Schedule 5 to the oceanone Reseller / Agency Service Agreement Controller: the Reseller (“Controller”) Processor: SWIFT17 GmbH, Zimmersmühlenweg 71, 61440 Oberursel, Germany (“Processor”) Effective: on electronic acceptance of the Reseller Agreement / this DPA Version: 23/10/2026
1. Subject matter and duration
1.1 The Processor processes personal data on behalf of the Controller solely to provide the white-label Services ordered under the Reseller Agreement (SEO, ads, social, content, web, AI-assisted marketing support, VA, and related fulfilment).
1.2 Duration: for the term of each relevant order and thereafter until deletion or return under Clause 10, unless longer retention is required by law.
2. Nature and purpose of processing
| Item | Description |
|---|---|
| Nature | Collection (from Controller), storage, structuring, access, use for delivery, transmission to sub-processors, deletion |
| Purpose | Perform ordered marketing / digital services under the Controller’s brand and instructions |
| Frequency | Continuous / per project for the engagement |
3. Types of personal data
As provided by the Controller, which may include: names, contact details, job titles, online identifiers, account usernames, content and creative assets containing personal data, analytics/ad account data, and communications content. The Controller shall minimise special-category data and not instruct processing of Art. 9 data unless expressly agreed with an Art. 9(2) basis.
4. Categories of data subjects
End Clients of the Controller; End Clients’ customers or users (if included in materials); Controller’s employees/contacts involved in the project.
5. Instructions
5.1 The Processor processes personal data only on documented instructions from the Controller (including the Reseller Agreement, Portal orders, and written briefs), unless required by Union or Member State law (in which case the Processor informs the Controller unless prohibited).
5.2 If an instruction infringes GDPR, the Processor will inform the Controller.
6. Confidentiality
Persons authorised to process the data are bound by confidentiality (contract or statutory obligation).
7. Security (Art. 32)
The Processor implements appropriate technical and organisational measures, including: encryption in transit/at rest where applicable; access control and authentication; least privilege; backups; logging/monitoring; staff training; and vendor management. Details may be provided on request under NDA.
8. Sub-processors
8.1 The Controller authorises the Processor to use sub-processors for hosting, email, collaboration, payment-adjacent tooling, and AI/production tools as needed for the Services.
8.2 The Processor will impose data-protection obligations no less protective than this DPA. The Processor remains responsible for sub-processors’ performance.
8.3 The Processor will inform the Controller of intended changes to sub-processors (Portal notice or email) and give a reasonable objection window for legitimate data-protection reasons. If unresolved, the Controller may terminate the affected Services.
8.4 Current categories: cloud hosting; email/support; project management; analytics tooling used on instruction; AI content/production vendors; Stripe (for Reseller payment data as separate controller/processor relationship as applicable).
9. International transfers
Where personal data is transferred outside the EEA/UK, the Processor ensures a valid transfer mechanism (adequacy decision, SCCs, or other Art. 46 GDPR tool) and completes transfer impact assessments where required.
10. Assistance to the Controller
The Processor will, taking into account the nature of processing:
(a) assist with data-subject requests (Arts. 12–22) that relate to Processor-held data; (b) assist with security, breach notification (Arts. 32–34), DPIAs, and prior consultation (Arts. 35–36) where relevant; (c) make available information needed to demonstrate Art. 28 compliance and allow audits (remote first; on-site on reasonable notice, during business hours, no more than once per year unless a breach or authority request requires more), subject to confidentiality and without access to other customers’ data.
11. Personal-data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data, with information reasonably available to fulfil Art. 33 duties.
12. Deletion and return
On termination of Services or on written request, the Processor will delete or return personal data (Controller’s choice) and delete existing copies, unless Union/Member State law requires storage. Backups expire on normal rotation. Invoices and contract records retained under German law are excluded from erasure where legally required.
13. Liability
Liability under this DPA follows the Reseller Agreement and mandatory GDPR rules (Arts. 82–84). Nothing limits liability that cannot be limited by law.
14. Governing law
German law; disputes as per the Reseller Agreement (Frankfurt am Main), without prejudice to data subjects’ rights to lodge complaints with supervisory authorities.
Annex A — Contact points
| Role | Contact |
|---|---|
| Processor (general) | hello@oceanone.io |
| Processor DPO | dpo@oceanone.io |
| Controller | As registered in the Portal |
End of DPA (English draft)