Data Processing Agreement (DPA)
The legally binding version is the German one at AVV
This agreement governs the cooperation between Bashkirixa GmbH and its business customers (B2B) regarding the protection of personal data in accordance with the GDPR and the Austrian Data Protection Act.
- Role: We act as a data processor for the customer data you provide to us during instrument maintenance orders.
- Security: We implement technical and organizational measures to protect your data from unauthorized access.
- Partners: We utilize trusted sub-processors, specifically easyname GmbH and FormSubmit.
- Deletion: Data is deleted after the completion of the order and the expiration of legal retention periods.
1. Subject and Parties
This agreement is entered into between the client (hereinafter "Controller") and Bashkirixa GmbH, represented by Managing Director Julia Leitner, Jakominiplatz 14, 8010 Graz (hereinafter "Processor"). The objective is to ensure GDPR-compliant processing of personal data during the repair and maintenance of musical instruments.
2. Nature and Purpose of Processing
The Processor shall process data only on the documented instructions of the Controller. This includes names, contact details, and information regarding the instruments of the Controller's end-customers to provide the contractually agreed services (see Services).
3. Obligations of the Processor
Bashkirixa GmbH undertakes to treat all data confidentially and use it solely for the purpose of instrument care. Processing is carried out in strict compliance with the General Data Protection Regulation (GDPR/DSGVO) and the Austrian Data Protection Act (DSG). Further details can be found in our Privacy Policy.
4. Sub-processors
To provide the services, the Processor utilizes the following sub-processors:
- easyname GmbH (Canettistraße 5/10, 1100 Wien) for the hosting of the digital infrastructure.
- FormSubmit (USA) for the technical transmission of contact requests.
The Controller is informed that data may be transferred to the USA via FormSubmit, where appropriate security safeguards are implemented.
5. Technical and Organizational Measures
We implement appropriate measures to maintain the confidentiality and integrity of data. These include encrypted transmission paths (SSL/TLS) and restricted access to physical documents within the workshop in Graz.
6. Incidents and Notification Duties
The Processor shall notify the Controller without undue delay of any personal data breach. The notification will specify the nature of the data and the affected persons, insofar as this is possible based on current knowledge.
7. Deletion and Return of Data
Upon completion of services or at the request of the Controller, all data will be deleted or returned. Retention periods are governed by the legal requirements for business records in Austria. Specific settlement conditions are detailed in our Terms.
8. Audit and Control
The Controller has the right to verify compliance with data protection obligations through audits or inspections. Such audits must be coordinated with a notice period of 14 days to avoid disrupting workshop operations.
9. Final Provisions
This agreement is governed by the laws of the Republic of Austria. The place of jurisdiction for all disputes arising from this agreement is Graz. The competent supervisory authority is the Austrian Data Protection Authority (DSB, Barichgasse 40-42, 1030 Wien, https://www.dsb.gv.at).
Bashkirixa GmbH (Share Capital 10,000 €) guarantees compliance with applicable standards, including TKG 2021 and KSchG.
Updated on 12 October 2026. Contact for data protection inquiries: [email protected] | Tel: 0316 65 27 88