Data processing agreement
under Art. 28 GDPR for NextKon VOD · version 1.0 of 02.10.2026 · sign in your NextKon account
Courtesy translation. Only the German version is legally binding.
Parties
Controller (“Client”): the organisation that uses NextKon VOD and concludes this agreement in the NextKon account (name, role and time are recorded there).
Processor (“Contractor”): TS Veranstaltungstechnik GmbH & Co. KG, Bürenweg 5, 73102 Birenbach, Germany, Ulm Local Court HRA 722595, represented by TS Veranstaltungstechnik Verwaltungs GmbH, in turn represented by its managing director Florian Daniel Tospann. Data protection contact: info@ts-veranstaltungstechnik.de, +49 7161 30 47 49 0.
The agreement is concluded electronically (Art. 28(9) GDPR): the Contractor offers it in this version, the Client accepts it by confirming it in the NextKon account. A signed PDF version is available on request.
§ 1 Subject matter and duration
(1) The Contractor provides the Client with the video library “NextKon VOD” (uploading, converting and storing videos, library and video pages, embedding, administration). In doing so, it processes personal data on behalf of the Client.
(2) The basis is the respective usage agreement (trial, VOD package, quote; together the “Main Contract”) including the GTC. This agreement applies as long as the Contractor processes personal data for the Client and ends with deletion under § 10.
§ 2 Nature, purpose, data, data subjects
(1) Nature and purpose: storage, conversion into streaming versions, provision and delivery of the videos according to the Client’s visibility settings (in the library, unlisted, private); backup, maintenance, deletion on instruction.
(2) Types of data: image and sound in the videos (in particular speakers, moderators, audience), titles, descriptions and thumbnails; email addresses of the admin users authorised by the Client; technical connection data of viewers when watching (IP address, time, file requested, browser identifier) in the delivery logs. No cookies are set and no viewer profiles are created.
(3) Data subjects: persons who can be seen or heard in the videos, viewers, the Client’s staff.
(4) Special categories of personal data (Art. 9, 10 GDPR) are not subject to processing unless the Client uploads such content itself; the Client is then responsible for the legal basis.
§ 3 Instructions
(1) The Contractor processes the data only on documented instructions from the Client, including with regard to transfers to a third country, unless required to do so by law; in that case it informs the Client beforehand unless the law prohibits this (Art. 28(3)(a) GDPR).
(2) Instructions are the Main Contract, this agreement and the settings and actions in the VOD admin (e.g. uploading, visibility, deletion). The Client gives further instructions in text form (email).
(3) If the Contractor considers an instruction unlawful, it informs the Client without delay and may suspend it until confirmed or changed.
§ 4 Confidentiality
The Contractor only uses persons who are committed to confidentiality or subject to a statutory duty of confidentiality and who have been familiarised with data protection rules (Art. 28(3)(b), Art. 29 GDPR). Only persons who need access for operation, troubleshooting or at the Client’s request (e.g. editing by the Contractor) have access to content.
§ 5 Security of processing
The Contractor takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection is not reduced; it documents material changes in the annex.
§ 6 Sub-processors
(1) The Client approves the sub-processors listed in Annex 2 (general written authorisation, Art. 28(2) GDPR).
(2) The Contractor informs the Client in text form at least 14 days in advance of intended changes. The Client may object within this period for an important data protection reason; if no agreement is reached, it may terminate the Main Contract as of the time of the change.
(3) The Contractor imposes the same data protection obligations on sub-processors as in this agreement (Art. 28(4) GDPR).
§ 7 Data subject rights
The Contractor supports the Client with appropriate measures in responding to requests from data subjects (Art. 12–22 GDPR). The Client can change, hide and delete videos itself in the VOD admin. If data subjects contact the Contractor directly, it forwards the request to the Client without delay.
§ 8 Personal data breaches
The Contractor notifies the Client of a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as known, and supports the Client with notification and communication (Art. 33, 34 GDPR).
§ 9 Further assistance
Taking into account the nature of processing and the information available to it, the Contractor assists the Client with the obligations under Art. 32 to 36 GDPR (security, data protection impact assessment, prior consultation).
§ 10 Deletion and return
(1) The Client can download its videos at any time (original file within 30 days of uploading) and delete them. Deleted files remain recoverable as an older version for 30 days and are then permanently removed.
(2) After the end of the Main Contract, the admin area remains accessible for 30 days; thereafter the Contractor deletes all of the Client’s videos and data within a further 30 days at the latest. Delivery logs, insofar as they are kept to measure viewing hours, are deleted after 30 days at the latest.
(3) Statutory retention obligations of the Contractor (e.g. for invoices) remain unaffected; they do not concern video content.
§ 11 Evidence and audits
The Contractor provides the Client with all information necessary to demonstrate compliance with Art. 28 GDPR and allows audits by the Client or an auditor commissioned by it and bound to confidentiality, after timely notice (usually 14 days), during normal business hours and without disrupting operations. For the data centres, the certificates and reports of the sub-processor (Annex 2) are sufficient.
§ 12 Place of processing
(1) The videos are stored and converted exclusively in data centres in Frankfurt am Main (Germany).
(2) For fast playback, the delivery network (Amazon CloudFront) delivers video segments via locations close to the viewer and caches them there briefly. Locations in Europe and North America are configured; a request from North America may therefore be served via locations there. The sub-processor is a company based in the EU (Luxembourg) with a parent company in the USA; the basis of any third-country transfer is the adequacy decision on the EU-US Data Privacy Framework (Amazon’s certification) and the EU Standard Contractual Clauses in the AWS data processing addendum (Art. 45, 46 GDPR). On request we restrict delivery to locations in Europe (Enterprise).
§ 13 Liability, final provisions
(1) Liability is governed by Art. 82 GDPR; otherwise the provisions of the Main Contract and the GTC apply.
(2) In the event of contradictions, this agreement takes precedence over the Main Contract in data protection matters. Changes require text form; the Contractor offers a new version for confirmation in the NextKon account.
(3) German law applies. If a provision is invalid, the remainder of the agreement remains valid; the statutory provision applies.
Annex 1 – Technical and organisational measures
Physical and logical access: Amazon Web Services data centres in Frankfurt am Main (certified among others under ISO 27001, SOC 2, C5). No server of our own at the Contractor; administration only via personal, password-protected accounts (NextKon account, login via Amazon Cognito); operator access only with a separate key, only for the managing director and commissioned technicians.
Separation: Each Client has its own area (tenant); admin access is restricted to the Client’s own tenant and checked server-side.
Encryption: Transmission only encrypted (TLS, HSTS); storage encrypted (AES-256, server-side); storage not public – original files are never accessible via the internet, streaming versions only via the delivery network.
Visibility: Each video is “in the library”, “unlisted” or “private”; private videos are only visible in the admin area.
No tracking: Library, video pages and player set no cookies, use no browser storage for recognition and load nothing from third-party servers; no advertising, no analytics tools.
Availability and backup: Storage with multiple redundancy across several data centres in Frankfurt; deleted or overwritten files recoverable for 30 days; database with point-in-time recovery for the last 35 days; monitoring and cost alerts.
Deletion: Deleting in the admin area removes videos from storage and library; final deletion of versions after 30 days; deletion of all data after the end of the contract under § 10.
Organisation: Staff committed to confidentiality; technical changes only via a documented deployment process with version control; reporting channel for data breaches to the managing director.
Annex 2 – Sub-processors
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
Storage (S3), conversion (MediaConvert), database (DynamoDB), login (Cognito), interface (Lambda/API Gateway): Frankfurt am Main region (eu-central-1); delivery (CloudFront): locations in Europe and North America, see § 12.