Data Processing Agreement

This Data Processing Agreement is entered into between:

– hereinafter the "Processor" –

and

– hereinafter the "Customer" –

– the Processor and the Customer hereinafter together the "Parties" and each individually a "Party" –

1. Subject Matter

In performing the agreement between the Parties on the provision of the Processor's software to the Customer (hereinafter the "Main Agreement"), it is necessary or possible that the Processor handles personal data in respect of which the Customer acts as controller within the meaning of applicable data protection law (hereinafter the "Customer Data"). This agreement (hereinafter the "Data Processing Agreement") specifies the data protection rights and obligations of the Parties in connection with the Processor's use of Customer Data in the provision of contractual services.

2. Scope of the Data Processing

2.1 The Processor processes the Customer Data on behalf of the Customer and in accordance with the Customer's instructions pursuant to Art. 28 of the General Data Protection Regulation (hereinafter the "GDPR"). The Customer remains the controller within the meaning of Art. 4(7) GDPR.

2.2 The nature, scope, and purpose of the processing of Customer Data by the Processor are as set out in Annex 1 to this Data Processing Agreement; the processing relates to the types of personal data and the categories of data subjects specified therein. The duration of the processing corresponds to the term of the Main Agreement.

2.3 The Processor generally processes the Customer Data within a member state of the European Union or another contracting state of the Agreement on the European Economic Area (EEA). However, the Processor is entitled to process Customer Data outside the EEA in accordance with the provisions of this Data Processing Agreement, provided that it informs the Customer in advance of the location of the data processing and that the requirements of Chapter V of the GDPR are met.

3. Customer's Authority to Issue Instructions

3.1 The Processor processes the Customer Data in accordance with the Customer's instructions, including with regard to the transfer of personal data to a third country or an international organization, unless the Processor is required to do otherwise by law. In the latter case, the Processor informs the Customer of that legal requirement before the processing, unless the law prohibits such information on important grounds of public interest.

3.2 The Customer's instructions are, as a rule, conclusively set out and documented in the provisions of this Data Processing Agreement. Individual instructions that deviate from the provisions of this Data Processing Agreement, or that impose additional requirements going beyond the services agreed in the Main Agreement and not necessary to prevent or remedy legal violations within the Processor's area of responsibility, shall be reasonably remunerated. In such a case, the Processor informs the Customer in advance that carrying out the instruction will give rise to costs.

3.3 The Processor ensures that the Customer Data is processed in accordance with the Customer's instructions. If the Processor is of the opinion that an instruction of the Customer violates this Data Processing Agreement or applicable data protection law, it is entitled, after notifying the Customer accordingly, to suspend the execution of the instruction until the Customer confirms the instruction. The Parties agree that sole responsibility for the compliance of the instructions with data protection law lies with the Customer.

3.4 Individual instructions may only be issued by the Customer's contacts designated in Annex 1 or, if none are designated there, by the Customer's legal representatives or the persons designated by the Customer to the Processor in text form. They must be addressed to the Processor's instruction recipient designated in Annex 1. Instructions require at least text form (e.g. email); instructions issued orally shall be confirmed in text form without undue delay. The Processor documents the instructions issued and their implementation. The Parties shall notify each other in text form of any changes to the designated contacts; no amendment of this Data Processing Agreement is required for such changes.

4. Legal Responsibility of the Customer

4.1 The Customer is solely responsible for the lawfulness of the processing of the Customer Data and for safeguarding the rights of data subjects in the relationship between the Parties. Should third parties assert claims against the Processor arising from the processing of Customer Data in accordance with the agreements between the Parties, the Customer shall indemnify the Processor against all such claims upon first demand, unless the third party's claim evidently results from a violation of law or contract by the Processor.

4.2 The Customer is responsible for making the Customer Data available to the Processor in good time for the performance of the contractual services and is responsible for the quality of the Customer Data. The Customer shall inform the Processor without undue delay and in full if, when reviewing the Processor's results, it identifies errors or irregularities with regard to data protection provisions or its instructions.

5. Confidentiality and Data Protection Officer

5.1 The Processor commits all persons involved in the processing of Customer Data to confidentiality with regard to the processing of Customer Data.

5.2 The confidentiality obligations under this Data Processing Agreement survive the termination of this Data Processing Agreement and of the Main Agreement.

