Data Processing Agreement (DPA)

• The processor processes personal data on behalf of the controller solely to provide the services under the main agreement (document management, automatic extraction, booking suggestions, client portal, export to DATEV or Lexware Office). The nature and purpose of the processing, the types of data and the categories of data subjects are set out in Annex 1.
• The DPA applies for the term of the main agreement and beyond for as long as the processor processes personal data of the controller.
• The DPA is concluded electronically (Art. 28(9) GDPR) when the customer expressly accepts it during registration or in the platform. The provider records the version, the time and the accepting person. The customer can access and save the text at this address at any time.
• In the event of conflict, this DPA takes precedence over the data protection provisions of the main agreement.

• The processor processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case it informs the controller of that legal requirement before processing, unless that law prohibits such information.
• Instructions are given by the main agreement, this DPA and the use of the platform's functions by the customer and its users (e.g. uploading, approving, exporting, deleting). The controller gives further instructions in text form to info@myrobotax.de.
• If the processor considers that an instruction infringes data protection law, it informs the controller without delay. It may suspend the instruction until the controller confirms or amends it.

• The processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• As the controller is bound by professional secrecy (§ 57(1) StBerG, § 203 StGB), the processor additionally undertakes the obligations in Annex 4 (§ 62a StBerG).

• The processor implements the technical and organisational measures required by Art. 32 GDPR (Annex 2).
• The measures are subject to technical progress. The processor may replace them with equivalent or better measures; the contractually agreed level of protection must not be reduced. Material changes are documented in Annex 2.

• The controller grants general authorisation to engage further processors. The sub-processors engaged at the time of conclusion are listed in Annex 3 and are deemed approved.
• The processor informs the controller in advance in text form of any intended addition or replacement of a sub-processor (e-mail to the account holder's address or notice in the platform). The controller may object for an important data protection reason within 14 days of receipt. If the parties cannot agree, the controller may terminate the main agreement with effect from the date the new sub-processor is engaged.
• The processor imposes on each sub-processor by contract essentially the same data protection obligations as set out in this DPA (Art. 28(4) GDPR). It remains liable to the controller for the sub-processor's compliance with these obligations.
• Services initiated by the customer itself and provided by a third party under its own responsibility are not sub-processing, in particular transfers to DATEV or Lexware Office via the interfaces set up by the customer.

The database and file storage are located in the European Union (Frankfurt am Main). Where a sub-processor processes data in a third country or access from a third country is possible, this takes place only where the conditions of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (e.g. the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. The respective basis is stated in Annex 3.

• The processor assists the controller with appropriate technical and organisational measures in fulfilling data subject rights (Art. 12–23 GDPR). The platform provides functions to find, export, rectify and delete data for this purpose. If a data subject contacts the processor directly, it forwards the request to the controller without delay.
• Taking into account the information available to it, it assists the controller in complying with the obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation).

• The processor notifies the controller of a personal data breach without undue delay, where possible within 24 hours of becoming aware of it, in text form to the account holder's address.
• The notification contains, as far as known, the information under Art. 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records, contact point, likely consequences, measures taken or proposed). Information not yet available is provided without further undue delay.
• The processor takes the measures necessary to secure the data and mitigate possible adverse effects without delay.

• After termination of the main agreement, the controller may download its data within 30 days using the platform's export functions or on request. The processor then deletes the controller's personal data unless Union or Member State law requires storage.
• During the term, the platform retains approved or exported documents even after deletion by the customer, to enable the customer to meet its retention obligations (§ 147 AO, § 257 HGB); they are no longer visible to users. On the controller's instruction they are deleted or handed over earlier.
• Backups are deleted within their regular rotation cycles. Deletion is confirmed in text form on request.

• The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA, its annexes and evidence from the sub-processors (e.g. certifications and audit reports, insofar as they provide them).
• The controller may carry out audits, including inspections, itself or through an auditor bound to confidentiality. Inspections must be announced with reasonable notice, as a rule four weeks, take place during normal business hours and must not disrupt operations disproportionately. Audits at sub-processors are subject to their terms.

Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the main agreement apply unless Art. 82 GDPR mandatorily provides otherwise.

• The provider notifies the customer of amendments to this DPA in text form; the amended version takes effect only once the customer accepts it again. Changes to Annexes 2 and 3 are governed by § 4 and § 5.
• Should any provision of this DPA be invalid, the validity of the remaining provisions is not affected.
• The law of the Federal Republic of Germany applies. Place of jurisdiction is Berlin, to the extent permitted by law.
• This DPA is concluded in German. Translations are for information only.

• The processor undertakes to maintain secrecy about all facts that come to its knowledge in providing the services to the controller. It will obtain knowledge of third-party secrets only to the extent necessary to perform the contract (§ 62a(3) StBerG).
• The processor has been informed that it may be liable to prosecution under § 203(4) StGB if it discloses without authorisation a third-party secret that has come to its knowledge in providing the services (§ 62a(3) StBerG).
• The processor may involve further persons in performing the contract only if it has bound them to secrecy in text form and informed them of the criminal consequences; this applies to its own staff and to sub-processors (§ 62a(3) StBerG).
• Where the service is provided abroad, this is permitted only if the protection of secrets there is comparable to that in Germany, unless such protection is not required for the secrets (§ 62a(4) StBerG). The controller assesses this on the basis of the information in Annex 3; the processor provides further information on request.
• Where the service directly serves an individual engagement, the controller may give the processor access to third-party secrets only if the client has consented (§ 62a(5) StBerG); obtaining that consent is the controller's responsibility.