Data Processing Agreement

Data Processing Agreement ("DPA")

between

RPS Planungssysteme GmbH
Agnes-Pockels-Str. 2
63457 Hanau
Germany
(hereinafter also referred to as "contractor")

and

the user (hereinafter referred to as "controller") of the cloud-based software offered by the contractor.

General

The controller and the contractor (hereinafter also referred to as "parties") have entered into a user agreement which obliges the contractor to process personal data on behalf of the controller.

This DPA forms an appendix to the Terms and Conditions.

By accepting the Terms and Conditions, the parties have accepted this Data Processing Agreement (DPA) as part of the user agreement to ensure that the processing of personal data by the contractor on behalf of the controller is carried out in accordance with applicable data protection laws.

Subject and Duration of the Agreement

• The contractor provides the controller with cloud-based software services (SaaS) for operational planning, enabling access to employee, customer, project and billing data.

• This agreement specifies the data protection obligations of the parties in the context of the processing of personal data.

• The duration of this data processing agreement (DPA) is determined by the duration of the user agreement, unless the provisions of the data processing agreement stipulate further obligations.

Type and Purpose of Data Processing

The contractor processes the data recorded by the controller in the provided software exclusively for the expressly agreed purposes.

The personal data processed depends on the personal data provided by the controller and may relate to the following persons:

• Employees of the controller
• The controller's customers and its employees
• Service providers and business partners of the controller and their employees
• Persons cared for by the controller
• Participants in the projects carried out by the controller

The personal data may include the following information:

• First and last name, date of birth
• Contact details such as telephone numbers, email addresses and residential addresses
• Employee master data such as employee numbers and employment status
• Job titles, qualifications, department and work group affiliations, job roles
• Services, planned and actual working hours, overtime or undertime, assigned shift models
• Times of attendance and absence (e.g. vacation or business trips)
• Vacation entitlements
• Working time bonuses
• Workplaces and activities
• Substitution arrangements
• Payment and billing information
• Data submitted by users in comments and free text fields

Right to Give Instructions

The contractor processes personal data only on the basis of documented instructions from the controller, unless he is legally obliged to process it.

The contractor shall inform the controller immediately if he believes that an instruction violates data protection regulations.

Contractor's Obligations

• The contractor shall support the controller if the controller is subject to an audit by supervisory authorities or other bodies, or if data subjects assert rights against the contractor insofar as the processing on behalf of the controller is concerned.

• The contractor will implement technical and organizational measures to adequately protect the controller's data in accordance with Article 32 of the General Data Protection Regulation (GDPR). These measures are listed in Appendix 1.

• The contractor reserves the right to change the technical and organizational measures taken, while ensuring that the contractually agreed level of protection is not undercut.

• The contractor will not make any copies or duplicates of the controller's data within the scope of order processing without the controller's prior consent. Exceptions to this are copies necessary to ensure proper data processing and the proper provision of services in accordance with the user agreement (including data backup), as well as copies required to comply with statutory retention obligations.

Obligations of the Controller

• The controller is solely responsible for assessing the permissibility of the commissioned processing in accordance with Art. 6 para. 1 GDPR and for safeguarding the rights of data subjects in accordance with Art. 12 to 22 GDPR.

• The controller shall inform the contractor immediately if he discovers any errors or irregularities in the examination of the order results.

• The controller generally issues all orders, sub-orders, and instructions in writing or in a documented electronic format. Verbal instructions must be confirmed immediately in writing or in a documented electronic format.

• The controller is entitled to monitor the contractor's compliance with data protection regulations and contractual agreements to a reasonable extent and at its own expense, either directly or through third parties.

  The controller must inform the contractor in good time (usually at least two weeks in advance) of all circumstances relating to the execution of the inspection.

  The controller will not conduct its own inspections, provided the contractor can furnish the requested proof by submitting a suitable attestation or a standard market certificate. Audit reports, ISO/DIN certificates, or equivalent test reports are particularly suitable as proof.

Rights of Data Subjects

If a data subject contacts the contractor with requests for rectification, erasure or information, the contractor will refer the data subject to the controller, provided that an assignment to the controller is possible based on the data subject's information.

The contractor shall forward the request of the data subject to the controller without delay. The contractor shall support the controller to the extent possible and as instructed, insofar as agreed. The contractor shall not be liable if the request of the data subject is not answered, is answered incorrectly, or is not answered within the required timeframe by the controller.

Return and Deletion of Provided Data and Data Media

Upon termination of the contractual relationship, the contractor will either delete all personal data or return it to the controller upon request. This excludes data subject to statutory retention requirements.

Supporting the Contractor in Complying with the Controller's Obligations under Articles 32-36 GDPR

The contractor shall assist the controller, taking into account the nature of the processing and the information available to the contractor, in complying with the obligations set out in Articles 32 to 36 of the GDPR regarding the security of personal data, notification obligations in the event of data breaches, data protection impact assessments and prior consultations.

For support services that are not included in the service description of the user agreement or are due to misconduct on the part of the controller, the contractor may claim reasonable compensation.

Subcontracts

The contractor is entitled to use the subcontractors listed in Appendix 2 for the processing of data on behalf of the controller.

The contractor must conclude a data processing agreement with the subcontractors that complies with the requirements of Article 28 GDPR.

The contractor shall inform the controller of any changes relating to the engagement or replacement of a subcontractor.

Unless the controller raises any objections to new subcontractors within 2 weeks of receiving notification of the new subcontractor, the engagement of the subcontractor shall be deemed approved by the controller.

The contractor may have services provided in whole or in part by subcontractors from a location outside the European Union, provided that the specific requirements of Art. 44 et seq. GDPR are met (e.g., adequacy decision of the Commission, standard contractual clauses, approved codes of conduct).

Amendments

The contractor reserves the right to unilaterally amend this data processing agreement if this appears objectively justified.

Changes are objectively justified, for example, in the case of an expansion or modification of the software provided, a change in the legal or statutory situation (e.g., if the courts declare a clause invalid), or if the equivalence existing at the time of the conclusion of the contract is disrupted to a not insignificant extent by unforeseeable changes that the contractor did not cause and over which the contractor has no influence.

A prerequisite for any change is always that it is reasonable for the controller and does not interfere with their existing right to issue instructions.

Relation to the Terms and Conditions

Unless otherwise specified in this agreement, the provisions of the user agreement (Terms and Conditions) shall apply. In the event of any conflict between this agreement and provisions of other agreements, in particular the user agreement, the provisions of this agreement shall prevail.

Final Provisions

• There are no oral side agreements. Amendments and additions to this contract must be in writing.

• Should individual provisions of this contract be or become invalid, the validity of the remaining provisions shall remain unaffected.