The customer — as defined in the terms of use — hereinafter “client” — and basebox GmbH, Bahnhofplatz 3, 86919 Utting am Ammersee — hereinafter “basebox” — one of them hereinafter “the party”; both together hereinafter “the parties” — have entered into the following data processing agreement (DPA) in order to fulfill their obligations under Art. 28 (3) GDPR.

Preamble

The parties have agreed to provide services in connection with the provision and use of AI models, either in the cloud or on-premise, and have entered into a contractual agreement in the form of terms of use (the “Agreement”). In order to provide the services as agreed, it is necessary for basebox to process personal data on behalf of and at the instruction of the client. The purpose of this data processing agreement (the “Agreement”) is to define the obligations of the parties in connection with the processing of personal data by basebox as a processor on behalf of the client as a controller.

1. Standard Contractual Clauses

1.1 The parties agree to the attached standard contractual clauses in **Appendix 1 in accordance with the European Commission’s implementing decision of June 4, 2021 [C(2021) 3701 final].

1.2 Insofar as the transfer of personal data by basebox to the client constitutes a transfer of personal data to a third country outside the EU, for example because the client is based outside the EU, the parties agree on the standard contractual clauses for the transfer of personal data to third countries in accordance with Regulation (EU) 2016/679, as agreed by the European Commission in its implementing decision (EU) 2021/914 of June 4, 2021, and attached to this agreement as Appendix 2 (the “International Standard Contractual Clauses”). Annexes I (I.A “SCC International”), II (I.B. “SCC International”), III (II. “SCC International”) and IV (III. “SCC International”) of Appendix 1 shall apply accordingly.

1.3 The standard contractual clauses and the international standard contractual clauses are supplemented by the provisions of this data processing agreement.

1.4 Insofar as a provision in this data processing agreement or other terms and conditions between the parties contradicts the provisions in the standard contractual clauses or the international standard contractual clauses, the provisions of the standard contractual clauses or the international standard contractual clauses shall take precedence over the other provisions. Insofar as a provision of the standard contractual clauses from Section 1.1 contradicts the international standard contractual clauses from Section 1.2, the international standard contractual clauses shall take precedence.

2. Supplementary provisions

2.1 Instructions and duties of the client

2.1.1 The instructions are initially defined by the contract and this agreement (including appendices and annexes) and can subsequently be amended, supplemented or replaced by the client in writing or in an electronic format (text form, e.g. via email) to basebox (individual instruction). Instructions that are not provided for in the underlying contract will be treated as a request for a change in performance. Verbal instructions must be confirmed in writing or text form without undue delay.

2.1.2 basebox has the right to supplement or amend the technical and organizational measures set out in the data processing agreement and its annexes and appendices at any time, although the security level must not fall below the originally agreed level.

2.1.3 The client must inform basebox immediately and in full if it discovers errors or irregularities with regard to data protection regulations when processing personal data.

2.1.4 The person registered as the admin for the customer will act as the point of contact for basebox for data protection issues arising in connection with the contract and the agreement.

2.2 Transfer of data to a third country

The approval of the use of a subcontractor is also considered to be an instruction in the sense of point 7.8.

2.3 Inspections

2.3.1 Should inspections by the client or an authorized inspector be necessary in individual cases, these will be carried out during normal business hours without disrupting operations, after registration and with an appropriate lead time.

2.3.2 Should basebox decide to commission a competent, independent external inspector or auditor, the client agrees to this commission on condition that he receives a copy of the report.

2.4 Liability and indemnity

2.4.1 The liability provisions of the contract shall apply unless otherwise expressly agreed.

2.4.2 In the event of a claim against the client by a data subject with regard to any claims under Art. 82 DS-GVO, the client shall indemnify basebox insofar as basebox is not responsible for the underlying violation of data protection regulations.

2.5 Miscellaneous

2.5.1 Amendments and supplements to this GTC and all its components – including any warranties of the Contractor – require a written agreement, which can also be in an electronic format (text form), and an explicit reference to the fact that it is an amendment or supplement to these terms. This also applies to the waiver of this formal requirement.

2.5.2 The law chosen in the underlying contract shall apply.

Appendix 1

STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1

Purpose and Scope

a) These Standard Contractual Clauses (hereinafter referred to as “Clauses”) are intended to ensure compliance with: Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

b) the controllers and processors listed in Annex I have agreed to these clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29(3) and (4) of Regulation (EU) 2018/1725

(c) These clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the clauses.

(e) These clauses are without prejudice to the obligations to which the controller is subject under Regulation (EU) 2016/679.

(f) These Clauses do not, on their own, ensure compliance with the obligations in relation to international transfers under Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2

Immutability of the Clauses

a) The parties undertake not to modify the Clauses, except to supplement or update information provided in the Annexes.

b) This shall not preclude the parties from incorporating the standard contractual clauses set out in these clauses into a larger contract and adding further clauses or additional safeguards, provided that these do not directly or indirectly contradict the clauses or undermine the fundamental rights or freedoms of the data subjects.