5.3 The Processor has appointed an external data protection officer:

The Customer will be informed in text form of any change of the data protection officer or of their contact details.

6. Security of Processing

6.1 The Processor takes the necessary appropriate technical and organizational measures pursuant to Art. 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing of the Customer Data, as well as the varying likelihood and severity of the risk to the rights and freedoms of the data subjects, in order to ensure a level of protection of the Customer Data appropriate to the risk. The implemented technical and organizational measures include the measures listed in Annex 2.

6.2 The technical and organizational measures are subject to technical progress and further development. The Processor is accordingly permitted to implement alternative adequate measures, provided that the alternative measures do not fall below the security level of the specified measures. Material changes shall be documented.

7. Use of Sub-processors

7.1 The Customer grants the Processor general authorization to engage sub-processors for the processing of Customer Data. The sub-processors engaged at the time of conclusion of this Data Processing Agreement are listed in Annex 3.

7.2 The Processor will inform the Customer of any intended changes concerning the addition or replacement of sub-processors (stating the company, its address, and a brief description of the data processing). The Customer has the right to object to the engagement of a potential sub-processor in an individual case. An objection may be raised by the Customer on objective grounds, which shall be communicated to the Processor. The Processor will give notice of the engagement of a new sub-processor no later than 14 days before the planned engagement of the sub-processor. If the Customer does not object within 14 days of receipt of the notice, the sub-processor is deemed approved. If the Customer objects, the Processor is entitled to terminate the Main Agreement and this Data Processing Agreement with three months' notice to the end of a month.

7.3 The agreement between the Processor and the sub-processor must impose on the sub-processor the same obligations as those incumbent on the Processor under this Data Processing Agreement. The Parties agree that this requirement is met if the agreement provides a level of protection corresponding to this Data Processing Agreement.

7.4 Subject to compliance with the requirements of Section 2.3 of this Data Processing Agreement, the provisions of this Section 7 also apply if a sub-processor in a third country is engaged. If the processing is not carried out on the basis of an adequacy decision issued by the EU Commission, the Parties agree that the Processor and the sub-processor may ensure compliance with Chapter V of the GDPR by using the standard contractual clauses adopted by the EU Commission pursuant to Art. 46(2) GDPR, as amended from time to time.

7.5 The Processor shall ensure that its sub-processors grant it audit and evidence rights corresponding to the Customer's rights under Section 11. Upon the Customer's substantiated request, the Processor shall exercise these rights vis-à-vis the relevant sub-processor and inform the Customer of the outcome. In addition, the Processor shall, upon request, provide the Customer with available evidence of the sub-processors' level of data protection and security (in particular certifications and audit reports within the meaning of Section 11.7).

8. Rights of Data Subjects

8.1 The Processor will, where possible, support the Customer with technical and organizational measures in fulfilling the Customer's obligation to respond to requests for the exercise of the data subjects' rights set out in Chapter III of the GDPR. Expenses incurred by the Processor as a result of supporting the Customer shall be reasonably remunerated, unless the support became necessary due to a violation by the Processor of the applicable data protection provisions or of this Data Processing Agreement.

8.2 If a data subject submits a request to exercise their rights directly to the Processor, the Processor will forward the request to the Customer in a timely manner.

9. Notification and Support Obligations of the Processor

9.1 The Processor supports the Customer in complying with the obligations set out in Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Processor. The Processor shall be reasonably remunerated for the expenses and costs incurred in this context and evidenced to the Customer, unless the Customer's notification obligation or the Processor's support results from a violation by the Processor of the applicable data protection provisions or of this Data Processing Agreement.

9.2 If the Customer is subject to a statutory notification obligation due to a breach of the security of the Customer Data (in particular pursuant to Art. 33, 34 GDPR), the Processor will inform the Customer of notifiable events within its area of responsibility without undue delay after becoming aware of them.

9.3 The Processor shall inform the Customer without undue delay if Customer Data held by the Processor is affected by attachment or seizure, by insolvency or composition proceedings, or by other measures of third parties or public authorities. The Processor shall inform all parties acting in this context without undue delay that the authority to decide on the Customer Data lies exclusively with the Customer as controller.

10. Deletion and Return of Customer Data

10.1 After completion of the provision of the processing services, the Processor will, at the choice of the Customer,

a) delete or return the Customer Data; and

b) delete existing copies,

unless the Processor is required by law to further store the Customer Data within the meaning of Art. 28(3)(g) GDPR.

