Data processing agreement (DPA)

Preamble

This Data Processing Agreement (the “DPA”) specifies the parties' data protection obligations arising from the main agreement between them for use of the Software-as-a-Service platform (the “Main Agreement”).

This DPA applies to all activities connected with the Main Agreement in which the processor's personnel or third parties engaged by it process the controller's personal data.

Section 1. Parties

Controller (customer): The platform user, meaning the self-employed person or company using the platform under contract. The user's account details identify the controller.

Processor (service provider):

Octon Holding GmbH
represented by: Mio McQueen (Managing Director)
Paul-Ehrlich-Straße 7
79106 Freiburg im Breisgau
Local Court of Freiburg im Breisgau, HRB 736329
Email: team@octonholding.de
(the “processor”)

Section 2. Subject matter and duration of processing

(1) Processing concerns the provision of the platform under the Main Agreement. The processor processes personal data exclusively for this purpose and only on behalf of, and on the instructions of, the controller.

(2) Processing continues for the duration of the Main Agreement and ends when that agreement ends, subject to the deletion and return obligations in section 11.

Section 3. Nature and purpose of processing

(1) The processor provides the following processing services to the controller:

• Providing the platform (SaaS) to support the creation and operation of a business
• Storing, structuring and analysing the controller's business data (contacts, offers, invoices, payments and documents)
• Providing AI functions to support business activities
• Connecting to third-party systems (accounting and payment processing) at the controller's request
• Creating and sending notifications and reports

(2) Processing serves performance of the Main Agreement. The processor does not process the data for its own purposes; in particular, data is not used to train its own or third-party AI models.

Section 4. Types of personal data

(1) The following categories of data are processed on behalf of the controller:

• Master data (names, addresses and contact details of the controller's customers, leads and contact persons)
• Communication data (email addresses, telephone numbers and message content entered into the platform)
• Contract data (offer, invoice and payment information)
• Financial data (expenses, receipts and accounting information)
• Usage data (sign-in times, IP addresses and browser information for security purposes)
• Content voluntarily stored in the platform by the controller
• Image files, image descriptions and related instructions where the controller uses image functions

(2) Processing special categories of personal data (Article 9 GDPR) is outside the scope of this agreement. If the controller enters such data into the platform, it does so on its own responsibility.

Section 5. Categories of data subjects

Processing concerns the following categories of data subjects:

• The controller's customers and prospective customers
• The controller's suppliers and service providers
• Customers of sales pages or web applications operated by the controller
• The controller's contact persons and business partners
• Other persons whose data the controller processes in the platform

Section 6. Processor's obligations

(1) The processor undertakes to process personal data:

• only within the agreed scope and in accordance with the controller's documented instructions
• without using it for its own purposes, particularly without using it to train its own or third-party AI models
• without disclosing it to unauthorised third parties

(2) The processor will inform the controller without undue delay if it considers an instruction to infringe data protection law.

(3) The processor ensures that all persons entrusted with processing are bound by confidentiality obligations and informed about the relevant data protection requirements.

(4) Data protection enquiries should be sent to team@octonholding.de.

(5) The processor assists the controller in fulfilling its obligations under Articles 32 to 36 GDPR (security of processing, breach notification and data protection impact assessments).

Section 7. Technical and organisational measures

The processor implements the technical and organisational measures required by Article 32 GDPR. These include:

Confidentiality

• Physical and system access controls: cloud hosting in EU data centres with access controls; multi-factor authentication for administrators
• Data access controls: strict tenant separation in database access (row-level isolation, each query bound to a userId/businessId); access restricted to designated administrators
• Passwordless authentication: one-time magic links (hashed tokens, valid for 15 minutes); no password storage
• Encrypted storage of sensitive credentials and tokens (AES-256-GCM, key derived from the server secret using HKDF)
• Separation controls: logical separation of different controllers' data through tenant identifiers in database access

Integrity

• Input controls: logging of sensitive operations (contract acceptance and actions affecting external parties)
• Transfer controls: TLS 1.2 or later encryption for data transfers

Availability and resilience

• Daily encrypted backups to S3, 30-day retention and automatic rotation
• Monitoring of critical services
• Infrastructure-level protection against DoS/DDoS

Regular review

• Documented data protection policies
• Incident response process for personal data breaches
• Regular security updates for software components

A detailed, current description of the technical and organisational measures will be provided as a separate annex upon request.

