Data Processing Agreement (DPA)

This Data Processing Agreement (hereinafter “DPA”) forms part of the contractual relationship between the customer (hereinafter “Controller”) and flow office GmbH, Beethovenstraße 8, 67098 Bad Dürkheim (hereinafter “Processor”, together the “Parties”) concerning the use of the OMVIN software (“Service”).

Section 1 Scope and relationship to the main contract

To the extent that personal data is processed on behalf of the controller in the course of providing the services, the provisions of this DPA shall supplement the relevant main agreement (in particular, the General Terms and Conditions and any existing individual agreements). The DPA governs the processing of personal data in accordance with Article 28 of the GDPR. In the event of any conflicts between this DPA and the main agreement, this DPA shall prevail.

§ 2 Subject matter and duration of processing

The subject matter of the processing is the processing of personal data carried out by the controller in connection with the services, in particular in relation to the management of projects, processes, customers, employees, time and documents. The processing shall take place during the term of the main contract and shall end upon its termination, without prejudice to statutory retention obligations.

§ 3 Scope, nature and purpose of processing

The processor shall process the personal data solely in accordance with instructions and for the purpose of providing the services in accordance with the contract. The nature and scope of the processing are set out in the main contract and this DPA.

• Types of personal data: master data (e.g. name, address), contact details (e.g. email address, telephone number), account data, content data and usage data.
• Categories of data subjects: Customers, prospective customers, employees and other persons whose data are processed in the course of providing the service.

§ 4 Obligations of the order processor

The processor undertakes, in particular, to:

• to process personal data only in accordance with the documented instructions of the controller (Article 28(3), second subparagraph, point (a), GDPR);
• to ensure the confidentiality of the personal data and to ensure that persons authorised to process them have committed themselves to confidentiality (Article 28(3), second subparagraph, point (b), GDPR);
• to take all necessary technical and organisational measures, taking into account Article 32 GDPR (Article 28(3), second sentence, point (c), GDPR);
• to comply with the conditions laid down in Article 28(2) and (4) GDPR for engaging sub-processors (Article 28(3), second subparagraph, point (d), GDPR);
• to assist the controller, taking into account the nature of the processing, by means of appropriate technical and organisational measures, in so far as this is possible, in fulfilling the controller’s obligations to respond to requests from data subjects exercising their rights of access, rectification, erasure, restriction of processing, data portability and objection (Article 28(3), second subparagraph, point (e) GDPR);
• to support the controller in complying with the obligations pursuant to Articles 32 to 36 GDPR (Article 28(3), second subparagraph, point (f), GDPR);
• at the controller’s discretion, to delete or return all personal data after completion of the service and to delete any existing copies (Article 28(3), second sentence, point (g) GDPR);
• to provide the controller with all information necessary to demonstrate compliance with the obligations and to enable audits (Article 28(3), second subparagraph, point (h) GDPR).

§ 5 Right to Issue Instructions and Duty to Notify

The controller shall issue instructions to the processor. Any amendments or additions to the instructions shall be made in writing or in text form. The processor shall inform the controller without undue delay if an instruction from the controller breaches data protection legislation.

If the processor determines that the processing of personal data violates the GDPR or other data protection regulations, they must inform the controller without undue delay.

§ 6 Sub-processors

The processor may engage sub-processors only with the controller’s prior specific or general written authorisation (Article 28(2) GDPR). The controller may request up-to-date information about the sub-processors engaged from the processor at any time.

If the processor engages a sub-processor, it must ensure that the same data protection obligations as those set out in this DPA are imposed on the sub-processor (Article 28(4) GDPR). If the sub-processor fails to comply with its data protection obligations, the processor shall remain fully liable to the controller.

§ 7 Rights of data subjects

The processor shall assist the controller, in accordance with Article 28(3), second subparagraph, point (e) of the GDPR, in fulfilling requests from data subjects. The processor shall promptly forward to the controller any requests from data subjects it receives directly.

§ 8 Notification of Personal Data Breaches

The processor shall notify the controller of any personal data breach without undue delay and, where possible, within 72 hours of becoming aware of it, in accordance with Article 33(2) of the GDPR. The notification shall be sent to: info@omvin.ai.

§ 9 Technical and organisational measures

The processor has implemented appropriate technical and organisational measures in accordance with Article 32 of the GDPR to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons. These measures include, among other things, the pseudonymisation and encryption of personal data, measures to ensure the confidentiality, integrity, availability and resilience of systems, and the ability to restore the availability of personal data promptly in the event of a physical or technical incident. The controller may request details of these measures from the processor.

Section 10 Audit rights of the controller

The Controller has the right to verify, by means of appropriate audits or inspections, that the Processor is complying with the obligations set out in this DPA (Article 28(3)(h) GDPR). The Processor shall provide the Controller with the information required for this purpose. Upon request, the documents shall be made available to the extent necessary to demonstrate compliance with the obligations.

Section 11 Transfers to third countries

The processor shall transfer personal data to a third country only on the documented instructions of the controller, provided that the requirements of Articles 44 et seq. of the GDPR are met.

§ 12 Termination and Deletion

Upon completion of the service, the processor shall, at the controller’s choice, delete or return all personal data to the controller and delete any existing copies, unless there is a legal obligation to retain them.

§ 13 Liability

The liability of the parties shall be governed by the provisions of the main contract and applicable statutory provisions. The processor shall be liable, in accordance with applicable statutory provisions and the main contract, for any loss or damage suffered by the controller as a result of a breach of its obligations under this DPA.

§ 14 Final Provisions

The laws of the Federal Republic of Germany shall apply. Should any individual provisions of this DPA be invalid, the validity of the remaining provisions shall remain unaffected. The invalid provision shall be replaced by a valid provision that most closely reflects the economic purpose of the invalid provision.

Section 15 Contact

For questions about this data processing agreement, please contact: info@omvin.ai or flow office GmbH, Beethovenstraße 8, 67098 Bad Dürkheim.