10.2 The Processor has no rights of retention with respect to the Customer Data.

11. Evidence and Audits

11.1 The Processor shall, upon request, provide the Customer with all information necessary to demonstrate compliance with its obligations under this Data Processing Agreement and its obligations arising directly from the GDPR.

11.2 The Customer is entitled to audit the Processor's compliance with the provisions of this Data Processing Agreement, in particular the implementation of the technical and organizational measures (including on-site inspections).

11.3 Audits pursuant to Section 11.2 are generally carried out during normal business hours (Monday to Friday, 10:00 to 18:00) and shall, as a rule, be announced in good time in accordance with Section 11.5 in order to avoid excessive disruption of business operations. Access to the Processor's business premises is subject to strict confidentiality regarding the Processor's business and trade secrets; this confidentiality obligation does not preclude any existing obligation to provide evidence to the supervisory authority or to data subjects. In this respect, confidential information within the meaning of Section 11.4 shall be redacted to the extent necessary, unless communicating the audit result as such is already sufficient. The audit of the Processor is carried out at the Customer's expense, unless the audit became necessary due to a violation of law or contract by the Processor.

11.4 The Processor is entitled, taking into account the Customer's statutory obligations, not to disclose information that is sensitive with regard to the Processor's business operations or whose disclosure would cause the Processor to violate statutory or other contractual provisions. The Customer is not entitled to obtain access to data or information concerning other customers of the Processor, cost information, quality control and contract management reports, or other confidential data of the Processor that is not directly relevant to the agreed audit purposes.

11.5 The Customer shall inform the Processor in good time (as a rule, at least two weeks in advance, unless this would jeopardize the purpose of the audit) of all circumstances relating to the performance of the audit. Unless there is a compelling reason, the Customer may not carry out more than one audit per calendar year. A compelling reason exists in particular where there is a substantiated suspicion of a data protection breach.

11.6 If the Customer engages a third party to carry out the audit, the Customer shall bind the third party in writing in the same way as the Customer is bound towards the Processor under this Section 11. In addition, the Customer shall bind the third party to secrecy and confidentiality by written agreement, unless the third party is subject to a professional duty of confidentiality. Upon the Processor's request, the Customer shall promptly provide the Processor with the commitment and confidentiality agreements concluded with the third party. The Customer may not engage any direct competitor of the Processor to carry out the audit.

11.7 When deciding whether to carry out an audit pursuant to Section 11.2, the Customer may take into account relevant certifications of the Processor, in particular the provision of a current attestation or report by an independent body (e.g. auditors, internal audit, data protection officer, IT security department, data protection auditors, or quality auditors) or suitable certification by way of an IT security or data protection audit (hereinafter the "Audit Report"), if the Audit Report reasonably enables the Customer to satisfy itself of the Processor's compliance with the contractual obligations contained in this Data Processing Agreement.

12. Term and Termination

12.1 The term and termination of this Data Processing Agreement are governed by the provisions on the term and termination of the Main Agreement. Termination of the Main Agreement automatically results in the termination of this Data Processing Agreement. A separate termination of this Data Processing Agreement is not required.

12.2 The Customer is entitled to terminate this Data Processing Agreement and the Main Agreement for cause without notice if the Processor is in serious breach of its obligations under this Data Processing Agreement or of applicable data protection law and fails to remedy the breach within a reasonable period despite a written warning by the Customer. No warning is required if the breach is so serious that the Customer cannot reasonably be expected to remain bound by the agreement.

13. Liability

13.1 The Processor's liability under this Data Processing Agreement is governed by the exclusions and limitations of liability provided for in the Main Agreement. To the extent liability matters are not fully addressed in the Main Agreement, the liability provisions of Art. 82 GDPR apply.

13.2 The Customer undertakes to indemnify the Processor upon first demand against all fines imposed on the Processor, to the extent of the Customer's share of responsibility for the violation sanctioned by the fine.

14. Final Provisions

14.1 Should individual provisions of this Data Processing Agreement be or become invalid, or should this Data Processing Agreement contain a gap, the remaining provisions remain unaffected. The Parties undertake to replace the invalid provision with a legally permissible provision that comes closest to the purpose of the invalid provision and thereby satisfies the requirements of Art. 28 GDPR.

