Data processing agreement
Updated 15 September 2026.
The German AVV is legally binding. This English page is a convenience translation.
In brief
- This DPA applies when Voxlyra GmbH processes personal data on behalf of a B2B customer.
- Sub-processors: Hetzner Online GmbH and FormSubmit where the form is used.
- Instructions in writing to hello@voxlyra.click.
- Deletion of session archives after 18 months unless an instruction blocks it.
Contents
1. Roles
The business customer is controller for guest data it sends us for production. Voxlyra GmbH is processor for those data. For its own customer data (invoices to the client) Voxlyra remains controller.
2. Subject
Recording, storage, editing and handover of picture and sound on instruction, and hosting of the website request where it contains production data.
3. Duration
For the production contract plus an 18-month archive, then deletion or anonymisation unless a tax duty blocks it.
4. Instructions
Instructions by email to hello@voxlyra.click from the person named in the contract. We refuse unlawful instructions.
5. Security
Access to masters only for Lena Hoffmann, Jonas Richter, Mira Schulz and Niklas Berger as the role requires. Machines in the house; no public cloud for masters. Website hosting at Hetzner.
6. Sub-processors
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hosting/email infrastructure of the domain). FormSubmit, United States, only if the customer uses the website form; direct mail is the alternative. Further sub-processors are announced before use; objection within 14 days.
7. Assistance
We assist with data-subject requests that concern production data held here, with a first reply within two working days.
8. Evidence
On written request we compile available notes on technical measures. No SOC certificate or ISO seal is claimed.
9. Closing
German law applies; place of jurisdiction for merchants is Berlin. The DPA supplements the terms.
Terms: terms. Privacy: privacy. Legal notice: legal notice.