Skip to content
Back to home

Auftragsverarbeitungsvertrag für Lumo Webstore

As of: October 15, 2026

This agreement pursuant to Art. 28 DSGVO applies between the operator of a Webstore (Controller, "Operator") and Agency Scripts, Inhaber: Leon Rudolf, Die Halde 2, 64853 Otzberg, Deutschland, E-Mail [email protected] (Processor, "we"). It is concluded as soon as the operator enables the Webstore module in the dashboard and ends when the Webstore is disabled.

1. Subject matter and duration

We operate an online shop for the operator that displays its products from Tebex, logs visitors in with Discord, and transfers orders to Tebex. Processing continues for as long as the Webstore is active.

2. Nature of data and data subjects

Data subjects are visitors and customers of the shop. Processed data includes Discord ID, Discord name, and profile picture, shopping cart, orders with Tebex cart identifier, reviews, loyalty points, questions to the AI assistant (if enabled), as well as technical data for page delivery.

3. Instructions

We process data only in accordance with the settings configured by the operator in the dashboard and documented instructions of the operator, unless we are legally required to process it. If we consider an instruction unlawful, we will inform the operator.

4. Confidentiality

Access to data is restricted to individuals who need it for operations and are bound to confidentiality.

5. Technical and organizational measures

  • Transmission exclusively encrypted (TLS).
  • Operation on our own server in Germany, access via key only, firewall.
  • The bot database is encrypted (SQLCipher); shop data is stored separately per shop.
  • Web server logs without IP addresses.
  • Regular encrypted backups.
  • Access to settings is limited to server team members with dashboard permissions.

6. Sub-processors

We use Cloudflare, Inc. (page delivery, attack protection) and, solely for the AI assistant, our AI provider. Transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. We announce new sub-processors in advance on lumobot.net; the operator may object and disable the Webstore. Discord and Tebex are independent controllers and not sub-processors.

7. Operator assistance

We assist the operator with requests from data subjects (access, rectification, erasure), notification of personal data breaches, and data protection impact assessments. We notify the operator of personal data breaches without undue delay upon becoming aware of them.

8. Erasure and return

Following the termination of the Webstore, we delete shop data within 30 days, unless statutory obligations require longer retention. Upon request, we will provide the operator with a copy beforehand.

9. Verification and audits

Upon request, we make available to the operator the information necessary to demonstrate compliance with this agreement and allow for reasonable audits following prior coordination.

10. Final provisions

German law applies. The Lumo Terms of Service apply supplementary. Should any provision be invalid, the remaining provisions of the agreement shall remain effective.

See also: Terms of Service