Die Verarbeitung
- Wofür
- Providing the hosted services the Customer uses under the Main Agreement, supporting the Customer, and keeping the services secure and available. No other purpose.
- Hosting and operating, in Germany, the hosted services the Customer uses: storage, organisation, retrieval, use and display of the data in the service; its transmission to the recipients the Customer chooses and to the Sub-processors in Schedule 3; backups; support; erasure.
- Personenbezogene Daten
- account and profile data of the Customer's users: name, email address, user name, profile image and roles
- content and files that the Customer and its users put into the hosted services, and the personal data contained in them
- request logs with IP address, user agent and time, kept for at most 30 days
- audit logs of administrative actions
- the further categories stated in the processing annex of each hosted service the Customer uses, published at gplatform.org and listed at gplatform.org/dpa, in the version in force when this agreement takes effect
- Betroffene Personen
- the Customer's users, members and staff who use the hosted services
- persons whose data the Customer or its users put into the hosted services, such as the reporters of vulnerabilities in GAdvisory
- the further categories stated in the processing annex of each hosted service the Customer uses, published at gplatform.org and listed at gplatform.org/dpa, in the version in force when this agreement takes effect
- Wie lange
- Content and accounts: for as long as the Customer uses the hosted service, and at the end of the Service as the clause “Return and deletion” provides
- Request logs: at most 30 days
- Audit logs: as stated in the processing annex of the hosted service concerned (GAdvisory: 24 months)
- Backups: as stated in Schedule 2
Wer verantwortlich ist
- Verantwortlicher
- Jeder Geschäftskunde, für die personenbezogenen Daten, die er mit Gelhaus Solutions verarbeitet
- Auftragsverarbeiter
- Gelhaus Solutions, Eichenwald 3, Löningen, 49624, Deutschland
Unterauftragsverarbeiter
| Unternehmen | Wofür | Wo | Dienste | Garantie | Stand |
|---|---|---|---|---|---|
| Cloudflare, Inc. | DNS hosting for our domains and nothing else: it answers which address belongs to a name. None of our services' pages, mail, files or other traffic passes through it, and no content of a service reaches itWhich names of our domains are looked up; no content of a service | USA | Jeder Dienst | EU-US Data Privacy Framework (Cloudflare, Inc. is certified) | Im Einsatz seit 17. Oktober 2026 |
| Functional Software, Inc. (Sentry) | Error reports of the hosted services that use itError reports of the hosted services that use it, as far as they contain Customer Personal Data | EU (Sentry's EU data region), access from the USA possible | GAdvisory, GAnalytics, GOpenCDR, GOpenCNR, GOpenCSR, Contribution Checker und Discord Tickets | EU-US Data Privacy Framework (Functional Software, Inc. is certified); EU standard contractual clauses in Sentry's data processing agreement | Im Einsatz seit 17. Oktober 2026 |
| GitHub, Inc. | Private fixes (Advisory Patch) made in GitHub mode, and only those: it stores the private copy of the repository and the invitations to it, in the GitHub organisation we keep for private fixes. In the native mode, which we host ourselves, GitHub receives nothingThe private copy of a repository for a fix and the invitations to it | USA | GAdvisory | EU-US Data Privacy Framework (GitHub, Inc. is certified) | Im Einsatz seit 20. Oktober 2026 |
| Google LLC (Gemini), through OpenRouter | The AI features of GAdvisory, which are enabled on the hosted service: OpenRouter routes them to GeminiPrompts and outputs of the AI features | USA | GAdvisory | EU-US Data Privacy Framework (Google LLC is certified) | Im Einsatz seit 20. Oktober 2026 |
| Groq LLC, through OpenRouter | AI tasks of Contribution Checker, only where a project enables one, which is off by default for every task: OpenRouter routes them to Groq. Where it is off, nothing reaches itPrompts and outputs of the AI tasks a project enables | USA | Contribution Checker | Standard contractual clauses in OpenRouter's data processing agreement | Im Einsatz seit 20. Oktober 2026 |
| IONOS SE | Rented servers in data centres in Germany for the hosted servicesCustomer Personal Data of the hosted services that run on the rented servers | Germany | Jeder Dienst | None needed: processing in the EU | Im Einsatz seit 17. Oktober 2026 |
| OpenRouter, Inc. | The AI features of GAdvisory and contribution-checkerPrompts and outputs of the AI features, passed on to the model provider (Google or Groq) | USA, and the model providers it routes to: Google and Groq, USA | GAdvisory und Contribution Checker | EU standard contractual clauses (Module Two) in OpenRouter's data processing agreement, signed 20 October 2026 | Im Einsatz seit 17. Oktober 2026 |
| Stripe Payments Europe, Limited | Two things, and the annex of GPlatform Billing says which is which: our processor for the customer record it holds for us, for issuing and numbering invoices, and for the billing portal; a controller in its own right for the payment instrument and for screening a payment for fraudThe customer record for invoices and the billing portal | Ireland | GPlatform Billing | Within Stripe's group, the safeguards in Stripe's data processing agreement | Im Einsatz seit 20. Oktober 2026 |
Die letzten Änderungen
Alle ÄnderungenOpenRouter, Inc.: geändert
Am 22. Oktober 2026 geändert: welche Dienste ihn nutzen. Eingesetzt für: The AI features of GAdvisory and contribution-checker.
Functional Software, Inc. (Sentry): geändert
Am 22. Oktober 2026 geändert: wo er verarbeitet und welche Dienste ihn nutzen. Eingesetzt für: Error reports of the hosted services that use it.