Data Processing Agreement (DPA)

Last updated: December 9, 2024

between

the Customer, defined in the specific order confirmation

- hereinafter referred to as "Controller" -

and

All Quiet GmbH, Blumenstr. 45, 10243 Berlin, Germany

- hereinafter referred to as the "Processor" -

- hereinafter referred to individually and collectively as „Party“ and/or „Parties“ -

§ 1 Definition of Terms

(1) For the purposes of this Data Processing Agreement, the following definitions apply:

(a) The “Processor”: the contractual party referred to as "Processor" in the above.

(b) “Main Agreement” refers to the Service Level or Cooperation Agreement designated in detail in § 2.

(c) The “Controller”: the contractual Party referred to above as the “Controller” that bears the sole responsibility for making decisions regarding the purposes and means for Processing Personal Data under this Agreement.

(d) “Additional Processor or Sub-Processor” is the contractual partner of the Processor, engaged to carry out specific processing activities on behalf of the Controller;

(2) In any other case, the definitions pursuant to Art. 4 GDPR shall apply.

§ 2 Subject matter of the Agreement; legal basis

This Agreement governs the collection and processing of personal data (hereinafter referred to as "Data") by the Processor for and on behalf of the Controller, according to the Controller's instructions, in connection with the terms of service of the "All Quiet Platform" and serves to supplement the agreement concluded by the parties (hereinafter referred to as "Main Agreement").

§ 3 Rights and obligations of the Controller

(1) The following shall arise from the main contract: the subject and duration of the assignment, the nature and purpose of the processing, the type of personal data and the categories of data subjects in connection with Annex 1.

(2) In relation to the Processor, the Controller is solely responsible for assessing whether Data can be processed lawfully and for safeguarding the rights of the data subjects.

(3) The Controller has the right to issue instructions on the type, scope, and methods of data processing. All instructions shall be issued in writing or by e-mail. If, in exceptional cases, instructions are given by telephone, they must then be confirmed by e-mail.

(4) The Controller may check the Processor's compliance with the Legal Provisions and this Agreement at any time and without undue delay, even at the Processor's premises, in particular by obtaining information and viewing the stored Data and the data processing programs on the Processor's premises. The Controller may perform the checks himself at his own expense or have them performed by a contracted independent, qualified third party who is obligated to maintain secrecy. The Controller shall announce checks to be carried out at the Processor within a reasonable period of time, perform the checks during normal business hours only, and take due care during their performance not to disturb the Processor's business operations and operational workflows. However, this does not apply in the case of a specific suspicion of abuse.

§ 4 Rights and obligations of the Processor

(1) The Processor processes the data in accordance with the law, the provisions of this contract and the instructions of the Controller. If the Processor is prevented by law from processing the data in accordance with this contract and the instructions of the Controller, it shall inform the Controller prior to processing, unless law prohibits such information. The Processor may not use the data for any other purpose and is in particular not entitled to pass on the data provided to him to third parties.

The data Processor will inform the data Controller immediately if instructions given by the data Controller, in the opinion of the data Processor, infringe the GDPR or the applicable Union or Member State data protection provisions.

(2) Any transfer of data to a third country or an international organisation by the data Processor shall be undertaken only because of documented instructions from the data Controller. With regard to the engagement of subcontractors the provisions in § 7 apply.

(3) The Processor shall support the Controller if necessary; in particular, in data protection audits by the supervisory authorities, insofar as these audits concern data processing in accordance with this Agreement.

(4) The Processor is obliged to assist the Controller in accordance with its instructions when the Controller fulfills his obligations towards data subjects exercising their rights under the law (e.g. right of access, rectification).

If a data subject addresses the Processor directly, the Processor shall not disclose any information, but rather refer the data subject to the Controller. The Processor shall inform the Controller accordingly.

(5) The Processor shall support the Controller in the performance of its other legal duties in accordance with Art. 32-36 GDPR where these are associated with the data processing under this contract. In particular, these include:

(a) reporting and/or documentation duties in accordance with the Legal Provisions;

(b) provision of information on the processing of data to government authorities and individuals;

(c) Information on data protection violations. The Processor is aware that the Controller is obliged to inform the supervisory authorities immediately of any data protection violations.

(6) The Processor will immediately notify the Controller of all communications from the supervisory authorities (e.g., inquiries, notification of measures or requirements) to the Processor in connection with the processing of Data under this Agreement. Subject to mandatory statutory requirements, the Processor shall only provide information to third parties, including supervisory authorities, with the prior consent of and in consultation with the Controller (in writing or by e-mail).

(7) The data Processor shall make available to the data Controller all information necessary to demonstrate compliance with the obligations set out in these Clauses and that are stemming directly from the GDPR.

