Data Processing Addendum (DPA)

Preamble

This Data Processing Addendum ("DPA") supplements the General Terms and Conditions (GTC) of Jungherz GmbH, Duvenkamp 21, 46282 Dorsten, Germany, which operates under the brand AppConfector ("Processor"), in its relationship with the customer ("Controller"). It governs the processing of personal data that the Processor carries out on behalf of the Controller when operating the Controller's apps, and meets the requirements of Art. 28(3) of the General Data Protection Regulation (GDPR). In case of conflict, this DPA takes precedence over the GTC.

Conclusion: This DPA is concluded automatically with the contract, upon registration and acceptance of the GTC, at the latest with the first payment. It exists in electronic form (Art. 28(9) GDPR); a separate signature is neither required nor provided for. It applies uniformly to all customers; individually negotiated versions are not concluded.

1. Subject matter and duration

1. The Processor processes personal data on behalf of the Controller (Art. 4(8), Art. 28 GDPR). Annex 1 describes the subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects.
2. This DPA applies for the term of the contract and beyond, for as long as the Processor processes data of the Controller.

2. Instructions and responsibility

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law. In that case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information.
2. The instructions result from the GTC, this DPA and the settings the Controller makes in the management area. The Controller issues supplementary instructions in text form, for example by e-mail.
3. If the Processor considers an instruction to infringe data protection law, it informs the Controller without undue delay (Art. 28(3) sentence 3 GDPR).
4. The Controller is the controller within the meaning of Art. 4(7) GDPR. It is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. Third-party services that the Controller embeds in its app itself (such as embedded videos, maps, chat providers or analytics services with their own ID) are used under the Controller's own responsibility; their providers are not sub-processors of the Processor.

3. Confidentiality

The Processor only engages persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). They process the data only to the extent necessary for the service.

4. Security of processing

1. The Processor takes the technical and organisational measures required under Art. 32 GDPR. They are described in Annex 3.
2. The measures evolve with the state of the art. The Processor may adapt them as long as the level of protection does not decrease.

5. Sub-processors

1. The Controller grants general authorisation to engage other processors (Art. 28(2) GDPR). Annex 2 lists the sub-processors engaged.
2. The Processor informs the Controller at least four weeks in advance of any intended addition or replacement of a sub-processor by updating the list in Annex 2 with the planned date and notifying the Controller in text form (by e-mail or in the management area).
3. Within this period, the Controller may object to the change for an important reason relating to data protection. If the parties do not find a solution, the Controller may terminate the contract extraordinarily with effect from the date of the change.
4. The Processor contractually binds each sub-processor to the data protection obligations of this DPA (Art. 28(4) GDPR).
5. Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

6. Assistance to the Controller

1. The Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts the Processor directly, it forwards the request to the Controller.
2. It assists the Controller with the obligations under Art. 32 to 36 GDPR (security of processing, notification of breaches, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to it.

7. Notification of breaches

The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it (Art. 33(2) GDPR), at the e-mail address stored in the customer account. The notification contains, as far as known, the information under Art. 33(3) GDPR; the Processor provides missing information as soon as it is available.

8. Deletion and return

1. During the term of the contract, the Processor deletes data according to the periods in Annex 1, section 5. Content that the Controller places in its apps remains until the Controller deletes it.
2. The Controller may at any time request that the Processor delete an app or its customer account together with all data processed on its behalf. The Processor then deletes within 30 days. Before deletion, the Controller can back up its content using the functions of the management area or request that it be handed over in a common format.
3. When a package ends, the app is deactivated, and the Controller can reactivate it by booking again. Apps of customers who have not booked a paid package are deleted by the Processor no earlier than 180 days after they expire, if nobody has logged in to the management area during that time, and after the Processor has announced the deletion by e-mail ten days in advance.
4. Together with the app, the Processor deletes all of its content, user accounts, media files, usage events and stored e-mails. If it deletes the customer account, the e-mails to the Controller are deleted as well. Data that the Processor must retain due to legal obligations, such as invoices, is blocked for any other use.
5. Copies in backups are overwritten in the regular backup cycle.

