Data Processing Agreement

Version of 13 November 2026. The German version (Auftragsverarbeitungsvertrag) is legally binding.

1. Parties and scope

1.1 This Data Processing Agreement (“DPA”) is concluded between the business that uses Leisbase (the owner of the Workspace, the “Controller”) and FREIZEITLAB GmbH, Kalvarienbergstraße 22/10, 8020 Graz, Austria, FN 671161b, Regional Court for Civil Matters Graz, VAT ID ATU83029839 (the “Processor”).

1.2 It forms part of the contract for the use of the Leisbase platform under the Terms of Service and is accepted together with them. In all matters of data protection it prevails over the Terms of Service. Terms defined in the Terms of Service have the same meaning here; “GDPR” means Regulation (EU) 2016/679.

1.3 Where the Controller is subject to the Swiss Federal Act on Data Protection (FADP), this DPA also applies to processing under the FADP; references to the GDPR are to be read as references to the corresponding provisions of the FADP, and the Swiss Federal Data Protection and Information Commissioner is an additional competent supervisory authority.

2. Subject matter, nature and purpose of the processing

2.1 The Processor provides the Controller with the Leisbase platform: the administration interface (panel), the desktop and mobile apps, the embeddable widgets and guest pages (bookings, gift cards, products, check-in and waivers, forms, chat) and the related services such as payment connections, sending messages, storage, reports and AI features.

2.2 In doing so it processes personal data on behalf of the Controller: collecting, recording, organising, storing, adapting, retrieving, analysing, transmitting to the recipients chosen by the Controller, making available, backing up, restricting and erasing. The sole purpose is to provide the contractual services.

2.3 Which processing takes place depends on the modules and integrations the Controller uses. Annex 3 describes it per module.

2.4 Not covered by this DPA is processing for which the Processor is itself the controller: the Controller’s customer account and billing, protecting the platform against abuse, and the Processor’s own messages to panel users. The privacy policy describes it. The Processor may also produce aggregated, anonymised statistics that do not relate to the Controller, its users or its guests, in order to operate, secure and improve the platform, and it evaluates questions that users ask the in-app help assistant about using the platform in order to improve its help pages. It never uses personal data of the Controller’s guests for its own purposes, never sells it and never combines it across workspaces.

3. Duration

This DPA applies for as long as the contract of use exists and beyond that until the Processor has erased the data under section 12.

4. Types of data and data subjects

4.1 The categories of personal data and of data subjects are set out in Annex 3.

4.2 Special categories of personal data (Art. 9 GDPR): the platform is not designed for them. They only arise where the Controller brings them in, for example through its own questions in forms or waivers, through sick leave of its staff (only the fact and the period are processed, no diagnoses) or through the content of screenshots and documents. The Controller ensures a legal basis under Art. 9(2) GDPR. The Processor protects such data with the same measures as all other data.

4.3 Minors: data of minors is processed in particular with waivers, entered by a parent or guardian. The Controller decides whether and to what extent it collects such data and ensures the required consent.

5. Instructions

5.1 The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Austrian law; in that case it informs the Controller of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

5.2 Instructions are this DPA, the contract of use, the settings and actions of the Controller and its users in the panel and the apps, and individual instructions in text form to support@leisbase.com. Individual instructions are given by the Workspace owner or a person with administrator rights.

5.3 If the Processor considers an instruction to infringe data protection law, it informs the Controller without delay. It may suspend carrying it out until the Controller confirms or changes it.

5.4 Instructions beyond the contractual scope of services are treated as a change request; the Processor may charge a reasonable fee for them, which it announces in advance.

6. Obligations of the Processor

6.1 Persons with access to the data are bound to data secrecy under sec. 6 of the Austrian Data Protection Act (DSG) and to confidentiality, also after their work ends. They receive access only as far as their task requires.

6.2 The Processor implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection does not decrease, and documents material changes.

6.3 Access by the Processor’s staff to the Controller’s Workspace, for example for support, takes place only where needed to provide the services or at the Controller’s request, through a separate administration account, with a notice in the panel, and is logged.

6.4 The Processor keeps a record of processing activities under Art. 30(2) GDPR.

6.5 The contact for data protection is the management, reachable at support@leisbase.com. A data protection officer is not currently required by law; if one is appointed, the Processor communicates the contact details.

6.6 If an authority or a third party requests access to the Controller’s data, the Processor refers it to the Controller, informs the Controller without delay unless legally prohibited, and discloses data only where it is legally obliged to do so, limited to what is required.

7. Assistance to the Controller

7.1 Data subject rights: the panel provides tools with which the Controller can handle requests under Chapter III GDPR itself, in particular exporting a guest’s data (access, portability) and erasing a guest’s personal data (erasure), as well as the file export. If a data subject contacts the Processor directly, the Processor refers them to the Controller and informs the Controller without delay; it does not answer the request itself.

