Data Processing Agreement

This DPA is concluded

between the Controller – the company accepting the corresponding offer of TRIALTA GmbH, whose full company name and address result from the respective offer – (hereinafter referred to as the “Controller”)

and TRIALTA GmbH, Seumestr. 12, 90478 Nürnberg, Germany (hereinafter referred to as the “Processor”).

The Processor and the Controller are hereinafter also referred to as the “Contracting Parties”.

• Section 1 | Subject
• Section 2 | Categories of personal data
• Section 3 | Special categories of data
• Section 4 | Categories of data subjects
• Section 5 | Purpose of the processing
• Section 6 | Responsibility and decisional authority
• Section 7 | Security concept and related obligations
• Section 8 | Duties to provide information and to cooperate
• Section 9 | Powers of control
• Section 10 | Sub-processor relationships
• Section 11 | Processing in third countries
• Section 12 | Duration, termination, and data deletion
• Section 13 | Remuneration
• Section 14 | Liability
• Section 15 | Final provisions
• Annex 1 – Security concept (TOMs)
• Annex 2 – Sub-processors

Section 1 | Subject

The subject of the DPA, i.e., the personal data processed within the scope of the Agreement (Art. 4 (1) GDPR; hereinafter referred to as “Data”), the data subjects affected by the processing (hereinafter referred to as “Data Subjects”) as well as the type, scope, and purposes of the processing are determined by the following legal relationship(s) between the Contracting Parties (hereinafter referred to as the “Main Contract”).

The Contracting Parties shall work together on the basis of individual orders placed by the Controller with the Processor within the framework of individual agreements concluded by the Controller with the Processor.

The provisions of this DPA shall take precedence over the Main Contract.

Section 2 | Categories of personal data

The categories of personal data correspond to the data that the Controller makes available to the Processor in the systems and documents provided for the delivery of services. These may include, but are not limited to, personal data relating to the following categories of personal data:

• Master data (e.g., names, addresses, job title)
• Contact details (e.g., e-mail, phone numbers)
• Content data (e.g., text input, photographs, videos)
• Contract data (e.g., subject matter of the contract, term)
• Payment data (e.g., bank details, payment history)
• Usage data (e.g., interests, websites visited, purchasing behaviour, access times, log data)
• Meta/communication data (e.g., device IDs, IP addresses, location data)
• User data (e.g., name, IP addresses, email address, profile picture)

Section 3 | Processing of special categories of personal data (Art. 9 (1) GDPR)

As a matter of principle, no special categories of data are processed, unless the Controller makes them available to the Processor in the systems and documents provided for the delivery of services. The Processor will not request such data from the Controller.

Section 4 | Categories of data subjects whose personal data is processed

The categories of data subjects correspond to the data that the Controller makes available to the Processor in the systems and documents provided for the delivery of services. These may include, but are not limited to, personal data relating to the following categories of data subjects:

• Authorized Users of the Controller
• Employees of the Controller
• Customers / Interested parties of the Controller
• Consultants, Agents, Contractors and Suppliers of the Controller
• Third parties the Controller conducts business with like family relations and linked parties such as owners, controllers, settlors, beneficiaries, beneficial owners

Section 5 | Purpose of the processing

The following purposes represent the general range of services offered by the Processor. The specific purposes – as well as the subject matter of the contract – result from the respective main documents (signed offer and/or framework agreement).

Importing, analyzing/evaluating, sorting/arranging, temporary storage/saving as well as the inspection and forwarding of personal data for the purposes of general advice to the Controller with regard to suitable marketing, sales and service measures as well as the setting up of new processes, the implementation of interfaces, the temporary storage in the event of an interface change, the sending of messages on behalf of the Controller and the maintenance of systems.

Section 6 | Responsibility and decisional authority

6.1 | As the responsible party pursuant to Art. 4 (7) GDPR, the Controller is responsible for compliance with the data protection requirements, in particular for the selection of the Processor, the data transmitted to the Processor, and the instructions issued.

6.2 | The Processor may only process data within the framework of the Main Contract and the Controller’s instructions (which also applies in particular to their rectification, erasure, or restriction of processing) and only insofar as the processing is necessary for this purpose, unless the Processor is obliged to carry out the processing by the law of the Union or the Member States to which the Processor is subject; in such a case, the Processor shall notify the Controller of these legal requirements prior to the processing, unless the law in question prohibits such notification due to an important public interest (Art. 28 (3) S. 2 lit. a GDPR).

