Data Processing Agreement

pursuant to Art. 28 GDPR · Version 1.4 · As of: 18 October 2026

between the Customer according to the details provided at the time of booking or in the licence agreement (hereinafter: Controller)

and Icarus Websites – Inh. Ralf Becker, Fabrikstraße 13A, 04178 Leipzig, Germany (hereinafter: Processor).

1. Subject matter and duration

(1) The Processor provides the Controller with the software "Das Icarus Manifest" or "Icarus Rigging" as software-as-a-service (main agreement, governed by the General Terms and Conditions). Within the scope of this service, the Processor processes personal data on behalf of the Controller.

(2) The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

(3) The term of this agreement corresponds to the term of the main agreement. The obligations under Section 9 continue to apply beyond the end of the agreement.

2. Instructions

(1) The Processor processes the data exclusively within the framework of the main agreement and on documented instructions from the Controller, unless it is required to carry out other processing by the law of the Union or of the Federal Republic of Germany. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The instructions result from this agreement and the main agreement. The Controller's use of the functions of the software constitutes an instruction. The Controller issues further instructions in text form.

(3) If the Processor is of the opinion that an instruction infringes data protection provisions, it informs the Controller without undue delay. It is entitled to suspend the execution of the instruction until the Controller confirms or changes it.

(4) The Processor does not process the data for its own purposes.

3. Obligations of the Processor

(1) The Processor ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(2) The Processor takes the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 2. It may adapt them to the state of the art, provided that the level of protection is not reduced. It documents significant changes.

(3) The Processor assists the Controller by appropriate technical and organisational measures in fulfilling the rights of data subjects under Art. 12 to 22 GDPR. The software enables the Controller to view, correct, export and delete data itself. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.

(4) Taking into account the information available to it, the Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR.

(5) The contact person for data protection matters is Ralf Becker, info@icarus-manifest.de. There is no statutory obligation to appoint a data protection officer.

4. Notification of personal data breaches

(1) The Processor notifies the Controller of a personal data breach without undue delay, at the latest within 48 hours after becoming aware of it, by email to the Controller's address stored with the Processor.

(2) The notification contains, to the extent known, the information pursuant to Art. 33 (3) GDPR. The Processor provides information that is not yet available without undue delay as soon as it becomes available.

(3) The Processor takes the necessary measures to secure the data and to mitigate possible adverse consequences without undue delay.

5. Sub-processors

(1) The Controller grants the Processor general authorisation to engage other processors (sub-processors). The sub-processors engaged at the time the agreement is concluded are listed in Annex 3 and are deemed approved.

(2) The Processor informs the Controller in text form at least four weeks in advance of any intended addition or replacement of a sub-processor. Within this period, the Controller may object for an important reason relating to data protection. If the parties cannot reach an agreement, the Controller is entitled to terminate the main agreement extraordinarily with effect from the time the new sub-processor is engaged.

(3) The Processor contractually imposes on each sub-processor data protection obligations corresponding to those set out in this agreement.

(4) Services that the Controller itself commissions and connects in the software do not constitute sub-processing within the meaning of this Section, in particular payment service providers (e.g. Stripe, PayPal), the Controller's own email server or own Microsoft 365 account, an own Ninox database for data import, and the bank account for SEPA direct debits. For these, the Controller itself is the contracting party.

6. Place of processing

(1) Processing generally takes place in the Federal Republic of Germany.

(2) By way of derogation, entries that users make in the software's integrated AI assistant are transmitted to the provider named in Annex 3 in order to be answered and are also processed in the USA in the process. The transfer is based on appropriate safeguards pursuant to Art. 46 (2) lit. c GDPR (standard contractual clauses of the European Commission pursuant to Implementing Decision (EU) 2021/914), which form part of the provider's data processing agreement. The provider does not use the transmitted content to train its models. The AI assistant does not receive any data from the Controller's database, but exclusively the texts entered in the chat. Use is voluntary; users are advised in the chat window not to enter any personal data.

(3) To display the map in the emergency alarm, the user's browser loads map images from the servers of the OpenStreetMap Foundation in the United Kingdom named in Annex 3; in the process, the user's IP address is transmitted. The transfer is based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).

(4) Any further relocation of processing to a third country requires prior information pursuant to Section 5 (2) and compliance with Art. 44 et seq. GDPR.

7. Evidence and audit rights

(1) On request, the Processor demonstrates to the Controller compliance with the obligations under this agreement. Evidence is provided primarily by the current description of the technical and organisational measures (Annex 2), written self-assessments and, for data centres, by certificates and audit reports of the sub-processors.

(2) If this evidence is not sufficient in an individual case, in particular after a personal data breach or by order of a supervisory authority, the Controller may request an audit by itself or by an auditor bound to confidentiality. The audit must be announced with at least four weeks' notice, takes place during normal business hours and must not disrupt operations disproportionately. The costs are borne by the Controller unless the audit reveals a breach by the Processor.

8. Rectification, restriction and erasure

The Processor rectifies, erases or restricts the processing of data only on the instructions of the Controller. The Controller can largely carry out these measures itself in the software.

9. Return and erasure after the end of the agreement

(1) The Controller can export its data at any time during the term of the agreement via the export functions of the software. It is the Controller's responsibility to do so before the agreement ends.

(2) After the end of the main agreement, the Processor erases all data of the Controller within 30 days, including uploaded files and all backups, unless there is a statutory obligation to store the data.

(3) The erasure is confirmed in text form on request.

