Data Processing Agreement (DPA)

§ 1 Subject Matter and Contractual Relationship

(1) This DPA supplements the main contract concluded between the parties for the use of the platform (see Terms & Conditions) with respect to the processing of personal data. In the event of conflicts between this DPA and the main contract, this DPA prevails on data protection matters.

(2) "Controller" within the meaning of this DPA is the Customer named in the main contract. "Processor" is the Provider named in the main contract (Tobias Boehm Softwareentwicklung).

(3) The parties conclude this DPA before processing begins. It is concluded upon the Controller’s consent at registration; if the Controller did not consent there or a new version applies, upon its consent before further use of the platform. It becomes part of the main contract as an annex.

§ 2 Definitions

The definitions set out in Art. 4 GDPR apply, in particular for "personal data", "processing", "controller", "processor", "data subject", "supervisory authority", and "personal data breach". In addition: "Platform" means the SaaS offering Begehung.pro described in the main contract; "Subprocessor" means any further processor within the meaning of Art. 28 paragraph 4 GDPR; "TOM" means technical and organizational measures within the meaning of Art. 32 GDPR.

§ 3 Subject, Duration, Nature and Purpose of Processing

(1) Subject matter: The provision of the SaaS services agreed in the main contract, in particular capturing, storing, and evaluating inspection data, creating and sending reports and protocols, access for external persons via link pages, and the AI functions under paragraph 4.

(2) Duration: Processing takes place for the term of the main contract plus the period for data return and deletion pursuant to § 11.

(3) Nature of processing: collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, making available, alignment or combination, restriction, erasure, and destruction.

(4) Purpose: Digital performance and documentation of inspections via the web app and mobile app; creation of reports and their conversion from Word to PDF; conversion and transcription of audio recordings; sending protocols, reports, and tasks to third parties by email; access for external persons via link pages (feedback on actions, coordination of a draft); data export; delivery of notifications to the app as push notifications; the AI functions checklist import, report import, comment suggestion, action suggestion, and audio transcription; error diagnostics; each in accordance with the main contract.

(5) Categories of personal data: Master data of the Controller’s employees (name, function, contact details, profile picture); inspection content (findings, actions with responsible person and deadline, notes, comments, attendees); photos with their metadata, including capture time and, where contained in the file, location coordinates (GPS) and bearing; audio files uploaded in the web app and their transcripts; handwritten signatures; uploaded import documents (checklists, earlier reports) including the photos they contain; contact details of third parties; email recipients with delivery status; feedback from external persons via the link pages (remark, proof photo, posts on a draft, signature); the content displayed in the session replay and in the screenshot of an error report of the error diagnostics.

(6) Categories of data subjects: Employees of the Controller; employees of contractors or third-party companies; visitors, tenants, and other persons present on the inspected properties; contacts of the Controller’s customers; recipients of protocols and reports; external persons responsible for actions; signatories.

(7) The Processor processes special categories of personal data pursuant to Art. 9 GDPR (for example health data in accident documentation) only insofar as the Controller enters them into the platform, and only on its behalf. If content sent to an AI function under paragraph 4 contains such data, Google Vertex AI processes it for that purpose; this also applies to audio transcription, which runs automatically after each audio file is uploaded. No further AI processing takes place. The protective measures are set out in Annex 2.

§ 4 Controller's Right to Issue Instructions

(1) The Processor processes personal data exclusively on documented instructions of the Controller, including with regard to transfers to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The initial instruction is the processing in accordance with the main contract and § 3 of this DPA.

(3) Subsequent individual instructions must be issued in text form (an email to datenschutz@begehung.pro is sufficient). Oral instructions must be confirmed in text form without undue delay.

(4) If the Processor considers an instruction to be unlawful, it shall inform the Controller without undue delay; pending clarification, it may suspend the processing in question.

(5) The Processor uses AI methods exclusively as a tool for providing the service commissioned by the Controller. Any further use of the data, in particular for training, fine-tuning, or permanently improving its own or third-party AI models, does not take place.

§ 5 Subcontractors (Subprocessors)

(1) The Controller generally consents to the engagement of further processors (subprocessors) in accordance with Art. 28 paragraph 2 sentence 2 GDPR.

(2) The current list of engaged subprocessors is available via this overview and forms part of this DPA as Annex 1. The sub-subprocessors of the subprocessors named there can be viewed via the lists linked in the overview, where the subprocessor publishes such a list.

(3) The Processor announces intended changes to the subprocessors to the Controller by email to the address of the customer account, at least four weeks before they are engaged. If an existing subprocessor engages a further sub-subprocessor, the Processor informs the Controller without undue delay after becoming aware of it. The Controller may object to the change in text form within four weeks of receipt of the notice for a legitimate reason, in particular data protection concerns.

