Data Processing Agreement according to Art 28 DSGVO   

executed between the customer pursuant to the main contract and Fronius International GmbH, Froniusstraße 1, 4643 Pettenbach, Austria, (hereinafter Fronius).

(1) To the extent that Fronius processes personal data for a client within the meaning of Article 4(2) and Article 28 of the EU General Data Protection Regulation (hereinafter referred to as "GDPR"), the provisions of this contract on commissioned processing (hereinafter referred to as "DPA") shall apply. The provisions of this DPA together with the annexes are integrated into the main contract and exist congruently with the one another. In the event of contradictions, the DPA shall take precedence over the provisions of the main contract.

(2) As a processor, Fronius undertakes to comply with the provisions of the GDPR, in particular Article 28 ff of the GDPR. 

1. Subject matter of the contract and processing activity 

(3) Fronius provides services to clients on the basis of the contractual relationship existing between the parties for the use of our product or online service (hereinafter: main contract). Annex 1 of this DPA describes the subject matter, duration, nature and purpose of the processing, as well as the type of personal data and the categories of data subjects.  

2. Binding of instructions

(4) Fronius shall - with regard to the transfer of personal data to a third country or to an international organisation - only process personal data on the documented instructions of the client, unless Fronius is required to process by the law of the European Union or the EU Member States to which Fronius is subject. In such a case, Fronius shall notify the client of these legal requirements prior to processing, unless the law in question prohibits such notification on the grounds of an important public interest (Art 28(3)(a) DSGVO).

(5) The Client's instructions regarding the handling of personal data are defined by this DPA, the associated main contract and the product functionalities provided; such instructions may subsequently be amended, supplemented or replaced in writing by the Client. Corresponding instructions shall be documented by the Client and Fronius.

(6) If Fronius is of the opinion that an instruction violates the Data Protection Regulation or other data protection regulations of the European Union or the EU Member States, Fronius shall inform the client of this without delay (Art 28 Para 3 GDPR). In this case, Fronius shall be entitled to suspend the implementation of the instruction until it is confirmed, amended, supplemented or replaced by the Client. Fronius is permitted to reject instructions that are obviously unlawful.  

3. Fronius Prevention Measures

(7) Fronius undertakes to comply with the statutory provisions of data protection law, in particular the Data Protection Act 2000 ("DSG 2000") and the GDPR.

(8) Fronius has obliged all persons authorised to process personal data to maintain confidentiality (Art 28 Para 3 lit b GDPR).

(9) Fronius shall take all technical and organisational measures (TOMs) within its area of responsibility to ensure appropriate protection of the Client's data in accordance with Article 32 of the GDPR, especially those listed in the Fronius TOM Report (Appendix 2), which can be accessed at https://dr-05.datareporter.eu/info/e3s2f7Ce (Article 28(1)(c) GDPR). Fronius shall be at liberty to take or use other suitable measures, provided that the security level of the specified measures is not fallen short of at the time of conclusion of the GCU.  

4. Support obligation  

(10) In view of the nature of the processing, Fronius will support the client as far as possible with suitable technical and organisational measures to comply with its obligation to assert data subject rights in accordance with Chapter III of the GDPR (Art 28 Para 3 lit e GDPR).

(11) If a data subject asserts rights directly against Fronius, Fronius will not respond unilaterally, but will immediately forward this request to the customer and await the customer's instructions.

(12) Fronius shall support the Client in complying with its obligations under Articles 32 to 36 of the GDPR (Article 28(3)(f) GDPR) with regard to the type of processing and the information available to Fronius. This applies specifically to the security of processing, notification of personal data breaches, data protection impact assessment and consultation with supervisory authorities.  

5. Control rights

(13) Upon request, Fronius shall provide the Client with all necessary information to prove compliance with the obligations under this DPA and under Art 28 GDPR. For this purpose, Fronius shall also enable the Client to conduct audits - including inspections - which shall be carried out by the Responsible Party or by an external and appropriately qualified auditor appointed by the Responsible Party. Inspections shall only be carried out to the extent necessary and shall not disproportionately disrupt Fronius' operations (Art 28 (1) (h) GDPR).

