Compliance
GDPR, NIS2 and your obligations — what we supply for them
Data processing agreement, list of sub-processors, description of safeguards, NIS2 supplier package.
- Hosting in Germany only
- DPA included in the price
- Sub-processors disclosed
If you use a service provider, you must be able to show how data is handled there. KDM Server supplies: the data processing agreement under Article 28 GDPR, the complete list of sub-processors, the description of technical and organisational measures, and — since the German NIS2 implementation act came into force on 6 December 2025 — a supplier package you can use to answer the questionnaires your own clients send you.
What you receive
| Document | Terms |
|---|---|
| Data processing agreement (Art. 28 GDPR) | included |
| List of sub-processors, published openly | included |
| Description of technical and organisational measures | included |
| Record of processing activities (your part, template) | included |
| NIS2 supplier package (questionnaires, evidence, contacts) | from €890 once |
| GDPR hosting package (review of your environment, documentation) | from €390 once |
| Annual update | from €290/year |
Our sub-processors
Hetzner Online GmbH, Gunzenhausen — data centre services, sites Falkenstein and Nuremberg, Germany.
Hosting and backups take place in Germany only; within hosting there is no transfer to third countries.
AI operations: for the diagnostic agents we use language models of Anthropic PBC (USA). Only operational data such as metrics and log excerpts are transmitted, never the contents of your applications. If you do not want this, book operations without the AI level.
E-mail: our mailboxes are hosted by Hosting Ukraine LTD in Kyiv (Ukraine), see section 5a of the privacy notice.
What we say plainly
We are not certified ourselves. The data centre operator is. We are reviewing our own certification for the coming years; until it exists, we do not claim it.
Frequent questions
A client sent us a NIS2 questionnaire — can you help?
Yes, that is what the supplier package is for: prepared answers for our part of the chain, with evidence.
Is the DPA charged extra?
No, it is part of the contract.
Where are the backups?
In Germany, separated from the production systems. A second site on request.
How does this work with the AI agents?
They work on operational data, not on the contents of your applications. Every step an agent takes is recorded in the ticket, and automatically generated messages are identifiable as such.
We are not a German company — does the DPA still work for us?
Yes. The GDPR applies across the EU, and the agreement is concluded with W&K Connect GmbH under German law. We also provide it in English.
Documents for your audit?
We send the agreement, the sub-processor list and the description of measures — the same day.
Request the documents