Template: Data Processing Agreement (DPA)

under Art. 28 GDPR · As of: November 4, 2026 · Template of dcyphr.® GmbH for use of dcyphr.® ID

Parties

Controller:
Company / organisation: ______________________________
Address: ______________________________
Represented by: ______________________________
Data protection contact: ______________________________

Processor:
dcyphr.® GmbH, Hans-Thoma-Straße 40, 69121 Heidelberg, represented by the managing director Matthias Alexander Walenda
Data protection contact: contact@dcyphr.ai

§ 1 Subject matter and duration

(1) The processor provides the controller with dcyphr.® ID and its apps (main contract: terms of use or a separate contract). In doing so it processes personal data on behalf of and on the instructions of the controller.

(2) This agreement applies from signature and for the duration of the main contract. The right to terminate for good cause remains unaffected.

§ 2 Nature, purpose, data and data subjects

The nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex 1.

§ 3 Instructions

(1) The processor processes the data only on documented instructions of the controller, including with regard to transfers to a third country, unless required to do otherwise by Union or Member State law; in that case it informs the controller beforehand, unless the law prohibits this (Art. 28(3)(a) GDPR).

(2) Instructions are the settings the controller makes in the platform and notices in text form. The processor informs the controller if it considers an instruction unlawful; it may then suspend it until clarified.

§ 4 Obligations of the processor

1. Confidentiality. It uses only persons who are bound to confidentiality (Art. 28(3)(b), Art. 29 GDPR).
2. Security. It takes the technical and organisational measures described in Annex 2 (Art. 32 GDPR) and develops them further in line with the state of the art. It reports material deteriorations.
3. Data subject rights. It supports the controller with suitable measures in fulfilling the rights of data subjects (Art. 15 to 22 GDPR), e.g. through access, rectification, deletion and export functions of the platform. It forwards requests from data subjects to the controller without delay.
4. Assistance. It assists with security, notification duties, data protection impact assessment and consultation of the supervisory authority (Art. 32 to 36 GDPR) to a reasonable extent.
5. Data breaches. It reports a personal data breach to the controller without undue delay after becoming aware of it and provides the information needed for a notification.
6. Records. It keeps a record of processing activities as a processor (Art. 30(2) GDPR).
7. Data protection contact. No data protection officer is currently appointed at the processor because the legal requirements are not met; the contact is the managing director (see above).

§ 5 Obligations of the controller

The controller is responsible for the lawfulness of processing and for safeguarding data subject rights. It informs the data subjects (e.g. attendees of its events) and ensures it may enter the data. It informs the processor without delay of irregularities in processing. Special categories of personal data (Art. 9 GDPR) may only be entered if this has been agreed beforehand in text form.

§ 6 Sub-processors

(1) The controller gives general authorisation to use further processors. Those used at the time of signature are listed in Annex 3.

(2) The processor informs of intended changes at least 14 days in advance in text form. The controller may object for good cause within that period; if no agreement is reached, either party may terminate the main contract for good cause as of the date of the change.

(3) The processor binds sub-processors by contract to at least this level of protection and is liable for them as for its own acts.

§ 7 Third countries

Processing takes place in principle in Germany or the EU. If a sub-processor uses services outside the EEA, the processor ensures the requirements of Art. 44 et seq. GDPR (adequacy decision, EU standard contractual clauses with supplementary measures).

§ 8 Audit rights

The processor provides the controller with the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections (Art. 28(3)(h) GDPR). On-site audits must be announced in good time (as a rule 14 days in advance), take place during normal business hours, do not disrupt operations disproportionately and respect confidentiality towards other customers. Proof may also be provided by current self-disclosures or certificates of the hoster.

§ 9 Return and deletion

After the main contract ends, the processor hands the data back to the controller on request in a common format (export functions) and then deletes it, at the latest after 30 days, including existing copies, unless a statutory retention duty applies. Backups are overwritten in the regular cycle. On request it confirms deletion in text form.

§ 10 Liability and final provisions

(1) Liability is governed by Art. 82 GDPR and, between the parties, by the liability provisions of the main contract (Part E of the AGB), unless mandatory law provides otherwise.

(2) Amendments and additions require text form. In case of conflict this agreement takes precedence over the main contract insofar as personal data is concerned.

(3) German law applies. The place of jurisdiction is, where permitted, Heidelberg. If a provision is invalid, the rest of the agreement remains valid.

Place, date: ______________________    Controller: ______________________
Place, date: ______________________    Processor (dcyphr.® GmbH): ______________________

Annex 1 — Subject matter of processing

Annex 2 — Technical and organisational measures

• Physical access: operation in the hoster’s data centres in Germany with its access controls; no own server room.
• System access: personal accounts, passwords stored only as hashes, lockout after failed attempts, optional second factor by email or SMS, sessions with secured cookies (HTTPS only, not readable by script).
• Data access: role and rights concept per organisation and per event; file access only after sign-in and authorisation, files stored outside the public web area.
• Transfer: encrypted transmission (TLS); protection against foreign scripts (Content Security Policy) and against cross-site form requests (CSRF protection).
• Input control: logging of key actions in the event studio (who, when, what).
• Order control: processing only within the platform’s functions and these instructions; sub-processors bound by contract.
• Availability: regular automatic backups of databases and files, restoration by the processor; operations monitoring without storing IP addresses.
• Separation: separation of data by account or organisation; separate databases for platform and events.
• Organisation: employees bound to confidentiality, data protection training, reporting route for security incidents via contact@dcyphr.ai.

Annex 3 — Sub-processors

Status of the annex: November 4, 2026. Changes under § 6.