(4) In the event of a justified objection, the Processor does not engage the subprocessor in question for the Controller’s data. If this is not reasonable for the Processor, either party is entitled to terminate the main contract for cause as of the effective date of the change; if the change is already effective at the time of the objection (paragraph 3 sentence 2), with immediate effect.

(5) Before engaging a subprocessor, the Processor concludes a data processing agreement with it that imposes data protection obligations equivalent to those set out in this DPA. On request, the Processor provides the Controller with a copy of this agreement; it may redact business secrets and other confidential information. The Apple Push Notification service is excepted: Apple does not offer a data processing agreement for it; the Apple terms named in Annex 1 apply. The Processor is liable for the conduct of its subprocessors as for its own (Art. 28 paragraph 4 sentence 2 GDPR).

(6) If the Processor becomes aware of a breach of data protection obligations by a subprocessor affecting the Controller’s data, it informs the Controller without undue delay.

(7) Pure telecommunications, postal, and logistics services as well as other ancillary services that do not serve the actual data processing are not subprocessors within the meaning of this DPA.

§ 6 Confidentiality

(1) The Processor binds all persons involved in the processing in writing to confidentiality, unless they are already subject to an appropriate statutory duty of confidentiality.

(2) The confidentiality obligation continues to apply beyond the end of the employment or working relationship.

(3) Upon request of the Controller, the Processor demonstrates the existence of these obligations in a suitable form, e.g., by submitting a sample declaration.

§ 7 Technical and Organizational Measures

(1) The Processor implements the technical and organizational measures (TOMs) described in Annex 2 and keeps them up to the state of the art.

(2) The Processor will notify the Controller in good time, in text form, of material changes to the TOM that might reduce the level of protection.

(3) The TOMs pursue the protection goals under Art. 32 GDPR: confidentiality, integrity, availability, and resilience of the systems, the ability to restore them quickly, and a process for regular review.

§ 8 Assistance to the Controller

(1) The Processor forwards requests from data subjects (Art. 15 to 22 GDPR) to the Controller without undue delay and does not respond to them on its own authority.

(2) The Processor supports the Controller in fulfilling its obligations under Art. 12 to 22 GDPR through suitable technical and organizational measures, insofar as this is possible within the scope of the processing on behalf.

(3) The Processor further supports the Controller in carrying out data protection impact assessments (Art. 35 GDPR) and, where applicable, in prior consultations with the supervisory authority (Art. 36 GDPR), by providing the necessary information on the TOM and the engaged subprocessors.

(4) Insofar as the support effort goes beyond the provision of standard information, the Processor is entitled to charge reasonable remuneration based on time and effort; the Processor will inform the Controller in advance of activities likely to be subject to remuneration.

§ 9 Notification of Personal Data Breaches

(1) Upon becoming aware of a personal data breach within the meaning of Art. 4 No. 12 GDPR, the Processor will inform the Controller without undue delay – at the latest within 24 hours of becoming aware – in text form.

(2) The notification contains the information required by Art. 33 paragraph 3 GDPR (description of the incident, affected categories of data, likely consequences, measures taken and planned), to the extent available at the time of notification. Further findings are reported subsequently without undue delay.

(3) The obligation to notify the supervisory authority pursuant to Art. 33 paragraph 1 GDPR and to inform data subjects pursuant to Art. 34 GDPR rests with the Controller; the Processor supports by providing all information required for this purpose.

§ 10 Inspection and Audit Rights

(1) The Controller may verify the Processor's compliance with its contractual and statutory obligations.

(2) The primary means of evidence is an annually updated self-assessment by the Processor describing the TOM and, where available, certificates or audit reports from independent auditors (e.g., ISO 27001, BSI C5, SOC 2).

(3) An on-site inspection is permissible if the evidence under paragraph 2 is insufficient. It must be announced with at least 30 days’ notice; in the event of a personal data breach or on the order of a supervisory authority, an appropriate shorter period suffices. The inspection is carried out by the Controller itself or by an auditor commissioned by it and bound to confidentiality. The Processor may reject an auditor only for good cause, for example if the auditor is a competitor of the Processor. The inspection must take due account of the Processor’s business operations, business secrets, and the data of other customers.

(4) The Processor bears the costs of the initial self-assessment. The Controller bears the costs of additional audits unless a material breach by the Processor is confirmed.

(5) The powers of the competent supervisory authority remain unaffected. The Processor cooperates with it, provides it with the necessary information on request, and informs the Controller without undue delay of inspections and measures by the supervisory authority insofar as they concern the processing for the Controller.

§ 11 Return and Deletion of Data

(1) After the processing has ended, the Controller has the choice between return or deletion of the personal data (Art. 28 paragraph 3 lit. g GDPR).

