Data Processing Agreement (DPA)

§ 1 Subject Matter, Scope and Duration

(1) The Processor processes personal data on behalf of the Controller in connection with the provision of the SocialEdge software, the optimization and ongoing management of Google Business Profiles, and the support, analytics and communication services agreed in the main agreement.

(2) The subject matter, nature, purpose and scope of the processing, the categories of personal data, the categories of data subjects, the frequency of processing and the permitted processing locations are described in Annex 1. The Annexes form an integral part of this Agreement.

(3) Processing begins no earlier than when this Agreement becomes effective and ends when all personal data processed on behalf of the Controller has been deleted or returned in accordance with § 11. Data protection obligations which by their nature continue to apply, in particular confidentiality, documentation and deletion obligations, remain in force until they have been fully fulfilled.

§ 2 Instructions of the Controller

(1) The Processor processes personal data exclusively on documented instructions from the Controller. This also applies to transfers to a third country or an international organization. The initial instructions arise from the main agreement, this Agreement, Annex 1 and the functions of the SocialEdge software approved by the Controller.

(2) Further instructions shall be issued through approved functions of the software or in text form by the persons authorized to issue instructions as specified in Annex 4. Oral instructions must be confirmed by the Controller in text form without undue delay. The Processor shall document material instructions.

(3) If the Processor is required under Union law or the law of a Member State to carry out processing without instructions from the Controller, the Processor shall inform the Controller of that legal requirement before processing, unless the relevant law prohibits such information on important grounds of public interest.

(4) If the Processor considers an instruction to be unlawful, it shall inform the Controller without undue delay. The Processor may suspend implementation of an obviously unlawful instruction until it is confirmed, amended or legally clarified.

(5) Instructions that materially expand the agreed scope of services may be charged separately after prior information about the expected effort. Statutory minimum obligations under this DPA remain unaffected.

§ 3 Obligations of the Controller

(1) The Controller is responsible for the lawfulness of the collection, processing and provision of personal data, the lawfulness of its instructions, compliance with information obligations and the protection of data subject rights.

(2) The Controller shall limit the data provided to what is necessary for the commissioned purposes and shall not transmit access passwords, health data, patient data, criminal offense data or other particularly sensitive data unless this has been expressly agreed in advance and secured by additional safeguards.

(3) As reviews, free-text fields or attachments may unintentionally contain special categories of personal data pursuant to Art. 9 GDPR or data pursuant to Art. 10 GDPR, their unsolicited occurrence alone does not constitute agreed systematic processing of such data. The Parties shall coordinate the further procedure without undue delay; until then, such data shall only be secured, restricted and not evaluated for other purposes.

(4) The Controller shall designate persons authorized to issue instructions and conduct audits, keep their contact details up to date and inform the Processor without undue delay of any identifiable errors, personal data breaches or irregularities.

§ 4 Obligations of the Processor

(1) The Processor processes data only within the contractually agreed scope and shall not use it for its own advertising, profiling, sale of data or the training of its own or third-party general-purpose AI models.

(2) The Processor shall only use persons who are bound by confidentiality or are subject to an appropriate statutory duty of confidentiality and who have been informed of the data protection and security requirements relevant to their tasks. Access shall be granted according to the principle of necessity.

(3) Where required by law, the Processor shall maintain a record of processing activities carried out on behalf of the Controller and cooperate with the competent supervisory authority.

(4) The Processor shall ensure that persons authorized to access personal data process such data only on documented instructions, unless processing is required by law.

(5) Personal or confidential customer data may only be processed via the approved business API or enterprise solutions listed in Annex 3. Entry into private, free or otherwise unapproved AI interfaces, in particular personal ChatGPT, Claude or Gemini accounts, is prohibited.

§ 5 Technical and Organizational Measures

(1) Before processing begins and throughout its duration, the Processor shall implement appropriate technical and organizational measures pursuant to Art. 32 GDPR. The measures agreed at the time of conclusion of the Agreement are set out in Annex 2 in the version stated therein.

(2) The measures shall take into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the likelihood and severity of risks to data subjects.

(3) The Processor may adapt the measures to technical developments provided that the overall agreed level of protection is not reduced. Material changes that increase risk shall be communicated to the Controller in advance or, where this is not possible for security reasons, without undue delay afterwards.

(4) By entering into this Agreement, the Controller confirms that it has reviewed the measures described in Annex 2 in light of its own processing activities and risks and considers them appropriate at the time of conclusion of the Agreement.

§ 6 Assistance and Data Subject Rights

(1) If the Processor receives a request from a data subject, it shall not respond itself but shall forward the request to the Controller without undue delay, unless expressly authorized to respond.

