Skip to content

Data processing agreement

Draft – legally reviewed before the sync starts
This agreement only applies once the sync add-on is available. A lawyer reviews this draft beforehand; the wording may still change until then.

The German version is the legally binding one; this translation is provided for convenience.

Data processing agreement under Art. 28 GDPR for the sync add-on
Version 1.0, last updated November 2026

between

the customer who has booked the sync add-on to their Kima license (sponsoring body or centre, as stated when booking)
– the "controller" –

and

Wi3e Digital UG (haftungsbeschränkt)
represented by its managing director Robin Wieske
Friedrich-Ebert-Straße 55, 42103 Wuppertal, Germany
Amtsgericht Wuppertal, HRB 36283
– the "processor" –

Preamble

Kima is a web application that stores its data in the browser on the controller's device. Without the sync add-on, the processor processes none of the controller's planning data (§ 8(2) of the terms and conditions); this agreement applies only if the controller has booked the add-on. With it, the devices of a centre reconcile their planning data through a server of the processor. For this, the data is end-to-end encrypted on the devices; the key never leaves the controller's devices. The server stores only encrypted data and the metadata needed to run it. This storage, too, is processing on the controller's behalf, governed by this agreement.

§ 1 Subject matter and duration

  1. This agreement covers the processing of personal data by the processor on behalf of the controller when operating the sync add-on (§ 10a of the terms and conditions). It sets out the parties' data protection duties; otherwise the terms and conditions apply. In the event of conflict, this agreement takes precedence over the terms and conditions in matters of data protection.
  2. The agreement begins when the add-on is booked and runs as long as the add-on is booked. It ends with the add-on without notice of termination. The duties under § 10 (deletion) and confidentiality continue until the data has been deleted completely.

§ 2 Nature and purpose of the processing

  1. The processor receives the changes and full states of the planning data encrypted on the controller's devices, stores them and makes them available to the devices the controller has paired (storing, providing, deleting). It manages the paired devices and their access credentials.
  2. The sole purpose is reconciling the planning data between the devices of one centre. The sync is not a backup for the controller.
  3. The processor cannot decrypt the encrypted content. It analyses neither content nor metadata for its own purposes, in particular not for advertising or analytics.
  4. Processing takes place exclusively in data centres in Germany. Moving it to a country outside the EU or EEA requires the controller's prior consent and compliance with Art. 44 et seq. GDPR.

§ 3 Types of personal data

  1. Content data (end-to-end encrypted, not readable by the processor): all data the controller enters in Kima, in particular
    • about children: name, date of birth or age, group, care hours and times, family, friendships used for planning, daily attendance and care;
    • about parents and guardians: name, where entered;
    • about staff: name, home group, where they can work, working hours and rota, daily assignments;
    • absences of children and staff with their period and, where entered, the flag "ill";
    • groups, daily plans, planning rules and the name of the centre.
  2. Special categories: the information that a child or a member of staff is ill is health data under Art. 9(1) GDPR. It, too, is only transmitted and stored encrypted.
  3. Metadata (needed for operation, not end-to-end encrypted): the id of the sync space and the license id it belongs to, the number of paired devices and the device names chosen by the controller, hashes of the device credentials, the size, time and sequence number of every transfer, the time of the last activity and the IP addresses of the devices accessing the server.

§ 4 Categories of data subjects

  • Children attending the centre
  • Parents and guardians of these children
  • Staff of the centre (educational and auxiliary staff, management)
  • Users of the paired devices (through device names and IP addresses)

§ 5 Duties of the processor

  1. The processor processes the data only on documented instructions from the controller (§ 6), unless required to do so by Union or German law; in such a case it informs the controller of that legal requirement before processing, unless that law prohibits this (Art. 28(3)(a) GDPR).
  2. It ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. It takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection is not reduced; it documents material changes and informs the controller of them.
  4. It informs the controller without undue delay when it becomes aware of a personal data breach affecting the data under this agreement, with the information under Art. 33(3) GDPR as far as available to it.
  5. It informs the controller without undue delay if it considers that an instruction infringes data protection law. It may suspend carrying out the instruction until the controller confirms or changes it.
  6. The processor's contact for data protection is its managing director, at hallo(at)kima-planer.de.
  7. The processor keeps a record of processing activities under Art. 30(2) GDPR.

