AGB for Proactive Data Protection Service
(Privacy Service)

Terms and Conditions of Eagle lsp GmbH, 
Neustädter Neuer Weg 22, 20459 Hamburg 

(hereinafter “eagle”)  

for the Proactive Data Protection Service (Privacy Service) 

 

1. Scope  

1.1. These General Terms and Conditions for the Proactive Data Protection Service (“Privacy Service Terms and Conditions”) apply to all our business relationships with our contractual partners in the field of data protection (hereinafter “Client”) and form an integral part of the contracts concluded with the Clients. The Privacy Service Terms and Conditions apply only if the Client is an entrepreneur (Section 14 of the German Civil Code (BGB)), a legal entity under public law, or a special fund under public law within the meaning of Section 310(1) of the German Civil Code (BGB). 

1.2. The Privacy Service Terms and Conditions apply exclusively. Any deviating, conflicting, or supplementary general terms and conditions of the Client shall only become part of the contract to the extent that we have expressly agreed to their validity. This requirement for consent also applies if the Client refers to its general terms and conditions and we have not expressly objected to them.  

1.3. eagle reserves the right to amend non-essential provisions of these Privacy Service Terms and Conditions without stating reasons. The amended provisions will be sent to the contracting party no later than two weeks before they take effect. If the contracting party does not object to the validity of the amended Privacy Service Terms and Conditions within four weeks, the amended Privacy Service Terms and Conditions shall be deemed accepted.   

 

2. Scope of Services 

2.1. Regardless of the package ordered, eagle does not provide legal services pursuant to Section 2(1) of the German Legal Services Act (RDG). Against this background, eagle does not handle matters of the client that require an extensive and individualized legal review involving the assessment of complex and difficult legal issues. Rather, eagle’s lawyers, who are trained in data protection law, assist the client in identifying such disputes in advance and—provided this is covered by the service package—minimizing the risk of such issues arising by establishing data protection-sensitive processes. Should a client matter require a comprehensive legal review and consultation in a specific case, eagle proactively refers the client to a partner law firm highly specialized in data protection law. 

2.2. As an external service provider, eagle handles the routine matters typical of data protection concerns on behalf of its clients. In this context, eagle supports its clients’ data protection management as a service partner with a team trained in data protection law. As an innovative legal service provider, eagle’s services—depending on the specific service package—focus on taking over standardizable work processes and tasks and continuously optimizing them. 

 
Regular tasks covered by our proactive data protection services include: 

• Guidance and support in conducting and reviewing the annual data protection audits required under the General Data Protection Regulation based on a privacy platform supported by eagle 
• Identifying and initiating measures to enhance the level of data protection and improve efficiency in data protection processes (e.g., example for SaaS clients: integration of standard data processing agreements into clients’ terms and conditions) 
• Evaluation of the VVT and TOMs automatically generated based on the annual audit, including recommendations for specific courses of action 
• Review and final adjustment of standard documents such as privacy policies (PP), data processing agreements (DPA), or data protection impact assessments (DPIA); in the event of frequent, recurring requests for DPAs, eagle will define a standard DPA on a case-by-case basis, which the client proactively shares with its contractual partners to avoid an individual review of the other party’s DPAs 
• Review of documents (customer contracts) with regard to data protection-relevant clauses; eagle will review the relevant data protection clauses, although revisions to contract documents (cited here as an example) by eagle are generally not included in the service. Typically up to 10 documents per year. 
• Support for data subject requests: the eagle team provides procedural support to the client upon receipt of a data subject request, particularly regarding obligations, deadlines, and the wording of responses; the client sends the response themselves 
• Support for data breaches: The client immediately reports data breaches via the DCO or by email to the eagle team, which then works with a contact person at the client’s organization to determine and initiate appropriate measures, provide guidance on deadlines, and, if necessary, draft the report of the incident to the relevant data protection authority; the client is responsible for sending the response 
• Communication with data protection authorities pursuant to Art. 36 GDPR: To the extent required by the circumstances of the individual case (e.g., prior consultation is necessary), eagle will, to a reasonable extent (typically <20 hours), prepare the documents for the request to the authority  

2.3. eagle offers its clients the following service packages for the provision of its services. The scope of the services included in each package is determined by the client-specific offer. Certain services are only included in higher-tier packages. The following services are not included: 

• Expert Guidance
  Customization of standard document templates that goes beyond legal review and specific issues; the client is responsible for creating the respective document based on the document templates in the software tool and the specific context, and for incorporating changes/feedback from eagle.  
• Full Service
  All services listed under 2.2 are included.  

2.4. eagle does not provide software-related services (Software-as-a-Service) that go beyond 1st-level support, in which eagle acts as the customer’s first point of contact. 

 

3. Obligations of the Client 

3.1. The Client warrants that it will provide all necessary resources and cooperation required for the services to be rendered by eagle in a timely manner and at no cost to eagle. 

3.2. The Client is obligated to provide files and data carriers made available to eagle within the scope of the service relationship in a condition that is technically sound and free of errors – in particular, free of malware (e.g., “viruses”).  