(2) Taking into account the nature of the processing, the Processor shall assist the Controller through appropriate technical and organizational measures with access, rectification, erasure, restriction, data portability, objection and other data subject rights.

(3) Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in complying with Articles 32 to 36 GDPR, in particular with risk assessments, data protection impact assessments, prior consultation and security evidence.

(4) The Processor shall provide available information necessary to fulfill these obligations without undue delay. Exceptional additional work beyond the statutory minimum level of assistance may be reasonably charged after prior agreement.

§ 7 Personal Data Breaches

(1) The Processor shall notify the Controller of any personal data breach without undue delay after becoming aware of it, using the reporting channel specified in Annex 4. Notification may not be postponed until completion of the internal investigation.

(2) To the extent available, the notification shall include: the nature and time of the incident, affected systems, categories and approximate number of affected data subjects and records, likely consequences, measures already taken or proposed, the data protection contact point and the status of the investigation. Missing information shall be provided without undue delay.

(3) The Processor shall take appropriate measures without undue delay to contain the incident, preserve evidence, analyze causes and prevent further damage, document the incident and assist the Controller with its notification and communication obligations.

(4) The decision as to whether notification to a supervisory authority or communication to affected data subjects is required shall be made by the Controller where SocialEdge acts as Processor in the specific matter.

§ 8 Subprocessors

(1) The Controller grants general written authorization for the use of the subprocessors listed in Annex 3 for the activities specified therein.

(2) The Processor shall inform the Controller in text form at least 14 calendar days before first engaging or replacing a subprocessor. The information shall include at least the name, address or registered office, purpose of processing, data categories, processing location and, where applicable, the mechanism used for third-country transfers.

(3) The Controller may object within this period for an important and objectively justified data protection reason. The Parties shall seek an appropriate alternative. If no reasonable alternative is available, the Controller may terminate the specifically affected service for cause before the new subprocessor is engaged; further statutory rights remain unaffected.

(4) The Processor shall contractually impose essentially the same data protection obligations on each subprocessor. It remains fully responsible to the Controller for the subprocessor’s performance of those obligations and shall inform the Controller of material breaches.

(5) Upon request, the Processor shall provide information regarding subprocessors and, where required, a copy of the relevant data protection provisions. Trade secrets, security details and personal data of third parties may be appropriately redacted.

§ 9 Third-Country Transfers

(1) Transfers to third countries shall take place exclusively on documented instructions and in compliance with Chapter V GDPR. The general designation “DPF/SCC” does not replace an assessment of the transfer mechanism actually applicable in the individual case.

(2) Where a recipient is validly certified under the EU-US Data Privacy Framework and the specific processing is covered by that certification, the transfer may be based on that framework. Otherwise, the applicable EU Standard Contractual Clauses, required transfer impact assessments and appropriate supplementary measures shall in particular be used.

(3) The Processor shall document the transfer mechanism used and, upon request, provide the Controller with the necessary evidence, unless prevented from doing so by statutory, security-related or contractual confidentiality obligations.

§ 10 Evidence and Audits

(1) The Processor shall make available all information necessary to demonstrate compliance with Art. 28 GDPR. Current technical and organizational measures documentation, certificates, audit reports, self-assessments and excerpts from subprocessor agreements may be used as primary evidence.

(2) The Controller may conduct reasonable audits itself or through an independent, qualified auditor bound by confidentiality. On-site audits shall generally be announced at least 14 business days in advance, conducted during normal business hours and limited to what is necessary.

(3) In the event of a specific data protection incident, reasonable suspicion of a material breach of obligations or an order from a supervisory authority, the regular notice period may be waived.

(4) Audits may not unreasonably interfere with business operations, the rights of other customers, trade secrets or system security. The Controller shall bear its own audit costs; necessary additional work demonstrably caused solely by a material breach by the Processor remains unaffected.

§ 11 Return, Deletion and End of Contract

(1) Upon completion of the commissioned services, the Processor shall, at the Controller’s choice, delete or return the personal data and copies under its control, unless a statutory retention obligation or another permissible legal basis requires temporary further storage.

(2) Operational app, ranking, review, support and Google Business Profile data shall generally be deleted or anonymized within 90 days after the end of the contract. Support uploads and evidence shall generally be deleted 90 days after completion of the relevant matter unless required for an ongoing Google procedure, legal defense or a statutory obligation.

(3) Data contained in technically necessary backups shall be overwritten or deleted according to the regular backup cycle, no later than within 90 days, and shall not be processed for productive purposes until then except for restoration or compliance with legal obligations.

