---
slug: rechtsdokumente
title: "Which legal documents exist, and where are they?"
category: datenschutz
locale: en
updated: 2026-10-12
keywords: ["terms","DPA","TOM","privacy notice","legal notice","record of processing","documents"]
questions: ["Where do I find the terms, the data processing agreement, the TOMs and the list of service providers?","Where do I find the terms and conditions?","Is there a model data processing agreement?","Which documents do I get for a privacy review?","TOMs under Art. 32 GDPR","Record of processing activities","Who is controller and who is processor?","Contract documents for procurement","Where do I find an earlier version of the terms?","Which version did I accept?","Old version of the data processing agreement","Permanent link to the agreed version"]
url: https://bench.metrunio.com/en/help/rechtsdokumente
---

# Which legal documents exist, and where are they?

**Where do I find the terms, the data processing agreement, the TOMs and the list of service providers?**

All of them are published openly, with no form and no sign-in: the general terms at /en/terms, the privacy notice at /en/privacy, and the data processing agreement, the technical and organisational measures, the annex listing the further processors and the deletion policy at /en/documents. The same page carries the overview “Service providers and recipients”: it names every recipient with its role, including those that act as their own controller and therefore do not belong in a contractual annex. Further evidence (record of processing activities, retention periods in detail, the breach notification process) is available on request.

| Document | Answers | Where |
| --- | --- | --- |
| General Terms and Conditions | Formation of contract, prices and billing, term, liability, changes | /en/terms |
| Privacy notice | What is processed when you visit the website and when you create an account | /en/privacy |
| Data processing agreement (Art. 28 GDPR) | Subject matter, instructions, sub-processing, return and deletion | /en/documents/avv |
| Technical and organisational measures (Art. 32 GDPR) | What is built in against unauthorised access, loss and mixing | /en/documents/tom |
| Annex to the DPA: further processors | Who processes on our behalf under Art. 28 GDPR, where, and on what basis for transfers outside the EU | /en/documents/subunternehmer |
| Service providers and recipients | Every recipient with its role, including those acting as their own controller | /en/documents |
| Deletion policy | Which data stays for how long, and what happens when a person is erased | /en/documents/loeschkonzept |
| Legal notice | Who the provider is | /en/imprint |

## The split of roles, without which none of it holds

For the measurement data on your website **you** are the controller; we process it on your behalf. For your account, the contract and billing **we** are the controller. That is why there are two texts rather than one: the data processing agreement governs the first role, the privacy notice describes the second.

## Earlier versions

The terms, the privacy policy and the four contract documents carry a version date, and every version stays available permanently under that date: /en/terms/2026-09-04, /en/privacy/2026-09-25, /en/documents/avv/2026-09-24. Such an address always shows exactly that text, even after we have changed it; an earlier version says at the top that it is no longer current and links to the current one. Every page lists all versions at the bottom. The confirmation you receive when concluding the contract links to the versions you accepted.

## What is added on request

- Record of processing activities under Art. 30 GDPR, separately for the controller and the processor role
- Deletion policy with the periods per data category
- Process for data subject requests, with the deadlines from Art. 12 GDPR
- Notification process for a personal data breach (Art. 33, 34 GDPR)
- The data processing agreement as a signed document rather than a page

> **Legal note:** The texts describe what the software actually does and are not legal advice for your case. Every version carries its date and stays available at its address; if a text changes, a new version is created.

## Also asked

- Where do I find the terms and conditions?
- Is there a model data processing agreement?
- Which documents do I get for a privacy review?
- TOMs under Art. 32 GDPR
- Record of processing activities
- Who is controller and who is processor?
- Contract documents for procurement
- Where do I find an earlier version of the terms?
- Which version did I accept?
- Old version of the data processing agreement
- Permanent link to the agreed version

## Related

- https://bench.metrunio.com/en/help/auftragsverarbeitung
- https://bench.metrunio.com/en/help/avv-abschliessen
- https://bench.metrunio.com/en/help/aufbewahrung
- https://bench.metrunio.com/en/help/rechtsgrundlage