Data Processing Agreement (DPA)

§ 1 Subject Matter and Duration of Processing

1. The subject matter of the processing, as well as the nature, purpose, type of personal data, and categories of data subjects are specified in Annex 1 to this Agreement.
2. The duration of this Agreement corresponds to the duration of the Main Agreement (Terms of Service), unless additional obligations arise from this DPA.

§ 2 Instructions

1. The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law (Art. 28(3)(a) GDPR).
2. The initial instructions are defined by this Agreement and the Main Agreement. Subsequent instructions may be issued in writing or in text form and shall be documented.
3. The Controller is solely responsible for assessing the lawfulness of the data transfer to the Processor and of the data processing.
4. If the Processor believes that an instruction infringes the GDPR or other data protection provisions, the Processor shall inform the Controller without undue delay.

§ 3 Technical and Organizational Measures

1. The Processor shall implement technical and organizational measures to ensure an appropriate level of security (Art. 32 GDPR).
2. The measures must ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services. See Annex 2.
3. The Processor shall regularly review and adapt the technical and organizational measures.

§ 4 Rectification, Restriction, and Erasure of Data

1. The Processor shall rectify, erase, or restrict the processing of personal data only upon documented instruction from the Controller.
2. If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay.

§ 5 Obligations of the Processor

1. The Processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality.
2. The Processor shall support the Controller with appropriate measures in fulfilling data subject requests under Chapter III of the GDPR.
3. The Processor shall assist the Controller in ensuring compliance with Art. 32–36 GDPR, including DPIAs and prior consultations.
4. The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach (Art. 33(2) GDPR).
5. Upon termination, the Processor shall return or delete all personal data, unless law requires storage.

§ 6 Sub-Processing

1. The approved sub-processors are listed in Annex 3.
2. The Controller grants general written authorization. The Processor shall inform the Controller of any changes concerning sub-processors, giving at least 30 calendar days to object.
3. Where the Processor engages a sub-processor, the same data protection obligations shall be imposed by contract (Art. 28(4) GDPR).
4. The Processor shall remain fully liable for the sub-processor’s obligations.

§ 7 Control Rights and Audit

1. The Processor shall demonstrate compliance by appropriate means, including evidence of TOMs pursuant to Art. 32 GDPR.
2. Compliance may be demonstrated through certifications (e.g. ISO 27001), independent audit reports, or self-audits.
3. The Controller may conduct inspections at the Controller’s expense with reasonable advance notice.

§ 8 Notification Obligations

The Processor shall notify the Controller without undue delay if:

• the Processor becomes aware of any suspected breach of personal data protection;
• a supervisory authority takes action concerning the processing;
• a data subject exercises rights directly against the Processor;
• the Processor believes that an instruction infringes applicable data protection law.

§ 9 Remuneration

Support services beyond the scope of the Main Agreement (e.g. DPIA assistance, audits, data subject requests) shall be billed at customary and reasonable hourly rates.

§ 10 Liability

1. The Controller and the Processor shall be liable in accordance with Art. 82 GDPR.
2. Any liability provisions in the Main Agreement (Terms of Service) shall also apply to this DPA.

§ 11 Processing Outside the EU/EEA

1. The Processor shall process personal data exclusively within the EU/EEA.
2. A transfer to a third country shall only take place with the prior written consent of the Controller and appropriate safeguards (SCCs, adequacy decision).

---

Annex 1 — Details of Processing

---

Annex 2 — Technical and Organizational Measures

The following measures are implemented in accordance with Art. 32 GDPR:

---

Annex 3 — List of Sub-Processors