Data processing agreement
When you use Kernwert, we process personal data on your behalf (Art. 28 GDPR). This agreement is part of the contract for the use of Kernwert.
This is a convenience translation. The German version of this agreement is legally binding.
1. Parties and subject matter
The controller is the business using Kernwert (“customer”). The processor is AUTOMATA, Erdberger Lände 26, 1030 Vienna, Austria (“provider”).
The subject matter is the provision of the Kernwert software for documenting the business’s own food safety checks (e.g. temperatures, goods-in, cleaning), including storage, backup and export of the data.
2. Types of data and data subjects
Data subjects are the customer’s employees and account holders. Processed data: names or short names of staff, name and email address of account holders, times and contents of entries (readings, actions, notes), device names and technical log data (IP address only for abuse prevention, timestamps).
Special categories of personal data (Art. 9 GDPR) are not processed. The customer should not enter such data in free-text fields.
3. Purpose and instructions
The provider processes the data solely to provide Kernwert and on documented instructions from the customer. The instructions result from the contract and the settings the customer makes in Kernwert. If the provider believes an instruction infringes data protection law, it will inform the customer.
4. Confidentiality
Persons at the provider with access to the data are bound to confidentiality. Customer data is only accessed where necessary for operation, maintenance or support requested by the customer.
5. Technical and organisational measures
The provider takes appropriate measures under Art. 32 GDPR, in particular: encrypted transfer (TLS), access protection by password and 6-digit code with optional Face ID and authenticator, lock-out after failed attempts, separation of data per customer at application level, checksum chaining of entries, daily backups with limited retention, logging of security-relevant events and regular updates.
The measures are adapted to the state of the art without lowering the level of protection.
6. Sub-processors
The customer agrees to the use of the following sub-processors: web hosting and email delivery (Hostinger International Ltd.) and payment processing via the AUTOMATA checkout and its payment providers (contract and payment data only). The provider will inform the customer of planned changes in advance by email; the customer may object for an important data protection reason.
7. Assisting the customer
The provider assists the customer in fulfilling data subject rights (access, rectification, erasure, portability) – in particular through the export and deletion functions in Kernwert – and with notification duties and data protection impact assessments where required.
8. Reporting breaches
The provider informs the customer without undue delay as soon as it becomes aware of a personal data breach and supports investigation and notification.
9. Deletion and return
The customer can export their data at any time (PDF, CSV, ZIP) and delete their business in Kernwert themselves. After the contract ends the data is deleted; backup copies are overwritten as part of the regular rotation within 30 days at the latest, unless a statutory retention obligation applies.
10. Audits
The customer may verify compliance with this agreement, primarily through information and documents provided by the provider. On-site audits are possible by arrangement with reasonable notice.
11. Contact
Please send questions about data protection and this agreement to office@automata.at.
Version: 24.10.2026