Data processing agreement

1. Subject matter and scope

1. The subject matter of this DPA is the processing of personal data by the Provider on behalf of and on the instructions of the Customer in the course of providing the qoyaa platform in accordance with the Main Contract.
2. The DPA applies in particular to data that the Customer transmits to the platform via the integrations with Odoo, WooCommerce, Shopware and Google Analytics 4, and to personal data contained in content of the Customer’s website or in other input from the Customer.
3. This DPA does not cover processing for which the Provider is itself the controller, in particular the management of customer accounts and team members, contract handling, billing and the operation and security of the website. The privacy policy applies to such processing.

2. Duration

The DPA applies for the term of the Main Contract. It does not end before the deletion or return of all data processed on behalf of the Customer has been completed in accordance with Section 12. The right to extraordinary termination remains unaffected.

3. Nature and purpose of the processing

The processing comprises the collection, recording, storage, organisation, analysis, retrieval, display, transmission to sub-processors, restriction and erasure of data for the following purposes:

4. Type of data

• Visit data from shop integrations after reported consent: pseudonymous session identifier, landing page, source or AI source, time, consent status,
• Order data: order and transaction identifiers, time of payment, amounts, currency, line items, refunds and the reference to the pseudonymous session; expressly no names, addresses or email addresses of end customers,
• Product and content data of released products, insofar as they contain personal information,
• Analytics data: aggregated daily figures from Google Analytics 4 such as sessions, sessions with key events, purchases and revenue, as well as the associated access tokens,
• Website content of the Customer’s domain, insofar as it contains personal data, such as names and contact details in a legal notice or on team pages,
• Other input from the Customer, insofar as it contains personal data contrary to Section 6.4, as well as persons named in AI answers.

Special categories of personal data pursuant to Art. 9 GDPR are not subject to the processing.

5. Categories of data subjects

• visitors to and buyers on the Customer’s websites and shops,
• persons named on the Customer’s website or in its product content,
• persons named in answers from AI assistants to the Customer’s prompts.

6. Rights and obligations of the Customer

1. The Customer is responsible for the lawfulness of the processing, in particular for the legal basis for the transmission to the Provider, and for safeguarding the rights of the data subjects.
2. The Customer generally issues instructions by configuring the platform, for example by enabling, restricting and disconnecting integrations, releasing products, exports and deletion requests. It issues further instructions in text form to Dennis Schott. The owners and admins of the respective team are authorised to issue instructions.
3. The Customer ensures that visit data is only reported to the integration after valid consent has been given via its consent management and that a withdrawal of consent is also reported.
4. The Customer does not enter any personal data in prompts, brand profiles or competitor information.
5. The Customer informs the Provider without delay if it discovers errors or irregularities in the processing.

7. Obligations of the Provider

1. The Provider processes the data only on documented instructions from the Customer, including with regard to transfers to third countries, unless it is required to process the data by Union or Member State law. In such a case, it informs the Customer of that legal requirement before processing, unless that law prohibits such information.
2. If the Provider is of the opinion that an instruction infringes data protection provisions, it informs the Customer without delay. It may suspend the execution of the instruction until it is confirmed or amended by the Customer.
3. The Provider commits all persons who have access to the data to confidentiality, unless they are subject to an appropriate statutory obligation of confidentiality.
4. The Provider implements the technical and organisational measures pursuant to Section 8 and Art. 32 GDPR.
5. Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR, in particular with data protection impact assessments.
6. The Provider notifies the Customer of a personal data breach without delay after becoming aware of it. The notification contains, where available, the information pursuant to Art. 33(3) GDPR.
7. The Provider maintains a record of processing activities pursuant to Art. 30(2) GDPR.
8. The Provider’s contact person for data protection is Dennis Schott.
9. The Provider does not use the data for its own purposes, in particular not for training AI models, and does not disclose it to third parties unless this is necessary for the provision of services under this DPA.

8. Technical and organisational measures

The Provider implements in particular the following measures. It may further develop them, provided that the level of protection is not reduced.

Confidentiality

• operation of the application, database and backups in the data centres of the hosting provider (Hetzner) with its physical access controls,
• sign-in with hashed passwords, optional two-factor authentication and passkeys, limitation of sign-in attempts,
• role-based permissions per team (Owner, Admin, Analyst, Member, Read only, Billing) and verification of team membership on every access,
• logical tenant separation: all project data is assigned to a team and can only be accessed by its members,
• integration keys are stored only as hashes and access tokens for Google Analytics 4 only in encrypted form, and are not output to browsers or connected systems,
• administrative access only for authorised personnel according to the principle of least privilege.

