Data Processing Agreement / AVV

Last updated: August 28, 2026

This Data Processing Agreement / AVV is intended for B2B customers who provide personal data to Tiros for processing on their behalf. It supplements the Terms of Service or another written agreement between the parties and is intended to meet the requirements of Article 28 GDPR where the GDPR applies.

1. Parties and roles

The customer is the controller. Tiros-IT GbR, partners Tim Schwab and Robin Schwab, Stadlgasse 1, 92253 Schnaittenbach, Germany, is the processor for personal data processed on behalf of the customer.

If Tiros processes personal data for its own business administration, legal compliance, security logs or direct customer communication, Tiros acts as an independent controller for that limited processing.

2. Subject and purpose

Tiros processes customer-provided order and personalization data to configure, test and provide automation that prepares production-ready files for personalized products.

3. Type of processing

Processing may include receiving Amazon order report files, reading order fields, mapping personalization data to layouts, generating working files and production-ready output files, storing files temporarily, troubleshooting, support communication and deleting uploaded or generated data.

4. Categories of personal data

The data may include order IDs, names, shipping or billing addresses, email addresses, uploaded photos, custom messages, product selections, SKU, ASIN, layout choices and other personalization fields contained in the customer's Amazon order report export. The customer must not provide payment card data, health data or other special categories of personal data unless expressly agreed in writing.

5. Categories of data subjects

Data subjects may include the customer's end customers, gift recipients, business contacts and persons whose information appears in the provided order or personalization data.

6. Duration and deletion

Amazon order report uploads and working data are generally deleted after 1 week unless the parties agree a shorter period or continued processing is required for an active support case or legal obligation. At the end of the service, Tiros deletes or returns personal data at the customer's choice where technically feasible.

7. Instructions

Tiros processes personal data only on documented instructions from the customer, including these terms and any workflow instructions provided for the test or paid service. Tiros will inform the customer if an instruction appears to violate applicable data protection law.

8. Confidentiality

Persons authorized to process personal data for Tiros are bound to confidentiality or are subject to an appropriate statutory confidentiality obligation.

9. Security measures

Tiros applies appropriate technical and organizational measures, including access limitation, password-protected systems, encrypted transport where available, separation of customer data, limited retention and deletion of Amazon order report uploads and working data after the agreed period.

10. Sub-processors

The website and related server data are hosted by ALL-INKL.COM - Neue Medien Muennich, owner Rene Muennich, Hauptstrasse 68, 02742 Friedersdorf, Germany. The customer authorizes this sub-processor. Tiros will inform the customer before adding or replacing material sub-processors for the processing covered by this DPA.

11. Assistance

Tiros will reasonably assist the customer with data subject requests, data security obligations, breach notifications and deletion requests to the extent the requested assistance relates to processing performed by Tiros.

12. Personal data breaches

Tiros will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-provided personal data and will provide available information needed for the customer's assessment.

13. Audits and documentation

Tiros will provide reasonable information necessary to demonstrate compliance with this DPA. Audits must be reasonable, proportionate, scheduled in advance and limited to processing relevant to the customer.

14. International transfers

Tiros is based in Germany and currently uses hosting in Germany for the website and related server data. If future processing requires a transfer outside the EEA, Tiros will use an appropriate transfer mechanism where required by law.

15. Return, deletion and portability

Upon request and where technically feasible, Tiros will provide available customer-provided data or generated files in a commonly used format before deletion. After the end of the service, Tiros may retain limited business records where required for accounting, legal defense or statutory obligations.

16. Audit and objection procedure for sub-processors

The customer may request information reasonably necessary to verify compliance with this DPA. If Tiros intends to add or replace a material sub-processor, Tiros will notify the customer in advance where reasonable. The customer may object on reasonable data protection grounds. If no practical alternative is available, either party may terminate the affected processing.

17. Processing details

Subject matter: automation for personalized product orders and production files. Duration: for the test phase and any paid service period plus the deletion and legal retention periods described above. Nature and purpose: technical processing of customer-provided order data to generate production-ready files. Data subjects: the customer's end customers, gift recipients, business contacts and persons shown or named in personalization data.

18. Contact

Questions about this DPA can be sent to schwab@tiros-it.de.