Clause 3

Interpretation

(a) Where the terms defined in Regulation (EU) 2016/679 are used in these clauses, those terms shall have the same meaning as in that Regulation.

(b) These clauses shall be interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) these clauses shall not be interpreted in a way that is contrary to the rights and obligations provided for in Regulation (EU) 2016/679 or that adversely affects the fundamental rights or freedoms of data subjects.

Clause 4

Primacy

In case of conflict between these Clauses and the provisions of related agreements existing or to be entered into or concluded between the parties, these Clauses shall prevail.

Clause 5 {deleted)

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6

Description of the processing

Details of the processing operations, in particular the categories of personal data and the purposes for which the personal data are processed on behalf of the controller, are set out in Appendix II.

Clause 7

Obligations of the parties

7.1 Instructions

(a) the processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In such a case, the processor shall inform the controller of that legal requirement before processing, unless the law concerned prohibits it because of an important public interest. The controller may give further instructions throughout the processing of personal data. Such instructions shall always be documented.

b) The processor shall immediately inform the controller if it considers that instructions from the controller infringe Regulation (EU) 2016/679 or applicable Union or Member State data protection provisions.

7.2 Purpose limitation

The processor shall process the personal data only for the specific purposes set out in Appendix II, unless it receives further instructions from the controller.

7.3 Duration of the processing of personal data

The data shall be processed by the processor only for the duration specified in Appendix II.

7.4 Security of processing

a) The Processor shall, as a minimum, take the technical and organizational measures set out in Appendix III to ensure the security of the personal data. This includes protecting the data against a breach of security that, whether unintentional or unlawful, results in the destruction, loss, alteration, or unauthorized disclosure of, or access to, the data (hereinafter referred to as a “personal data breach”). When assessing the appropriate level of protection, the parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks for the data subjects.

b) The Processor shall only grant its personnel access to the personal data that is the subject of the processing to the extent that this is strictly necessary for the execution, administration and monitoring of the Agreement. The Processor warrants that the persons authorized to process the personal data received have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.

7.5 Sensitive data

If the processing concerns personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, sex life or sexual orientation of a person or data concerning criminal convictions and offenses (hereinafter “sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance with the clauses

a) The parties must be able to demonstrate compliance with these clauses.

b) The Processor shall promptly deal with in a reasonable manner any requests from the Controller concerning the processing of data under these clauses.

c) The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in these clauses and arising directly from Regulation (EU) 2016/679. At the request of the controller, the processor shall also allow for and contribute to the audit of the processing activities covered by these clauses at appropriate intervals or when there are indications of non-compliance. When deciding whether to carry out an audit or inspection, the controller may take into account relevant certifications held by the processor.

d) The controller may conduct the audit itself or engage an independent auditor. The audits may include inspections at the premises or physical facilities of the processor and, where appropriate, shall be carried out with reasonable notice.

e) The parties shall make the information referred to in this clause, including the results of audits, available to the competent supervisory authority upon request.

7.7 Use of subprocessors

a) The processor has the general approval of the controller for the appointment of subprocessors, who are included in an agreed list. The Processor shall inform the Controller expressly in writing at least three weeks in advance of any intended changes to this list by adding or replacing Sub-Processors, thereby giving the Controller sufficient time to object to such changes before the relevant Sub-Processor(s) are engaged. The processor shall provide the controller with the information necessary to enable the controller to exercise its right to object.

(b) Where the processor engages a subprocessor for carrying out specific processing activities (on behalf of the controller), such engagement shall be by way of a contract imposing essentially the same data protection obligations on the subprocessor as those imposed on the processor under these clauses. The Processor shall ensure that the Sub-processor performs the obligations to which the Processor is subject under these Clauses and under Regulation (EU) 2016/679.

(c) The processor shall make available to the controller, upon its request, a copy of such subcontracting agreement and any subsequent modifications. To the extent necessary to protect trade secrets or other confidential information, including personal data, the processor may redact the text of the agreement prior to providing a copy.

(d) the processor shall be fully liable to the controller for the performance by the subprocessor of its obligations under the contract entered into with the processor. The processor shall notify the controller if the subprocessor fails to fulfill its contractual obligations.

e) The processor shall agree with the subprocessor on a third-party beneficiary clause, whereby the controller, in the event that the processor ceases to exist in fact or in law or is insolvent, has the right to terminate the subprocessing agreement and to instruct the subprocessor to delete or return the personal data.

7.8 International data transfers

a) Any transfer of data by the processor to a third country or an international organization shall be carried out only on the basis of documented instructions from the controller or to comply with a specific provision of Union or Member State law to which the processor is subject and must comply with Chapter V of Regulation (EU) 2016/679.

b) The controller consents to the fact that in cases where the processor uses a subprocessor in accordance with clause 7.7 for the performance of certain processing activities (on behalf of the controller) and these processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the subprocessor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of Regulation (EU) 2016/679, provided that the conditions for the application of these standard contractual clauses are met.

