under Art. 28 GDPR · Annex to the Terms · Version 2026-10 · valid from 1 October 2026
This agreement applies automatically to every contract for ShortBoost One, including on the Free plan; you do not need to sign anything. For your records, you can save this page as a PDF using your browser's print function.
1.1 This data processing agreement (“AVV”) applies between the customer of ShortBoost One as controller and Inexdu GmbH, Spitalbergweg 87, 9020 Klagenfurt am Wörthersee, Austria, FN 497589z, as processor (“we”).
1.2 The AVV is an annex to and part of the Terms (“main contract”). It applies from the conclusion of the main contract and ends with it; obligations that continue beyond the end of the contract (in particular clause 10) remain in force. In the event of conflicts between the Terms and the AVV, the AVV takes precedence as regards data protection.
1.3 If the customer is itself a processor of a third party, we act as its sub-processor. The customer ensures that its instructions are consistent with those of its controller.
2.1 Subject matter: We process personal data on behalf of the customer to the extent that we provide ShortBoost One to it, in particular:
2.2 Nature of the processing: collecting, storing, analysing, displaying, exporting and deleting.
2.3 Purpose: provision of the functions of the main contract, in particular redirection and statistics.
2.4 Types of data:
2.5 Data subjects: visitors to the customer's short links and pages; persons whose data the customer enters into its content.
2.6 We process special categories of personal data (Art. 9 GDPR) only if the customer itself enters them into content. The customer should avoid doing so.
2.7 Not covered by this AVV is the data that we process as a controller in our own right: account, contract and payment data of the customer and its team members, security logs as well as the checking of destination addresses and the handling of abuse reports (see privacy policy). We may also use the click data as a controller in our own right for abuse prevention and security, to the extent necessary for those purposes.
3.1 We process the data only on documented instructions from the customer, including with regard to transfers to third countries, unless EU or Austrian law requires us to carry out processing; in that case we inform the customer of this beforehand, unless the law prohibits this.
3.2 The customer's instructions are set out exhaustively in the main contract, in this AVV and in the settings the customer configures in the dashboard (for example stored pixels and the consent prompt before pixels, deleting links, export). The customer issues further instructions in text form to support@shortboost.one. We treat instructions that go beyond the scope of services as change requests.
3.3 If we consider an instruction to be unlawful, we inform the customer without undue delay and may suspend its implementation until the customer confirms or changes it.
3.4 Standard deletion period: In the absence of other instructions, we delete click data 25 months after the visit.
4.1 The customer is responsible for the lawfulness of the processing, in particular for the legal basis, for informing visitors (for example in its privacy policy) and, where necessary, for obtaining consent.
4.2 The customer informs us without undue delay if it finds errors or irregularities in the processing.
Persons at our company who have access to the data are bound by a duty of confidentiality or are subject to a statutory duty of secrecy (Art. 28(3)(b) GDPR, § 6 DSG). This obligation continues to apply after their work for us has ended.
6.1 We take the technical and organisational measures under Art. 32 GDPR that are described in Annex 1.
6.2 We may adapt the measures to technical progress, provided that the level of protection is not reduced. We document material changes.
7.1 The customer grants us general authorisation to engage sub-processors. Those engaged at the time the contract is concluded are listed in Annex 2 and are deemed authorised.
7.2 We notify the customer by email of a new or changed sub-processor at least 30 days in advance. Within this period, the customer may object for good cause relating to data protection. If we cannot find a solution, the customer may cancel the main contract free of charge with effect from the date the new sub-processor is engaged; we refund pro rata any amounts already paid for the period thereafter (for Lifetime, in accordance with clause 7.3 of the Terms). In emergencies (for example, failure of a provider), we may switch immediately and inform the customer without undue delay; the right to object then applies from the time of notification.
7.3 We contractually impose on every sub-processor the same data protection obligations as those set out in this AVV, in particular the obligation to provide sufficient guarantees of appropriate technical and organisational measures. We are liable to the customer for the sub-processor's compliance.
7.4 The following do not constitute sub-processing: services that we use as ancillary services, such as telecommunications, certificates (Let's Encrypt) or the checking of destination addresses with Google Web Risk and abuse.ch, which we carry out as a controller in our own right. The pixel providers are not sub-processors (clause 11.5).
We or our sub-processors transfer data to countries outside the EU and the EEA only if the requirements of Art. 44 et seq. GDPR are met, for example by way of an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses. Annex 2 specifies the basis for each sub-processor.
9.1 Data subject rights: The customer can view, export and delete click data itself via the dashboard. If a data subject contacts us, we forward the request to the customer without undue delay and do not respond ourselves unless the customer instructs us to do so. To the extent that the customer cannot answer a request itself, we assist it.
9.2 Personal data breaches: If we identify a personal data breach that affects the customer's data, we inform the customer without undue delay, where possible within 48 hours, by email, providing the information referred to in Art. 33(3) GDPR to the extent available to us. We supply any further information subsequently.
9.3 Further obligations: We assist the customer with data protection impact assessments and prior consultations (Art. 35, 36 GDPR) by providing the information available to us.