6.Use of subcontractors or processors

(14) The list of subcontractors and processors used by Fronius for data processing or parts thereof is contained in Appendix 3 of the DPA for the respective product or online service and in Appendix 4 of the DPA (subsidiaries as processors). By concluding the DPA, the Client agrees to the appointment of the subcontractors listed in Appendix 3 for the respective product or online service and in Appendix 4 at the time of concluding the DPA. Fronius shall be authorised to select additional or other subcontractors with due diligence in accordance with their suitability and reliability. In this case, Fronius shall inform the client by adding the subcontractor to the relevant appendix and publishing it on the website and simultaneously notifying the client of the addition. In the event of objectively verifiable objections, the client shall have a right of written objection within a period of 4 weeks. Objectively comprehensible objections to an added subcontractor may include justified concerns regarding the level of protection of personal data at the subcontractor. In the event of an irresolvable objection, both parties shall have the right to terminate the contract with a notice period of 4 weeks, in which case the main contract shall also be deemed terminated.

(15) Fronius shall ensure that the use of subcontractors or processors does not impair the rights arising from this contract (specifically the rights of control) and shall demand sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing is carried out in accordance with the requirements of the GDPR. If subcontractors or processors in a third country are involved, Fronius shall ensure that an appropriate level of data protection is guaranteed at the respective subcontractor, taking into account Article 44 ff of the GDPR.

(16) By way of clarification, it is noted that there is no subcontracting relationship within the meaning of these provisions if Fronius commissions third parties to provide services that are to be regarded as purely ancillary services. This includes, for example, postal, transport and shipping, cleaning, IT and telecommunication services without any specific reference to services that Fronius provides for the client.  

7. Liability  

(17) For compensation of damages suffered by a data subject due to inadmissible data processing in accordance with the data protection laws within the scope of commissioned processing, the customer alone shall be responsible with regards to the data subject in the internal relationship. Reference is made to Art 82 GDPR.

(18) The responsible party shall indemnify and hold Fronius harmless in full for any infringements for which the responsible party is solely or predominantly responsible, such as processing in an unlawful, improper or otherwise inadmissible manner, irrespective of whether Fronius has instituted its own proceedings against the responsible party.

(19) In the event of a claim under clause 18, Fronius is entitled to block the account of the person responsible. The claim to remuneration agreed with Fronius remains unaffected. (20)   In all other respects, it is agreed that the provisions on limitation of liability from the corresponding main contract shall apply.  

8. Term of contract and legal consequences in the event of termination

(21) The term of the DPA shall be governed by the term of the main contract. In the event of termination of the main contract, this agreement shall also be terminated at the same time without any further notice being required. The possibility of extraordinary termination for good cause remains unaffected.

(22) After termination of the main contract, the Contractor shall either delete or destroy personal data at the Client's discretion or return and delete or destroy the existing copies, unless there is an obligation to retain the personal data under EU or EU Member State law.

(23) Fronius shall (a) upon corresponding order by the Client or (b) in any case within 14 days after dissolution, keep available for download by the Client all Content of the Client or User in an appropriate format - chosen by Fronius at its own discretion. After expiry of the 14-day period following dissolution, Fronius shall irretrievably delete the content. In return for a separate order and remuneration, Fronius shall make available to the Client or a third party designated by the Client all Content on an agreed data carrier or by means of remote data transmission in an agreed format.  

9. Final provisions

(24) Should individual provisions of this contract prove to be legally invalid or unenforceable, or contain errors, the parties are obliged to replace the invalid or unenforceable provisions with valid and enforceable ones that come as close as possible to the intention of the contracting parties at the time the respective provision was agreed. The validity of the remaining provisions shall remain unaffected.

(25) This agreement is subject to Austrian law. However, the provisions of international private law (conflict of laws) shall not apply. The exclusive place of jurisdiction is Wels, Austria.

(26) The appendices to the order processing agreement available on our website for the respective products or online services form an integral part of this agreement.