Clause 8

Assistance to the controller

a) The processor shall inform the controller without undue delay of any request it has received from the data subject. It shall not respond to the request itself unless authorized to do so by the controller.

b) Taking into account the nature of the processing, the processor shall assist the controller in fulfilling its obligation to respond to requests from data subjects to exercise their rights. In performing its obligations under points (a) and (b), the Processor shall comply with the Controller’s instructions.

(c) Apart from the Processor’s obligation to assist the Controller in accordance with Clause 8(b), the Processor shall, taking into account the nature of the data processing and the information available to it, also assist the Controller in complying with the following obligations:

1) the obligation to carry out an assessment of the impact of the planned processing operations on the protection of personal data (hereinafter referred to as “data protection impact assessment”) if a form of processing is likely to result in a high risk to the rights and freedoms of natural persons;

2) the obligation to consult the competent supervisory authority or authorities prior to processing where a data protection impact assessment indicates that the processing would result in a high risk if the controller does not take measures to mitigate the risk;

3) the duty to ensure that personal data are accurate and up to date by requiring the Processor to inform the Controller without undue delay if it becomes aware that the personal data it processes are inaccurate or out of date;

4) obligations pursuant to Article 32 of Regulation (EU) 2016/679.

d) The parties shall specify in Annex III the appropriate technical and organizational measures to be taken by the Processor in support of the Controller in the application of this clause, as well as the scope and extent of the assistance required.

Clause 9

_Personal Data Breach Notification

In the event of a personal data breach, the Processor shall cooperate with the Controller and provide assistance to enable the Controller to meet its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, taking into account the nature of the processing and the information available to the Processor.

9.1 Personal data breach concerning the data processed by the Controller

In the event of a personal data breach in relation to the data processed by the controller, the processor shall assist the controller by:

a) in notifying the personal data breach to the competent supervisory authority without undue delay after the controller has become aware of the breach, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

b) the following information, to be provided in the controller’s notification pursuant to Article 33(3) of Regulation (EU) 2016/679, which shall include at least the following:

1) the nature of the personal data, where possible, with an indication of the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

2) the likely consequences of the personal data breach;

3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where and to the extent that not all of this information can be provided at the same time, the initial notification shall consist of the information available at that time, with further information subsequently provided without undue delay as it becomes available;

c) to comply with the obligation under Article 34 of Regulation (EU) 2016/679 to notify the data subject without undue delay of the personal data breach where that breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Personal data breach of data processed by the processor

In the event of a personal data breach in relation to the data processed by the processor, the processor shall notify the controller without undue delay after having become aware of the breach. This notification must include at least the following information:

a) a description of the nature of the breach (if possible, stating the categories and the approximate number of data subjects and the approximate number of data records concerned);

b) the contact details for a point of contact from which further information about the personal data breach may be obtained;

(c) the likely consequences and the measures taken or proposed to be taken to address the personal data breach, including measures to mitigate its possible adverse effects.

Where, and in so far as, not all of this information can be provided at the same time, the initial notification shall consist of the information available at that time, with further information subsequently provided without undue delay as it becomes available.

The parties shall specify in Annex III any additional information to be provided by the Processor to assist the Controller in fulfilling its obligations pursuant to Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10

Breaches of the Clauses and Termination of the Contract

a) In the event that the Processor fails to comply with its obligations under these Clauses, the Controller may, without prejudice to the provisions of Regulation (EU) 2016/679, instruct the Processor to suspend the processing of Personal Data until it complies with these Clauses or the Agreement is terminated. The Processor shall immediately inform the Controller if, for whatever reason, it is unable to comply with these Clauses.

b) The controller shall have the right to terminate the contract insofar as it relates to the processing of personal data under these clauses if

1) the controller has suspended the processing of personal data by the processor under point (a) and compliance with these clauses has not been restored within a reasonable period, and in any case within one month of the suspension;

2) the processor is in substantial or persistent breach of these clauses or fails to fulfil its obligations under Regulation (EU) 2016/679;

3) the processor fails to comply with a binding decision of a competent court or supervisory authority concerning its obligations under these clauses or Regulation (EU) 2016/679.

c) The Processor is entitled to terminate the Agreement insofar as it concerns the processing of Personal Data pursuant to these Clauses, if the Controller insists on following its instructions after it has been brought to the attention of the Processor that its instructions violate applicable legal requirements pursuant to Clause 7.1 letter b.

d) Upon termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that this has been done, or return all personal data to the controller and delete existing copies, unless there is an obligation under Union or national law to store the personal data. Until the data is deleted or returned, the processor continues to ensure compliance with these clauses.

ANNEX I – LIST OF PARTIES

Controller: [Identity and contact details of the controller and, where applicable, the controller’s data protection officer].

The controller is the client:

The customer, as defined in the terms of use.

