Version: 1.0 · Last updated: 2026-10-08

Preamble

This DPA is concluded between:

(1) the customer that accepts the ShellRoom Terms of Service, as the controller of the personal data concerned ("Customer" or “Controller”); and

(2) ShellRoom, Mario Fasold, Sternwartenstr. 29, 04103 Leipzig, Germany ("ShellRoom" or “Processor”).

Customer and ShellRoom are together the “Parties” and each a “Party”.

This DPA applies to all processing of Personal Data that ShellRoom carries out on behalf of the Customer in connection with the Services. It forms part of, and is incorporated into, the ShellRoom Terms of Service ("Terms") by reference. It is concluded when the Customer accepts the Terms. In the event of a conflict, this DPA prevails over the Terms with respect to the processing of Personal Data.

1. Definitions

1.1 Terms used but not defined in this DPA have the meanings given in the Terms or, where applicable, in Art. 4 GDPR.

1.2 In this DPA:

• “Applicable Data Protection Law” means the GDPR (Regulation (EU) 2016/679), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and any other data protection laws applicable to the processing under this DPA.
• “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Supervisory Authority” have the meanings given in Art. 4 GDPR.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data (Art. 4(12) GDPR).
• “Services”, “Customer”, “Participant”, “Trainer”, “Training Server”, “ShellRoom CLI Agent”, “Web Applications”, “Auth Key” and “Virtual Login Mode” have the meanings given in the Terms.
• “Sub-processor” means any processor engaged by ShellRoom to process Personal Data on behalf of the Customer.

2. Roles of the Parties

2.1 With respect to the processing of Personal Data described in Annex I, the Customer is the Controller and ShellRoom is the Processor.

2.2 If the Customer is itself a processor acting for a third-party controller, ShellRoom acts as a sub-processor, and the Customer warrants that it is authorised by the relevant controller to give the instructions in this DPA and to engage ShellRoom.

2.3 ShellRoom acts as a controller in its own right for account, billing and contact data and for aggregated or statistical data that does not relate to an identifiable person. That processing is governed by the ShellRoom Privacy Policy and lies outside this DPA.

2.4 ShellRoom does not act as a controller for the Personal Data processed on the Customer’s behalf under this DPA, and does not use it for its own purposes (Section 4.3).

3. Subject Matter, Duration, Nature and Purpose of Processing

3.1 ShellRoom processes Personal Data in order to provide the Services: the browser-based terminal training platform, the management of users and Auth Keys, and the relay of Terminal Sessions.

3.2 The subject matter, nature, purpose and duration of the processing, the categories of Data Subjects and Personal Data, and the retention periods are described in Annex I, which forms part of this DPA.

3.3 The DPA applies for the duration of the Terms and ends when ShellRoom has deleted or returned the Personal Data in accordance with Section 11.

3.4 Terminal Session content is end-to-end encrypted between the browser and the ShellRoom CLI Agent, and ShellRoom’s backend does not have access to its plaintext content. Virtual Login Mode credentials are verified locally by the ShellRoom CLI Agent on the Customer’s Training Server. This is reflected in Annex I and Annex II.

4. Processing on the Customer’s Instructions

4.1 Documented instructions. ShellRoom processes Personal Data only on the Customer’s documented instructions. The Customer’s instructions are: (a) this DPA and the Terms; (b) the configuration and use of the Services by the Customer and its Authorized Users; and (c) any additional written instructions given by the Customer.

4.2 Unlawful instructions. ShellRoom will inform the Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law.

4.3 Restrictions on processing. ShellRoom will not:

(a) sell or share Personal Data; (b) use, retain or disclose Personal Data for its own purposes outside the Services; (c) use Personal Data to train or develop algorithms or models; or (d) combine Personal Data with data received from other sources, except as necessary to provide the Services or as expressly authorised by the Customer in writing.

4.4 De-identification. To the extent ShellRoom creates aggregated or statistical data from the Personal Data (for example session duration and participant counts), it will take reasonable measures to ensure that the data cannot be linked to an identifiable person and will not attempt to re-identify it.

5. Confidentiality

5.1 ShellRoom will ensure that persons authorised to process the Personal Data (including any employees, freelancers or contractors it engages) are bound by appropriate confidentiality obligations, whether contractual or statutory, that survive the end of their engagement. This applies in particular to any person assisting a sole proprietorship.

