SaaS · DACH
Every German deal comes with an AVV. Here is how to sign one without giving away the product.
You sell B2B SaaS into DACH. The buyer’s procurement sends their Auftragsverarbeitungsvertrag, their security addendum, their Einkaufsbedingungen — and expects them signed as-is. Most of it is standard. The parts that are not will cost you if you sign them blind.
5.1Der Auftragsverarbeiter darf Unterauftragsverarbeiter nur mit vorheriger schriftlicher Einwilligung des Verantwortlichen im Einzelfallauf Grundlage einer allgemeinen Genehmigung beauftragen; Wechsel werden 30 Tage im Voraus angezeigt, mit Widerspruchsrecht.
“Non-negotiable” usually means “nobody has asked”
A German procurement package arrives as a fait accompli, and most vendors sign it. The core of an AVV genuinely is fixed — it is Article 28 GDPR, written out in German. The mechanics around it are not.
We know which clauses are law and which are drafting preference, so the conversation is short and you keep the parts of your product that matter.
The package
What a German procurement package looks like.
Four documents, usually in one email, usually with a deadline attached.
AVV / DPA
Their template under BDSG and GDPR Art. 28. Sub-processor lists, audit rights, deletion, TOMs annex. Negotiable at the edges: audit frequency, sub-processor notice period, liability link to the main agreement.
Security addendum
ISO 27001 / BSI-style controls, pen-test rights, 24-hour incident notification. Say yes to what you do, and “by [date]” to what you will.
Einkaufsbedingungen
Their general purchasing terms, which try to override your SaaS agreement. The order-of-precedence clause is where this is won or lost.
The MSA itself
Liability caps under German law read differently (§ 309 BGB), and a mutual 12-month cap may not be enforceable as drafted. This is where our German-admitted lawyer picks up the document.
Who does the German-law part
GDPR is the same in Berlin, Tallinn and Warsaw. The BGB is not.
DPAs and security addenda under GDPR we handle directly — GDPR is EU law, and it is the same in Berlin, Tallinn and Warsaw.
Where the contract is governed by German law and the point requires advice on the BGB — liability limitations in standard terms, warranty periods, termination — the review is done by our own German-admitted lawyer. Same desk, same fee, same Slack channel — we do not refer work out.
What it costs
Per document, or a desk.
One MSA or AVV, review + negotiation
€890–2,990
Contract Desk
from €1,900/mo
Legal Desk
from €3,900/mo
Prices in EUR, exclusive of VAT. Reverse-charge applies to EU businesses with a VAT number.
Questions
What SaaS vendors ask before their first DACH deal.
Their AVV says “no negotiation”. Is that true?
Usually not. The core of an AVV is mandated by GDPR Art. 28 and does not change. Audit mechanics, sub-processor notice, the link to the main agreement’s liability cap, and the TOMs annex are negotiated in most deals over €50k.
Do we need a German entity to sell into Germany?
No. An EU entity anywhere in the EEA is enough for VAT and GDPR purposes; a non-EU entity needs an EU representative under GDPR Art. 27 and an OSS or VAT registration depending on the customer. If you are a non-EU company, see Entering the EU.
Can you review our security questionnaire answers?
Yes — the legal parts. We check that what you commit to in the questionnaire matches what the addendum obliges you to, so you are not promising 24-hour notification in one document and 72 in another.
Next step
Send us the AVV they just sent you.
Marked up and explained in twenty minutes. No cost, no obligation.