Processor: [Identity and contact details of the processor and, if applicable, the processor’s data protection officer].

basebox GmbH

Contact details of the processor’s data protection officer:

Bahnhofsplatz 3
86919 Utting am Ammersee
Germany
Telephone: +49 8806 9590600
Email: contact@basebox.ai

ANNEX II — DESCRIPTION OF PROCESSING

Categories of data subjects whose personal data are processed

• The customer
• Users invited by the customer
• Persons whose data are contained in the input prompts that the customer or its users have processed by the AI model.

Categories of personal data being processed

The processing of relevant personal data includes:

• Names,
• Business addresses,
• Email addresses,
• Telephone numbers,
• Bank details,
• Other data contained in the prompts,
• Insofar as installation and/or support is provided, all data categories with which the processor comes into contact.

RAG data

Sensitive data processed (if applicable) and the restrictions or safeguards applied, which take full account of the nature of the data and the risks involved, such as strict purpose limitation, access restrictions (including access only for employees who have completed special training), recording of access to the data, restrictions on disclosure or additional security measures.

The processing of sensitive data in connection with the provision of the agreed services does not take place. Insofar as the controller uses the processor’s services for the processing of sensitive data, the controller shall inform the processor accordingly.

Type of processing

The Processor shall provide the agreed services to the Controller. The nature of the processing of personal data includes all processing necessary for the Processor to provide these services to the Client. It includes, in particular, the collection, organization, structuring, storage and provision of personal data, but may also include any other operation such as adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction of personal data.

Purpose for which personal data is processed on behalf of the controller

basebox in the cloud

The processor processes personal data in order to provide its services, as agreed with the controller. This includes, in particular, providing basebox for the use of the AI models offered and contract management.

basebox on-premise

The processor processes personal data for the purpose of providing its services as agreed with the controller in the contract. This may include, in particular, the installation and maintenance of the basebox software and the provision of support.

Duration of processing

The processing will continue for as long as the processor provides its services to the controller and will end when the contract is terminated.

ANNEX III – TECHNICAL AND ORGANIZATIONAL MEASURES, INCLUDING THOSE TO ENSURE THE SECURITY OF THE DATA

Measures for pseudonymization and encryption of personal data

• Protection of secret keys with strong passwords
• Encryption (asymmetric/symmetric) according to the state of the art
• Encryption of systems
• Encryption of storage media
• Encryption of data carriers

• Encryption of communication (e.g. email encryption)

  Measures to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services

• Documentation of authorizations

• Use of authentication procedures
• Secured WLAN
• Individual log-in and password procedures
• Special protective measures for the server room (Hetzner, Telekom)
• Use of strong passwords (e.g. at least 10 digits)
• Prevention of the selection of weak passwords for applications
• Confidentiality obligations of employees
• Administration activities on the servers may only be carried out by suitably trained persons
• Use of appropriate firewalls
• Use of logging and evaluation systems that ensure the traceability and documentation of data management
• Use of two- or multi-factor authentication procedures for high-risk processing activities
• Creation of role profiles/definition of functional responsibilities

• Use of access rights

  Measures to ensure the ability to quickly restore the availability and access to personal data in the event of a physical or technical incident

• Back-up procedures

• Appropriate data backup measures: Backups are stored in different locations and kept for different periods of time depending on the application
• Mirroring of hard disks

• Substitution rules

  Procedures for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of data processing

• Penetration tests (comprehensive security tests of individual computers or networks)

• Regular awareness training for employees (at least once a year)
• Regular tests to ensure that all relevant data is included in the back-up process and that recovery works

• Review of the effectiveness of technical measures (at least once a year)

  Measures for user identification and authorization

• Instruction of all employees in the use of authentication procedures and mechanisms

• Regulated process for the central administration of user identities, in particular for the creation (e.g. of new employees), modification (e.g. name change after marriage) and deletion (e.g. departure of employees)
• Allocation of unique identifiers for each user

• Avoiding group identifiers

  Measures for protecting data during transmission

• Provision via encrypted connections: e.g. use HTTPS according to the state of the art

• SSL certificate from trustworthy certification authorities
• Data hashing (transformation of personal data into a specific character sequence)

• Use of cryptographic tools

  Measures for protecting data during storage

• Protection of secret keys with strong passwords

• Encryption (asymmetric/symmetric) using state-of-the-art technology
• Encryption of systems
• Encryption of storage media
• Encryption of data carriers

• Encryption of communication (e.g. email encryption)

  Measures to ensure the physical security of locations where personal data is processed

• There is a concept for access regulations and for physical access control (perimeter protection)

• Clear rules for dealing with visitors (e.g. accompaniment, security zones, visitor badges, logging, employee responsible for visitors) as part of the concept
• Secure locking systems including documented key management

• Fire-resistant cabinets/safes for storing essential components (e.g. backup tapes, important original documents)

  Measures to ensure the logging of events

• Logging and blocking of indicators of compromise (IOCs)

• Logging at firewall level to also detect and analyze unauthorized access between networks
• Logging of visitors