Integrity

• encryption of all connections using TLS,
• verification of the signature of incoming payment events and their encrypted storage,
• logging of security-relevant changes in the team with the acting person and time,
• checksums for stored original answers.

Availability and resilience

• regular encrypted data backups with restore testing,
• separate processing queues so that individual operations do not block operation,
• time and cost limits for requests to third-party providers.

Data minimisation and deletion

• shop integrations do not transmit names, addresses or email addresses of end customers; visits are only recorded after reported consent,
• prompts and project details for prompt suggestions are transmitted to AI providers without account or personal data,
• automated deletion periods pursuant to Section 12,
• deletions are recorded in a deletion log and reapplied when restoring from backups.

Review

• regular review of the measures and security checks when the application changes,
• procedures for reporting and handling data protection incidents.

9. Sub-processors

1. The Customer grants general authorisation for the engagement of sub-processors. At the time the contract is concluded, the following sub-processors are approved:

2. AI providers receive prompt text and technical search parameters for measurements. For prompt, profile and competitor suggestions, they also receive the product category, company profile, brand names, domain, existing prompts and home page meta data. For implementation proposals requested by the Customer, they additionally receive the relevant task, measurement findings, source references and selected excerpts from captured pages of the Customer’s website, content drafts and AI answers. These contents may include personal data where such data appears in the inputs or captured contents. Account and billing data are not included as such.
3. The Provider informs the Customer in text form at least 30 days in advance of any intended changes concerning sub-processors. The Customer may object to the change within this period for an important reason relating to data protection law. If the parties cannot reach an agreement, the Customer may terminate the Main Contract as of the date on which the change takes effect.
4. The Provider contractually imposes on each sub-processor data protection obligations that essentially correspond to the obligations under this DPA. If processing takes place outside the EU or the EEA, it ensures compliance with Art. 44 et seq. GDPR.
5. Services that the Customer commissions itself, in particular Google Analytics 4, Odoo, WooCommerce and Shopware, as well as ancillary services such as telecommunications services, do not constitute sub-processing within the meaning of this Section.

10. Assistance with data subject rights

1. The Provider assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects pursuant to Art. 12 to 22 GDPR. In particular, the platform’s export, disconnection and deletion functions are available for this purpose.
2. If a data subject contacts the Provider directly, the Provider forwards the request to the Customer without delay and does not respond to it itself, unless the Customer instructs otherwise.

11. Evidence and audits

1. On request, the Provider makes available to the Customer the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular a current description of the technical and organisational measures.
2. The Customer is entitled to carry out audits, including inspections, itself or through an auditor commissioned by it who is bound to confidentiality and is not in a competitive relationship with the Provider. Inspections must be announced at least 14 days in advance, take place during normal business hours and must not disproportionately disrupt operations.
3. Audits may extend to the premises of sub-processors only in accordance with their terms; their audit reports and certifications may replace an inspection by the Customer.

12. Deletion and return

1. During the term of the contract, the Provider automatically deletes the data in accordance with the following periods:

2. If the Customer disconnects a Google Analytics 4 connection, the Provider deletes the access tokens and the imported figures. The Provider carries out deletion requests for projects and teams after a waiting period of 24 hours, during which the Customer can withdraw the request.
3. Before the end of the contract, the Customer can retrieve its data as CSV via the export function. This fulfils the obligation to return the data. After the end of the contract, the Provider deletes the data processed on behalf of the Customer, unless Union or Member State law requires storage of the data.
4. Data in backups is overwritten in the regular backup cycle after 35 days at the latest. Until then, it is protected against access and is deleted again in the event of a restore.
5. On request, the Provider confirms the deletion in text form.

13. Liability

Art. 82 GDPR applies to liability towards data subjects. As between the parties, the liability provisions of the Main Contract apply, unless mandatory statutory provisions provide otherwise.

14. Final provisions

1. In the event of conflicts between this DPA and the Main Contract, the provisions of this DPA take precedence with regard to the protection of personal data.
2. Amendments and supplements to this DPA require text form. § 14 of the GTC applies accordingly to amendments.
3. Should any provision of this DPA be invalid, the validity of the remaining provisions remains unaffected. It is replaced by a provision that meets the requirements of Art. 28 GDPR.
4. The law of the Federal Republic of Germany applies. The place of jurisdiction is the place of jurisdiction agreed in the Main Contract.