Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is entered into by and between
the Customer ("Controller")
and
LOADIA GmbH ("Processor")
pursuant to Article 28 of the General Data Protection Regulation (GDPR).

1. Subject Matter and Duration

(1) The subject matter of this DPA is the performance of services by the Processor for the Controller as described in the Service Agreement (providing a SaaS platform).

(2) The duration of this DPA corresponds to the duration of the Service Agreement.

2. Nature and Purpose of Processing

The nature and purpose of the processing of personal data by the Processor are defined in the Service Agreement. Processing operations include collection, recording, organization, structuring, storage, and retrieval of data.

3. Types of Personal Data and Categories of Data Subjects

(1) Types of Data: Contact details (name, email, phone), usage data, content data.

(2) Categories of Data Subjects: Customers of the Controller, employees of the Controller, leads.

4. Rights and Obligations of the Controller

(1) The Controller is solely responsible for assessing the admissibility of the processing pursuant to Art. 6 (1) GDPR and for safeguarding the rights of data subjects.

(2) The Controller has the right to issue instructions concerning the nature, scope, and method of data processing.

5. Obligations of the Processor

(1) The Processor shall process personal data only within the scope of the agreement and in accordance with the Controller's documented instructions.

(2) The Processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Technical and Organizational Measures

The Processor has implemented appropriate technical and organizational measures (TOMs) pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. Evidence of these measures will be provided to the Controller upon request.

7. Sub-processing

The Processor is authorized to engage sub-processors. The Processor shall inform the Controller in advance of any intended changes concerning the addition or replacement of other processors.