(4) Data subject to retention obligations shall be separated from ongoing processing or its use shall be restricted and it shall be processed solely for the applicable retention or documentation purpose.

(5) Content and optimizations already published in the Google Business Profile or on other platforms remain within the Controller’s area of responsibility and under the Controller’s control. Their deletion from SocialEdge systems does not reverse previously published profile changes.

(6) Upon request, the Processor shall confirm completion of deletion in text form. Statutory rights and obligations relating to documentation under this Agreement remain in force until expiry of the applicable period.

§ 12 Liability

(1) Art. 82 GDPR shall apply to the Parties’ liability toward data subjects. Internal allocation of responsibility shall be governed by statutory provisions and the respective contribution to responsibility.

(2) In all other respects, the liability provisions of the main agreement shall apply only insofar as they do not conflict with mandatory data protection law and do not restrict the rights of data subjects.

§ 13 Final Provisions

(1) In the event of contradictions, the provisions of this DPA shall prevail with regard to the processing of personal data on behalf of the Controller. Individual instructions may not waive statutory minimum requirements.

(2) Amendments and supplements to this Agreement, including its Annexes, require at least text form. Electronic form and verifiable execution via a contract or signature platform are sufficient.

(3) German law shall apply. Jurisdiction clauses in the main agreement shall apply insofar as they are valid and do not affect mandatory data protection jurisdiction.

(4) Should individual provisions be or become invalid, the validity of the remaining provisions shall remain unaffected. The Parties shall replace the invalid provision with a valid provision that comes as close as possible to the intended data protection purpose.

Annex 1 – Description of Processing

1. Subject Matter and Purpose

Provision and administration of the SocialEdge software; authorized management and optimization of Google Business Profiles; creation, approval and publication of profile content and review responses; analysis of rankings, visibility and interactions; support with suspensions, restrictions and video verification; in Plan 3, review and reporting of demonstrably false or reputation-damaging factual claims; support and technical troubleshooting.

2. Nature of Processing

• Collection, recording, organization, storage, structuring and retrieval;
• Comparison, analysis, calculation and presentation of ranking, visibility and interaction data;
• Creation, adaptation, approval, transmission and publication of profile content and review responses;
• Management of profile, location, product, service, opening-hours and contact data;
• Communication with the Controller and, where instructed and technically possible, with Google;
• Restriction, export, anonymization and deletion.

3. Categories of Personal Data

• Master, business and contact data of the Controller and its users;
• User account, role, authorization and authentication data; customer passwords are not stored as a regular part of the service;
• Location, profile, product, service, opening-hours and other business profile data;
• Review and interaction data, in particular names/pseudonyms and content of reviewers as well as review responses;
• Posts, images, videos, documents and other content provided by the Controller;
• Support, chat, email and communication data including attachments and evidence;
• Usage, log, device, security and metadata, in particular timestamps, IP addresses, activities and error data;
• Ranking, visibility, competitor and aggregated Google interaction data.

4. Categories of Data Subjects

• Owners, corporate officers, employees, representatives and users of the Controller;
• Customers, prospects, website or location visitors and other end customers of the Controller;
• Reviewers and other persons interacting with the Google Business Profile;
• Contact persons at Google or other platforms used by the Controller.

5. Special Categories and Criminal Offense Data

Systematic processing of special categories of personal data pursuant to Art. 9 GDPR or personal data relating to criminal convictions and offenses pursuant to Art. 10 GDPR is not agreed. Such data may appear unintentionally in reviews, free-text fields or attachments; § 3 para. 3 and the Controller’s instructions shall apply in such cases.

6. Duration and Frequency

Regular processing during the term of the main agreement and any subsequent free guarantee extension; subsequent return or deletion pursuant to § 11. Ranking scans, profile updates and publications shall take place at the frequency agreed in the main agreement or software.

7. Processing Locations

Germany, EU/EEA and the processing locations specified in Annex 3. Access from or transfers to third countries are permitted only in accordance with § 9 and the transfer mechanism documented for the respective subprocessor.

Annex 2 – Technical and Organizational Measures (TOMs)

Version: 30 July 2026. This Annex describes the minimum technical and organizational standard to be maintained by SocialEdge.

1. Data Protection Organization and Responsibilities

• Designated data protection contact point and documented responsibilities within SocialEdge;
• Confidentiality obligations for all persons authorized to access data before their first access;
• Regular awareness training regarding data protection, phishing, access security and data protection incidents;
• Records of relevant processing activities, deletion concept and documented incident-response process;
• Regular review of subprocessors and their data protection terms.

