Version of November 11, 2026
This is a translation. In case of doubt, the German version prevails.
between the Customer (controller, hereinafter the “Customer”) and CreateWebinar, owner Lars Eppendahl, Wasserstr. 496, 44795 Bochum, Germany (processor, hereinafter “we”).
(1) We process personal data on behalf of the Customer when it offers webinars with CreateWebinar, that is, when it accepts sign-ups, sends emails to guests, and holds and analyses broadcasts with chat. Section 2 describes the subject matter, nature and purpose, types of data and data subjects.
(2) This agreement is an annex to the General Terms and Conditions (“Terms”) and is concluded together with the contract of use for the account. It applies for as long as we process data for the Customer. In the event of conflict, it takes precedence over the Terms insofar as the protection of personal data is concerned.
(3) For the Customer's own data (account, billing), we are a controller in our own right; our privacy policy applies to this, not this agreement.
| Purpose | Provision of sign-up pages, double opt-in, management of dates, sending of confirmation, reminder and (with consent) follow-up emails, holding the broadcast with chat and AI replies, counting attendance and clicks, analytics for the Customer, access requests and erasure |
| Nature | Collection, storage, organisation, retrieval, transmission (to sub-processors), display, erasure |
| Types of data | First name, email address, selected date and time zone; consents with wording, time and IP address (proof of sign-up); confirmation and unsubscribe status; personal access identifier; attendance (joining, presence, time spent), name displayed in the chat, chat messages, clicks on the offer, applause; email events (delivery; opens and clicks only with the guest's consent); where applicable, content that guests themselves write in the chat |
| Data subjects | Guests (prospects, attendees) of the Customer's webinars |
| Special categories (Art. 9 GDPR) | not intended; the Customer ensures that its webinars are not designed to collect such data |
(1) We process the data only on documented instructions from the Customer. Instructions are the Terms, this agreement and the settings that the Customer makes in the Service (for example deletion periods, email tracking, deletion of individual guests).
(2) Further instructions must be issued in text form (for example by email to info@createwebinar.com). Oral instructions are permitted only in urgent cases and must be confirmed by the Customer in text form without undue delay. We document instructions issued.
(3) If processing is required by law, we inform the Customer beforehand, unless the law prohibits this. If we consider an instruction to be unlawful, we will notify the Customer without undue delay and may suspend its execution until it is confirmed.
(1) We process the data only in the EU or the EEA, unless section 6 permits a transfer to a sub-processor in a third country.
(2) Persons who have access to the data have been bound to confidentiality before commencing their activity and have been familiarised with the relevant data protection provisions. The obligation of confidentiality continues to apply after the end of this agreement.
(3) We take the technical and organisational measures under Art. 32 GDPR that are described in Annex A. We may develop them further provided that the level of protection does not decrease.
(4) We support the Customer with appropriate measures in fulfilling the rights of data subjects (access, rectification, erasure, restriction, data portability, objection). The Service offers functions for this (search, access information as a file, deletion, export). If data subjects contact us directly, we forward the request to the Customer without undue delay.
(5) We support the Customer with the obligations under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment, prior consultation), insofar as the information is available to us.
(6) We notify the Customer of a personal data breach without undue delay, where possible within 24 hours of becoming aware of it, with the information under Art. 33(3) GDPR, insofar as known.
(7) We do not use the data for our own purposes, in particular not for advertising, for analyses across multiple customers or for training AI models.
(8) We inform the Customer without undue delay of inspections or measures by supervisory authorities insofar as they may concern its data, and of events that could endanger its data.
(9) We are not legally required to appoint a data protection officer. Contact for data protection: info@createwebinar.com.
(1) The Customer grants general authorisation to engage the sub-processors listed in Annex B.
