Data Processing Agreement (DPA)

Data processing agreement pursuant to Art. 28 GDPR between the customer as controller (the "customer") and DigitalToolsList Extended UG (haftungsbeschränkt), Paalende 26, 22149 Hamburg, Germany, as processor (the "provider", "we"). This English version is a courtesy translation; the German version (Auftragsverarbeitungsvertrag) is legally authoritative.

This agreement ("DPA") supplements the terms of service for the use of ScanToPitch (the "main agreement"). It applies to the extent that the customer stores or manages personal data in the service for which the customer is itself the controller (in particular the lead data described in sections 3 and 4).

1. Subject matter and duration of the processing

The subject matter of the processing is the provision of the software-as-a-service application ScanToPitch, in which the customer stores, organizes, and edits researched business data (in particular in lists, follow-ups, and reminders, and with the customer's own notes, manual additions, and corrections).

The duration of the processing corresponds to the term of the main agreement. It ends with the deletion of the customer account or with the complete deletion of the data concerned by the customer, whichever occurs first.

2. Nature and purpose of the processing

The processing comprises the storage, organization, display, alteration, evaluation, export, restriction, and deletion of the data within the application.

The purpose of the processing is the research, assessment, and organization of potential business contacts by the customer in preparation of the customer's own business development. The customer alone is responsible for the lawfulness of any outreach (see the main agreement).

3. Categories of data subjects

• Owners of the researched businesses,
• Employees and publicly named contact persons of these businesses.

4. Categories of personal data

• Business contact data: name of the business, names of publicly named contact persons, business email addresses and phone numbers, postal address, website URL,
• Content entered by the customer: the customer's own notes, manual additions and corrections, assignments to lists and reminders,
• Analysis results concerning the respective business website (measurements, scores, screenshots), insofar as they relate to identifiable persons.

Special categories of personal data (Art. 9 GDPR) are not part of the processing and must not be stored in the application by the customer.

5. Allocation of roles

For the data described in sections 3 and 4 that the customer stores and manages in its account ("lead data"), the customer is the controller within the meaning of Art. 4(7) GDPR; we process this data as processor pursuant to Art. 28 GDPR.

Processing that we carry out under our own responsibility to provide and operate the service remains unaffected (in particular finding and analyzing publicly accessible business data, caching, abuse prevention, and billing); our privacy policy and the data subject notice provide information about this.

6. Instructions of the customer

We process the lead data only on documented instructions from the customer, including with regard to transfers to a third country or an international organization, unless required to do so by Union or Member State law to which we are subject; in such a case, we inform the customer of that legal requirement before processing, unless that law prohibits such information (Art. 28(3)(a) GDPR).

The customer's use of the functions of the application constitutes the instructions. Further instructions require text form. If we are of the opinion that an instruction infringes the GDPR or other data protection provisions, we inform the customer without undue delay; we may suspend the execution of the instruction concerned until it is confirmed or changed.

7. Confidentiality

We grant access to the lead data only to persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

8. Security of processing

We implement all technical and organizational measures required pursuant to Art. 32 GDPR. The measures agreed at the time this agreement is concluded are described in Annex 1. We may adapt the measures to technical developments, provided the agreed level of protection is not reduced.

9. Sub-processors

The customer grants a general authorization for the engagement of sub-processors (Art. 28(2) GDPR). The sub-processors engaged at the time this agreement is concluded are set out in the overview "Processors and recipients" in our privacy policy; Annex 2 refers to that list.

We inform the customer of intended changes (addition or replacement of sub-processors) in advance in text form with a notice period of 30 days. The customer may object to the change for an important data protection reason; if no amicable solution is reached, either party may terminate the main agreement with effect from the end of the current billing period.

We impose on sub-processors, by contract, substantially the same data protection obligations as set out in this DPA (Art. 28(4) GDPR). For transfers to third countries, the safeguards pursuant to Art. 44 et seq. GDPR apply; details per provider are set out in the privacy policy.

10. Assistance to the customer

We assist the customer by appropriate technical and organizational measures in responding to requests of data subjects pursuant to Art. 12 to 23 GDPR, in particular through the display, rectification, export, and deletion functions available in the application. Requests from data subjects received by us that recognizably concern the customer's lead data are forwarded to the customer without undue delay.

Taking into account the nature of the processing and the information available to us, we assist the customer in complying with the obligations pursuant to Art. 32 to 36 GDPR (security of processing, breach notification, data protection impact assessment, prior consultation).

11. Notification of personal data breaches

We notify the customer of any breach of the protection of the lead data without undue delay after becoming aware of it and provide the customer with the information pursuant to Art. 33(3) GDPR insofar as it is available to us.

12. Deletion and return

After the end of the provision of the processing services, we delete or return the lead data, at the choice of the customer, and delete existing copies unless storage is required by law (Art. 28(3)(g) GDPR). The customer can back up its data at any time via the export functions of the application (including CSV, Excel, JSON) and remove it via the deletion functions; deleting the account permanently deletes all lead data. Where statutory retention obligations exist, processing is restricted instead.

13. Evidence and audits

We make available to the customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the customer or an auditor mandated by the customer.

Audits are generally carried out first by providing suitable evidence (e.g. documentation, certifications, or audit reports).

14. Liability and final provisions

The liability of the parties is governed by the provisions of the main agreement; Art. 82 GDPR remains unaffected.

In the event of conflicts between this DPA and the main agreement, this DPA prevails with regard to the processing of the lead data. The law of the Federal Republic of Germany applies. Should individual provisions of this DPA be invalid, the validity of the remaining provisions remains unaffected.

Annex 1: Technical and organizational measures (TOMs)

• Access control: tenant-separated data storage with row-level security on all customer-data tables; privileged keys server-side only; a password-protected, separately secured administration area; access only for authorized personnel.
• Encryption: transport encryption (TLS) for all connections; encryption of stored data at the hosting providers; screenshots stored in a non-public storage area.
• Availability and resilience: daily backups of the production database, recovery procedures, continuous operational and uptime monitoring, protection against overload (rate limits) and failed processing (automatic retries, watchdogs).
• Data storage in the EU: database, authentication and storage in an EU region; web hosting in the EU region Frankfurt; scan server in a data center in Germany.
• Deletion concept: account deletion with cascading deletion of all customer data; data export for customers; automatic cleanup of temporary files and caches after defined periods.
• Regular review: continuous improvement and testing of the measures as part of the development process; measures documented in the internal record of processing activities.

Annex 2: Sub-processors

The current list of sub-processors engaged (service, provider, purpose, seat, third-country safeguard) is contained in the overview "Processors and recipients" of our privacy policy and is kept up to date there.