5.2 Access to production systems is limited to persons who require it to operate and maintain the Services.

6. Security of Processing

6.1 ShellRoom implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Art. 32 GDPR. The current measures are described in Annex II.

6.2 ShellRoom may update the measures in Annex II to maintain or improve security, provided that the level of protection is not reduced.

7. Sub-processors

7.1 General authorisation. The Customer gives ShellRoom a general written authorisation to engage sub-processors for the processing described in Annex I.

7.2 Current sub-processors. The sub-processors engaged as of the date of this DPA are listed in Annex III, together with the services they provide and the countries in which they process data.

7.3 Changes. ShellRoom will inform the Customer of any intended addition or replacement of a sub-processor in advance — by updating the list on our DPA page and, where the Customer has subscribed to notifications, by email — and will give the Customer a reasonable opportunity (normally at least fourteen (14) days) to object.

7.4 Objection. If the Customer objects on reasonable data-protection grounds and the Parties cannot reach a mutually acceptable solution, the Customer may terminate the affected Services. This is the Customer’s sole remedy in that case.

7.5 Obligations on sub-processors. ShellRoom imposes on each sub-processor, by written agreement, data-protection obligations that are no less protective than those in this DPA, in accordance with Art. 28(4) GDPR.

7.6 Liability. ShellRoom remains liable to the Customer for the performance of its sub-processors’ obligations under this DPA, as required by Art. 28(4) GDPR.

8. Data Subject Rights

8.1 Taking into account the nature of the processing, ShellRoom assists the Customer, by appropriate technical and organisational measures, in fulfilling the Customer’s obligation to respond to requests by Data Subjects under Chapter III GDPR (access, rectification, erasure, restriction, data portability and objection).

8.2 ShellRoom will not respond to a Data Subject request on its own behalf unless legally required to do so or instructed by the Customer. ShellRoom will forward any request it receives that relates to the Customer’s processing to the Customer without undue delay.

9. Personal Data Breach

9.1 Notification. ShellRoom will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer’s Personal Data.

9.2 Content. The notification will, to the extent available, describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

9.3 Assistance. ShellRoom will assist the Customer in meeting its obligations under Art. 33 and 34 GDPR (notification to the Supervisory Authority and to Data Subjects), taking into account the information available to ShellRoom.

9.4 No public statements. ShellRoom will not make public statements or notify Data Subjects on the Customer’s behalf without the Customer’s prior agreement, unless required by law. Where ShellRoom must be named, it will be identified only as agreed.

10. Assistance with Impact Assessments and Consultations

10.1 ShellRoom will provide reasonable assistance to the Customer in connection with data protection impact assessments and prior consultations with a Supervisory Authority (Art. 35 and 36 GDPR) relating to the processing, taking into account the nature of the processing and the information available to ShellRoom.

10.2 Where the Customer needs information to comply with its obligations under Art. 32 to 36 GDPR, it may request it by writing an email to contact@shellroom.io.

11. Deletion and Return of Personal Data

11.1 On termination or request. On termination or expiry of the Terms, or on the Customer’s written request, ShellRoom will delete or return the Personal Data processed on the Customer’s behalf, at the Customer’s choice. This is subject to:

(a) retention required by Applicable Law (for example, accounting and tax records relating to billing); and (b) residual copies held in backups, which remain subject to the measures in Annex II and are removed as the backups rotate.

11.2 Requests. Deletion requests may be submitted by writing an email to contact@shellroom.io.

12. International Transfers

12.1 ShellRoom processes Personal Data primarily within the European Economic Area.

12.2 Where Personal Data is transferred to a third country, ShellRoom ensures that an appropriate safeguard under Chapter V GDPR is in place, namely one or more of the following:

(a) an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; (b) the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), which are incorporated into this DPA by reference and completed using the details in Annex I and Annex III; or (c) another lawful transfer mechanism under Applicable Data Protection Law.

12.3 The sub-processors and the countries involved are listed in Annex III.

13. Demonstrating Compliance and Audits

13.1 ShellRoom makes available to the Customer all information reasonably necessary to demonstrate compliance with the obligations in Art. 28 GDPR.

13.2 ShellRoom allows for audits and inspections by the Customer or an auditor mandated by the Customer, subject to:

(a) reasonable advance notice and reasonable scheduling; (b) performance during normal business hours and in a way that does not unreasonably disrupt ShellRoom’s operations; (c) confidentiality obligations on the part of the auditor; and (d) not more than once per year, unless required following a Personal Data Breach or by a Supervisory Authority.

