This Article 28 GDPR agreement concerns personal data in workspace contents processed by the operator outside exclusively personal or household activities.
The controller is the workspace operator identified at acceptance. The processor is Robert Paul Kothe Video & Foto, proprietor Robert Paul Kothe, Proskauer Straße 25, 10247 Berlin, Germany, hello@kitwerk.app. The person accepting confirms their authority to represent the operator. The exact German or English version displayed is expressly accepted before that processing begins. The selected language is the contract language. This agreement applies throughout provision and until the agreed return or deletion.
Kitwerk’s own account administration, contracts, billing, security and own public functions follow the roles in the privacy notice. A user's household exemption does not exempt Kitwerk from its own data-protection duties.
The subject matter is equipment and production management, including inventory, loans, enquiries, packing lists, documents, Setwerk and Scriptwerk. The nature and purpose of processing are collection, storage, organisation, retrieval, synchronisation, technical adaptation, transmission to recipients selected by the operator, export, restriction and erasure to provide these functions.
Kitwerk processes only on documented instructions, including for third-country transfers. Invoking a function constitutes the corresponding instruction; further instructions may be sent in text form to hello@kitwerk.app. Processing required by law remains permitted; Kitwerk informs the controller beforehand unless prohibited by law. Kitwerk promptly reports unlawful instructions and suspends their execution until clarified.
Data may include names, contact details, addresses, organisation and role information, messages, loan periods, contractual and invoice details, notes, photographs, reference images, board photos and production documents. Subjects include borrowers, prospective customers, customers, contact persons, employees and production participants. Article 9 special-category data are outside the service's scope and must not be uploaded.
Authorised persons are bound by confidentiality. Access is limited to necessary tasks. Kitwerk implements appropriate Article 32 measures, including encrypted transmission, roles and access controls, database tenant-separation rules, protected private-media access and monitoring of security-related errors. Privileged operational access requires separate authorisation; Kitwerk does not claim that erroneous access is technically impossible in every circumstance.
Backups, recovery and provider access depend on the services and their configuration. The current measures description and evidence can be requested at hello@kitwerk.app. Publicly released contents and operator-selected token shares must be distinguished from purely private media. Changes must not inappropriately weaken security measures.
General authorisation covers Supabase, Inc. (database and authentication), Vercel, Inc. (hosting), Cloudflare, Inc. (media and technical protection), Resend, Inc. (service emails) and OpenAI Ireland Limited (only expressly requested optional AI functions). The privacy notice describes purposes and transfers; independently controlled Apple and Stripe/Link operations are not processing on behalf of the controller under this agreement.
Kitwerk imposes the same data-protection duties on subprocessors and remains responsible for their performance under Article 28(4). New or replacement subprocessors are announced on a durable medium at least four weeks in advance. The operator may object on substantiated data-protection grounds. If no reasonable solution can be found, the operator may end the affected service before the change; unused prepaid periods are refunded proportionally.
Transfers outside the EEA require compliance with Articles 44 et seq., including an applicable adequacy decision or appropriate safeguards such as standard contractual clauses and necessary supplementary measures. Copies or locations of applicable safeguards are available from hello@kitwerk.app. No general EU-only restriction for every provider is promised.
Taking account of the processing, Kitwerk assists with data-subject rights and Articles 32–36, including security incidents, impact assessments and consultation. Requests received directly concerning processor data are promptly forwarded; Kitwerk does not respond independently unless required by law. Personal-data breaches are reported without undue delay after awareness; available details and further findings follow without unreasonable delay.
Kitwerk provides required evidence and permits appropriate audits, including inspections by the operator or its appointed auditor. Protecting other customers’ confidential information and organisational arrangements must not exclude a necessary audit.
At the end of the service, personal data processed on behalf of the operator are returned or deleted at its choice, including existing copies unless retention is legally required. Export and account management remain available without accepting new terms; further copies and deletion can be requested through hello@kitwerk.app. Temporary backup remnants are restricted until overwritten and deleted again if restored. Kitwerk handles contract evidence retained for its own purposes under the privacy notice.
This agreement prevails over the terms for processing on behalf of the controller. Mandatory data-protection law remains unaffected. The selected version, full checksum and acceptance time are available in account management.