Data Processing Agreement

2.1. The object and duration of the processing, the nature and purpose of the processing, as well as the type of data and categories of data subjects are described in Appendix 1 to this Data Processing Agreement.

2.2. The duration of this agreement is based on the term of the Subscription Agreement between parties, unless further obligations arise from the provisions of this agreement.

3.1. The Contractor processes data on behalf of the Client. This includes activities specified in the Subscription Agreement and the performance description. The Client is responsible for compliance with legal data protection requirements, especially the lawfulness of data processing.

3.2. Instructions are initially defined in the Subscription Agreement and can be amended, supplemented, or replaced by the Client in writing or in text form to the contact point designated by the Contractor through individual instructions. Instructions exceeding the contractually agreed performance are treated as requests for a change in performance.

4.1. The Contractor may only process data from data subjects within the scope of the Subscription Agreement and the documented instructions of the Client. If the Contractor is obligated by national or European law to deviate from this processing, Contractor informs the Client hereof before the processing begins, if legally permissible.

4.2. The Contractor will organize the internal organization within its responsibility to meet the special requirements of data protection. The technical and organizational measures described in Annex 2 to ensure the adequate protection of the Client's data will be implemented. These measures are designed to ensure the confidentiality, integrity, availability, and resilience of systems and services in connection with processing in the long term. The Client is aware of these technical and organizational measures. He is responsible for ensuring that they provide an adequate level of protection for the risks of the data being processed.

4.3. Changes to the implemented technical and organizational measures are reserved for the Contractor, ensuring that the contractually agreed protection level is not undercut.

4.4. The Contractor assists the Client, within its capabilities and the contractually owed performance, in fulfilling requests and claims of data subjects according to Chapter III of the GDPR and in compliance with the obligations stated in Articles 33 to 36 of the GDPR.

4.5. The Contractor ensures that employees and other individuals working for the Contractor involved in the processing of Client's data are prohibited from processing the data outside Client's instructions. Furthermore, the Contractor ensures that individuals authorized to process the data have committed to confidentiality or are subject to an appropriate legal confidentiality obligation. The obligation of confidentiality and non-disclosure persists even after the termination of the Subscription Agreement.

4.6. The Contractor informs the Client immediately if Contractor becomes aware of breaches of the protection of the Client's data. The Contractor takes the necessary measures to secure the data and mitigate any potential adverse consequences for the data subjects, coordinating promptly with the Client.

4.7. The Contractor informs the Client of the contact person for data protection matters arising within the scope of the Subscription Agreement.

4.8. The Contractor ensures compliance with his obligations under Article 32(1)(d) of the GDPR and implements a procedure for regular review of the effectiveness of technical and organizational measures to ensure the security of processing.

4.9. The Contractor corrects or deletes the contractually relevant data if instructed by the Client and if it is within the scope of the instructions. If a data protection-compliant deletion or a corresponding restriction of data processing is not possible, the Contractor ensures the data protection-compliant destruction of data carriers and other materials based on an individual instruction from the Client, unless already agreed in this contract.

4.10. The Contractor confirms that Contractor is aware of the data protection regulations of the GDPR relevant to order processing.

4.11. Data, data carriers, and all other materials must be handed over or deleted upon request of the Client at the end of the Subscription Agreement.

5.1. The Client must promptly and completely inform the Contractor if Client discovers errors or irregularities regarding data protection regulations in the results of the order.

5.2. In the event of a claim by an affected person regarding claims under Article 82 of the GDPR, the Client and the Contractor agree to support each other in verifying the legal standing in defense of the claim.

5.3. The Client provides the contact person for data protection matters arising within the scope of the Subscription Agreement.

7.1. The Contractor demonstrates compliance with the obligations laid down in Article 28 of the GDPR and this agreement to the Client with suitable means. For proof of compliance with the agreed obligations, the Contractor can provide the Client with certificates and/or results of third-party audits (e.g., according to Article 42 of the GDPR or ISO 27001) or audit reports from the company's data protection officer.

7.2. If inspections by the Client or an auditor appointed by the Client are necessary in individual cases, they will be carried out during normal business hours without disrupting operations, after notification and with reasonable lead time. The Contractor may make this dependent on the signing of a reasonable confidentiality agreement. If the auditor appointed by the Client is in a competitive relationship with the Contractor, the Contractor has the right to object.

7.3. If a data protection supervisory authority or other public supervisory authority of the Client carries out an inspection, 7.2 generally applies. The signing of a confidentiality obligation is not required if this supervisory authority is subject to professional or legal confidentiality, with a violation being penalized under criminal law.

7.4. The Contractor may request reasonable compensation for assistance with the implementation of an inspection under this clause unless the reason for the inspection is the urgent suspicion of a data protection incident in the Contractor's area of responsibility. In this case, the grounds for suspicion are to be presented to the Client upon announcing the inspection.

8.1. The Client agrees that the Contractor may engage subcontractors. Before engaging or replacing subcontractors, the Contractor informs the Client in writing with a four-week notice. The Client can only object to the change for good cause. The objection must be made within 14 days and explicitly state all significant reasons. If no objection is made within the deadline, consent to the change is considered granted. If there is a significant reason that cannot be eliminated by the Contractor through an adjustment of the Subscription Agreement , the Contractor is entitled to a special termination right. This special termination right applies to both this agreement and the Subscription Agreement. There is no right of objection for subcontractors already existing at the conclusion of this data processing agreement, as listed in Annex 3. Services considered subcontracting relationships under this agreement are those services directly related.

8.2. If the Contractor awards contracts to subcontractors, it is the Contractor's responsibility to transfer his data protection obligations under this contract to the subcontractor.

8.3. Sub-contractors shall be seated in the EU or in countries for which the requirements of Art 44 et. seq. GDPR are met, in particular based on a decision of adequate level of protection by the European Commission in accordance with Art. 45 DGPR (including the certification to fall under the respective data privacy framework with such country, if any).

8.4. Upon written request from the Client, the Contractor must provide information at any time about the data protection obligations of his subcontractors.

9.1. If the Client's data at the Contractor is jeopardized by seizure or confiscation, by insolvency or settlement proceedings, or by other events or measures of third parties, the Contractor must inform the Client immediately. The Contractor will promptly inform all those responsible in this context that sovereignty and ownership of the data lie exclusively with the Client as the "Controller" within the meaning of the GDPR.

9.2. Changes and additions to this agreement and all its components, including any assurances by the Contractor, require a written agreement, which can also be in electronic form, and an explicit indication that it is a change or addition to these terms. This also applies to waiving this form requirement.

9.3. In case of contradictions, the provisions of this data protection agreement take precedence over the provisions of the Subscription Agreement. If individual parts of this agreement are invalid, this does not affect the validity of the agreement as a whole.

10.1. For clients with a registered office in Germany, German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG of April 11, 1980), and the conflict rules of international private law, with Munich as the exclusive place of jurisdiction.

10.2. For clients with a registered office in countries other than Germany, Dutch law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG of April 11, 1980), and the conflict rules of international private law, with Amsterdam as the exclusive place of jurisdiction.