6.3 | If instructions change, cancel or supplement the stipulations made within the framework of this contract, they are only permissible if a corresponding new agreement is made in writing, unless required by applicable laws. Irrespective of the form in which they are issued, both the Processor and the Controller shall document each instruction of the Controller in text form. The instructions shall be kept for the period of validity of this contract and subsequently for three years. If the instruction is given verbally, the Controller shall confirm it without delay – at least in text form.

6.4 | If the Processor believes that an instruction of the Controller violates applicable data protection law, they will notify the Controller thereof without delay. In this case, the Processor shall be entitled to suspend the execution of the instruction until the Controller confirms the instruction and to refuse execution in the case of obviously unlawful instructions.

6.5 | If supplementary instructions from the Controller exceed the Processor’s performance obligations under the main contract or the Controller’s mandatory legal obligations under Article 28 (3) of the GDPR, the Controller shall reimburse the Processor separately for the additional expenses incurred in accordance with the provisions of Section 13.

6.6 | The Contracting Parties may name persons authorised to give and receive instructions (in particular, if they do not become apparent from the Main Contract) and are obliged to notify their change without delay.

Section 7 | Security concept and related obligations

7.1 | The Processor shall organise the internal organisation in their area of responsibility in accordance with legal requirements and shall, in particular, take technical and organisational measures (hereinafter referred to as “TOMs”) to adequately safeguard, in particular, the confidentiality, integrity, and availability of the Controller’s data, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of the Data Subjects, and shall ensure that they are maintained (Art. 28 (3) and 32–39 in conjunction with Art. 5 GDPR). TOMs include, in particular, access control, disclosure control, input control, order control, availability control, separation control and the safeguarding of data subjects’ rights both in the role of the data subject’s own controller and in the context of the duty to cooperate as a processor.

7.2 | The TOMs underlying this DPA result from Annex 1 “Security Concept”. They may be further developed in accordance with technical progress and replaced by adequate protective measures, provided they do not fall below the security level of the specified measures and the Controller is notified about significant changes.

7.3 | The Processor shall ensure that the persons authorised to process the Controller’s data are bound to confidentiality and secrecy (Art. 28 (3) S. 2 lit. b GDPR) and have been instructed in the protective provisions of the GDPR or are subject to an appropriate statutory obligation of secrecy.

7.4 | The Controller agrees to the processing of data by the Processor in the home office. In return, the Processor undertakes to ensure the necessary security provisions in the home office.

7.5 | The data provided within the scope of the DPA as well as data carriers and all copies made thereof shall remain the property of the Controller, shall be carefully stored by the Processor, shall be protected against access by unauthorised third parties, and may only be destroyed with the consent of the Controller, and then only in accordance with data protection provisions. Copies of data may only be made if they are necessary for the fulfilment of the Processor’s principal and secondary obligations towards the Controller (e.g., backups).

7.6 | Insofar as stipulated by the GDPR or supplementary, in particular national regulations, the Processor shall appoint a data protection officer in accordance with the statutory requirements and inform the Controller accordingly (Art. 37 to 39 GDPR).

The data protection officer of the Processor is:
sicur data GmbH
Seumestraße 12, 90478 Nuremberg, Germany
Mrs Beate Bender
E-mail: dsb@sicur-data.de

Section 8 | Duties to provide information and to cooperate

8.1 | The Processor shall support the Controller with appropriate technical and organisational measures in responding to data subject requests pursuant to Art. 12–22 GDPR (Art. 28 (3) lit. e GDPR). This also includes the immediate forwarding of such requests should they be received by the Processor.

8.2 | The Controller shall inform the Processor immediately and in full if they discover errors or irregularities as to the processing of the data with regard to compliance with the provisions of this DPA or relevant data protection regulations.

8.3 | The Processor shall inform the Controller without delay of all personal data breaches of which he becomes aware within the scope of this Data Processing Agreement and, within the scope of his possibilities, supports the Controller, after consultation, in complying with its obligations pursuant to Art. 33 and 34 GDPR.

8.4 | If the security of the Controller’s data is endangered by actions of third parties (e.g., creditors, authorities, courts, etc.) (attachment, seizure, insolvency proceedings, etc.), the Processor shall immediately inform the third parties that sovereignty and ownership of the data lie exclusively with the Controller and, after consultation with the Controller, take appropriate protective measures if necessary (e.g., file objections, applications, etc.).

8.5 | The Processor shall inform the Controller without delay if a supervisory authority takes action against the Processor and their activity may affect the data processed for the Controller. The Processor shall support the Controller to the extent required by law in the performance of their obligations (in particular, to provide information and tolerate inspections) towards supervisory authorities (Art. 31 GDPR).