7.2 Further obligations: taking into account the nature of processing and the information available to it, the Processor assists the Controller with its obligations under Art. 32 to 36 GDPR, in particular with information for a data protection impact assessment (for example for the desktop time tracker with monitoring functions) and for a prior consultation of the supervisory authority.

7.3 The tools in the panel and the information in this DPA are included in the fees. For further assistance the Processor may charge a reasonable fee, which it announces in advance, unless the assistance is required because of a breach on the Processor’s part.

8. Personal data breaches

8.1 The Processor notifies the Controller of a personal data breach affecting the Controller’s data without undue delay and at the latest within 48 hours after becoming aware of it, by email to the Workspace owner and in the panel.

8.2 The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information that is not yet available follows in phases without undue further delay.

8.3 The Processor takes measures without delay to contain the breach and mitigate its effects, documents it and assists the Controller with its notification to the supervisory authority and its communication to data subjects (Art. 33 and 34 GDPR). The Controller makes these notifications; the Processor notifies on the Controller’s behalf only at its request.

9. Sub-processors

9.1 The Controller gives general authorisation to engage the sub-processors listed in Annex 2. Many of them only act when the Controller uses the corresponding module or integration; Annex 2 states this per provider.

9.2 The Processor informs the Controller at least four weeks before adding or replacing a sub-processor, by email to the Workspace owner and in the panel, and updates Annex 2.

9.3 Within these four weeks the Controller may object in text form on reasonable data protection grounds. The parties then seek a solution, for example not using the affected function. If none is found, the Controller may terminate the affected service or the contract of use as of the change, without cost; fees already paid for the period after that are refunded pro rata.

9.4 If a sub-processor has to be replaced at short notice for urgent reasons, such as a security incident or the discontinuation of a service, the period may be shorter; the Processor then informs the Controller immediately, and the right to object under section 9.3 applies accordingly.

9.5 The Processor binds each sub-processor by contract to data protection obligations equivalent to those of this DPA (Art. 28(4) GDPR), checks them before engaging them and is liable to the Controller for their compliance.

9.6 Not sub-processors are services that the Controller engages itself and connects to Leisbase – for example its own account with a payment provider (Stripe, PayPal, Revolut, N-Genius, Telr), its own mail server or mailbox, its calendar, its Meta, Google or advertising accounts, shipping carriers it chooses, or an AI app it gives access through the AI connectors – and payment providers to the extent they act as independent controllers. The Controller’s contracts with those providers apply.

10. Location of processing and international transfers

10.1 The Controller’s data is stored in data centres in the European Union: application, databases and backups at Hetzner, and files such as chat attachments, task files and exports in Cloudflare R2 with EU jurisdiction.

10.2 Some sub-processors process data outside the EU/EEA, or may access it from there. Transfers take place only under Chapter V GDPR: on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified recipients), the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), or binding corporate rules. Annex 2 states the basis per provider. A summary of the assessment of these transfers is available to the Controller on request.

10.3 If the Controller is established in a country outside the EU/EEA that has no adequacy decision, Module 4 (processor to controller) of the SCCs applies to the transfer of the Controller’s data from the Processor to the Controller and is incorporated into this DPA by reference; Annexes 1 to 3 of this DPA contain the information required for the SCCs, and Austrian law and the courts of Austria are chosen for them. In case of conflict the SCCs prevail.

11. Evidence and audits

11.1 On request the Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA, the description of measures, the list of sub-processors and answers to a reasonable security questionnaire.

11.2 If this information is not sufficient, the Controller may carry out an audit itself or through an auditor bound to confidentiality who is not a competitor of the Processor: announced at least 30 days in advance, during business hours, without disturbing operations, without access to other customers’ data, and at most once in twelve months. After a personal data breach or at the request of a supervisory authority an audit is also possible at short notice.

11.3 The Controller bears the costs of an audit unless it reveals a material breach by the Processor.

12. Return and deletion after the end of the contract

12.1 During the term, the Controller can export its data in the panel at any time.

12.2 After the contract ends, the Processor schedules the Workspace for deletion; the Controller can also schedule it itself in the settings. For 30 days after scheduling, the Workspace can be restored so that the Controller can still export its data. After that the Processor permanently deletes the Workspace’s database and all its files.

12.3 Data in encrypted backups is erased as the backups expire: database snapshots at the latest 13 months after their creation, backup copies of files at the latest 12 months after the Workspace has been deleted. Until then backups are used only to restore data after an incident.

12.4 Longer retention takes place only where Union or Austrian law requires it. The Controller must export and keep its own invoices and accounting records before the contract ends.