(2) We inform the Customer of intended changes (addition or replacement) at least 30 days in advance by email and on the “Data processing” page (Annex B). The Customer may object to the change in text form within this period for good cause under data protection law. If we are unable to remedy the objection, the Customer may terminate the affected services with effect from the time of the change; § 3(3) of the Terms applies accordingly to paid services not used.
(3) We select sub-processors carefully, contractually bind them to a level of protection that corresponds to this agreement, and review them regularly and whenever there is cause to do so.
(4) Ancillary services without a specific connection to the processing of the Customer's data, for example telecommunications, postal or transport services, do not constitute sub-processing. In these cases, too, we ensure confidentiality appropriately.
(5) If the Customer uses its own key for an AI or voice service (BYOK), it selects this service itself and concludes its own contract with it. We then transmit the data to this service on the Customer's behalf; the Customer is responsible for the lawfulness of this transmission.
Data is transferred to a country outside the EU and the EEA only to the recipients listed in Annex B and only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (for example the EU-US Data Privacy Framework for certified recipients) or the standard contractual clauses of the European Commission.
(1) On request, we provide the Customer with the information necessary to demonstrate compliance with this agreement (for example these annexes, information, confirmations from service providers).
(2) The Customer may carry out inspections itself or through an auditor bound to confidentiality, after giving timely notice (as a rule 30 days), during normal business hours and without disrupting operations disproportionately. Evidence is primarily provided by means of documents. For on-site inspections exceeding one day per year, we may charge reasonable remuneration, unless the inspection is prompted by a breach on our part.
(1) We delete guest data in accordance with the Customer's settings: unconfirmed sign-ups after 30 days, other guests and attendance data after the deletion period chosen by the Customer (default setting 12 months after the date), and individually on instruction in the Service.
(2) After the end of the agreement, the Customer can export the data for 30 days. After that, we delete it, including any existing copies; backup copies are overwritten within their regular cycle (no more than 30 days). We confirm the deletion in text form on request. Statutory retention obligations remain unaffected.
(1) Art. 82 GDPR applies to liability; otherwise, the liability provisions of the Terms apply.
(2) Changes to this agreement require text form. Otherwise, the final provisions of the Terms apply.
Confidentiality
Integrity
Availability and resilience
Procedures for regular review
| Sub-processor | Service | Data | Location / legal basis |
|---|---|---|---|
| netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe | Server (hosting) | all data under section 2 | Germany (data centre in Nuremberg) |
| Backblaze, Inc., 201 Baldwin Ave., San Mateo, CA 94401, USA | Storage of backup copies | all data under section 2, encrypted on our server beforehand (not readable by Backblaze) | Data centre in Amsterdam (Netherlands, EU Central region); access from the USA possible: EU-US Data Privacy Framework, standard contractual clauses |
| Mailgun Technologies, Inc. (Sinch), EU region | Sending of emails to guests | Email address, first name, content of the emails, delivery events and (with consent) open/click events | Processing in the EU region (Belgium); support from the USA possible: Data Privacy Framework according to the provider, standard contractual clauses |
| OpenRouter, Inc., 169 Madison Ave #2404, New York, USA | Routing of AI replies in the chat | Guest's chat message with displayed name, content of the webinar | USA: standard contractual clauses; setting without storage of inputs (Zero Data Retention); forwarding to the selected model (Anthropic) under its terms |
| Anthropic PBC, San Francisco, USA (via OpenRouter) | AI model for chat replies | as for OpenRouter | USA: standard contractual clauses; no training with customer data according to the provider |
If the Customer uses its own key (for example directly with Anthropic or with OpenRouter), section 5(5) applies: the Customer has chosen this service itself and has concluded its own contract with it.
Not included in this list because no guest data is transmitted: ElevenLabs (voicing of the host script), Modal Labs (generation of the host videos from the slides' audio track), Black Forest Labs (images from image descriptions without personal data), Pixabay and Pexels (stock photos via our server), VIES. Stripe processes only data of the Customer itself (not the subject matter of this agreement).
Earlier versions