

transport encryption (TLS) for all external connections; all backups (database backups and the backup copy of the file store) are stored encrypted,
no personal data in URL parameters; self-service links (e.g. “My booking”) use random, unguessable tokens,
personal downloads and dashboard endpoints are delivered with cache suppression (no caching in upstream systems),
structured, content-sparse logging: no e-mail contents, passwords or tokens in logs; changes to data are traceable via the application.

4. Availability and resilience:

daily automated database backups to separate object storage in the EU with 30-day retention and a documented, tested recovery procedure,
continuous technical monitoring (monitoring, alerting) on own infrastructure,
protection against overload and attack traffic through the DDoS mitigation in the hosting provider's data-centre network,
system hardening, prompt security updates, limitation of publicly reachable services.

5. Procedures for regular review, assessment and evaluation:

automated security checks in the development pipeline before every release (including secret scanning, dependency checks and static checks of tenant separation) plus weekly vulnerability scans of the container base images,
four-eyes principle (code review) for changes to the platform,
defined process for security incidents including documentation (§ 10 DPA),
data protection by design and by default, including storage limitation in practice (automatic deletion concepts under Annex 3).

Annex 2: Sub-processors (as of October 2026)

Activento engages the following sub-processors at the time of conclusion of the contract. Changes are governed by § 7 DPA; the current list is published on the Activento website.

Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany: hosting of the platform, databases and object storage (documents, media, backups); server location Germany/EU.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: name resolution (DNS) for the platform's domains. Cloudflare only answers DNS queries and in doing so processes the queried domain name and the IP address of the querying DNS resolver; requests to the platform and content data do not pass through Cloudflare. When checking a custom domain the Controller has connected, the platform also queries Cloudflare's public DNS resolver; only the domain name is transmitted. Transfer basis: EU standard contractual clauses or the EU-US Data Privacy Framework.
Brevo SAS (formerly Sendinblue), 7 rue de Madrid, 75008 Paris, France: sending of transactional e-mails (e.g. booking confirmations to end customers, account e-mails) and receipt of support e-mails addressed to Activento; processing in the EU.
Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands: technical payment connection (Mollie Connect) and collection of the platform fees. For the Controller’s payment processing vis-à-vis its end customers, the Controller has its own contract with Mollie; to that extent Mollie is not a sub-processor of Activento.
Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland: technical payment connection (Stripe Connect) for Controllers who connect their Stripe account: order reference, amount and currency of orders paid via Stripe; end customers enter their payment data directly with Stripe. Processing in the EU; a transfer to the USA (Stripe, LLC) is possible on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. For the Controller’s payment processing vis-à-vis its end customers, the Controller has its own contract with Stripe; to that extent Stripe is not a sub-processor of Activento.
Mistral AI SAS, 15 rue des Halles, 75001 Paris, France: Activento AI, the AI-supported support assistant (processing of support conversations and, where data lookups are enabled, of the Controller's customer and booking data that the assistant looks up to answer a question) and the machine translation, triggered by the Controller, of its ticket templates, offer text snippets, website texts, translation hub texts and seating plan texts; processing in the EU.
Expo (650 Industries, Inc.), 624 University Avenue, Palo Alto, CA 94301, USA: delivery of push notifications to devices of the Controller’s users (mobile app). Push contents are limited to the necessary minimum and contain no contact data of end customers. Transfer basis: EU-US Data Privacy Framework and, in addition, EU standard contractual clauses.
fiskaly GmbH, Franz-Josefs-Kai 33, 1010 Vienna, Austria: technical security device (cloud TSE) under the German KassenSichV for registers in Germany and signature creation unit and register registration under the Austrian RKSV (fiskaly SIGN AT, reporting to FinanzOnline) for registers in Austria: Activento creates and operates one managed fiskaly organisation per Controller; processed are the Controller’s legal name, address and tax number/VAT ID, the signed register transactions (receipt data without end-customer contact details) and, for Austrian registers, the Controller’s FinanzOnline web service credentials (participant id, user id, PIN), which Activento passes through to fiskaly and does not store. Processing in the EU; the security module (SMAERS) runs at Google Cloud EMEA Limited (Ireland) in the Frankfurt region.

Services connected by the Controller itself are not sub-processors (§ 7 (4) DPA), in particular its own accounts with payment service providers (e.g. Mollie, PayPal, Stripe), accounting connections (e.g. Lexware Office), services for the electronic signature of offers connected through its own account (e.g. Yousign), own cloud-storage destinations, self-configured outgoing webhooks and connected sales channels (OTAs).

Annex 3: Deletion and Retention Periods

End of contract (termination): 30 calendar days of read-only access with full export access, extended once by up to 30 further calendar days on timely request (§ 19 of the Terms); thereafter deletion or anonymisation of the Controller’s data.
Termination of free accounts for inactivity (§ 18 (4) of the Terms): announcement 30 and 7 days in advance; after deactivation a 90-day grace period with export possibility; thereafter permanent deletion.
Ticket PDF files: automatic deletion 18 months after creation; on renewed retrieval the document is regenerated from the continuing booking data (storage limitation; no loss of information).
Conversations with Activento AI (help chat): automatic, permanent deletion 7 days after the conversation began; every individual read access by Activento staff is logged (§ 13 (3) DPA). Support cases arising from a handover to the support team remain unaffected.
Backups: rolling retention of 30 days; deleted data is removed from the backups no later than 30 days after deletion from the production systems (§ 14 (3) DPA).
IP addresses: for abuse and rate limiting only short-lived storage with automatic expiry. Beyond that, Activento keeps IP addresses in the session records of user accounts (deleted 90 days after the session expires or is revoked), in the per-account usage log for sign-in events (12 months, readable by Activento staff only), as evidence of contract acceptance (for the term of the contract) and in central system logs (at most 30 days). Rating elements on the Controller’s websites store a check value derived from the IP address while the element is published, if one vote per IP is enabled.
Activento’s own records subject to statutory retention obligations (e.g. statements vis-à-vis the Controller): blocked retention for the duration of the statutory periods, then deletion. To that extent Activento acts as controller in its own right, not as processor.