Section 8. Subprocessors

(1) The controller grants general authorisation to engage the following subprocessors to provide the platform:

• Amazon Web Services EMEA SARL (hosting, data storage and email delivery via SES) — based in Luxembourg; server location: Frankfurt am Main, Germany
• Stripe Payments Europe Ltd. (payment processing and Stripe Connect) — based in Ireland
• Anthropic PBC (AI processing) — based in the USA; Data Processing Addendum (DPA) and SCCs in place; no use for training
• OpenAI (API image generation; image descriptions and output parameters). Processing outside the EU may occur. Article 28 and Chapter V GDPR also apply to this service.
• Lexware GmbH (lexoffice) (accounting integration, only when enabled) — based in Germany
• PostHog EU B.V./Ltd. (product analytics, only with consent through the cookie banner) — EU hosting (eu.posthog.com)

(2) Transfers to third countries (USA: Anthropic) are safeguarded by EU Standard Contractual Clauses (SCCs).

(3) The processor will inform the controller of any intended addition or replacement of subprocessors. The controller has a right to object within 30 days. Where an objection is justified, the controller may terminate the agreement for cause.

(4) The processor ensures that each subprocessor is subject to equivalent data protection obligations (Article 28(4) GDPR).

Section 9. Data subjects' rights and assistance to the controller

(1) The processor assists the controller in responding to data subject requests (Articles 12 to 23 GDPR).

(2) The platform provides the following functions:

• Export of stored data (Article 20 GDPR)
• Deletion of individual records and the entire account (Article 17 GDPR)
• Correction of inaccurate data (Article 16 GDPR)

Section 10. Notification of personal data breaches

(1) The processor will notify the controller of any personal data breach within its area of responsibility without undue delay and no later than 48 hours after becoming aware of it.

(2) The notification will include at least:

• A description of the nature of the breach
• Categories and numbers of affected data subjects and records, where possible
• The name and contact details of a contact person
• A description of the likely consequences
• Measures taken or proposed

Section 11. Deletion and return after termination

(1) After the Main Agreement ends, the controller may download its data using the platform's export function during a 30-day grace period.

(2) After the grace period, the processor deletes the controller's personal data unless statutory retention obligations prevent deletion.

(3) Data in backup systems is deleted through the regular backup cycles, within a maximum of 90 days.

(4) Confirmation of deletion is provided upon written request.

Section 12. Controller's audit rights

(1) The controller may verify compliance with this agreement. The processor enables this through:

• Written information upon request
• Current documentation of technical and organisational measures and subprocessors
• Inspections by prior arrangement where there are reasonable grounds, at the controller's expense

(2) Where available, audit reports and certifications issued by recognised auditors for the hosting providers used will be supplied.

Section 13. Liability

The parties' liability for damage resulting from a breach of data protection law is governed by Article 82 GDPR and the Main Agreement (Terms, section 10).

Section 14. Final provisions

(1) If a provision of this agreement is invalid, the remaining provisions remain valid.

(2) If this DPA conflicts with the Main Agreement, this DPA prevails on data protection matters.

(3) Amendments and additions must be in text form; email is sufficient. The controller will be informed of material changes in good time.

(4) German law applies. The courts of Freiburg im Breisgau have jurisdiction if the controller is a merchant or a legal entity under public law.

Conclusion of the agreement

This DPA is concluded when the controller accepts the processor's Terms during registration. The processor records the time and version of acceptance.