Data Processing Agreement (DPA)

Data Processing Agreement pursuant to Art. 28 GDPR

between

the company named in the electronic acceptance form (“Customer”, controller)

and

MKBurg Process Experiences GmbH, Fahrenkrön 122a, 22179 Hamburg, Germany, represented by its managing director Mirko Kloppenburg, Local Court of Hamburg, HRB 185292 (“Provider”, processor)

Together the “Parties”.

Preamble

The Customer uses the software-as-a-service solution RocketBPM (app.rocketbpm.com) provided by the Provider to model, publish and maintain processes. In doing so, the Provider processes personal data on behalf of the Customer. This Agreement sets out the Parties’ rights and obligations. It supplements the main agreement on the use of RocketBPM (general terms and conditions or individual agreement, the “Main Agreement”).

§ 1 Subject matter and term

(1) The subject matter is the processing of personal data by the Provider in the course of providing and operating RocketBPM for the Customer.

(2) This Agreement applies from acceptance in the electronic form. It ends with the Main Agreement. Obligations which by their nature continue (in particular confidentiality, deletion, evidence) remain in force.

§ 2 Nature, purpose, data and data subjects

(1) Nature, purpose, types of data and data subjects are set out in Annex 1.

(2) The Provider processes personal data solely to perform the agreed services and not for its own purposes, except as provided in paragraph 4.

(3) Special categories of personal data (Art. 9 GDPR) and data relating to criminal offences (Art. 10 GDPR) are not covered. The Customer must not enter such data into RocketBPM, including in free text, ratings or descriptions.

(4) Delimitation: For user account master data (name, email address, language setting, newsletter choice) the Provider also uses the data on its own responsibility to support users and customers and, with the person’s consent, for the newsletter. The Provider is a controller for this. Details are in the RocketBPM privacy notice. The Provider does not use the remaining data (in particular content in Process Worlds) for this.

(5) The Customer remains responsible for the lawfulness of the processing, in particular for the legal basis, for informing data subjects and, where required, for involving works councils or staff representatives. This applies especially to role assignments, teams, qualifications and contact data of employees.

§ 3 Instructions

(1) The Provider processes the data only on documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law. In that case, it informs the Customer of the legal requirement before processing unless the law prohibits this.

(2) The Main Agreement, this Agreement and the use of RocketBPM functions by the Customer and its users are the instructions. The Customer gives additional individual instructions in text form (email suffices) to info@mkburg.de.

(3) The Provider informs the Customer without delay if it considers an instruction to infringe data protection law. It may suspend execution until the Customer confirms or changes the instruction.

§ 4 Provider’s obligations

(1) Confidentiality: The Provider only uses persons who are bound to confidentiality or subject to a statutory duty of secrecy. This also applies to persons of the sub-processor.

(2) Data protection contact: The Provider’s contact for data protection matters is Mirko Kloppenburg, info@mkburg.de.

(3) Records: The Provider keeps a record of processing activities carried out on behalf of a controller (Art. 30(2) GDPR).

(4) Cooperation: The Provider cooperates with supervisory authorities and informs the Customer of inspections or measures insofar as they concern this processing.

§ 5 Technical and organisational measures

(1) The Provider implements the measures described in Annex 2 to ensure security of processing (Art. 32 GDPR).

(2) The measures evolve with the state of the art. The Provider may change them if the level of protection does not decrease. It informs the Customer of material changes on request.

§ 6 Sub-processing

(1) The Customer gives general authorisation for the sub-processors listed in Annex 3.

(2) The Provider informs the Customer in text form at least 30 days in advance of any intended addition or replacement. Within that period, the Customer may object for an important data protection reason. If the Parties cannot agree, the Customer may terminate the Main Agreement for cause as of the date of the change without incurring costs.

(3) The Provider binds each sub-processor to the same data protection obligations as in this Agreement and is liable to the Customer for the sub-processor’s performance.

§ 7 Third-country transfers

(1) Processing takes place in principle in the European Union. Exceptions are access by sub-processors in third countries listed in Annex 3.

(2) A transfer to a third country takes place only if Art. 44 et seq. GDPR are met, in particular through an adequacy decision or the European Commission’s standard contractual clauses (Module 3, processor to processor) with appropriate supplementary measures.

(3) If the Customer itself is located in a third country, the standard contractual clauses under paragraph 2 apply only as between the Provider and the sub-processor.

§ 8 Assistance to the Customer

(1) The Provider assists the Customer with appropriate measures in fulfilling data subject rights (Art. 12 to 22 GDPR). It forwards data subject requests to the Customer without delay and does not respond itself unless agreed otherwise.

(2) It also assists with security of processing, personal data breach notifications, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR) to the extent the information is available to the Provider.

§ 9 Personal data breaches

The Provider notifies the Customer of a personal data breach in this assignment without undue delay and no later than 48 hours after becoming aware, at the contact address named in the acceptance form. The notification contains, as far as known: nature of the breach, categories and approximate number of data subjects and data records, likely consequences, and measures taken or proposed.

§ 10 Evidence and audits

(1) The Provider makes available to the Customer all information necessary to demonstrate compliance with this Agreement.

(2) The Customer may carry out audits or have them carried out by an auditor bound to confidentiality. It announces them at least 30 days in advance, conducts them during normal business hours without significant disruption, at most once a year unless there is a specific reason such as a data breach.

(3) The Provider may first satisfy the Customer with current evidence (for example certificates, audit reports, description of measures) if it covers the audit objectives. The Customer bears its own costs; the Provider may charge reasonable compensation for significant additional effort.

§ 11 Return and deletion

(1) After the Agreement ends, the Provider returns the data on request in a common, machine-readable format, insofar as RocketBPM offers an export. The request must be made within 30 days after the end of the Agreement.

(2) After that, the Provider deletes the Customer’s data from the production systems and confirms this in text form on request. Data in backups is overwritten no later than 90 days later.

(3) Statutory retention obligations remain unaffected. They apply only to data for which the Provider is itself the controller (billing, § 2(4)). Logs (audit and activity logs) are deleted after 12 months.

§ 12 Liability

Liability is governed by Art. 82 GDPR and, as between the Parties, by the liability rules of the Main Agreement.

§ 13 Remuneration

No separate remuneration is payable for performing this Agreement. For assistance beyond the usual scope (e.g. individual audits under § 10(2), exceptional access or deletion requests), the Provider may charge reasonable remuneration based on effort.

§ 14 Final provisions

(1) Form: This Agreement is concluded electronically when the Customer’s authorised representative confirms it in the acceptance form and the Provider confirms acceptance (Art. 28(9) GDPR). Amendments and additions require text form.

(2) Precedence: In case of conflict on data protection matters this Agreement prevails over the Main Agreement.

(3) Governing law and jurisdiction: German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Jurisdiction is Hamburg, where permitted.

(4) Severability: If a provision is invalid, the rest remains effective. The Parties replace the invalid provision with a valid one that comes closest to its purpose.

(5) Language: The Agreement exists in German and English. In case of discrepancy the German version prevails.

Annex 1 – Subject matter of processing

Annex 2 – Technical and organisational measures

Annex 3 – Sub-processors

Addition: Sign-in with Google or Microsoft and embedding of YouTube occur only at the user’s initiative. The providers are then independent controllers and not sub-processors.