9. Evidence and audits

1. On request, the Processor provides the Controller with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, first in the form of documents (such as a description of the measures and the list of sub-processors).
2. If the documents are not sufficient in an individual case, the Processor allows for audits, including inspections, by the Controller or an auditor mandated by it who is bound to confidentiality and is not a competitor of the Processor. On-site audits must be announced with reasonable notice, as a rule four weeks, take place during normal business hours and must not disrupt operations disproportionately. The Controller bears the costs of an audit.

10. Final provisions

1. Liability is governed by Art. 82 GDPR; otherwise the liability rules of the GTC apply.
2. Changes to this DPA are made in the same way as changes to the GTC (§ 12 GTC); changes to Annex 2 according to section 5.
3. Should any provision be invalid, the validity of the remaining provisions remains unaffected.
4. The German version is authoritative.

Annex 1 – Subject matter of the processing

1. Subject matter and purpose

• Provision and operation of the apps created with AppConfector (web apps and, if booked, apps in the app stores), including hosting, database and backups
• Forms, orders, appointment requests, comments, reactions and messages in the apps
• User accounts of the apps and push notifications
• Sending e-mails from the app to its users and to the Controller
• Counting usage (views, installations, downloads) for the Controller's statistics
• Translation of app content, if the Controller uses it
• Support by artificial intelligence in creating and designing the app, if the Controller uses it
• AI tools of the management area (“Improve text”, “Create image”), if the Controller uses them
• Support for requests concerning content from the app

2. Types of personal data

• Information that users of the app provide in forms, orders, appointment requests, comments and messages (e.g. name, contact details, content of the request)
• User accounts of the app (e-mail address, language, time of last login, permissions; name, profile picture and custom fields of the Controller, if provided). Users log in without a password via a link sent by e-mail.
• Push identifiers (device tokens, browser subscriptions) and a random device identifier
• Usage events (type and time of a view, device identifier, browser identifier, referring page; no IP address)
• E-mails of the app (content, recipient, delivery status)
• Content that the Controller places in its apps, insofar as it relates to persons (e.g. contact persons, photos)

3. Data subjects

• Users of the apps
• Customers, prospects, employees and business partners of the Controller

4. Place of processing

The apps run on servers of netcup GmbH in a data centre in Nuremberg, Germany. Annex 2 lists the sub-processors and their places of processing.

5. Retention periods

Annex 2 – Sub-processors

The Processor sends e-mails via its own mail server (Mailverse) and handles support requests with its own system (Auxdesk); both run on the servers of netcup GmbH.

Annex 3 – Technical and organisational measures

1. Confidentiality

• Physical access: data centre of netcup GmbH in Nuremberg with access control and surveillance by the operator
• Access to the servers: only for authorised administrators, via encrypted connections (SSH)
• Access within the application: every record is assigned to an app; customers only see their own apps; logins to the management area with a time-limited token, passwords not stored in plain text; users of the apps log in without a password via a link sent by e-mail
• Sessions: deleted on the server 24 hours after the last activity

2. Integrity

• Transmission: encrypted via TLS (HTTPS), requests via HTTP are redirected to HTTPS; e-mails with DKIM, SPF and DMARC
• Interfaces: incoming webhooks are verified by signatures or by querying the sender; internal tools can only be reached with signed links
• Input control: changes made by AI functions are logged with their previous state and can be undone; logins to the management area are logged

3. Availability and resilience

• Database replicated three times on separate servers
• Own backups at netcup GmbH in Germany
• Monitoring of the services with alerting

4. Data minimisation and review

• Automatic deletion according to the periods in Annex 1, section 5
• No storage of IP addresses in usage events; server logs deleted after 14 days
• Regular review of the measures and of the places of processing of the sub-processors