14.2 In the event of conflicts between this Data Processing Agreement and other agreements between the Parties, in particular the Main Agreement, the provisions of this Data Processing Agreement take precedence.

Annexes:

• Annex 1: Further Information on the Processing of Customer Data
• Annex 2: Technical and Organizational Measures pursuant to Art. 32 GDPR
• Annex 3: Sub-processors

Annex 1: Further Information on the Processing of Customer Data

Purpose and scope of the data processing

Provision of the Cosuno platform as a software-as-a-service tool and (where applicable) further processing purposes specified in the Main Agreement. The Cosuno platform serves to enable the Customer to intelligently manage the commissioning of subcontractors in construction projects.

Types of personal data

Personal master data, communication data, contract master data, customer history, contract billing and payment data, planning and control data.

Categories of data subjects

Employees of the Customer; suppliers of the Customer; end customers of the Customer; further categories of data subjects specified in the Main Agreement (if any).

Contacts for data protection instructions (Section 3.4)

Instruction recipient of the Processor:

Annex 2: Technical and Organizational Measures pursuant to Art. 32 GDPR

1. Confidentiality (Art. 32(1)(b) GDPR)

1.1 Physical Access Control

The Processor takes measures to secure data processing facilities against unauthorized physical access.

In the Processor's office premises, the following measures, among others, are implemented:

Technical measures:

• Manual locking system
• Security locks
• Alarm system
• Doorbell system with camera

Organizational measures:

• Key policy and key log
• Visitors only when accompanied by employees
• Careful selection of cleaning staff

The production systems for processing personal data are not operated in the Processor's office premises but exclusively in the data centers of carefully selected sub-processors. These include hosting providers such as AWS (Amazon Web Services) and GCP (Google Cloud Platform) as well as all other engaged sub-processors that process personal data on the Processor's behalf (see Annex 3).

1.2 System Access and User Control

The Processor takes the following measures, among others, to secure data processing systems against unauthorized use.

Technical measures:

• Authentication with username and password
• Multi-factor authentication
• Encryption of data storage media
• Use of anti-virus software
• Use of firewalls
• Use of password managers
• Automatic desktop lock on inactivity

Organizational measures:

• Authorization concept based on the need-to-know and least-privilege principles
• Unambiguous assignment of user profiles to IT systems
• Immediate revocation of access when an employee leaves
• Company-wide password policy including password length and complexity
• Clean desk policy

1.3 Access, Data, and Storage Control

The Processor takes the following measures, among others, to prevent unauthorized reading, copying, modification, or removal within the system.

Technical measures:

• Use of document shredders
• Proper destruction of data storage media (DIN 32757)
• Physical deletion of data storage media before reuse
• Logging of access to applications, in particular when entering, modifying, and deleting data
• Use of version control systems (VCS) and code review processes for software changes

Organizational measures:

• Authorization concept based on the need-to-know and least-privilege principles
• Minimal number of administrators
• Management of user rights by designated administrators
• Company-wide password policy including password length and complexity
• Secure storage of data storage media
• Logging of the destruction of data

1.4 Separation Control

The Processor takes the following measures, among others, to ensure that data collected for different purposes is processed separately.

Technical measures:

• Separation of production, testing, and development environments
• Separate storage of data processed for different purposes
• Multi-tenancy of relevant applications

Organizational measures:

• Authorization concept based on the need-to-know and least-privilege principles
• Clearly documented, limited granting of access rights to databases
• Documentation of the processing purposes for all categories of stored data

1.5 Pseudonymization

The Processor uses the following measures, among others, to ensure that, where certain data is pseudonymized, that data can no longer be attributed to a specific data subject without the use of additional information.

Technical measures:

• In the case of pseudonymization: storage of the attribution data in a separate, secured system

Organizational measures:

• Internal policies specifying in which cases and in what manner certain data sets are to be pseudonymized

2. Integrity (Art. 32(1)(b) GDPR)

2.1 Transfer Control

The Processor takes the following measures, among others, to prevent unauthorized reading, copying, modification, or removal during electronic transmission or transport.

Technical measures:

• Encrypted data transmission (TLS/HTTPS)
• System-side logging of access and of retrieved data
• Secure transport containers and packaging for the physical transport of data

Organizational measures:

• Documentation of the data recipients as well as the duration of the planned provision and the deletion periods
• Overview of regular retrieval and transmission processes
• Transfer in anonymized or pseudonymized form, where possible
• Care in the selection of transport personnel and vehicles

2.2 Input Control

The Processor takes the following measures, among others, to make it possible to determine whether and by whom personal data has been entered into, modified in, or removed from data processing systems.

