Data processing agreement

This is a translation for convenience. The German version is legally binding.

As of 25 October 2026

This agreement under Art. 28 GDPR applies between the operator of a website or app that includes Relyo and uses relyo.de as its server (the controller) and Jochen Maurer, Evereststrasse 41, 81825 München, Germany (the processor). It becomes part of the terms of use upon integration. Electronic form is sufficient (Art. 28(9) GDPR).

1. Subject matter, duration, nature and purpose

  • Subject matter: operating the server for support sessions: issuing codes, forwarding screen content and control commands between user and supporter, event log.
  • Duration: for as long as the controller uses relyo.de as its server.
  • Purpose: supporting the controller’s users by screen sharing.

2. Types of data and data subjects

  • Data subjects: users of the controller’s website or app; the controller’s supporters.
  • Data:
    • connection data: IP address, website address or app identifier, platform
    • device and tab identifier, and where applicable the user identifier and name passed by the controller
    • screen content and interactions, only after the user has shared them and excluding masked areas
    • session metadata and event log

Special categories of personal data (Art. 9 GDPR) are not intended to be processed. The controller masks areas in which they may appear.

3. Instructions

I process the data only on documented instructions from the controller. The instructions are set out exhaustively in this agreement and in the configuration the controller chooses when integrating Relyo (for example masking). If I consider an instruction unlawful, I will inform the controller.

4. Confidentiality

I run the service alone. Only I and persons I have bound to confidentiality have access to the server.

5. Technical and organisational measures (Art. 32 GDPR)

  • Data minimisation: screen content is only forwarded, not stored; during a session only the latest state is held in memory.
  • Masking on the device: password, email, phone and payment fields and marked areas never leave the device in plain text.
  • Consent: transmission only after the user shares, control only after a second consent; the user can end at any time.
  • Encryption: transmission exclusively via TLS.
  • Access control: codes are random, valid for 10 minutes and usable once; lockout after repeated failed attempts; access to a session only for the supporter who entered the code.
  • Storage limitation: IP addresses in the event log are deleted automatically after 30 days, session metadata after 12 months.
  • Operations: own server in Germany, software verifiable as open source, timely updates.

6. Sub-processors

The controller consents to the use of the following sub-processors:

Sub-processor Service Location, safeguard
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA network access to the server (tunnel), TLS, attack protection worldwide; EU-US Data Privacy Framework, standard contractual clauses

I will announce new sub-processors on this page at least 4 weeks in advance. The controller may object for an important data protection reason; its option is then to stop using relyo.de.

7. Assisting the controller

I assist the controller, with the means available to me, with requests from data subjects (Art. 12 to 23 GDPR), with the security of processing, with notifications of personal data breaches and with data protection impact assessments. If a data subject contacts me directly, I forward the request to the controller where the controller can be identified.

8. Personal data breaches

I notify the controller of personal data breaches without undue delay after becoming aware of them. Because operators can use relyo.de without registering, notification is sent to a contact address assigned to the controller, where known, and additionally published on this website.

9. Deletion and return

Screen content is not stored. Session metadata and the event log are deleted according to the periods in section 5. On request I will delete the controller’s data earlier, unless a statutory retention obligation applies.

10. Evidence and audits

On request I provide the controller with the information necessary to demonstrate compliance with Art. 28 GDPR. Once published, the Relyo source code is open to inspection. On-site audits are possible by arrangement.

11. Liability

Liability is governed by Art. 82 GDPR; otherwise the liability provisions of the terms of use apply.

← Back to the home page