2. Physical Access and Device Protection

• Protection of work premises against unauthorized access; no unattended disclosure of customer data;
• Device encryption, automatic screen locking and password-protected user accounts;
• Timely security updates for operating systems, browsers and applications used;
• Protection against malware and the ability to lock or erase lost devices where technically available;
• No processing via publicly accessible or uncontrolled devices.

3. Access and Authorization Controls

• Individual user accounts; no sharing of personal login credentials;
• Multi-factor authentication for administrative cloud, Google and code/deployment access where supported by the service;
• Strong, unique passwords and a protected password manager;
• Role- and task-based permissions according to the need-to-know and least-privilege principles;
• Regular review of privileged access at least quarterly and immediate revocation of rights that are no longer required;
• The customer remains the owner/primary owner of its Google Business Profile; SocialEdge receives only the manager or API permissions required.

4. Transmission, Input and Disclosure Controls

• Encrypted data transmission using current TLS connections;
• No transfer of personal customer data via unapproved private communication or AI accounts;
• Documentation of material recipients, API permissions and administrative profile changes where technically available;
• Secure transmission of particularly sensitive attachments; avoidance of unencrypted public links;
• Verification of recipients before manual data transfers.

5. Storage, Tenant Separation and Segregation Controls

• Logical separation of customer data through user-, tenant-, role- or document-based security rules;
• Server-side authorization checks; restrictions implemented only at the user-interface level are insufficient;
• Separation of development, testing and production environments; production personal data is avoided in tests or anonymized/pseudonymized beforehand;
• Encryption of stored data by the cloud providers used according to their documented standards;
• API keys and other secrets are not stored in publicly accessible source code.

6. Availability, Resilience and Recovery

• Use of professional cloud infrastructure with documented availability and backup mechanisms;
• Appropriate data backup or recovery mechanisms for business-critical data;
• Rate limiting, security rules and monitoring for publicly accessible interfaces where technically relevant;
• Documented procedures for disruptions, security incidents and recovery;
• Regular verification of recoverability and administrative emergency access.

7. Logging and Security Controls

• Logging of administrative and security-relevant events where technically available;
• Protection of logs against unauthorized modification and access;
• Limited retention of security logs according to a documented deletion concept;
• Regular review of suspicious access, error messages and failed authentication attempts;
• Documented remediation and tracking of identified security vulnerabilities.

8. Deletion and Data Minimization

• Collection and storage only of data required for the respective purpose;
• Deletion and retention rules according to data category; operational customer data generally in accordance with § 11;
• Revocation of manager, API and software access after termination of the contract;
• Deletion or anonymization of temporary exports, screenshots and support attachments after completion of their purpose;
• Data subject to retention obligations is restricted and is not further used for operational or advertising purposes.

9. AI-Specific Measures

• Personal customer data only via expressly approved business API/enterprise solutions;
• No use for model training or general product improvement where this can be controlled through provider settings and contractual terms;
• Data minimization, pseudonymization and removal of unnecessary identifiers before transfer to AI services;
• No entry of login credentials, authentication secrets or complete customer files;
• Human review before publication of AI-assisted content or review responses;
• Documentation of approved AI providers in Annex 3.

Annex 3 – Approved Subprocessors

The Controller authorizes the subprocessors listed below. For transfers outside the EU or EEA, the specific transfer mechanism applicable in each case pursuant to § 9 of this Agreement shall apply.

Not automatically covered by this DPA: Payment processing, SocialEdge’s own accounting, website operation, appointment booking and self-promotion are generally SocialEdge’s own processing activities and are not subprocessed on behalf of the customer merely for that reason. Google, as operator of the Google Business Profile held by the customer, may act as an independent Controller depending on the specific activity. These roles shall be reassessed in the event of material product changes.

Figma / native AI features: As long as no personal customer data is processed there on behalf of the Controller, Figma is not included in the above list for this purpose. Before any such use, Figma must be assessed as a subprocessor, announced in advance pursuant to § 8 and, where available, use for training/content training must be disabled.

Annex 4 – Contacts, Instructions and Customer-Specific Provisions

By signing or providing verifiable electronic consent, the Parties confirm that they have received and reviewed this DPA, including its Annexes, and agreed to it as part of the main agreement.

Legal basis and guidance: Art. 28 GDPR and the Standard Contractual Clauses between controllers and processors pursuant to Commission Implementing Decision (EU) 2021/915. The Parties shall review the Annexes in the event of material changes to the technical configuration, subprocessors or processing activities and update them where necessary.