• Logging of data input, modification and deletion

  Measures to ensure the system configuration, including the standard configuration

• Automatic installation of security updates for the operating system and installed software

• Regular data recovery tests and logging of the results
• Regular evaluation of information on security vulnerabilities of the software used

• Regular, unprompted evaluation of log files to detect unusual entries

  Measures for internal governance and administration of IT and IT security

• Role profiles for employees, including the entries in the directory of processing activities

• Regular review (once a year) of whether the assignments of roles meet the requirements and whether the roles still meet the requirements of the business activity
• No administrator IDs for users who do not perform administrative tasks
• The use of superuser (e.g. root under Linux) is not used as far as possible
• Determination of contact persons and responsible project managers for the specific order
• Implementation of data protection training for all employees (including regular refresher training for existing personnel)
• Implementation of internal company data protection guidelines
• Consistent involvement of data protection officers (DPO) in security matters
• Knowledge of the responsible data protection supervisory authority and knowledge of the reporting obligation under Art. 33 and 34 GDPR
• Relevant guidelines (e.g. for e-mail/internet use, use of encryption techniques) are kept up to date and are easy to find
• Commitment of employees to data secrecy

• Existence of a suitable organizational structure for information security

  Measures for certification/quality assurance of processes and products

• Regular awareness-raising among employees (at least annually)

• Regular testing to ensure that all relevant data is included in the back-up process and that recovery works

• Review of the effectiveness of technical measures (at least annually)

  Measures to ensure data minimization

• Reduction of attributes

• Reducing the processing options in processing steps
• Defining default settings for data subjects that limit the processing of their data to what is necessary for the purpose of the processing. Default settings)

• Defining and implementing a deletion concept

  Measures to ensure data quality

• Removing or correcting incorrect, duplicate and incomplete data records

• Use of software tools that check data entries to ensure that they meet certain standards or formats
• Application of uniform formats and conventions across all data sources to ensure consistency

• Training and raising awareness among employees regarding the importance of data quality and proper data management

  Measures to ensure limited data retention

• Collect and store only the data that is strictly necessary for the intended purpose*

• Establish a clear expiration time for data storage, after which the data is automatically deleted or anonymized
• Conduct regular audits to ensure that data is reliably deleted after its retention period has expired.

• Ensure that all data storage measures comply with local data protection laws and regulations.

  Measures to ensure accountability

• A record of processing activities is maintained.

• Erasure and retention concepts are maintained.
• Regular review of the effectiveness of technical and organizational measures according to the PDCA cycle (Plan-Do-Check-Act).
• Implementation of data protection training for all employees (including regular refresher training for existing staff)
• Implementation of internal company data protection guidelines.

• Consistent involvement of data protection officers (DPO) in security matters.
  Knowledge of the responsible data protection supervisory authority and knowledge of the reporting obligation under Art. 33 and 34 GDPR.
  Relevant guidelines (e.g. for e-mail/Internet use, use of encryption techniques) are kept up to date and are easy to find.
  Obligation of employees to maintain data secrecy.

  Measures to enable data portability and to ensure deletion

• Retention and deletion concepts are maintained.

• A clear expiration period for the storage of data is set, after which the data is automatically deleted or anonymized.
• Regular audits are carried out to ensure that data is reliably deleted after its retention period has expired.
  No storage of archive data in productive databases, but transfer of archive data from productive systems to archive systems.
  Archive data must be effectively deleted after the retention period has expired.
  Implementation of data protection training for all employees.

  TOMs of the employed sub-processors:

The processor uses sub-processors to provide its services (see Appendix IV). All sub-processors implement appropriate technical and organizational measures. Further information can be found at:

• For Hetzner: https://www.hetzner.com/AV/TOM.pdf
• For Google Vertex: https://cloud.google.com/vertex-ai/docs/shared-responsibility?hl=de#:~:text=Security%20is%20a%20shared%20responsibility%20of%20your%20data%2C%20code%20and%20models.

ANNEX IV – LIST OF SUBCONTRACTORS

The controller has authorized the use of the following subcontractors:

Appendix 2

MODULE VI: Transfer from processors to controllers

STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1

Purpose and Scope

a) These Standard Contractual Clauses are intended to ensure ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 1 when personal data are transferred to a third country.

b) The parties:

i) the natural or legal person(s), agency(ies), agency(ies) or other body(ies) listed in Appendix IA (hereinafter referred to as the “body(ies)”) that transfers the personal data (hereinafter referred to as the “data exporter”), and

(ii) the entity or entities in a third country listed in Appendix I.A to which the personal data are disclosed, directly or indirectly through another entity that is also a party to these clauses (each, a “data importer”),

have agreed to be bound by these standard contractual clauses (the “Clauses”).

c) These clauses shall apply to the transfer of personal data as specified in Appendix I.B.

d) The Appendix to these clauses, including the Appendices therein, is an integral part of these clauses.

