Data Processing Agreement (DPA)

Binding version, adopted unchanged from our collection of legal texts. Questions about it are answered at datenschutz@zepdesk.de.

This English text is a convenience translation. The legally binding version is the German original.

Data Processing Agreement (DPA) pursuant to Art. 28 DSGVO (GDPR) for the use of ZepDesk. As of: 2026-04-25

Preamble

This Data Processing Agreement (hereinafter "DPA") specifies the parties' data protection obligations arising from the provision and use of the ZepDesk platform agreed in the main contract ("usage contract").

The controller within the meaning of Art. 4 No. 7 DSGVO (GDPR) is the Customer, hereinafter "Client".
The processor within the meaning of Art. 4 No. 8 DSGVO (GDPR) is ZeptronIT UG (haftungsbeschränkt), hereinafter "Contractor".

§ 1 Subject Matter and Duration of the Order

(1) The subject matter of the processing is the provision of the SaaS platform ZepDesk, including the associated storage, processing and provision of the data entered by the Client.

(2) Nature and purpose: ERP and accounting functions, customer management, quotes, invoices, delivery notes, payment reconciliation, reporting.

(3) Duration: The duration corresponds to the term of the usage contract plus a 30-day grace period for the data export.

§ 2 Scope, Nature and Purpose of the Collection, Processing and Use

(1) Types of data:

• Master data (name, address, email, phone) of the Client's end customers, suppliers and employees
• Communication data from the invoicing and quotation process
• Contract and billing data
• Bank details, insofar as entered by the Client
• Content data from documents, attachments and notes

(2) Categories of data subjects:

• Employees and users of the Client
• Customers, prospects, suppliers of the Client
• Other business partners of the Client whose data is recorded

(3) Purpose: Operation of the ERP/accounting functions for the Client.

§ 3 Obligations of the Contractor

The Contractor undertakes:

1. to process data exclusively on the documented instructions of the Client. Instructions are given in particular through the provisions of this agreement, through specific individual instructions of the Client, or through functions that the Client controls itself via the platform.
2. to comply with the technical and organizational measures (TOM) referred to in Art. 32 DSGVO in accordance with Annex 1 of this agreement.
3. to obligate all persons engaged in data processing to confidentiality (Art. 28 para. 3 lit. b, Art. 29, Art. 32 para. 4 DSGVO).
4. to inform the Client without undue delay in the event of data breaches (Art. 33 para. 2 DSGVO), so that the Client can fulfill its own notification obligations under Art. 33 DSGVO.
5. to support the Client in fulfilling requests and claims of data subjects (Art. 12 et seq. DSGVO).
6. to support the Client with data protection impact assessments and consultations with the supervisory authorities (Art. 35, 36 DSGVO).
7. after completion of the provision of the processing services, to return or delete all personal data at the Client's choice, unless there is an obligation to store the data under Union law or the law of the Member States.

§ 4 Obligations of the Client

The Client is the controller within the meaning of Art. 4 No. 7 DSGVO. In particular, the Client is obliged:

• to ensure the lawfulness of the processing (legal basis, obtaining consents where applicable);
• to safeguard the rights of data subjects (access, rectification, erasure, objection);
• to issue instructions clearly and in documented form;
• to inform the Contractor without undue delay if it detects errors or irregularities in the processing.

§ 5 Sub-Processing Relationships

(1) The Client consents to the use of the following sub-processors:

Sub-processor	Service	Location
Hetzner Online GmbH	Server hosting, storage, network	EU
Mollie B.V.	Payment processing (SEPA, card)	Netherlands (EU)
Let's Encrypt (ISRG)	SSL certificate issuance	USA (Standard Contractual Clauses)

(2) The Contractor will announce new sub-processors in writing at least 30 days before their use. The Client can object within 14 days; in this case, the Client can terminate the contract extraordinarily.

(3) The Contractor contractually obligates the sub-processors to a level of protection that at least corresponds to that of this DPA.

§ 6 Technical and Organizational Measures (TOM), Annex 1

6.1 Confidentiality (Art. 32 para. 1 lit. b DSGVO)

• Physical access control: Hetzner server rooms, multi-level access control (video surveillance, access cards, biometric procedures). ISO 27001-certified.
• System access control: SSH only via Ed25519 key, no password login. Two-factor authentication for the Contractor's admins. Passwords are stored as bcrypt/scrypt hashes.
• Data access control: A separate, isolated database per customer. Role-based permission system within the customer instance. Complete audit log.
• Separation control: Multi-tenancy at the database level (a separate schema namespace per customer), not at row level. No shared database.
• Pseudonymization: IP addresses in the server log are anonymized after 7 days.

6.2 Integrity (Art. 32 para. 1 lit. b DSGVO)

• Transfer control: Encryption in transit (TLS 1.2/1.3) and at rest (AES-256 for password fields, backups encrypted with customer-specific keys).
• Input control: Every change is recorded with a timestamp and user ID in the audit log.

6.3 Availability and Resilience (Art. 32 para. 1 lit. b DSGVO)

• Availability control: Daily automatic backups, 30 days retention, restore tests at least weekly. Auto-scaling via the Hetzner Cloud API.
• Rapid recoverability: Recovery Point Objective (RPO) ≤ 24h, Recovery Time Objective (RTO) ≤ 4h.

6.4 Procedure for Regular Review (Art. 32 para. 1 lit. d DSGVO)

• Internal security reviews at least semi-annually
• Penetration tests for major changes to the platform
• Dependencies (third-party libraries) monitored via Dependabot
• Incident response plan and emergency contacts documented

§ 7 Client's Audit Rights

(1) The Client has the right to verify the Contractor's compliance with its data protection obligations by means of random checks. Upon request, the Contractor provides suitable evidence (e.g. TOM documentation, certificates of the sub-processors).

(2) On-site inspections by the Client are permitted with reasonable advance notice (min. 14 days), during normal business hours and while safeguarding operational procedures. The Client bears the costs of the on-site inspection itself.

§ 8 Liability

The parties are liable for damages arising from the processing of data within the meaning of this DPA in accordance with Art. 82 DSGVO. The limitation of liability in § 9 of the main contract (GTC) remains unaffected, insofar as it is permitted under the DSGVO.

§ 9 Final Provisions

(1) This DPA ends upon termination of the main contract. Data protection obligations that by their nature continue beyond the termination of the contract (in particular deletion obligations) remain unaffected.

(2) In the event of conflicts between this DPA and the main contract, the DPA takes precedence in matters of data protection.

(3) German law applies.

AUDIT TRAIL ................