(8) After completion of the commissioned work and after notification within a reasonable period of time the Processor shall delete the personal data or destroy data carriers with personal data in such a way that it is not possible to restore the data or only at unreasonable expense, and shall confirm this to the Controller. The Processor will delete all existing copies.

Deviations from the above obligations to delete or return data will only be considered if legal regulations require the storage of personal data.

(9) Unless explicitly agreed otherwise, support services provided by the Processor under this Agreement shall be remunerated according to agreed, otherwise regular per hour rate.

§ 5 Appropriate technical and organisational measures

(1) The Processor shall ensure that the Controller's Data is processed exclusively in compliance with the technical and organizational measures required in accordance with the Legal Provisions and this Agreement. The measures currently required are described in Annex 2.

(2) The Processor will inform the Controller on any substantial security-related decisions on the organization of data processing and the applied procedures.

§ 6 Confidentiality

The Processor guarantees that only persons who have first been bound by confidentiality or are subject to an appropriate legal obligation to secrecy are authorized to process the personal data. The Processor shall ensure that persons entrusted with the data processing are familiar with the specifications and instructions in this Agreement in advance.

§ 7 Sub-Processors

(1) The Processer may assign other Processors ("Sub-Processors"). The Processor shall inform the Controller in writing or by e-mail of any intended order and/or change in respect of the inclusion or change of a Sub-Processor in advance. It may proceed as suggested if the Controller raises no objection within one week from receipt of the information.

(2) The Processor ensures that the Sub-Processor is obligated toward the Processor in the same manner that the Processor is obligated toward the Controller under this Agreement.

(3) The Processor shall review the Sub-Processor's compliance with the Sub-Processor's obligations, in particular compliance with the agreed technical and organizational measures, before the start of data processing and regularly thereafter. Replacement of these reviews based on approved rules of conduct or an approved certification procedure with regard to the subcontracted Processor is permitted.

(4) The companies listed in Annex 3 are deemed to be approved by the Controller. The Parties shall keep Annex 3 up to date.

(5) The use of sub-sub-contractors is permissible provided that the above requirements are met.

§ 8 Term and Termination of the Agreement

This Agreement shall be valid for the duration of the actual provision of services by the Processor. This shall apply regardless of the terms of any other agreements (in particular, the Main Agreement) that the Parties have concluded regarding the provision of the agreed services.

§ 9 Liability

(1) Any limitations of liability under the main contract shall apply. The Controller shall indemnify the Processor against all claims brought by third parties against the Processor for infringement of their rights on the basis of the processing of personal data under this contract, unless the claim of the third party is based on unlawful processing of the personal data by the Processor.

(2) The Processor is liable for any fault on the part of its Sub-Processor and Sub-Sub-Processors as if the Processor itself were at fault.

§ 10 Miscellaneous

(1) The invalidity of a provision of this Agreement shall not affect the validity of the remaining provisions. If a provision proves to be invalid, the Parties shall replace it with a new provision that approximates the intentions of the Parties as closely as possible.

(2) Any changes to this Agreement and any side agreements shall be made in writing (including by e-mail). This shall also apply to the waiver of this written form clause itself.

(3) The General Terms and Conditions of the Controller shall not apply to this Agreement.

(4) The sole place of jurisdiction for this contract is that of the main contract. This shall apply notwithstanding any exclusive statutory jurisdiction.

(5) In the event of any contradictions between the provisions of this Agreement and provisions of any other agreements, and in particular of the Main Agreement, the provisions of this CDP Agreement shall take precedence. In all other respects, the provisions of the Main Agreement shall remain unaffected and shall apply accordingly to this Agreement.

Annexes

The following Annexes are integral parts of this Agreement:

Annex 1: Details about data processing

Annex 2: Technical and organizational measures

Annex 3: List of the assigned Sub-Processors

Annex 1

Details about data processing

1. Data-to-be-processed/Data-affected; Type of access; services

a. Categories of data subjects

• Employees
• Customers

b. Possibly affected personal data (if sent in a payload):

• Surname/First name
• Address
• Contact details (e.g. telephone, e-mail)
• Inventory data (e.g. billing address, contract number)
• Traffic data (e.g. connection identification, location data, beginning/end of a telephone connection)
• Contract master data
• Personnel master data
• Customer history
• Profession

2. Services, purpose of the Processing:

The object of the data processing as well as the type and purpose is described in the main contract.

3. Processing location

The processing of the data by the Provider takes place at the following locations: Germany

Annex 2

Technical and organizational security measures pursuant to Article 32 GDPR

Annex 3

List of the assigned Sub-Processors

The following sub-processors may be user under the agreements:

Contact Us

If you have any questions about this Data Processing Agreement, You can contact us:

• By email: support@allquiet.app