§ 6 Instructions

  1. The controller's instructions are set out conclusively in this agreement and the functions of the add-on: by pairing and removing devices, editing data and ending the sync in the app, the controller gives the respective instruction.
  2. The controller gives further instructions in text form (e.g. by e-mail to the address in § 5(6)). It confirms oral instructions in text form without undue delay.
  3. The parties treat instructions that go beyond the agreed service as a change request.

§ 7 Duties of the controller

  1. The controller is responsible for the lawfulness of the processing, in particular for entering the data in Kima, and for safeguarding the rights of the data subjects (Art. 24 GDPR). This includes the legal basis for health data under Art. 9(2) GDPR.
  2. The controller keeps the key and the pairing codes (QR codes) safe, pairs only devices of its centre and removes lost or unused devices without undue delay. Anyone holding a pairing code or a paired device can read and change all synced data.
  3. It informs the processor without undue delay if it detects errors or irregularities in the processing.

§ 8 Sub-processors

  1. The controller consents to the engagement of the sub-processors listed in Annex 2.
  2. The processor informs the controller in text form at least four weeks in advance before engaging an additional sub-processor or replacing an existing one. The controller may object to the change on important data protection grounds within this period. If it objects, it may end the add-on as of the change; we refund the price already paid pro rata for the remaining term.
  3. The processor contractually binds every sub-processor to the duties of this agreement (Art. 28(4) GDPR).
  4. Ancillary services the processor uses for its own purposes (e.g. telecommunications, payment processing, sending e-mail to the customer) are not sub-processing.

§ 9 Assisting the controller

  1. The processor assists the controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). As it cannot read the content data, the controller handles access, rectification and erasure of individual persons in the app; the changes are transferred to all devices, and deleting a person removes their data from the sync state. If a data subject contacts the processor directly, it forwards the request to the controller without undue delay.
  2. It assists the controller with the duties under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available to it, in particular with the description of the measures in Annex 1.

§ 10 Deletion and return

  1. The complete data is held on the controller's devices; a return by the processor is therefore not required. The controller can export it in the app at any time.
  2. When the add-on or the license ends, the server can only be read for 30 days, so the devices can reconcile their state. After that, the processor automatically deletes the sync space with all stored data and metadata under § 3. On the controller's instruction it deletes it earlier.
  3. Already during the term, older transfers are deleted once a newer full state is available, and the credentials of removed devices are invalidated.
  4. The sync data is not part of the processor's backups, so the deletion under paragraph 2 also covers backup copies. The IP addresses in the web server's logs are deleted after 14 days.
  5. On request, the processor confirms the deletion in text form.

§ 11 Evidence and audits

  1. On request, the processor provides the controller with all information necessary to demonstrate compliance with the duties under Art. 28 GDPR, in particular this description of the measures and the evidence of the sub-processors (e.g. ISO/IEC 27001 certifications).
  2. The controller, or an auditor it engages who is bound to confidentiality, may carry out audits including inspections. These are announced with reasonable notice (usually 14 days), take place during normal business hours and must not disrupt operations disproportionately. Without a specific reason, one audit per year is usually sufficient; written information and evidence are used first.
  3. For on-site inspections beyond one audit per year, the processor may charge reasonable compensation, unless a breach by the processor gave rise to the audit.

§ 12 Liability

  1. The parties are liable to data subjects for damage caused by processing that infringes the GDPR under Art. 82 GDPR.
  2. Between the parties, § 9 of the terms and conditions applies, unless Art. 82 GDPR mandatorily provides otherwise. A party that has paid compensation to a data subject may claim back from the other party the part corresponding to the other party's responsibility for the damage (Art. 82(5) GDPR).