Technical measures:

• Technical logging of the entry, modification, and deletion of data
• Manual or automated review of the logs

Organizational measures:

• Overview of which programs can be used to enter, modify, or delete which data
• Traceability of the entry, modification, and deletion of data through individual usernames (not user groups)
• Granting of rights to enter, modify, and delete data on the basis of the authorization concept
• Deletion concept with clear responsibilities and logging

3. Availability and Resilience (Art. 32(1)(b) GDPR)

3.1 Availability Control

The Processor takes the following measures, among others, to protect personal data against accidental destruction or loss.

Technical measures:

• Use of outsourced data centers that are certified according to ISO 27001 and employ comprehensive measures to ensure a high level of availability (fire protection, air conditioning, uninterruptible power supply, etc.)
• Redundant system architecture
• Flexible scalability of the IT infrastructure
• Automated backup processes
• Continuous monitoring of the IT systems

Organizational measures:

• Documented backup and recovery concept
• Control of the backup processes
• Regular data recovery tests with logging of the results
• Storage of backups in a secure, off-site location
• Documented contingency plan

4. Procedures for Regular Testing, Assessment, and Evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)

4.1 Data Protection Measures

The Processor takes the following measures, among others, to organize its internal operations in such a way that they meet the specific requirements of data protection.

Technical measures:

• Software solutions for data protection management in use
• Central documentation of all data protection procedures and rules, accessible to employees

Organizational measures:

• Review of the effectiveness of the technical protective measures, at least annually
• Training of employees on data protection and the GDPR, with participation logged
• Annual repetition of the training
• Logged commitment of employees to confidentiality
• Written appointment of a data protection officer
• Process for handling access requests from data subjects

4.2 Incident Response Management

The Processor takes the following measures, among others, to ensure GDPR-compliant handling of IT security incidents.

Organizational measures:

• Documented process for detecting and reporting security incidents and data breaches, including with regard to notification obligations towards supervisory authorities
• Documented procedure for handling security incidents
• Involvement of the data protection officer in security incidents and data breaches
• Detailed documentation of security incidents and data breaches
• Formal process and responsibilities for the follow-up of security incidents and data breaches

4.3 Data Protection by Default

The Processor takes the following measures, among others, to ensure through default settings that only personal data that is necessary is processed.

Organizational measures:

• No collection of personal data that is not necessary for the respective purpose
• Privacy-friendly default settings of products and services, in place before their first use

4.4 Order Control

The Processor takes the following measures, among others, to ensure that data processed on its behalf is processed in accordance with instructions.

Organizational measures:

• Selection of service providers with due diligence regarding data protection and data security
• Prior review of the security measures taken by the service provider and their documentation
• Conclusion of data processing agreements (DPAs) with service providers
• Regular review of the service provider and its level of protection

Annex 3: Sub-processors

Sub-processor	Description of the processing	Location of the data processing
Amazon Web Services EMEA SARL	Cloud hosting	Germany
Datadog, Inc.	Storage of technical logs, monitoring	Germany
dbt Labs, Inc.	Provision of reports and data analytics	USA (basis: adequacy decision pursuant to Art. 45 GDPR; EU-U.S. Data Privacy Framework)
Functional Software Inc	Technical error tracking	Germany
Google Cloud EMEA Limited	Cloud hosting	EU
Intercom, Inc.	Live chat with customer support	USA (basis: adequacy decision pursuant to Art. 45 GDPR; EU-U.S. Data Privacy Framework)
Joincube, Inc.	Display of product news	Belgium (EU)
Sinch AB (Mailjet)	Sending of emails	Germany / Belgium (EU)
Estuary Technologies, Inc.	Provision of reports and data analytics	Germany
Catamorphic, Co. dba LaunchDarkly	Technical control of product features	USA (basis: adequacy decision pursuant to Art. 45 GDPR; EU-U.S. Data Privacy Framework)
Twilio Inc.	Sending of emails and SMS	USA (basis: adequacy decision pursuant to Art. 45 GDPR; EU-U.S. Data Privacy Framework)
Docusign, Inc.	Electronic contract signing	EU