Data Processing Agreement

between the customer of the Branddoq platform as controller (“Customer”) and today is day one UG (haftungsbeschränkt), Rotebühlstraße 44, 70178 Stuttgart, Germany, as processor (“Branddoq”)

This Data Processing Agreement (“DPA”) is a convenience translation. It was drafted in German; in case of discrepancies, the German version available at https://www.branddoq.io/legal/avv prevails.

1. Subject matter, duration, roles

Branddoq processes personal data on behalf of the Customer in the course of providing the Branddoq platform in accordance with the Terms and Conditions (“Main Agreement”). The term of this DPA corresponds to the term of the Main Agreement, including the 30-day export period after the end of the contract. The obligations under Sections 6, 7, 8 and 10 continue to apply beyond that until all of the Customer’s data, including backups and copies held by sub-processors, has been deleted or returned.

The Customer is generally the controller. Where the Customer itself processes the data as a processor for a third party (for example an agency operating brand guides for its end clients), Branddoq acts as a further processor within the meaning of Article 28 (4) GDPR. In that case the Customer warrants that its principal has authorised the engagement of Branddoq and of the sub-processors listed in Section 9, and passes on the obligations of this DPA in its own data processing agreement. Instructions towards Branddoq are given solely by the Customer; requests from the end client or from data subjects received directly by Branddoq are forwarded to the Customer.

2. Nature and purpose of the processing

Storage, provision, display, reproduction (preview images, exports), transmission to users authorised by the Customer and, where the Customer uses AI features, transmission of content to the sub-processor Anthropic for the generation of suggestions and check results. The sole purpose is the operation of the Customer’s brand guides.

3. Types of personal data

• Master and access data of users created by the Customer: name, email address, password (as a hash), role, assignment to brand guides and pages.
• Usage data: login timestamps, server logs.
• Content data in brand guides and the media pool insofar as it relates to individuals: for example photos and names of employees, contact person details, email signatures.
• Content that users enter into AI features.

4. Categories of data subjects

Employees, service providers and business partners of the Customer who are set up as users; persons depicted or named in customer content; visitors to published brand guides (server logs).

5. Instructions and obligations of the Customer

As controller, the Customer is responsible for the lawfulness of the processing, in particular for the existence of a legal basis, for informing the data subjects and for the lawfulness of the content it uploads. The Customer shall inform Branddoq without delay if it detects errors or irregularities in the processing and shall name a contact person for data protection matters.

Branddoq processes the data only on documented instructions from the Customer. Instructions are given through the use of the platform (for example creating users, uploading and publishing content, deleting) and additionally in text form to hello@branddoq.io. If Branddoq considers an instruction to be in breach of data protection law, it shall inform the Customer without delay (Article 28 (3), third sentence, GDPR) and may suspend execution until the Customer has amended the instruction or has comprehensibly demonstrated its lawfulness. Branddoq may refuse an instruction whose execution would manifestly infringe the GDPR or other data protection provisions.

6. Confidentiality

Branddoq shall bind all persons involved in the processing to confidentiality and shall ensure that they process the data only in accordance with instructions. This obligation continues after the end of their engagement.

7. Technical and organisational measures (Article 32 GDPR)

• Physical and system access: data centre of the hosting provider with access control; server access only encrypted (SSH) with personal credentials; administration interface restricted to named persons.
• Data access: role-based permission system (administrator, editor, viewer); tenant separation by assigning each record to exactly one brand guide; page-level access restrictions for viewers.
• Transfer: TLS encryption of all connections; protected delivery of media pool files via authenticated routes; no transmission to third parties other than the sub-processors listed in Section 9.
• Input: logging of publications and changes with timestamps; server logs.
• Availability: redundant power supply and network connection of the data centre; availability monitoring; daily backups (files, database, configuration) retained for at least 14 days with notification in case of a failed backup; export functions (ZIP, PDF) with which the Customer can back up its content itself at any time.
• Separation: separate environments for development and production; no live data in test environments.
• Application security: server-side verification of uploaded file types, sanitising of SVG files, protection against cross-site request forgery, Content Security Policy, password hashing, timely security updates of framework and server software.
• Organisation: named contact person for data protection and information security; process for reporting security incidents (Section 8); regular review of the measures.

