Agreement under Art. 28(3) GDPR between the customer (controller) and Marco Lohmann, newways.consulting (processor). It forms part of the Terms of Service and is concluded on booking.
1. Subject matter and duration
The subject matter is the processing of personal data that the controller enters into newways.suite or that arises from its use.
The agreement runs for as long as the main contract and ends with it, extended by the deletion period in clause 10.
2. Nature and purpose
Storage, structuring, retrieval, use, transmission and erasure for the purpose of providing a business management application: client management, quotes and invoices, projects and tasks, time tracking, calendar, file storage, inbox and client area.
The processor processes the data solely on documented instructions and for no purpose of its own. In particular, it is not used to train artificial intelligence models, neither by the processor nor — per their contractual assurance — by the subprocessors named in clause 6.
3. Types of data
Master and contact data, contract and billing data, content data from messages and documents, usage and log data, uploaded files and, where applicable, signature images from quote acceptance.
The controller decides what data to enter and ensures a legal basis exists for its processing. Special categories under Art. 9 GDPR should not be entered; if they are, the processor will process them under the same measures.
4. Categories of data subjects
The controller's clients and prospects, their contact persons, the controller's staff, and senders of incoming messages.
5. Instructions
- The controller issues instructions in text form. Use of the application and its settings count as instructions.
- If the processor considers an instruction unlawful, it will say so without delay and may suspend performance.
- Where the processor is required to process by Union or member state law, it will give notice beforehand unless the law prohibits it.
6. Subprocessors
- The controller authorises the subprocessors listed in the List of subprocessors, which forms part of this agreement.
- Additional or replacement subprocessors will be announced in text form at least 30 days in advance. The controller may object on substantive data protection grounds; if it does, either party may terminate the main contract with effect from the planned change.
- The processor imposes the same obligations on subprocessors and is liable for them as for its own conduct.
- On the Assistant: transmission to Anthropic PBC occurs while the Assistant is switched on and an analysis is triggered. For accounts set up on or after 1 November 2026 it is delivered switched on; the controller thereby instructs the processing and may end it at any time under Settings → Assistant. From the moment it is switched off, the transmission no longer takes place. Accounts set up earlier keep their state.
- On voice: the same applies to ElevenLabs Inc. for dictation and read-aloud. Both are likewise delivered switched on from 1 November 2026 and work either with a key of the controller's own or with the processor's. Only the passage recorded, or the text to be read out, is transmitted, and only when the controller or its staff trigger it.
7. Technical and organisational measures
The processor maintains measures under Art. 32 GDPR, in particular:
| Area | Measure |
|---|---|
| Transmission | TLS only; HSTS on encrypted connections |
| Access control | Passwords stored only as bcrypt hashes; attempt limiting; session identifier renewed on sign-in |
| Authorisation control | Roles per tenant; automatic tenant filtering at query level; separate operator area |
| Separation | Every record carries its tenant's identifier; queries without it are not possible in the program |
| Input control | Log of creation, change and deletion; immutable log of operator access |
| Availability | Daily backup, 30 days' retention |
| Encryption | Mailbox and interface credentials stored encrypted |
| Delivery of uploads | Dedicated delivery layer with path checking and a restrictive content policy |
| Physical media | Operated in ISO 27001 certified data centres |
Measures may evolve provided the level of protection is not reduced.
8. Assistance to the controller
The processor assists the controller with:
- Data subject requests (access, rectification, erasure, restriction, portability). The application provides export and deletion; further assistance is given without delay.
- Data protection impact assessment and prior consultation (Art. 35, 36 GDPR) where required.
- Notification obligations under Art. 33, 34 GDPR.
If a data subject approaches the processor directly, it forwards the request without delay and does not answer it itself.
9. Personal data breaches
The processor notifies the controller of any breach that comes to its attention without undue delay and at the latest within 24 hours of becoming aware, with the information required by Art. 33(3) GDPR to the extent available.
10. Deletion and return
- During the term, the controller may export its data at any time (CSV per list, complete archive as ZIP).
- After the contract ends, the data remains readable and exportable for 30 days.
- It is then deleted, including from backups within the retention cycle, at the latest 60 days after the contract ends.
- Data subject to a statutory retention obligation is excepted; it is blocked and deleted when the period expires.
11. Evidence and audit
- The processor demonstrates compliance in text form on request.
- The controller may verify on site, on at least 14 days' notice, during normal business hours and at most once per calendar year — more often only for specific cause.
- Available certificates and audit reports of subprocessors are made available on request.
12. Confidentiality
Persons involved in the processing are bound to confidentiality. The obligation continues beyond the end of their activity.
13. Governing law
Spanish law applies. The Spanish version prevails.