Auftragsverarbeitungsvertrag (AVV)

Data Processing Agreement

Last updated: [Date]

1. Parties

Controller: The Owner (channel/group operator) who uses VX0D.
Processor: VX0D ([Legal name, address]).

2. Subject matter

Processing of personal data of subscribers (Telegram users) on behalf of the Owner for the purpose of managing access to Telegram channels and groups.

3. Types of data

• Telegram user ID, name, username
• Payment transaction references
• Form responses (as configured by Owner)
• Access and membership timestamps

4. Technical and organizational measures (TOMs)

• Data stored on Hetzner servers in Germany (EU).
• Bot tokens encrypted at rest (AES-256-GCM).
• Database access restricted to application service accounts.
• Audit logging of all data access and modifications.
• Form data exports logged with IP and timestamp.
• Regular backups, encrypted, 30-day retention.

5. Sub-processors

• Hetzner Online GmbH — infrastructure hosting
• Telegram Messenger Inc. — bot platform

6. Data subject rights

VX0D assists the Owner in fulfilling data subject requests (access, deletion, portability) via the /mydata bot command and admin panel export/delete functions.

7. Deletion

Upon termination, all subscriber data is deleted within 30 days, except where retention is required by law.

8. Acceptance

The Owner accepts this AVV by checking the corresponding box during project creation. The acceptance timestamp is recorded.