Branddoq may further develop the measures as long as the level of protection is not reduced.

8. Notification of personal data breaches

Branddoq shall inform the Customer without undue delay, and at the latest 48 hours after becoming aware, of personal data breaches affecting the Customer’s data, providing the information available at that time in accordance with Article 33 (3) GDPR, and shall support the Customer in fulfilling its notification and communication obligations under Articles 33 and 34 GDPR.

9. Sub-processors

The Customer authorises the use of the following sub-processors:

Stripe (payment processing) processes only the Customer’s own master data for its own contract with Branddoq and no data that Branddoq processes on behalf of the Customer; Stripe is therefore not a sub-processor within the meaning of this DPA.

Branddoq shall inform the Customer in text form (email to the account address) at least four weeks before engaging additional sub-processors or replacing existing ones. The Customer may object within this period for important reasons relating to data protection. If the Customer objects in time, Branddoq shall not transmit any of the Customer’s data to the new sub-processor until the parties have found a solution or the Main Agreement has been terminated with respect to the affected service; if Branddoq cannot provide the affected service without the sub-processor, that service is suspended for the Customer and the fee is reduced pro rata for that part. If no solution is reached, either party may terminate the Main Agreement with respect to the affected service with one month’s notice. Branddoq shall contractually bind each sub-processor to the obligations of this DPA.

10. Deletion and return

After the end of the Main Agreement, the Customer shall decide within 30 days whether Branddoq returns or deletes the data. For the return, the Customer may back up its content via the platform’s export functions until the end of the contract or request, within this period and in text form, an export in a common, machine-readable format; Branddoq makes it available for retrieval within 14 days of the request (details in Section 9.5 of the Terms and Conditions). After expiry of this period or after the return has taken place, Branddoq shall delete all customer content and user data from the production systems. Backups are overwritten in the regular cycle of about four weeks, so that the data is completely removed no later than eight weeks after the end of the contract; if data is restored from a backup during this time, Branddoq shall immediately delete the Customer’s already deleted data again. The protective obligations of this DPA continue to apply until deletion is complete. Branddoq shall also arrange for deletion at the sub-processors under Section 9. Statutory retention obligations remain unaffected. Deletion will be confirmed in text form upon request.

11. Assistance, evidence, audits

Branddoq shall support the Customer, to the extent reasonable, in responding to requests from data subjects (Articles 15 to 22 GDPR) and shall provide the information required for this within five working days of the request; requests from data subjects received directly by Branddoq shall be forwarded to the Customer without delay. Branddoq shall further support the Customer with data protection impact assessments and prior consultations (Articles 35 and 36 GDPR) and shall provide all information necessary to demonstrate compliance with this DPA. The Customer may verify compliance once a year and in the event of a specific reason, after giving reasonable notice, during normal business hours, or have it verified by a third party bound to confidentiality. Branddoq may initially refer to current audit reports and certificates of its sub-processors. Effort exceeding information provided in text form will be remunerated on a time-and-materials basis unless the audit reveals a breach by Branddoq.

12. Liability

The liability of the parties is governed by Article 82 GDPR. In all other respects, Section 11 of the Terms and Conditions applies. Fines imposed on a party for its own breach shall be borne by that party alone.

13. Place of processing

Processing takes place within the European Union. Transfers to third countries take place only via the sub-processors listed in Section 9 on the basis of the safeguards stated there (Articles 44 et seq. GDPR).

14. Final provisions

Amendments to this DPA require text form; Section 13 of the Terms and Conditions applies accordingly. In the event of conflicts between this DPA and the Main Agreement, this DPA prevails in matters of data protection law. German law applies; the place of jurisdiction is governed by Section 15.2 of the Terms and Conditions.