§ 13 Conclusion and final provisions

  1. The agreement is concluded when the controller, on booking the sync add-on, confirms that it concludes it in this version. The processor stores the license, the version and the time. The agreement is thereby concluded in an electronic format (Art. 28(9) GDPR).
  2. If the controller needs a signed copy, it can print this page or save it as a PDF, sign it and send it to the processor, which returns a countersigned copy.
  3. Changes and additions to this agreement require text form. The processor offers a new version with at least four weeks' notice; the previous version applies until it is accepted.
  4. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected. German law applies; the place of jurisdiction is, where permissible, Wuppertal.

For the controller (only for a signed copy):

Place, date: ……………………………………

Name, position, signature: ……………………………………

For the processor:

Place, date: ……………………………………

Robin Wieske, managing director: ……………………………………

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Encryption and pseudonymisation

  • End-to-end encryption: the content data is encrypted on the controller's devices with AES-GCM (256 bits) before it leaves the device. The key is generated randomly on one of the controller's devices and passed from device to device only when pairing by QR code. It is never transmitted to the server; the processor cannot decrypt the content.
  • Integrity: every transfer is encrypted with authentication and bound to the space, the device and its sequence number; the devices detect and discard altered data.
  • Transport encryption: all connections to the server use HTTPS (TLS) only.
  • Device credentials: the server stores only a hash (SHA-256) of the device credentials.
  • Little metadata: transfers are padded to fixed size steps, so their size reveals little about the content.

Confidentiality

  • Physical access control: the servers are located in data centres of Hetzner Online GmbH in Germany (Falkenstein and Nuremberg) with access control, video surveillance and security staff; the data centres are certified to ISO/IEC 27001.
  • System access control: access to the server only for the processor, with personal keys; the admin area requires a second factor for every sign-in.
  • Data access control: a device gets access only to the space it was paired with, and only while the license with the add-on is valid; this is checked on every request. A removed device is refused at once. The admin area shows only metadata per space (device count, size, last activity), never content.
  • Separation: every centre has its own space with its own key.
  • Personnel confidentiality: only the processor itself has access to the systems; authorised persons are bound to confidentiality.

Integrity

  • Transfer control: no disclosure of the data to third parties other than the sub-processors in Annex 2; transport only encrypted (above).
  • Input control: the web server logs access without content; the logs are deleted after 14 days. Administrative actions (e.g. deleting a space) are recorded in the event log without content data. No analytics run on the server.

Availability and resilience

  • The complete data is held on every paired device; a server outage only delays the reconciliation, planning on the devices continues.
  • Limits per device, space and IP address (number of devices, storage size, requests) protect against overload and abuse.
  • Monitoring of availability and server health with notification of failures.
  • The server's other databases (licenses, customers) are backed up daily, encrypted, to the Object Storage of Hetzner Online GmbH in Germany. The sync data is excluded from this (§ 10(4)).

Deletion

  • Older transfers are deleted once a newer full state is available.
  • When a device is removed, the remaining devices create a new key; the data encrypted with the old key is deleted afterwards.
  • 30 days after the add-on or the license ends, the space is deleted automatically and completely (§ 10(2)).

Regular review

  • Automated tests of the access rules, the deletion periods and the limits with every change to the software.
  • Timely security updates of the operating system and the libraries used.
  • Review of these measures at least once a year and on material changes.

Annex 2: Sub-processors

Sub-processor Service Place of processing
Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany Data centre and servers (hosting the sync server) Germany (Falkenstein and Nuremberg)

The processor uses e-mail delivery (e.g. license keys, invoices) only to communicate with the customer under its own responsibility; sync data is never sent by e-mail. The e-mail provider is therefore not a sub-processor under this agreement.