Data processing agreement (AVV)

1. Subject and duration

Reunitems provides the venue with an online lost & found service: a public venue page with forms for lost and found items, a staff area for managing and matching reports, and emails to guests and finders. In doing so, Reunitems processes personal data on behalf of the venue. This agreement applies for as long as the venue uses Reunitems and ends automatically when the venue is deleted.

2. Nature and purpose of the processing

Collecting reports through the venue's forms; storing them together with photos and staff notes; showing them to the venue's team; computing match suggestions; sending emails about a report on the venue's behalf; and deleting reports automatically according to the venue's retention setting. The purpose is to return lost items to their owners.

3. Types of data and data subjects

Guests who lost an item: name, email address, description and category of the item, date and approximate time, an optional photo, the time of consent and the preferred language.

Finders: the same information about the found item, whether they hand it in or keep it, and, if given, name and email address.

Staff accounts of the venue's team are not covered by this agreement: Reunitems is responsible for them itself (see the privacy policy).

4. Responsibilities of the venue

The venue is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. It decides how long closed reports are kept (retention setting) and makes sure that only authorised people are on its team.

The venue gives its instructions through the settings and functions of the staff area and, where needed, by email. It informs Reunitems without delay if it notices errors or irregularities in the processing.

5. Obligations of Reunitems

Reunitems processes the data only on the venue's documented instructions, unless EU or German law requires otherwise; in that case it informs the venue beforehand where the law allows. Reunitems informs the venue if it believes an instruction infringes data protection law.

Everyone working for Reunitems who has access to the data is bound to confidentiality. Reunitems doesn't use the data for its own purposes, doesn't sell it and doesn't use it for advertising or analytics.

As far as possible, Reunitems supports the venue in answering requests from data subjects (Art. 12–23 GDPR) and in meeting its obligations under Art. 32–36 GDPR.

Reunitems informs the venue without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the venue's data, with the information the venue needs to report it.

6. Technical and organisational measures (Art. 32 GDPR)

Hosting in data centres in Frankfurt, Germany; encrypted transmission (HTTPS) and encrypted storage at the hosting providers.

Access control: database rules make sure each venue's team only sees its own reports; personal staff accounts with passwords of at least 10 characters and optional two-factor authentication; photos in private storage, shown only through short-lived links, with metadata such as location removed.

Data minimisation and deletion: the forms only ask for what is needed; closed reports are deleted automatically after the venue's retention period, and reports nobody has worked on for 180 days are closed automatically. Security-relevant actions are logged; the log is deleted after 730 days.

Reunitems may adapt these measures to technical progress as long as the level of protection doesn't drop.

7. Sub-processors

The venue agrees that Reunitems uses these sub-processors: Supabase Inc. (database, file storage and sign-in; servers in Frankfurt, Germany), DigitalOcean, LLC (hosting of the application; servers in Frankfurt, Germany) and Mailjet SAS, part of Sinch AB (sending emails; servers in the EU).

Supabase and DigitalOcean are based in the USA and certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Reunitems has data processing agreements with all sub-processors that impose the same data protection obligations as this agreement.

Reunitems informs the venue by email before adding or replacing a sub-processor. The venue can object within 14 days for an important data protection reason; if no solution is found, either side may end the use of Reunitems.

8. Deletion at the end

When the venue stops using Reunitems, the venue and all its reports, photos and notes are deleted. Before that, Reunitems provides the venue on request with an export of its data as a ZIP file (reports, notes, team and categories as CSV files, plus the photos). Copies in the hosting providers' backups are overwritten in their regular cycle.

9. Proof and audits

Reunitems provides the venue with the information needed to show that the obligations of Art. 28 GDPR are met, and allows and contributes to audits by the venue or an auditor it appoints, after reasonable notice and without disrupting operations. As a rule, this page and written answers from Reunitems are sufficient.

10. Final provisions

This agreement is concluded electronically (Art. 28(9) GDPR) when the venue ticks the box when applying or in the staff area. Reunitems records which version was accepted, when and by which account.

If Reunitems changes this agreement, the venue admin is asked to accept the new version the next time they sign in. Liability follows Art. 82 GDPR. German law applies; the place of jurisdiction is Munich, as far as legally permitted. If a provision is invalid, the rest of the agreement remains in effect.

Questions about this agreement: [email protected].