Clause 2

Effect and immutability of the clauses

a) These clauses contain appropriate safeguards, including enforceable data subject rights and effective legal remedies as required by Article 46(1) and point (c) of Article 46(2) of Regulation (EU) 2016/679 and, in relation to transfers from controllers to processors and/or from processor to processors, standard contractual clauses as referred to in Article 28(7) of Regulation (EU) 20 16/679, provided that these are not modified, except for the selection of the relevant module or modules or the addition or update of information in the appendix. This shall not preclude the parties from incorporating the Standard Contractual Clauses set out in these clauses into a larger agreement and/or adding other clauses or additional safeguards as long as they do not directly or indirectly conflict with these clauses or impair the fundamental rights or freedoms of the data subjects.

(b) These Clauses are without prejudice to the data exporter’s obligations under Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

(a) Data subjects may rely upon and enforce these Clauses as third-party beneficiaries against the data exporter and/or the data importer, with the exception of the following: (i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7

(ii) Clause 8 – Module one: Clause 8.5 e and Clause 8.9 b Module two: Clause 8.1 b, Clause 8.9 a, c, d, e Module three: Clause 8.1 a, c, d, and Clause 8.9 a, c, d, e, f, g Module four: clause 8.1(b) and clause 8.3(b)

(iii) Clause 9 – module two: clause 9(a), (c), (d) and (e) module three: clause 9(a), (c), (d) and (e)

(iv) Clause 12 – module one: clause 12(a) and (d) modules two and three: clause 12(a), (d) and (f)

(v) Clause 13

(vi) Clause 15.1(c), (d) and (e)

(vii) Clause 16(e)

(viii) Clause 18 – modules one, two and three Clause 18(a) and (b) Module four: Clause 18

(b) The rights of data subjects under Regulation (EU) 2016/679 shall not be affected by point (a).

Clause 4

Interpretation

(a) Where terms defined in Regulation (EU) 2016/679 are used in these Clauses, those terms shall have the same meaning as in that Regulation.

b) These Clauses shall be interpreted in light of the provisions of Regulation (EU) 2016/679.

c) These Clauses shall not be interpreted in a manner that is inconsistent with the rights and obligations set forth in Regulation (EU) 2016/679.

Clause 5

_Supersession

In case of conflict between these clauses and the provisions of related agreements between the parties in place at the time these clauses are agreed or entered into, these clauses shall prevail.

Clause 6

Description of the data transfer(s)

The details of the data transfers, in particular the categories of personal data transferred and the purpose(s) for which they are transferred, are specified in Appendix I.B.

Clause 7 – Optional

Coupling Clause

(a) At any time, an organization that is not a party to these clauses may, with the consent of the parties, join these clauses, either as a data exporter or a data importer, by completing the Appendix and signing Appendix I.A.

b) Upon completing the Appendix and signing Addendum I.A, the Adhering Entity shall become a party to these Clauses and shall have the rights and obligations of a data exporter or a data importer, as applicable, as designated in Addendum I.A.

c) The Adhering Entity shall have no rights or obligations under these Clauses for the period prior to its adherence as a party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer — through implementation of appropriate technical and organizational measures — is able to satisfy its obligations under these clauses.

8.1 Instructions

a) The data exporter shall process the personal data only on documented instructions from the data importer, who shall act as its data controller.

b) The data exporter shall promptly inform the data importer if it cannot comply with such instructions, including where such instruction would violate Regulation (EU) 2016/679 or other Union or Member State data protection provisions.

(c) The data importer shall refrain from any action that would impede the data exporter from fulfilling its obligations under Regulation (EU) 2016/679, including in relation to subprocessing or cooperation with the competent supervisory authorities.

d) At the choice of the data importer, the data exporter shall, after the end of the data processing services, delete all personal data processed on behalf of the data importer and certify to the data importer that this has been done, or return all personal data processed on behalf of the data importer to the data importer and delete existing copies.

8.2 Security of processing

a) The parties shall take appropriate technical and organizational measures to ensure the security of the personal data, including during transmission, as well as protection against a breach of security that, whether unintentional or unlawful, results in the destruction, loss, alteration, or unauthorized disclosure of, or access to, the personal data (hereinafter “personal data breach”). When assessing the appropriate level of protection, they shall take into account the state of the art, the costs of implementation, the nature of the personal data 2, the nature, scope, context and purposes of the processing as well as the risks posed to data subjects by the processing, and shall consider in particular encryption or pseudonymization, including during transmission, if this can fulfill the purpose of the processing.

b) The data exporter shall assist the data importer in ensuring adequate security of the data in accordance with point a. In the case of a personal data breach relating to personal data processed by the data exporter under these clauses, the data exporter shall notify the data importer of the breach without undue delay after having become aware of it and shall assist the data importer in addressing the breach.

c) The data exporter warrants that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8.3 Documentation and compliance with the clauses

a) The parties must be able to demonstrate compliance with these clauses.

b) The data exporter shall make available to the data importer all information necessary for demonstrating compliance with its obligations under these clauses and shall allow for and contribute to audits.

