Data Processing Agreement

The Controller decides on the purposes and means of processing personal data in the Services. The Processor processes personal data only on behalf of the Controller and on its documented instructions. For its own customer management and invoicing, the Processor is an independent controller; this DPA does not apply to that.

Subject: hosting, operation, maintenance, support and development of the Services.

Nature of processing: collecting, storing, organising, retrieving, transmitting (for example by email or messenger notifications), deleting and otherwise processing data within the Services.

Purpose: providing the Services agreed in the service agreement.

Duration: for the term of the service agreement and until the data has been deleted or returned under section 10.

Data subjects: website visitors, prospects and leads, customers and buyers, event participants, newsletter subscribers, job applicants, employees and users of the Controller, and other persons whose data the Controller processes in the Services.

Categories of data: contact and identification data, communication content, inquiry, project and purchase data, event and consent data, application data including CVs, documents uploaded to the client portal, usage and log data, and account data. The Controller shall not use the Services for special categories of data (Art. 9 GDPR) unless agreed separately.

The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by law; in that case the Processor informs the Controller beforehand unless the law prohibits this. Instructions are given by the configuration of the Services, the service agreement and in text form. The Processor informs the Controller without delay if it believes that an instruction infringes data protection law.

The Processor ensures that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they only access data as far as necessary for their tasks.

The Processor implements the technical and organisational measures described in the annex, appropriate to the risk (Art. 32 GDPR). It may adapt them to technical progress as long as the level of protection is not reduced.

The Controller gives the Processor general authorisation to engage the sub-processors listed below and on the sub-processor page. The Processor informs the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within this period; if no solution is found, either party may terminate the affected Services. The Processor imposes the same data protection obligations on every sub-processor by contract and remains liable for their performance.

Services that the Controller connects with its own account (for example its email provider, advertising platforms, newsletter or analytics tools) are not sub-processors of the Processor; the Controller contracts with them directly.

Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12–22 GDPR), and in ensuring compliance with Art. 32–36 GDPR, including data protection impact assessments. Requests from data subjects that reach the Processor are forwarded to the Controller without delay.

The Processor notifies the Controller without undue delay, and where possible within 24 hours, after becoming aware of a personal data breach concerning the Controller's data, and provides the information the Controller needs for its own notifications (Art. 33 and 34 GDPR).

After the end of the Services, the Processor deletes all personal data processed on behalf of the Controller, or returns it at the Controller's choice, and deletes existing copies, unless law requires storage. Data in backups is deleted with the regular backup cycle. Upon request, the Processor confirms the deletion in text form.

The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it, after reasonable prior notice, during normal business hours and without disproportionate disruption. The Processor may meet this obligation by providing current certifications or audit reports of itself and its sub-processors.

The Processor processes data in the EU/EEA. Transfers to sub-processors in third countries take place only in accordance with Art. 44 et seq. GDPR (for example based on the EU-US Data Privacy Framework or Standard Contractual Clauses). Where the Controller is established outside the EU/EEA, the transfer of data from the Processor to the Controller is governed by the EU Standard Contractual Clauses, Module 4 (processor to controller), which the parties incorporate into this DPA by reference.

This DPA applies for as long as the Processor processes personal data on behalf of the Controller. Liability is governed by Art. 82 GDPR and the service agreement. In the event of a conflict, this DPA prevails over the service agreement with regard to data protection. The Processor may amend this DPA where required by changes in law or in the Services; it informs the Controller of material changes in advance.

• Access control: role-based permissions per module, tenant isolation through row-level security in the database, separate server and browser credentials, no service-role access in user-facing code
• Authentication: passwordless login links and passkeys, administrative access to the infrastructure providers restricted to the operator and protected by strong authentication
• Encryption: TLS for all connections; encryption at rest by the hosting and database providers; secrets stored encrypted in a vault
• Storage: database and file storage in Frankfurt (Germany); private buckets for documents and CVs, accessible only via short-lived signed links
• Input control: activity logs for changes to records, job run logs for automated processes
• Availability: managed infrastructure with redundancy, database backups, monitoring of scheduled jobs
• Data minimisation and deletion: automated retention jobs where retention periods are defined (for example job applications), deletion of orphaned uploads
• Spam and abuse protection: bot protection on public forms, file type verification on uploads
• Organisation: confidentiality obligations, least-privilege access, documented incident response