(2) Return and erasure are subject to the periods in § 10 of the T&C: the Controller can retrieve the data until the retrieval period expires (90 days from the end of the contract, but not before the end of a transitional period under § 8 paragraphs 7 and 8 of the T&C; extended upon request). The Processor then blocks access and, subject to § 10 paragraph 4 of the T&C, erases the data no later than seven days after the block, without the need for an express choice; for the trial run, the retrieval period is governed by § 2 paragraph 4 (a) and (c) of the T&C. Exempt are the fingerprint of the email addresses and the record of acceptance of the T&C and the DPA under § 10 paragraph 4 of the T&C; the Provider thereafter processes them under its own responsibility for the purposes and periods stated there. If the Controller has requested erasure under § 8 paragraph 7 (c) of the T&C, the Processor erases the data upon the end of the contract.

(3) Return takes place in a standardized, machine-readable format: as a ZIP archive containing XML data with its schema, PDF files, and the stored files; scope and exemptions are governed by § 10 of the T&C. During the term of the contract, the Controller can retrieve the return itself at any time in the profile of the web app. The Processor charges no fee for return, porting, or erasure.

(4) Upon request, the Processor provides written confirmation of deletion.

(5) Insofar as statutory retention obligations preclude deletion, the affected data will be processed only on a restricted basis (blocked) and deleted after the retention obligations expire.

(6) The database is backed up daily; each backup is kept for seven days and then overwritten. The files (photos, audio files, signatures, reports, report templates, company logos, profile pictures, proof photos from external persons) are backed up daily at Google Cloud Storage in Frankfurt am Main. Files that are short-lived or can be regenerated at any time are excluded: draft reports, uploaded import documents, data exports (ZIP archive), and the archives of the data return. Targeted deletion of individual data from a backup is technically not possible. Deleted database data is removed from the database backups no later than when the seven days have passed. Deleted or replaced files remain retrievable in the backup for 30 days from the next successful backup run and are then permanently deleted. Data from backups is used exclusively to restore the platform. Sentry automatically deletes error diagnostics events, including session replays, after 30 days; until then, they may still contain the Controller’s content even after the contract has ended.

(7) Paragraphs 1 to 6 do not cover the operational records of AI calls (AI telemetry). The provider processes them under its own responsibility for cost and operational control. They contain neither the prompt nor the content of the processed data or the model’s response, identify user and tenant only by a pseudonym, and are anonymized after 24 months. Details are set out in the privacy policy.

§ 12 Liability

(1) The liability provisions of the T&C (§ 12) apply, including the clarification regarding GDPR fines in cases of intent or gross negligence arising from breaches of this DPA (§ 12 paragraph 6 T&C).

(2) The joint and several liability towards data subjects under Art. 82 GDPR is governed by the statutory provisions.

(3) The Processor maintains appropriate professional or commercial liability insurance. Key coverage details will be communicated upon request.

§ 13 Third-Country Transfers

(1) The subprocessors process the Controller’s data at the locations named in Annex 1. These are locations in the European Union, except for the delivery of push notifications to the app; Google and Apple also process this delivery outside the EU, in particular in the USA. Some subprocessors are established in a third country or belong to groups established in a third country; this may result in transfers to a third country, for example through access for maintenance and support. Annex 1 states the third-country relation and the safeguard under Art. 44 et seq. GDPR for each subprocessor, and for the Apple Push Notification service the applicable Apple terms.

(2) The Controller instructs the Processor to transfer data to the subprocessors named in Annex 1 to the extent described there, on the basis of the safeguards named there: EU Standard Contractual Clauses (Art. 46 paragraph 2 lit. c GDPR) or the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR). For the Apple Push Notification service, Annex 1 names none of these safeguards between the Processor and Apple; what Annex 1 states on this is authoritative.

(3) The Processor announces any new transfer to a third country that is not described in Annex 1 in accordance with § 5; the Controller’s right to object applies accordingly. Such a transfer only takes place on the basis of an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR), supplemented where necessary by additional technical, organizational, or contractual measures.

§ 14 Final Provisions

(1) Amendments and supplements to this DPA must be in text form. This also applies to the cancellation of this text-form clause.

(2) Should individual provisions of this DPA be or become invalid or unenforceable, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by a provision that comes closest to the economic purpose of the invalid one.

(3) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). The exclusive place of jurisdiction is – to the extent legally permissible – the Processor's place of business.

(4) On all data protection matters, this DPA prevails over the provisions of the main contract.

(5) The German-language version of this DPA is authoritative. Translations are provided for ease of understanding only.

Annex 1: List of Subprocessors

This annex refers to the list of subprocessors engaged by the Processor, with registered office, purpose, data categories, processing location, and third-country safeguard. The list in version 4, as of 5 October 2026, is authoritative; later versions apply after notice in accordance with § 5.

The current version is available at the subprocessors overview and forms part of this DPA.