8.6 | Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in complying with its obligations under Articles 32 to 36 GDPR. Specifically, with regard to the security of processing, with notifications of data protection breaches to the supervisory authority, with notification of affected persons in the event of a data protection breach, with data protection impact assessment and with consultation of the responsible supervisory authority.

8.7 | If the provision of the necessary information and cooperation goes beyond the mandatory legal obligations of the Controller pursuant to Art. 28 (3) GDPR, the Controller shall reimburse the Processor separately for the additional expenses incurred in accordance with the provisions of Section 13.

Section 9 | Powers of control

9.1 | The Controller shall have the right to monitor the Processor’s compliance with the statutory requirements and the provisions of this DPA, in particular the TOMs, to the extent necessary, including on-site inspections (Art. 28 (3) lit. h GDPR).

9.2 | On-site inspections shall take place within normal business hours, shall be notified by the Controller with a reasonable period of notice (at least 14 days, except in emergencies) and shall be supported by the Processor (e.g., by providing personnel).

9.3 | The inspections shall be limited to the necessary scope and must take into account the Processor’s trade and business secrets as well as the protection of personal data of third parties (e.g., other customers or employees of the Processor). Only competent persons who can legitimise themselves and are bound to secrecy with regard to the Processor’s trade and business secrets as well as processes and personal data of third parties are permitted to carry out the inspection. In the event that the third party is in a direct or indirect competitive relationship with the Processor, the Processor reserves the right to object and to commission a neutral auditor by the Controller.

9.4 | Besides of the inspections and the on-the-spot checks, the Processor may refer the Controller to an equivalent inspection by independent third parties (e.g., neutral data protection auditors), compliance with approved codes of conduct (Art. 40 GDPR), or suitable data protection or IT security certifications pursuant to Art. 42 GDPR. This applies, in particular, if company and business secrets of the Processor or personal data of third parties would be endangered by the inspections.

9.5 | If the tolerance and cooperation in the checks or adequate alternative measures taken by the Controller go beyond the mandatory legal obligations of the Controller pursuant to Art. 28 (3) GDPR, the Controller shall reimburse the Processor separately for the additional expenses incurred in accordance with the provisions of Section 13.

Section 10 | Sub-processor relationships

10.1 | The Processor may engage additional sub-processors only with the prior approval of the Controller. The Controller hereby grants general authorization to engage additional sub-processors, subject to compliance with the following requirements regarding information, the right to object, and contractual obligations.

10.2 | If the Processor employs the services of a sub-processor to carry out certain processing activities on behalf of the Controller, they must impose the same data protection obligations on the sub-processor as those to which the Processor has committed themselves in this DPA (in particular, with regard to compliance with instructions, compliance with TOMs, provision of information and acceptance of inspections) by means of a contract or another legal instrument permitted under the GDPR. Furthermore, the Processor must carefully select the sub-processor, check their reliability and monitor this, as well as their compliance with the contractual and legal requirements (Article 28 (2) and (4) GDPR).

10.3 | The Controller expressly agrees, without prejudice to any restrictions under the Main Contract, that the Processor may use the sub-processors listed in Annex 2 as affiliated companies of the group of companies or as third-party providers within the scope of the data processing. Changes to the sub-processors listed in Annex 2 are subject to the agreed-upon notification and objection procedure.

10.4 | Should additional sub-processors be engaged or existing sub-processors be replaced during the course of the cooperation, the Controller must be notified about any intended changes in writing by email in good time before the new sub-processor begins processing personal data. This gives the Controller the opportunity to review these changes and raise objections. The Controller shall not exercise their right to object with regard to the changes or new sub-processors without a valid data protection reason. If the Controller does not object to such changes in writing or in electronic form within 14 days of the notification being sent, this shall be deemed approved by the Controller.

10.5 | If the Controller raises an objection to a new sub-processor with a valid data protection reason, the Controller and the Processor shall endeavour to find a mutually agreed solution by taking appropriate measures to address the cause of the objection to the adding of the new sub-processor and to enable the Controller to withdraw its objection. If the parties are unable to agree on a joint solution regarding the objection to the new sub-processor, and if the Processor is unable to provide the services without the sub-processor in question, or if doing so is economically unreasonable, both parties shall be entitled to terminate the relevant services or the framework agreement for services extraordinarily, giving reasonable notice as agreed on in the framework contract or order and without incurring a contractual penalty. Termination shall be effected by written notice.

10.6 | The Controller assures the Processor that they will not directly contact or commission any sub-processors under any circumstances without the Processor’s consent.