3.3. The Client is responsible to eagle for the functionality of and access to the software obtained from SECJUR.  

3.4. The Client shall cooperate proactively with eagle in a spirit of partnership with the common goal of continuously optimizing the workload involved in fulfilling data protection obligations.  

3.5. The Client is obligated to act in compliance with the law, i.e., to fulfill its contractual obligations toward eagle and third parties and to comply with all applicable legal regulations. If the Client is legally required to provide evidence of compliance with certain requirements, it shall also provide such evidence to eagle within the permissible scope.  

 

4. Remuneration and Terms of Payment 

4.1. The amount of the fee depends on the selected service package and is specified in the quote. Additional or special services will be billed separately. All prices are exclusive of applicable sales tax.  

4.2. Payment is due immediately and without deduction, no later than 14 days after receipt of the invoice, to the account specified by eagle.  

4.3. Billing is done annually in advance. Any deviations in individual contracts remain unaffected by this provision.  

4.4. In the event of default, eagle will charge statutory default interest and reserves the right to claim further damages resulting from the delay. 

4.5. eagle is entitled to adjust the contractually agreed remuneration annually by 2.9% net, as well as additionally in line with the development of the Consumer Price Index (Germany). The amount of the adjustment will be communicated to the client in writing no later than six weeks before the change takes effect. 

 

5. ContractTerm and Termination 

5.1. The contract term is 12 months. Unless terminated by either party in a timely manner, the contract shall be extended for an additional 12 months.  

5.2. The notice period is three months prior to the end of the contract term. Termination must be in writing. Compliance with the notice period is determined by the receipt of the notice of termination by the other party. 

5.3. The right to terminate the contract for cause remains unaffected by this provision. Cause shall be deemed to exist, in particular, if the Client is more than 90 days in arrears with payment. 

 

6. Liability

6.1. eagle is liable exclusively for intent and gross negligence. 

6.2. This limitation of liability does not apply to damages resulting from injury to life, limb, or health, nor to damages resulting from the breach of material contractual obligations. Material contractual obligations refer to those obligations whose fulfillment is essential for the proper performance of the contract and on whose compliance the client may rely. In the event of a breach of essential contractual obligations, liability for damages is limited to foreseeable damages typical for this type of contract. 

6.3. The limitations of liability set forth in Sections 6.1 and 6.2 also apply to third parties and in the event of breaches of duty by employees, representatives, or vicarious agents.  

 

7. Confidentiality 

7.1. eagle and the Client (hereinafter “the Parties”) mutually undertake to treat confidential information as strictly confidential and neither to disclose it to third parties who are not authorized persons nor to make it accessible to them in any other way, as well as to take appropriate precautions to protect this information. The obligation of confidentiality also extends to the content of this cooperation agreement. The Parties mutually undertake to fully inform all authorized persons who may receive confidential information regarding the scope of the confidentiality obligation. 

7.2. “Confidential Information” within the meaning of Section 7.1 includes all financial, technical, legal, tax-related, business operations-, employee-, or management-related information, as well as any other information (including data, records, and know-how) pertaining to the respective party, its customers, or an affiliated company, and which comes to the knowledge of the respective party. 

7.3. “Authorized Persons” within the meaning of Section 7.1 are the other party, its executive bodies and employees, as well as the other party’s affiliated companies, their executive bodies and employees, provided that they are each subject to a confidentiality obligation consistent with this Agreement and are necessarily involved in the business relationship. Authorized Persons also include consultants of the other party who are professionally or contractually bound to confidentiality. 

7.4. The duty of confidentiality shall survive the termination of the parties’ business relationship 

7.5. The confidentiality obligations pursuant to Section 7.1 shall not apply if  

a. the respective party has given its prior written consent to the other party for the specific instance of disclosing its confidential information to a third party, or  

b. the other party obtains the confidential information from a third party prior to the conclusion of this Agreement, provided that the third party lawfully came into possession of the information and does not violate a confidentiality obligation binding upon it by disclosing it; or  

c. the other party is required to disclose the Confidential Information by a court order, an order from a government agency, or another authority.

 

8. Reference 

eagle is entitled to name the Client as a reference customer and to use the Client’s logo in this context. This does not apply if the Client has objected in writing to the reference or the use of its logo. 

 

9. Final Provisions

9.1. The courts of the Free and Hanseatic City of Hamburg shall have jurisdiction over any disputes arising from or in connection with these Privacy Service Terms and Conditions as well as with the services provided by eagle. 

9.2. There are no oral side agreements to the Privacy Service Terms and Conditions, nor are there any offers or contracts that refer to them. Any amendments or additions to these Terms and Conditions, including the written form requirement itself, must always be made in writing to be effective. 

9.3. Should any provision of the Privacy Service Terms and Conditions be or become invalid in whole or in part, this shall not affect the validity of the remaining provisions of the Privacy Service Terms and Conditions. In such a case, the invalid provision shall be replaced by a valid provision that comes as close as possible to the meaning and purpose of the invalid provision. The same applies if a gap requiring supplementation arises during the performance of a contract to which the Privacy Service Terms and Conditions apply. In such a case, the parties undertake to agree on a valid provision that would have been agreed upon in accordance with the meaning and purpose of this contract had the matter been considered.