Annex 2: Technical and Organizational Measures (TOM)

The following technical and organizational measures are in place as of the date of this DPA and serve a level of protection appropriate to the risk within the meaning of Art. 32 GDPR. They are structured according to Art. 32 paragraph 1 lit. b to d GDPR.

• Confidentiality (Art. 32(1)(b) GDPR)

  Physical access control: The Processor does not operate its own data center; the systems run exclusively at the providers listed in Annex 1. System access control: two-factor authentication on all administrative accounts (Google Cloud, Amazon Web Services, Supabase, Sentry, PowerSync, GitLab); service credentials are kept in Google Cloud Secret Manager, as server secrets at Supabase, or as protected, masked variables of the build pipeline and never reach a client; deployment to Google Cloud runs without a stored key. Data access and separation control: user access via the web app and the link pages is restricted to the user’s own tenant via row-level security; which data the mobile app receives is limited by sync rules with the same tenant filter. Server-side functions and the Processor’s administration tool (admin panel) access data with a service key without this restriction; the key is kept only as a server secret or on the Processor’s computer. Files are kept in private buckets whose storage policies limit access to the folder of the user’s own tenant, and are delivered only via short-lived signed links. Links for external persons are stored in the database only as a hash, release only the content of the respective link, and end by expiry or revocation. Encryption: connections to the applications and services exclusively via TLS; the web app enforces HTTPS (HSTS) and restricts loadable content via a Content Security Policy; Amazon SES delivers emails encrypted if the receiving mail server offers TLS; the local database of the mobile app is encrypted, its key is kept in the Android Keystore or the iOS Keychain; encryption of stored data at the providers (AES-256) is based on their commitment. Error diagnostics: automatic error diagnostics in the web app and the app are only active with the user’s consent; in the session replay, input fields are masked and media blocked; the diagnostics SDK does not send default personal data such as the IP address (sendDefaultPii: false); filters remove cookies, headers, query parameters, and link tokens from events; events are processed in Frankfurt am Main. Development and testing take place locally with test data, not with customer data. Deletion: after the end of the contract, the Processor deletes the data manually in accordance with § 11 and confirms the deletion in text form on request.

• Integrity (Art. 32(1)(b) GDPR)

  Transfer control: connections exclusively via TLS, no unencrypted HTTP (for email delivery, see confidentiality). Immutability: a sealed inspection cannot be changed; every correction creates a new version, previous versions are retained. The PDF of a sealed version is digitally signed with a certificate of the Processor and carries a timestamp (PAdES); any later change invalidates the signature. The SHA-256 hash of the file is stored when it is filed and shown in the web app. Input control: every version records its time of sealing and names, where recorded, the inspector who carried it out. There is no log of individual entries and changes.

• Availability and resilience (Art. 32(1)(b) GDPR)

  Daily backup of the database with seven days of retention. Daily backup of the files at a second provider (Google Cloud Storage, Frankfurt am Main), excluding the short-lived or regenerable files listed in § 11 paragraph 6; the backup is private and encrypted. Deleted or replaced files remain in it for 30 days from the next successful backup run; neither the backup run nor the credentials of the file storage can permanently delete them before this period ends. The backup runs are monitored; a failed or missed run is reported to the Processor. Operation at the providers listed in Annex 1 in data centers in the EU; push notifications to the app are delivered via the infrastructure of Google and Apple, including in the USA. Rate limits on the link pages for external persons and on the AI functions triggered by users. The mobile app captures data offline and syncs as soon as a connection is available.

• Recoverability (Art. 32(1)(c) GDPR)

  The database can be restored from the daily backup, up to seven days back. The files can be restored from their backup individually, per tenant, or per storage bucket, optionally as of a point in time matching the database backup; restoring a single file and the files of a tenant in one storage bucket was tested on 28 September 2026. The applications can be redeployed at any time from version control via the build pipeline.

• Process for regular review (Art. 32(1)(d) GDPR)

  The technical and organizational measures are reviewed at least once a year and whenever the services engaged or the architecture change; the result is recorded in writing. Last review: 28 September 2026. Every change to the source code of the web app, the server functions, and the mobile app passes automated checks (lint, tests, build) and a review before it is merged. The shipped dependencies of the web app, the server functions, the mobile app (Android and iOS), and the begehung.pro website are automatically checked for known vulnerabilities with every change and every week.

• Processor control (subprocessors)

  Selection of subprocessors by processing location, encryption, and retention; a data processing agreement is in place with every subprocessor before it is engaged, except for the Apple Push Notification service (§ 5 paragraph 5); the list is maintained in Annex 1; the providers’ notifications about changes to their sub-subprocessors are subscribed to, where a provider offers them.

The measures of the providers listed in Annex 1, such as the encryption of stored data and the physical protection of the data centers, are based on their contractual commitments in the data processing agreements linked there, and for the Apple Push Notification service in the Apple terms linked there.