13.3 The costs of an audit are borne by the Customer. This does not affect the Customer’s statutory rights under Art. 28(3)(h) GDPR.

14. Liability

14.1 The liability of the Parties under this DPA is governed by Section 15 of the Terms, and any limitations there apply accordingly, except where Applicable Data Protection Law requires otherwise.

14.2 Nothing in this DPA limits the rights of Data Subjects under Applicable Data Protection Law or the powers of a Supervisory Authority.

15. Changes, Governing Law and Miscellaneous

15.1 Changes. ShellRoom may update this DPA where necessary to reflect changes in law or in the Services. Material changes are notified and take effect under the change mechanism in Section 17 of the Terms.

15.2 Governing law and venue. This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is determined by Section 18.3 of the Terms.

15.3 Order of precedence. In the event of a conflict: (1) the EU Standard Contractual Clauses (if applicable) prevail over this DPA; (2) this DPA prevails over the Terms; (3) the Terms prevail over other documents, in each case with respect to the processing of Personal Data.

15.4 Severability. If a provision of this DPA is invalid or unenforceable, the remaining provisions remain in force, and the statutory law applies in place of the invalid provision.

15.5 Conclusion. This DPA is concluded when the Customer accepts the Terms.

Annex I — Description of Processing and Transfer Details

Parties

• Controller: the Customer (the trainer, host or organisation that accepts the Terms). Contact details are those in its Account.
• Processor: ShellRoom, Mario Fasold, Sternwartenstr. 29, 04103 Leipzig, Germany. Data protection contact: contact@shellroom.io.

Subject matter and purpose of the processing

Provision of the Services, comprising: the browser-based environment for practical training exercises; management of users, Auth Keys and subscriptions; and the relay of Terminal Sessions between the participant’s browser and the ShellRoom CLI Agent running on the Customer’s Training Server.

Nature of the processing

Collection, storage, transmission, use and deletion of the data categories below. Terminal Session content is end-to-end encrypted between the browser and the CLI Agent, and is not readable by ShellRoom. Virtual Login Mode credentials are verified locally by the CLI Agent on the Training Server.

Categories of Data Subjects

(a) the Customer’s account holders and Trainers; and (b) Participants in trainings conducted by the Customer.

Categories of Personal Data

(a) usernames and (where provided) email addresses of account holders and Trainers; (b) Auth Keys; (c) subscription and billing information; (d) training session metadata: timestamps, duration and participant counts; (e) technical data: connection information and server logs; (f) Virtual Login Mode usernames (verified locally by the CLI Agent).

Terminal Session input and output is end-to-end encrypted and is not accessible to ShellRoom’s backend.

Special categories of Personal Data

None intended. The Customer must not introduce special categories of data (Art. 9 GDPR) into the Services without a separate written agreement.

Retention

Participant names or usernames submitted to the servers: for the duration of the session plus a grace period of up to twelve (12) hours. Account and billing data: for the term of the Terms, then as required by law (accounting and tax retention). Aggregated or statistical data: as described in Section 4.4.

Sub-processors and transfers

As listed in Annex III.

Annex II — Technical and Organisational Measures

1. Access control

• Access to the Web Applications and production database is protected by authentication with individual credentials.
• Access rights are limited to what is necessary to operate and maintain the Services.

2. Encryption

• Data is transmitted over encrypted connections (TLS).
• Terminal Session content is end-to-end encrypted between the browser and the ShellRoom CLI Agent. Encryption keys are generated on the endpoints and are not accessible to ShellRoom, so ShellRoom cannot read the plaintext content.
• Virtual Login Mode credentials are verified locally by the CLI Agent on the Customer’s Training Server and are not transmitted to ShellRoom’s backend.

3. Availability and backups

• Regular database backups are taken and stored in encrypted form.

4. Deletion

• Records are marked as deleted, excluded from further processing and removed from active systems; backup copies expire with the backup rotation cycle.

5. Personnel and confidentiality

• Persons authorised to process Personal Data are bound by confidentiality obligations (Section 5).

6. Incident handling

• Personal Data Breaches are handled and notified as set out in Section 9.

Annex III — Sub-processors

The following sub-processors are engaged as of the date of this DPA. Countries outside the European Economic Area require a Chapter V transfer safeguard (Section 12).