10.7 | Contractual relationships in which the Processor uses the services of third parties as a purely ancillary service in order to carry out their business activities (e.g., cleaning, security, or transport services) do not constitute subcontracted processing within the meaning of the above provisions of this DPA. Nevertheless, the Processor must ensure, e.g., by means of contractual agreements or notices and instructions, that the security of the data is not jeopardised and that the requirements of this DPA and the data protection regulations are complied with.

Section 11 | Processing in third countries

11.1 | The provision of the contractually agreed data processing shall take place exclusively in a member state of the European Union or in another contracting state of the Agreement on the European Economic Area (EEA).

11.2 | Data processing in a third country, including by sub-processors, requires the prior authorisation (see 10.4 and 10.5 of this agreement) of the Controller and may only take place if the special requirements of Art. 44 et seq. GDPR are met.

11.3 | The Controller’s consent to processing in the third country shall be deemed to have been granted with regard to Sub-processors named in Annex 2 “Sub-processors”.

Section 12 | Duration of the agreement, termination of the agreement, and data deletion

12.1 | This DPA shall take effect upon its conclusion, shall be concluded for an indefinite period of time, and shall expire with the term of the Main Agreement at the latest.

12.2 | The Contracting Parties reserve the right to extraordinary termination, in particular, in the event of a serious breach of the provisions of this DPA and applicable data protection law.

12.3 | After completion of the provision of the processing services under this DPA, the Processor shall either delete or return all personal data and copies thereof (as well as all documents, processing, and utilisation results created and data files that have come into their possession in connection with the contractual relationship) at the discretion of the Controller, unless there is an obligation to store the personal data under Union law or the law of the Member States (Article 28 (1) S. 2 lit. g GDPR). The defence of a right of retention is excluded with regard to the processed data and the associated data carriers. With regard to deletion or return, the Controller’s rights to information, proof, and control apply in accordance with this DPA. The Processor shall confirm the deletion or destruction accordingly at the Controller’s request.

12.4 | The obligation to maintain confidentiality with regard to data processed within the scope of the order shall continue to exist after termination of this contractual relationship.

12.5 | If the deletion or return of the data goes beyond the mandatory legal obligations of the Controller pursuant to Art. 28 (3) GDPR, the Controller shall reimburse the Processor separately for the additional expense incurred in accordance with the provisions of Section 13.

Section 13 | Remuneration

13.1 | Support services arising from mandatory legal obligations of the Controller pursuant to Art. 28 (3) GDPR shall be provided by the Processor without additional remuneration. Separate remuneration shall only be paid for services that go beyond legal requirements. Remuneration shall be paid in accordance with the remuneration provisions in the main contract. The actual additional expenditure shall be fully documented by time recording and receipts.

13.2 | The amount of the remuneration shall be determined in accordance with the Main Contract. If the Main Contract does not contain any remuneration regulations relevant for the DPA or correspondingly applicable rates for services, the Processor’s usual rates shall apply or, if these cannot be determined, the rates customary in the industry.

Section 14 | Liability

The statutory provisions pursuant to Art. 82 GDPR apply.

Section 15 | Final provisions, order of precedence, amendments, form of communication, choice of law, place of jurisdiction

15.1 | Amendments, subsidiary agreements and supplements to this DPA and its annexes require a written agreement and an express reference to the fact that they constitute an amendment or supplement to this DPA. This also applies to any waiver of this formal requirement.

15.2 | This DPA only obliges the Processor to the extent that this is necessary for the fulfilment of the statutory obligations, in particular, pursuant to Art. 28 et seq. GDPR and does not impose any further obligations on the Processor.

15.3 | The law of the Federal Republic of Germany shall apply, with the exception of its provisions on the choice of law, which would lead to the application of a different legal system. The applicability of the CISG (‘UN Convention on Contracts for the International Sale of Goods’) is excluded.

15.4 | The exclusive place of jurisdiction for all disputes arising from or in connection with this DPA is the registered office of the Processor. The Processor is also entitled to bring legal action at the registered office of the other party or at any other competent court.

Annex 1 – Security concept | Technical and organisational measures according to Art. 32 GDPR

1. Access control

Unauthorized access must be prevented, whereby the term is to be understood in a spatial sense.

• All entrances to the buildings are equipped with electronic or analogue access restrictions. The necessary access media (key, chip) are only issued to authorised persons (employees, carefully selected cleaning staff) and both issue and entry are documented in a traceable manner.
• There is no server room, as only SaaS services are used for data processing. The security regulations of the service providers have been checked.
• There are regulations for dealing with visitors, who are not allowed to move around the offices unsupervised and only in the company of employees.
• Sensitive data is kept separately and in locked cabinets.