Clause 9 [deleted]

Clause 10

Rights of data subjects

The parties shall provide each other with mutual assistance in responding to requests and demands made by data subjects in accordance with local laws applicable to the data importer or, with respect to data processing by the data exporter in the Union, in accordance with Regulation (EU) 2016/679.

Clause 11

Redress

a) The data importer shall inform data subjects in a transparent and easily accessible manner, by means of individual notifications or a website with a contact point, of a contact point authorized to handle complaints. It shall promptly handle any complaints received from a data subject.

Clause 12

Liability

a) Each party shall be liable to the other party(ies) for damages it causes the other party(ies) by any breach of these clauses.

b) Each party shall be liable to the data subject, and the data subject shall be entitled to recover damages from that party, for any actual or consequential damages that party causes the data subject, in breach of that party’s third-party beneficiary rights under these clauses. This is without prejudice to the data exporter’s liability under Regulation (EU) 2016/679.

c) If more than one party is responsible for damages incurred by the data subject as a result of a breach of these clauses, all responsible parties shall be jointly and severally liable, and the data subject shall be entitled to take legal action against any of the parties.

d) The parties agree that a party held liable under paragraph c shall be entitled to seek contribution from the other party(ies) for that portion of the damages corresponding to such party’s responsibility for the damage.

e) The data importer shall not be able to rely on a behavior of a processor or sub-processor in order to avoid its own liability.

Clause 13 (deleted)

SECTION III – LOCAL LAWS AND OBLIGATIONS REGARDING GOVERNMENT ACCESS TO DATA

Clause 14

Local laws and practices affecting compliance

a) The parties warrant that they have no reason to believe that the laws and practices governing the processing of personal data by the data importer in the third country of destination, including requirements to disclose personal data or measures allowing public authorities to access such data, will prevent the data importer from fulfilling its obligations under these clauses. It is understood that these Clauses do not preclude legislation or practices that respect the essence of the fundamental rights and freedoms and that do not go beyond what is necessary and proportionate in a democratic society to ensure one of the objectives mentioned in Article 23(1) of Regulation (EU) 2016/679.

(b) the parties declare that, in particular, they have taken due account of the following aspects in providing the assurance in point (a):

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and of transmission channels used, intended data onward transfers, the nature of the recipient, the purpose of the processing, the categories and format of personal data transferred, the industry sector in which the transfer takes place, the location of transferred data;

(ii) the relevant laws and practices of the third country of destination (including those requiring or permitting disclosure or access to data) relevant to the special circumstances surrounding the transfer, as well as the applicable restrictions and safeguards; 3

(iii) any relevant contractual, technical or organizational safeguards implemented to supplement the safeguards under these Clauses, including measures applied during transfers and to processing of Personal Data in the country of destination.

c) The data importer warrants that it has used its best efforts, as part of its assessment under paragraph b, to provide relevant information to the data exporter and agrees that it will continue to cooperate with the data exporter to ensure compliance with these clauses.

d) The parties agree to keep the assessment referred to in point (b) documented and make it available to the competent supervisory authority on request.

e) The data importer agrees to notify promptly during the duration of the contract the data exporter if it has reason to believe, after having given its consent to these clauses, that it is subject to legislation or practices that do not comply with the requirements referred to in point (a), including a change in the third country’s legislation or an action, such as a request for disclosure, that relates to an application of that legislation that does not comply with the requirements referred to in point (a). Upon notice under paragraph (e), or if the data exporter otherwise becomes aware that the data importer is likely to be unable to comply with its obligations under these clauses, the data exporter shall promptly determine appropriate measures, such as technical and organizational measures to ensure security and confidentiality, to be taken by the data exporter and/or the data importer to remedy the situation. The data exporter shall suspend the data transfer if it believes that no appropriate safeguards can be provided for such transfer or if instructed to do so by the relevant supervisory authority. In such an event, the data exporter is entitled to terminate the contract insofar as it relates to the processing of personal data pursuant to these clauses. If there are more than two parties to the contract, the data exporter may exercise this right of termination only with respect to the responsible party, unless the parties have agreed otherwise. If the contract is terminated pursuant to this clause, Clause 16(d) and (e) shall apply.

