GraceDNSData Processing Agreement#
Last updated: 2026-08-20
This Data Processing Agreement ("DPA") pursuant to Art. 28 GDPR is concluded between the customer (the "Controller") and botBrains GmbH, Osloer Str. 83, 13359 Berlin, Germany (the "Processor") and forms part of the Terms of Service for GraceDNS. Business and school customers accept it as part of their order; a countersigned copy is available on request from legal@gracedns.eu.
1. Subject matter and duration#
The Processor provides protective DNS resolution and, at the Controller's instruction, query logging. The DPA runs for the duration of the service agreement.
2. Nature and purpose of processing#
Resolution of DNS queries originating from the Controller's users and devices; filtering of queries against blocklists and Controller-defined rules; storage of query logs strictly according to the logging mode (none, blocked_only, all) selected by the Controller per configuration.
3. Categories of data and data subjects#
- Data subjects: the Controller's employees, students, pupils, household members or other users of the Controller's networks and devices.
- Data categories: DNS query data (queried domain, record type, timestamp, verdict, protocol), client IP addresses (only in logging mode "all" or when the Controller configures linked IP ranges), configuration identifiers, and account/administrator contact data.
4. Instructions#
The Processor processes personal data only on documented instructions from the Controller. The configuration set by the Controller through the API (logging mode, retention, rules) is the primary documented instruction. The Processor informs the Controller if an instruction, in its opinion, infringes the GDPR.
5. Confidentiality#
Persons authorized to process personal data have committed themselves to confidentiality (see Compliance: Personnel and Confidentiality).
6. Security of processing (Art. 32 GDPR)#
Technical and organizational measures include: TLS encryption in transit for DoT, DoH, API and artifact distribution; encryption at rest on encrypted volumes; access restricted to named administrators with key-based authentication; separation of the data plane (resolvers) from the control plane; logging modes that minimize data by default (individuals default to "none"); backups of the control-plane database and artifacts; hosting exclusively in ISO 27001 certified data centers of Hetzner Online GmbH in Germany. Details: Compliance.
7. Subprocessors#
The Controller grants general authorization for the subprocessors listed at Subprocessors. The Processor will announce intended additions or replacements at that page and by email to account holders at least 30 days in advance; the Controller may object on reasonable data protection grounds. Blocklist feed providers are data sources, not subprocessors: no Controller data is disclosed to them.
8. Data subject rights#
The Processor supports the Controller with appropriate technical measures (log export, deletion per configuration, account deletion) in fulfilling data subject requests. Requests received directly from data subjects are forwarded to the Controller without undue delay.
9. Personal data breaches#
The Processor notifies the Controller of a personal data breach affecting the Controller's data without undue delay and at the latest within 72 hours of becoming aware, including the information required by Art. 33(3) GDPR as available.
10. Deletion and return#
On termination, the Processor deletes all query logs and configuration data within 30 days, unless statutory retention obligations apply. Before deletion, the Controller can export configurations (JSON via API) and query logs. See Compliance: Migration and Data Export.
11. Audits#
The Processor makes available the information necessary to demonstrate compliance with Art. 28 GDPR, in particular the Compliance page, the ISMS FAQ and, where available, third-party attestations of its hosting providers. On-site audits are supported where legally required, with reasonable notice and at the Controller's expense.
12. Data location#
All processing under this DPA takes place in Germany. No transfers to third countries occur.