2. Virtual access control

Unauthorized access to or use of IT systems and data outside of granted permissions must be prevented.

• The distribution and collection of company-owned hardware is documented. External data carriers are not accepted. Personal data may not be copied to removable media, except to media that has been expressly approved by the employer for specific tasks.
• There is a role-based authorisation system that is based on the need-to-know principle.
• Access to hardware and software components is secured by individual user passwords. User passwords are assigned and stored in accordance with guidelines that comply with industry-standard security standards. Failed login attempts and screen locks prevent unauthorized access.
• In addition to the general handling of personal data at the workplace, a clean desk policy regulates manual as well as automatic and password-protected screen locks.
• Both the computers and the SaaS software used always have up-to-date anti-virus software and firewalls to protect against unauthorised intrusion from outside. In addition, there are general intrusion detection systems.
• Data carriers are destroyed in accordance with DIN 66399 if necessary. An order processing contract has been concluded with the external data destruction company.
• The number of administrators is limited to what is necessary.
• Data protection through technology design and through data protection-friendly default settings.
• The principles of privacy by design and by default are taken into account to an appropriate extent in all processes and processing.

3. Input control

The traceability and documentation of data management and maintenance must be ensured.

• User activities, system activities and administrator activities are logged.
• New programmes are subjected to a malware check by IT. The external IT (DPA is available) is also responsible for setting up and maintaining all devices. In addition, all end devices and storage media are centrally managed through them.
• Maintenance and repair activities are documented, and data backups are made beforehand in the case of major work.
• Differentiated role-based user authorisations define different rights such as reading, editing and deleting.

4. Order control

It must be ensured that data processed on behalf of the Controller by service providers (subcontractors) is processed only in accordance with the instructions of the Controller.

• Data processing agreements are concluded, both in the role as controller and as processor.
• Before a service provider is commissioned, its suitability from a data protection point of view is checked. Even after the contract has been concluded, regular checks are carried out on the order processing.
• There is an overview of all data processing agreements.
• It is ensured that data is only processed on the basis of documented instructions. Similarly, the proper destruction or return of data after termination of the contract is carried out in coordination with the Controller.
• Current changes in data protection law relevant in the context of order processing are taken into account appropriately (e.g. discontinuation of adequacy decisions).

5. Data separation control

Data collected for different purposes must also be processed separately.

• Conducting of a logical client separation (on the software side).
• Data is separated according to different clients and also according to purpose.
• There is a strict separation of productive and test systems.

6. Data transfer control

Aspects of the transfer (transmission) of personal data must be regulated: electronic transmission, data transport, and their control.

• Wi-Fi connections within the network infrastructure operated by the Processor are secured in accordance with the state of the art. To this end, up-to-date and appropriate security standards, in particular WPA2-Enterprise or WPA3-Enterprise, are used.
• When using external networks, communication with the applications in use is secured by appropriate encryption methods, in particular TLS/HTTPS.
• In the case of physical data transmissions, corresponding documentation of the recipients is carried out through delivery notes, etc.
• Both data carriers and data connections are encrypted.
• Before reusing written data carriers, the previous data is deleted. Data carriers that are no longer needed are securely destroyed.

7. Availability and resilience

The data must be protected against accidental destruction or loss.

• There is an emergency concept for data protection violations (both for the position of processor and controller). Corresponding reporting channels are in place.
• Available software and firmware updates are activated promptly and regularly.
• In the event of IT system malfunctions, the administrators are automatically notified.
• Data backup and security concepts, as well as their implementation, are managed by the SaaS providers.

8. Control procedures and organisational control

A procedure for regularly reviewing, assessing, and evaluating the effectiveness of data security measures must be implemented.

• All employees are committed to confidentiality under data protection law and complete regular training courses on data protection law.
• Internal records of processing activities are updated at least annually and new/changed data processing activities will be reported to the persons responsible for data protection and information security.
• A procedure for risk assessment of, for example, data protection impact assessments or transfer impact assessments (TIA) is in place.
• Furthermore, there are additional data protection agreements and existing data protection guidelines. This also includes guidelines on the protection of data subjects’ rights or on how to deal with data protection violations, including reporting channels.
• The effectiveness of the technical and organisational measures is regularly reviewed as part of data protection management.

Annex 2 – Sub-processors

These Sub-processors are engaged by the Processor to fulfil the main contract/orders:

Sub-processors used permanently or occasionally* within the scope of the data processing (SaaS applications & data hosting):