Data Processing Agreement (Art. 28 GDPR)

1. Parties and Conclusion

1. This Data Processing Agreement ("DPA") is concluded between the Team Owner within the meaning of section 5 of the T&Cs ("Controller") and Alec Winter, Blumenau 89, 22089 Hamburg, Germany ("Processor").
2. The DPA forms part of the contract for the Team plan and is concluded when the Team plan is booked. It is concluded in electronic form (Art. 28 (9) GDPR).
3. In the event of conflicts, this DPA takes precedence over the T&Cs with regard to data protection.

2. Subject Matter and Duration

1. The Processor processes personal data on behalf of the Controller in order to provide the Team plan: creating, storing, and publishing digital business cards about the Controller's team members, a company page, and team analytics.
2. The DPA applies for as long as the Processor processes personal data for the Controller under the Team plan, and ends with the deletion of that data.

3. Nature and Purpose of Processing

Storage, organization, publication on the internet under the addresses chosen by the Controller, aggregation of visitor statistics, and deletion of personal data, in each case solely for providing the Team plan.

4. Types of Personal Data

• Contact details (name, title, phone number, email address, website)
• Address data, if the Controller adds it to a card
• Further personal information the Controller adds to a card (for example languages, biography, social media links)
• Profile pictures and card images
• Access codes of private cards
• Visitor statistics of the cards (country, device type, browser type, time of access; no IP addresses)

5. Categories of Data Subjects

• Employees, colleagues, members, and other persons the Controller presents on cards
• Visitors of these cards and of the company page (only through the visitor statistics)

6. Instructions

1. The Processor processes the data only on documented instructions from the Controller, unless Union or Member State law requires otherwise; in that case the Processor informs the Controller before processing, unless the law prohibits such information.
2. The Controller gives instructions primarily by using the Platform's functions (for example creating, editing, publishing, or deleting cards). Further instructions are given in text form to contact@helllo.me.
3. The Processor informs the Controller without delay if it considers that an instruction infringes data protection law.

7. Confidentiality

The Processor ensures that persons authorized to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

8. Technical and Organizational Measures

The Processor implements appropriate technical and organizational measures under Art. 32 GDPR, in particular:

• Encrypted data transmission (TLS)
• Primary database and image storage in the EU project region Stockholm
• Sign-in by magic link or Google; no passwords stored
• Application-level authorization with every query restricted to the account holder's data, plus deny-by-default row-level security for direct database roles
• Administrative access limited to the Processor; secrets and service keys are never exposed to browsers
• Rate limiting against brute-force attempts on private cards
• Server-side validation of uploaded files (type, signature, size)
• Regular security updates and backups by the hosting providers

The measures are adapted to technical progress; the level of protection must not fall below the measures described here.

9. Sub-processors

1. The Controller gives general authorization for the use of the following sub-processors:
   • Vercel Inc. (USA): hosting and delivery; EU-U.S. Data Privacy Framework and Standard Contractual Clauses
   • Supabase Inc. (USA): database and image storage, project region Stockholm (AWS)
   • Brevo (Sendinblue, France): transactional emails to the Controller
2. The Processor informs the Controller of any intended addition or replacement of sub-processors at least 30 days in advance by email. The Controller may object for important data protection reasons; if no agreement is reached, the Controller may terminate the Team plan at the time the change takes effect.
3. The Processor imposes data protection obligations on sub-processors that are equivalent to this DPA.
4. Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or Standard Contractual Clauses.

10. Support for the Controller

1. The Processor supports the Controller with appropriate measures in responding to requests from data subjects (Art. 12 to 23 GDPR). Requests that data subjects send to the Processor are forwarded to the Controller without delay.
2. The Processor supports the Controller in complying with the obligations under Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to it.

11. Personal Data Breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning the Controller's data and provides the information the Controller needs for its own notification under Art. 33 and 34 GDPR.

12. Deletion and Return

1. The Controller can view, edit, and delete all card data in the dashboard at any time.
2. When the Controller deletes cards, the organization, or the account, the Processor deletes the corresponding data, subject to backup cycles of the hosting providers and statutory retention obligations.
3. Visitor statistics are deleted together with the card or the account.

13. Information and Audits

1. The Processor provides the Controller with the information necessary to demonstrate compliance with Art. 28 GDPR, primarily by providing documentation and written answers.
2. On-site audits are possible after reasonable advance notice, during normal business hours, at most once per calendar year, and at the Controller's expense, unless there are specific indications of a breach.

14. Final Provisions

1. Liability is governed by Art. 82 GDPR and the liability provisions of the T&Cs.
2. Amendments to this DPA require text form.
3. German law applies. The place of jurisdiction is determined by the T&Cs.

---

Contact: Alec Winter, Blumenau 89, 22089 Hamburg, Germany · contact@helllo.me