Data Processing Agreement

under Art. 28 GDPR for the rented servers on boothcloud.de

Last updated: 4 November 2026 · Deutsche Fassung

This is a translation for convenience. The German version is legally binding.

Parties

Controller (hereinafter “Customer”):
the business that books a server through the customer area on boothcloud.de, with the name and address given in its order.

Processor (hereinafter “Provider”):
Thomas Michael Müller – RAWCaptureBooth
Fichtenstr. 10C
85659 Forstern
Germany
hello@rawcapturebooth.app

Preamble

Under the rental agreement the Customer concludes when booking on boothcloud.de (“Main Agreement”), the Provider supplies the Customer with a dedicated instance of the RAWCaptureBooth Selfhosted Webserver on a server operated by the Provider. Through it, the Customer uploads pictures taken by its photo booths, makes them available to its guests in online galleries and monitors its photo booths remotely. In doing so, the Provider processes personal data on behalf of the Customer. This agreement sets out the obligations of both parties under Art. 28 GDPR. In the event of any conflict, it takes precedence over the Main Agreement in all data protection matters.

§ 1 Subject matter and duration

1. The subject matter is the operation of a dedicated instance of the Selfhosted Webserver for the Customer: storing uploaded pictures, providing the galleries, receiving status reports and remotely controlling the Customer's photo booths.
2. Processing takes place in a data centre of Contabo GmbH in the “EU” region, i.e. within the European Union. Backup copies are kept on servers of the Provider in Germany (Annex 1). Data is transferred to a third country only for remote access to photo booths, if the Customer uses it (Annex 2).
3. This agreement remains in force for as long as the Main Agreement. The obligations under § 8 (deletion) and confidentiality continue beyond that.

§ 2 Nature and purpose, data and data subjects

Purpose: hosting the Customer's gallery, upload and remote management functions. The Provider does not analyse the data for its own purposes and does not pass it on.

The Provider does not deliberately process special categories of data under Art. 9 GDPR. Pictures may reveal such data in individual cases; the Customer decides what is uploaded.

§ 3 Instructions

1. The Provider processes the data only on documented instructions from the Customer. Instructions are the Main Agreement, this agreement and everything the Customer configures in its administration area – for example deleting events or pictures and the periods for automatic clean-up.
2. The Customer gives further instructions in text form to hello@rawcapturebooth.app.
3. If the Provider considers an instruction to be unlawful, it informs the Customer without delay and may suspend it until it is confirmed or changed.
4. Statutory processing obligations remain unaffected; the Provider informs the Customer of them in advance where the law permits.

§ 4 Obligations of the Provider

1. Confidentiality: Only the Provider itself has access to the data. If it engages other persons, it first commits them to confidentiality in writing.
2. Security: The Provider takes the technical and organisational measures under Art. 32 GDPR set out in Annex 1. It may develop them further as long as the level of protection does not decrease; it gives notice of material changes.
3. No access without cause: The Provider looks at pictures and content of the instance only if the Customer asks it to or if this is strictly necessary for troubleshooting or security. Ongoing monitoring uses only key figures (storage usage, number of events and pictures, time of the last report).
4. Data protection contact: Thomas Michael Müller, hello@rawcapturebooth.app. The Provider is not required to appoint a data protection officer.

§ 5 Sub-processors

1. The Customer approves the sub-processors listed in Annex 2.
2. The Provider announces any new or changed sub-processor in text form at least 30 days in advance. The Customer may object within this period for an important data protection reason; if no agreement is reached, either party may terminate the Main Agreement extraordinarily as of the change.
3. The Provider contractually binds every sub-processor to a level of protection that corresponds to this agreement.

§ 6 Assistance and notification duties

1. Data subject rights: If a data subject contacts the Provider, the Provider forwards the request to the Customer without delay and does not reply itself. The Customer can handle access, rectification and erasure itself in its administration area; where that is not sufficient, the Provider assists.
2. Data breaches: If the Provider becomes aware of a personal data breach, it notifies the Customer without delay, at the latest within 24 hours, with all information under Art. 33(3) GDPR available to it. Notifying the supervisory authority remains the Customer's responsibility.
3. Further duties: The Provider assists the Customer with data protection impact assessments and prior consultations (Art. 35, 36 GDPR) insofar as they concern the operation of the server.

§ 7 Evidence and audits

1. On request, the Provider makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR – primarily this agreement, Annex 1 and the certifications of the data centre operator.
2. On-site audits are possible with at least 14 days' notice during normal business hours. The Customer audits the data centre itself through the operator's certifications, not on site.
3. The Provider may charge for the effort of an on-site audit based on time spent, unless the audit reveals a breach by the Provider.

§ 8 Deletion and return

1. Until the end of the agreement, the Customer can save all pictures itself using the download functions of its administration area.
2. If the Main Agreement ends by cancellation, the Provider locks the instance at the end of the term and permanently deletes it, including all pictures, the database and the login data, 14 days later. If a payment finally fails, the Provider locks the instance immediately and deletes it after 30 days unless payment is received by then. At the Customer's request, the Provider deletes immediately.
3. Server logs containing IP addresses of gallery visitors are continuously overwritten and deleted after 7 days at the latest.
4. Backup copies are continuously overwritten. Deleted data is removed from all backups no later than 14 days after deletion.
5. The Provider confirms deletion in text form on request.

§ 9 Liability and final provisions

1. This agreement is concluded when the Customer confirms it while booking in the customer area on boothcloud.de. It is thereby concluded in an electronic format (Art. 28(9) GDPR). The Provider stores the time of confirmation.
2. Liability is governed by Art. 82 GDPR. Otherwise, the liability provisions of the Main Agreement apply.
3. Amendments and additions must be made in text form. This also applies to any waiver of this requirement.
4. If any provision is invalid, the remainder stays in effect. It is replaced by the provision that comes closest to its purpose.
5. German law applies. Place of jurisdiction, where permitted, is the Provider's registered place of business.

Annex 1: Technical and organisational measures

This is how operations are set up today. Changes under § 4(2).

Annex 2: Sub-processors

The Provider has concluded a data processing agreement with Contabo GmbH. For Cloudflare, its Data Processing Addendum applies, which forms part of the terms of use of the Cloudflare account. Domain management at STRATO GmbH only concerns address records; no Customer data passes through it.