9.4 For assistance that goes beyond self-service in the dashboard and beyond statutory obligations within our area of responsibility, we may charge business customers reasonable remuneration based on the effort involved, provided that we announce this in advance. We do not make the assistance itself conditional on prior payment.
9.5 Authorities and third parties: We inform the customer without undue delay of inspections and measures by a supervisory authority that concern this AVV, to the extent permitted. If the data held by us is jeopardised by attachment, seizure, insolvency proceedings or other measures by third parties, we likewise inform the customer without undue delay and notify the third parties that the customer is the controller of the data.
9.6 Contact: We are not required to appoint a data protection officer. The contact for data protection matters and this AVV is the management, who can be reached at support@shortboost.one.
10.1 The customer can export (Settings → Data export) and delete its data at any time.
10.2 After the end of the main contract, we delete the data processed on behalf of the customer. If the account is deleted, this takes place once the 30-day deactivation period has expired. If an account merely switches to the Free plan, the main contract continues; the data is retained.
10.3 Deleted data remains in our encrypted backups until those backups expire (see privacy policy, section 16). Until then, it is not processed further and is used only in the event of a restoration; afterwards we delete it again.
10.4 Any obligation to retain data under EU or Austrian law remains unaffected.
11.1 If the customer stores pixels from Meta, Google, TikTok or LinkedIn, we deliver the provider's code to the visitor's browser when the link is opened. The customer determines which pixels are loaded where.
11.2 By default, we deliver the stored pixels to all visitors to the link, regardless of their country. Automated requests (bots) do not receive pixels.
11.3 If the customer switches on “Ask visitors for consent first” for a link, this constitutes its instruction to display a prompt in its branding before the redirect (showing its company name, the pixel providers, a notice that data is also transferred to the USA, and the buttons “Agree” and “Continue without” with equal weight). We then deliver pixels only if the visitor has agreed; if the visitor chooses “Continue without”, we redirect without pixels. We store the choice for 6 months in a technically necessary cookie “sbpx_” containing a customer identifier (value “ja” or “nein”), only for the short-link domain. If the visitor deletes the cookie, we ask again.
11.4 The customer alone is responsible for whether it uses pixels and whether it switches on the prompt under clause 11.3, for the lawfulness of the processing by the pixels, in particular for ensuring that the required legal basis is in place (within the EU and the EEA, for loading pixels, generally consent under Art. 5(3) of the ePrivacy Directive, in Austria § 165 para. 3 TKG 2021, in Germany § 25 TDDDG, as well as any basis required under the law of the countries outside Europe in which its visitors are located), for informing visitors and for concluding the necessary agreements with the pixel provider, for example on joint controllership.
11.5 The data that the visitor's browser sends to the pixel provider does not pass through our servers. The pixel providers are therefore not our sub-processors but recipients selected by the customer.
11.6 We may suspend the delivery of pixels if a provider changes its technology in such a way that the prompt under clause 11.3 can no longer be implemented reliably, i.e. pixels would transmit data even though “Continue without” has been chosen. We inform the customer of this.
12.1 On request, we make available to the customer the information necessary to demonstrate compliance with this AVV, in particular an up-to-date description of the measures under Annex 1 and the parts of the contracts with sub-processors that are relevant to data protection.
12.2 If that is not sufficient, the customer may carry out an audit (including on site) or have one carried out by an auditor who is bound to secrecy and is not a competitor of ours. The customer gives at least 30 days' notice of the audit; it takes place during our business hours and without disrupting operations, as a rule no more than once a year, except following a personal data breach. Business customers bear their own costs and our reasonable expenses.
13.1 Liability is governed by Art. 82 GDPR. In all other respects, the liability rules of the Terms apply.
13.2 Changes to this AVV are made under clause 20.3 of the Terms, and for new sub-processors under clause 7.2 of this AVV.
13.3 Austrian law and the rules of the Terms on choice of law and place of jurisdiction apply.
| Sub-processor | Service | Place of processing | Basis for third-country transfer |
|---|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Server: database, applications, redirection | Data centre in Frankfurt am Main, Germany | not necessary (EU) |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace, Google Drive; Cloud Data Processing Addendum) | Storage of encrypted backups (encrypted with AES-256 before uploading, key held only by Inexdu GmbH; Google cannot read the content) | EU and USA | EU-US Data Privacy Framework (Google LLC), supplemented by standard contractual clauses |
| easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria | Sending system emails via SMTP (only to the extent emails contain data under clause 2) | Austria | not necessary (EU) |
| HighLevel Inc., Dallas, Texas, USA (platform operator of BusinessBoost One) | only for accounts used via BusinessBoost One: sign-in, embedding of ShortBoost in BusinessBoost One, storage of images in the media library | USA | Standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) |
AI programs that the customer itself connects to ShortBoost (e.g. Anthropic Claude) are not sub-processors of Inexdu GmbH. The customer connects them on its own instruction and is responsible for the transfer of data to them.
Version 2026-10, valid from 1 October 2026