10. Liability

Art. 82 GDPR applies to liability. In all other respects, the liability provisions of the main agreement apply, insofar as Art. 82 GDPR does not preclude this.

11. Final provisions

(1) This agreement is concluded electronically (Art. 28 (9) GDPR) by the Controller agreeing to it during the booking process. For customers whose main agreement was concluded before this agreement was introduced, it is deemed concluded upon consent in text form.

(2) In the event of contradictions between this agreement and the main agreement, the provisions of this agreement take precedence in matters of data protection.

(3) Amendments and supplements require text form.

(4) Should individual provisions of this agreement be or become invalid, the validity of the remaining provisions shall remain unaffected.

(5) The law of the Federal Republic of Germany applies. The place of jurisdiction is Leipzig, to the extent permitted by law.

(6) This agreement is drawn up in German. Translations into other languages are provided for information purposes only; in the event of any discrepancy, only the German version shall be authoritative.

Annex 1 — Subject matter, purpose, types of data, data subjects

Subject matter and purpose

Provision and operation of a tenant-specific instance of the software for organising a skydiving operation or a parachute workshop. This includes storing, displaying and analysing data, sending emails and generating documents such as invoices, receipts and contracts on behalf of the Controller.

Categories of data subjects

• Skydivers, club members and guest jumpers
• Tandem passengers as well as purchasers and recipients of vouchers
• Students in training
• The Controller's staff, e.g. tandem instructors, instructors, pilots, manifest, office and riggers
• Clients and owners of equipment (workshop)
• Contact persons at suppliers and business partners
• Users of the jumper app Sky.Dash

Types of personal data

• Master data: name, address, date of birth, gender, nationality, photos
• Contact data: email address, phone number
• Contract and billing data: invoices, credit notes, account balances, payments, membership fees
• Bank data: IBAN, BIC, account holder, SEPA mandates
• Jump and training data: jumps, loads, licences, ratings, training progress
• Body weight for tandem and load planning
• Signatures on transport contracts and liability waivers
• Equipment data relating to persons: owners, inspection and packing data
• Personnel data: working hours, duty scheduling, roles and permissions
• Access data: user name, password exclusively as a hash
• Log data: change history with user and time, IP addresses

Special categories of personal data

The software is not intended for processing special categories of personal data pursuant to Art. 9 GDPR. Where the Controller records such data, for example injuries in incident reports or health information in declarations, the Processor processes it with the same protective measures. Responsibility for the legal basis of the collection lies with the Controller.

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality

Physical access control. Operation takes place on a virtual private server of IONOS SE in a data centre in Germany. Physical security, physical access control and monitoring of the data centres are the responsibility of IONOS. The Processor does not operate its own server rooms.

System access control.

• Transmission exclusively encrypted via HTTPS/TLS with automatically renewed certificates
• Passwords are stored exclusively as bcrypt hashes
• Sessions expire after 24 hours
• Invitation and password links are time-limited one-time tokens
• Limitation of requests (rate limiting) for public forms and login processes
• Server access via SSH exclusively with a key; access to server administration (Plesk) with two-factor authentication
• Firewall on the server; only required services are accessible from outside
• Automatic blocking of IP addresses after repeated failed login attempts (Fail2Ban)

Data access control.

• Role and permission concept within the instance; the Controller assigns roles and permissions itself
• Administrative functions such as the change history are only available to the Controller's administrators
• Platform administration exclusively by the owner; access to the Controller's data only for troubleshooting or at the Controller's request

Separation control.

• Each tenant receives its own separate database
• Uploaded files and backups are stored in tenant-specific directories
• Demo and production environments are separate

2. Integrity

Transfer control. Data transfers are exclusively encrypted. Public links, for example for the voucher shop, Sky.Dash or shared content, are signed or encrypted and time-limited. No exchange of data carriers takes place.

Input control. The creation, modification and deletion of data is logged with user and time. Invoice numbers are assigned consecutively; invoices are cancelled rather than deleted.

3. Availability and resilience

• Backup per tenant several times a day according to a schedule (database and uploaded files), with checksum and logging
• Staggered retention: all backups of the last 7 days, then one per week up to 30 days, then one per month up to a maximum of 180 days
• Restoration of individual tenants without affecting other tenants
• Monitoring of storage space with automatic notification
• Availability of 98 % on an annual average in accordance with the main agreement
• Security updates of the operating system are installed automatically; updates of the application and other components as required after review

4. Procedures for regular review

• Review of these measures at least once a year and in the event of significant changes
• Changes to the software are reviewed before being deployed, including syntax checks and comparison against the production version

Annex 3 — Sub-processors

• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany — server hosting, database, backup and email sending; processing in Germany
• apilayer GmbH, Elisabethstraße 15, 1010 Vienna, Austria (service "openiban.com") — validation of IBANs and determination of the BIC when bank details are entered in the software and in Sky.Dash; only the IBAN is transmitted. This is a free, publicly available service with which, by way of derogation from Section 5 (3), no separate agreement exists. According to the operator, no personal data is stored and no request logs are kept; the server location is not specified.
• OpenStreetMap Foundation, Cambridge, United Kingdom — provision of map images for the map view in the emergency alarm; the user's IP address is transmitted when the map is loaded. This is a publicly available service with which, by way of derogation from Section 5 (3), no separate agreement exists. Transfer on the basis of the adequacy decision for the United Kingdom (see Section 6 (3)).
• Anthropic Ireland, Limited, Dublin, Ireland — answering entries in the software's AI assistant; processing also in the USA by Anthropic, PBC, on the basis of standard contractual clauses (see Section 6 (2))