12.5 On request the Processor confirms the deletion in text form.

13. Obligations of the Controller

13.1 The Controller is responsible for the lawfulness of the processing, in particular the legal bases, consents (for example for marketing messages) and informing data subjects under Art. 13 and 14 GDPR, for example its guests in its privacy policy.

13.2 If it uses functions that can monitor the performance or behaviour of its staff (for example screenshots and activity tracking of the desktop time tracker, location when clocking in or out and, if the venue switches it on, whether the phone leaves the venue area during a shift, or call recording), it ensures the employment law requirements – in Austria in particular a works agreement or the staff’s consent under sec. 96 and 96a ArbVG or sec. 10 AVRAG – and checks whether a data protection impact assessment is required.

13.3 It informs the Processor without delay if it finds errors or irregularities in the processing.

14. Liability

Towards data subjects the parties are liable for damage caused by breaches of the GDPR under Art. 82 GDPR. Between the parties the liability rules of the Terms of Service apply, as far as legally permitted.

15. Final provisions

15.1 The Processor publishes changes to this DPA as a new version on this page and in the panel and informs the Controller by email. Section 23 of the Terms of Service applies to changes; changes required by law or by an authority, and the updating of Annex 2 under section 9, follow their own rules. Individual agreements require text form.

15.2 If a provision is invalid, the rest remains valid; it is replaced by the provision that comes closest to the purpose of the GDPR.

15.3 Austrian law applies. The place of jurisdiction follows the Terms of Service. In case of discrepancy between the language versions, the German version prevails.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Physical and system access

• Servers and backups in certified data centres of Hetzner Online GmbH in the EU, files in Cloudflare R2 with EU jurisdiction; physical access only for data centre staff.
• Administrative server access only by SSH key, for a small, named group of people; firewall; databases and internal services not reachable from the internet.
• Passwords stored only as bcrypt hashes. Panel sign-in with a password policy (at least 12 characters, checked against known leaked passwords), two-factor authentication (TOTP; mandatory for accounts that sign in with a username), passkeys, sign-in with Google, a notice of every new sign-in, optional country-based restriction, and an overview of sessions that can be ended.
• Passwords set by the Controller for its users are temporary and expire after 72 hours.

Data access and separation

• A separate database and separate file storage for each Workspace.
• Roles and permissions per user, restriction to single locations, separate permissions for sensitive functions (for example export and erasure of guest data, cancelling payments, monitoring functions).
• Support access by the Processor’s staff only through a separate administration account, with a notice in the panel and a log.
• Credentials of connected services (API keys, mailbox passwords, tokens) are stored encrypted; time tracker screenshots and documents are stored encrypted.
• Full card numbers are not processed on the Processor’s servers; card payments go through the payment pages or input fields of the payment providers.
• Shared devices at the venue can be locked with a PIN after a period of inactivity.

Transmission

• Encrypted transmission (TLS) for all connections from browsers, apps and widgets and to sub-processors.
• Protection against attacks and overload by Cloudflare (DDoS protection, web application firewall), with a fallback route through bunny.net.
• Files that guests send to the chatbot and files shared in the team chat are scanned for malware.
• Partner interfaces only with their own credentials and limited permissions; AI connectors only with the user’s consent per Workspace and location, and changes only with separate approval.

Input control

• Change and activity logs for important records (for example orders, gift cards, customers), logs of sign-ins and of support access.

Availability and resilience

• Databases backed up hourly (kept for 48 hours) and in full nightly, every file additionally once; all backups encrypted with AES-256 and kept in separate storage at another location as 14 daily, 8 weekly and 12 monthly copies; restore possible per Workspace; the freshness of backups is monitored.
• Monitoring of errors (Sentry, without sending default personal data), queues and availability; automatic switch of the delivery network during regional outages.

Data protection by design and by default

• Data-minimising defaults: website statistics without cookies and without storing the IP address, location only rounded; “Global Privacy Control” and “Do Not Track” signals respected.
• Automatic erasure after set periods (for example unfinished orders, change logs, message logs), erasure or anonymisation of single guests on request, with a privacy log.
• AI providers only under contracts that exclude the use of the data for training their models; tools for AI reports have no access to guests’ contact details.

Organisation and review

• All staff bound to data secrecy; access on a need-to-know basis.
• A defined procedure for security incidents with assessment, containment, documentation and notification under section 8.
• Regular security reviews of the code and remediation of vulnerabilities found; selection and control of sub-processors under section 9.

Annex 2: Sub-processors

As of 13 November 2026. Providers marked “always” process data for every Workspace; all others only when the Controller uses the module or integration named.

For PayPal, Revolut and other payment providers the Controller connects with its own account, see section 9.6.

Annex 3: Processing per module

Only data of the modules and integrations that the Controller uses is processed.