Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Customer", the controller) and the company named in the Imprint ("Pactinel", the processor). It applies where Pactinel processes personal data contained in Customer Data on behalf of Customer and the GDPR, the UK GDPR or other data protection law applies. It is intended to meet Article 28 GDPR.

1. Definitions

"Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in the GDPR. "Customer Data" means the documents and data Customer or its users put into the Service. "Subprocessor" means a third party engaged by Pactinel to process Personal Data. "SCCs" means the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the addendum issued by the UK Information Commissioner for those clauses.

2. Roles and instructions

Customer is the controller and Pactinel is the processor of Personal Data in Customer Data. Pactinel processes it only on Customer's documented instructions, which are these Terms, this DPA, Customer's configuration and use of the Service and Customer's other reasonable written instructions consistent with them, unless the law requires otherwise; in that case Pactinel informs Customer before processing unless the law prohibits it. Pactinel will tell Customer if it believes an instruction infringes data protection law.

3. Details of processing

4. Pactinel's obligations

Pactinel will:

1. ensure that persons authorized to process Personal Data are bound by confidentiality;
2. implement the technical and organizational measures in section 6;
3. assist Customer, taking into account the nature of the processing, in responding to data subject requests, with tools in the Service such as search, export and deletion of personal data in contracts, and forward to Customer any request it receives directly without responding itself unless instructed;
4. assist Customer with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to Pactinel;
5. make available the information necessary to demonstrate compliance and allow for and contribute to audits as set out in section 9.

5. Customer's obligations

Customer is responsible for the lawfulness of the processing, for having a legal basis and giving any required notices to data subjects, for the accuracy of Customer Data and for its configuration of the Service, including role assignments, two-step verification and AI settings.

6. Security

Pactinel maintains the measures described on the Security page, which are incorporated here, including: encryption in transit and at rest, with field-level encryption of bank details, tax identifiers and secrets; tenant isolation through application filters and row-level security; role-based access with record-level scopes and a confidentiality setting; two-step verification; logging of access and changes in an append-only audit log; malware scanning of uploads; support access only on Customer's time-limited, revocable grant; backups with monthly restore tests; and written incident and key-loss procedures. Pactinel may update the measures if the overall level of protection is not reduced.

7. Subprocessors

Customer gives Pactinel general written authorization to engage Subprocessors listed on the Subprocessors page. Pactinel will notify Customer by email at least 30 days before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds within that period. The parties will discuss in good faith; if the issue is not resolved, Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period. Pactinel binds each Subprocessor to data protection obligations no less protective than this DPA and remains liable to Customer for each Subprocessor's performance.

8. International transfers

Production data and backups are stored in the EU. Where processing involves a transfer of Personal Data from the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer is covered by the SCCs, which are incorporated by reference:

• Module Two (controller to processor) applies where Customer transfers Personal Data to Pactinel and Pactinel is located in a country without adequacy;
• Module Three (processor to processor) applies to onward transfers from Pactinel to Subprocessors, including the US-hosted AI provider, which Pactinel will enter into with that Subprocessor;
• the optional docking clause applies; the option for general authorization of Subprocessors applies with the notice period in section 7; the competent supervisory authority is the one responsible for Customer; the governing law (Clause 17) is the law of Germany and the courts (Clause 18) are those of Germany; Annex I is section 3 of this DPA and Annex II is section 6;
• for UK transfers the UK Addendum applies, with the same Annexes.

If the SCCs conflict with this DPA, the SCCs prevail. If a transfer mechanism is invalidated, the parties will agree on an alternative. Pactinel applies additional safeguards: only relevant pages go to the AI provider, unnecessary personal data is masked first, transmission is encrypted and the provider must not retain or train on data.

9. Audit and information

On request, no more than once a year unless there has been a personal data breach or a supervisory authority requires it, Pactinel will provide its security pack, questionnaire answers and other reasonable information to demonstrate compliance. If that is not sufficient, Customer may carry out an audit, by itself or by an independent auditor bound by confidentiality, on 30 days' written notice, during business hours, without disrupting operations or accessing other customers' data, at Customer's cost.

10. Personal data breach

Pactinel will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information it has about the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed, and will update Customer as it learns more. Pactinel's notification is not an admission of fault.

11. Deletion and return

Customer can export its data at any time, including a full archive, also after the subscription ends. After a workspace is closed it stays read-only for 30 days and is then deleted. Items Customer deletes sit in the trash for 30 days. Remaining copies in backups are overwritten within about 8 weeks. Pactinel keeps Personal Data after that only where the law requires and keeps it protected.

12. Liability and order of precedence

The liability limits in the Terms of Service apply to this DPA to the extent the law allows; nothing limits a data subject's rights or either party's liability that cannot be limited. If this DPA conflicts with the Terms on data protection, this DPA prevails.

13. Term

This DPA lasts as long as Pactinel processes Personal Data for Customer.

14. Contact

Data protection questions go through the contact page. The EU and UK representatives and any data protection officer are named in the Imprint.