Data protection · Art. 28 GDPR
Data processing at ownCloud.online
When you use ownCloud.online, BW-Tech GmbH processes personal data on your behalf. For this processing we conclude a Data Processing Agreement (DPA) with you in accordance with Article 28 of the General Data Protection Regulation (GDPR).
As the provider of a managed cloud service, we store and process the content, usage and master data that you and your users place in the cloud. You remain the “controller” within the meaning of the GDPR at all times; BW-Tech GmbH acts as a “processor” bound by your instructions.
The DPA defines in binding terms the purpose, scope and safeguards under which this processing takes place. All data is processed exclusively in data centers in Germany.
At a glance
- Legal basis: Art. 28 GDPR
- Controller: you, the customer
- Processor: BW-Tech GmbH
- Place of processing: Germany only
- Annex: technical and organizational measures (TOMs)
Roles
Who is responsible for what?
Controller – you, the customer
You decide on the purposes and means of the processing, determine which personal data is placed in the cloud, and issue the relevant instructions. You remain responsible towards data subjects and the supervisory authority.
Processor – BW-Tech GmbH
We process the data exclusively on your documented instructions, provide the technical and organizational safeguards, and support you in meeting your data protection obligations.
Statutory content
What our DPA covers under Art. 28(3) GDPR
Article 28(3) GDPR sets out the obligations a processor must assume by contract. Our DPA covers all legally required points:
Processing on instructions
Processing of personal data solely on the controller's documented instructions.
Confidentiality
All persons authorized to process the data are bound to confidentiality or are under an appropriate statutory duty of secrecy.
Data security
Implementation of all technical and organizational measures (TOMs) required under Art. 32 GDPR.
Sub-processors
Engagement of further processors only under the conditions of Art. 28(2) and (4) GDPR.
Assisting with data-subject rights
Support in responding to data-subject requests (access, rectification, erasure and more, Chapter III GDPR).
Assisting with compliance duties
Assistance with the obligations under Art. 32–36 GDPR: data security, breach notification and data protection impact assessments.
Erasure or return
After the services end, all personal data is, at your choice, deleted or returned.
Evidence & audits
Provision of all information needed to demonstrate compliance and enabling audits, including inspections.
Key processing details
Subject matter, nature, purpose & scope
Art. 28(3) GDPR requires the contract to define the subject matter, duration, nature and purpose of the processing as well as the type of data and the categories of data subjects:
| Subject matter | Provision and operation of the managed cloud service ownCloud.online (storage, management, sharing and editing of files). |
| Nature and purpose | Hosting and operation of a dedicated cloud instance for file storage and collaboration on behalf of the controller. |
| Duration of processing | For the term of the underlying main or subscription contract. |
| Type of personal data | Master and contact data, usage and log data, and all content data uploaded by the controller. |
| Categories of data subjects | E.g. employees, customers, partners and other users of the controller. |
| Place of processing | Data centers in Germany only. |
Sub-processors
Service providers engaged
Where BW-Tech GmbH engages further processors, this is done only under the conditions of Art. 28(2) and (4) GDPR. We inform you of intended changes in good time and grant you a right to object.
We currently engage the following sub-processors:
Provider / location: Stripe Payments Europe, Ltd., Ireland
The current full list forms part of the DPA; we inform you of intended changes in advance.
Annex to the DPA
Technical & organizational measures
The safeguards taken under Art. 32 GDPR are a binding part of the DPA. They describe how we ensure the confidentiality, integrity, availability and resilience of your data.
How to conclude the DPA
Sign the DPA in a few steps
Request the DPA
Request your DPA, pre-filled with your data and ready to sign.
Receive your DPA
The completed DPA is generated automatically with your details and sent to you by email.
Sign
Sign the DPA digitally or return it signed.
Questions about data processing? Email us at info@bw.tech or call +49 6202 95323 00.
Last updated: 2 July 2026 · Version 1.0. Controller: BW-Tech GmbH, Albert-Bassermann-Strasse 31, 68782 Bruehl, Germany. This page does not constitute legal advice.