Clause 15

Data importer’s obligations in the event of access to the data by public authorities

15.1 Notification

a) The data importer agrees to notify the data exporter and, where possible, the data subject (with the data exporter’s assistance, as appropriate) without undue delay where it receives a legally binding request for disclosure of Personal Data transferred pursuant to these Clauses from an authority, including a judicial authority, in accordance with the laws of the country of destination (such notification shall include information as to the Personal Data requested, the requesting authority, the legal basis for the request and the response provided); or

(ii) it becomes aware that an authority under the laws of the country of destination has direct access to personal data transferred under these clauses; such notification shall include all information available to the data importer.

b) If the law of the country of destination prohibits the data importer from notifying the data exporter and/or the data subject, the data importer agrees to use its best efforts to seek to have the prohibition lifted, so that as much information as possible is provided as quickly as possible. The data importer undertakes to document its efforts in order to be able to prove these at the request of the data exporter.

c) To the extent permitted by the laws of the country of destination, the data importer agrees to provide as much relevant information as possible about the requests received (including, but not limited to, the number of requests, the nature of the data requested, the requesting authority or authorities, whether any request has been challenged and the outcome of any such challenge) to the data exporter periodically during the term of the contract.

d) The data importer agrees to keep the information referred to in letters a) to c) during the term of the contract and to make it available to the competent supervisory authority upon request.

e) Paragraphs a) to c) are without prejudice to the data importer’s obligation under Clause 14 e) and Clause 16 to promptly inform the data exporter if it is unable to comply with these Clauses.

15.2 Legality and data minimization checks

a) The data importer agrees to check the legality of the request for disclosure, in particular, whether the request is within the powers delegated to the requesting authority, and to challenge the request if, after careful assessment, it concludes that there are substantial grounds to believe that the request is unlawful under the laws of the country of destination, applicable international law obligations and the principles of international comity. In such circumstances, the data importer shall seek any available remedies. If contesting a request, the data importer shall seek interim measures to suspend the effect of the request pending an outcome on the merits by the competent judicial authority. It shall not disclose the personal data requested until required to do so by applicable procedural requirements. These requirements are without prejudice to the data importer’s obligations under Clause 14(e).

b) The data importer agrees that it will document its legal assessment and any challenge to the disclosure request and make these documents available to the data exporter to the extent permitted by the laws of the country of destination. Upon request, it will also make these documents available to the competent supervisory authority.

c) The data importer agrees that it will make the minimum amount of information reasonably necessary to respond to a disclosure request.

SECTION IV — FINAL PROVISIONS

Clause 16

Breach of the Clauses and Termination of the Contract

a) The data importer shall promptly inform the data exporter if it is unable for any reason to comply with these clauses.

b) If the data importer is in breach or is unable to comply with these clauses, the data exporter shall suspend the transfer of personal data to the data importer until the breach is remedied or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall have a right to terminate the contract as it relates to the processing of personal data under these clauses if

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to point (b) and compliance with these clauses has not been re-established within a reasonable period, and in any event within a one-month suspension;

(ii) the data importer is in substantial or persistent breach of these clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or a competent supervisory authority concerning its obligations under these clauses.

In such cases, the data exporter shall inform the competent supervisory authority of such violations. If more than two parties are involved in the contract, the data exporter may only exercise this right of termination against the responsible party, unless the parties have agreed otherwise.

d) Personal data collected by the data exporter established in the EU and transferred prior to the termination of the contract in accordance with clause c) must be completely deleted without delay, including all copies. The data importer shall certify the deletion to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these clauses. In the event that the data importer is subject to local legislation prohibiting the return or deletion of the personal data transferred, the data importer warrants that it will continue to ensure compliance with these clauses and will only process such data to the extent and for so long as required by such local legislation.

(e) Either party may withdraw its consent to be bound by these clauses if (i) the European Commission adopts an decision pursuant to Article 45(3) of Regulation (EU) 2016/679, which covers the transfer of personal data subject to these Clauses; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data are transferred. This is without prejudice to any other obligations applicable to the processing in question under Regulation (EU) 2016/679.

Clause 17

Applicable law

These Clauses shall be governed by the law of a country that allows third-party beneficiary rights. The parties agree that this is the law of the Federal Republic of Germany.

Clause 18

Jurisdiction and Venue

Any dispute arising under these Clauses shall be resolved by the courts of the Federal Republic of Germany.

1: Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting as a controller on behalf of a Union institution or body, recourse to these clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 shall ensure also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), insofar as these clauses and the data protection obligations laid down in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This is particularly the case if the controller and the processor rely on the standard contractual clauses set out in Commission Decision […]

2: This includes whether the transfer and further processing will involve personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation or data concerning criminal convictions or offenses.

3: In assessing the impact of such laws and practices on compliance with these Clauses, various elements may be considered in the overall evaluation. These elements may include relevant and documented practical experience as to whether there have been prior requests for disclosure by public authorities covering a sufficiently representative time frame or whether there have been no such requests. This concerns in particular internal records or other evidence, established and maintained with due care and endorsed by senior management, provided that such information can be legitimately disclosed to third parties. Insofar as this practical experience leads to the conclusion that it is not impossible for the data importer to comply with these clauses, this must be supported by other relevant objective elements; the parties must carefully consider whether all these elements are sufficiently reliable and representative to support the conclusion reached. In particular, parties must consider whether their practical experience is corroborated, rather than contradicted, by publicly available or otherwise accessible reliable information on the existence or non-existence of requests within the same industry sector and/or on the application of the legislation in practice, such as jurisprudence and reports by independent oversight bodies.