Data Processing Agreement (DPA)

1. Parties

1.1 The controller is the customer as specified in the main contract, the order or the customer account (hereinafter the “Customer”).

1.2 The processor is SimpliServ GmbH, Gewerbepark West 2a, 8504 Preding, Austria, FN 676594t, Regional Court for Civil Matters Graz (Landesgericht für ZRS Graz), VAT ID ATU83276107, represented by its managing director Luca Malli (hereinafter “SimpliServ”).

1.3 SimpliServ provides the Customer with the SimpliServ software as software-as-a-service (hereinafter the “Main Contract”: the General Terms and Conditions of SimpliServ GmbH together with the order or an individual SaaS contract). In doing so, SimpliServ processes personal data on behalf of the Customer. This agreement applies to all activities in which SimpliServ, its employees or sub-processors come into contact with the Customer's personal data.

2. Subject Matter and Term

2.1 SimpliServ processes personal data on behalf of the Customer in order to provide, operate and maintain the SimpliServ software and to support the Customer (support, setup, data import, training).

2.2 This agreement remains in force for as long as the Main Contract is in force and thereafter until SimpliServ has deleted or returned all of the Customer's data in accordance with Section 12.

3. Nature, Purpose, Types of Data and Data Subjects

3.1 Nature of processing: collection, storage, organisation, alteration, retrieval, use, disclosure by transmission (at the Customer's instigation), restriction and erasure.

3.2 Purpose: operation of the functions used by the Customer, in particular customer and vehicle management, orders and tickets, appointments, quotes, invoices and point of sale, payments, inventory and purchasing, communication with end customers (email, SMS, WhatsApp, telephone), staff scheduling, time recording and personnel records, signatures, reports and AI-supported functions, insofar as the Customer activates them.

3.3 Types of data: master and contact data (name, address, email, telephone, company, VAT ID); contract, order and vehicle data (e.g. registration number, vehicle identification number, repair history); invoicing, payment and bank data (IBAN, SEPA mandates, payment status); communication content (messages, emails, call recordings and transcripts, insofar as activated); the Customer's employee data (staff schedule, working hours, absences, employment contracts, payroll and tax data, insofar as recorded); signatures, photos, documents and files uploaded by the Customer; access and log data (user account, IP address, time, activities).

3.4 Data subjects: end customers and prospective customers of the Customer, employees and job applicants of the Customer, suppliers and business partners of the Customer and their contact persons, users of the software.

3.5 Special categories of personal data pursuant to Art. 9 GDPR are not processed as a matter of course. If the Customer records such data (e.g. sick leave), the Customer shall ensure that a legal basis exists.

4. Instructions

4.1 SimpliServ processes the data only on documented instructions from the Customer, unless required to do so by Union or Member State law. In such a case, SimpliServ shall inform the Customer of that legal requirement beforehand, unless that law prohibits such information.

4.2 The instructions are set out in this agreement, the Main Contract and the settings the Customer configures in the software. The Customer issues individual instructions in text form (email is sufficient).

4.3 If SimpliServ considers an instruction to be unlawful, it shall inform the Customer without undue delay and may suspend its execution until the matter has been clarified.

4.4 SimpliServ does not use the data for its own purposes. In particular, the data is neither sold nor used to train AI models. Anonymised usage statistics that cannot be related to individuals may be used to operate and improve the software.

5. Place of Processing

5.1 Servers, databases and backups are located in Germany. Individual services listed in Annex 1 may also process data outside the EU or the EEA; clause 5.2 applies to them.

5.2 A transfer to a third country takes place only if the conditions of Art. 44 et seq. GDPR are met (adequacy decision, in particular the EU-US Data Privacy Framework, or standard contractual clauses). Annex 1 lists the sub-processors concerned.

6. Confidentiality

6.1 All persons at SimpliServ who have access to the data have committed themselves in writing to confidentiality (data secrecy pursuant to § 6 DSG, Austrian Data Protection Act). This obligation continues after their engagement ends.

6.2 Access to customer data is granted only to persons who require it for their tasks, in particular for support at the Customer's request.

7. Technical and Organisational Measures

7.1 SimpliServ implements the measures pursuant to Art. 32 GDPR described in Annex 2.

7.2 SimpliServ may adapt the measures to the state of the art, provided that the level of protection is not reduced. Material changes are documented.

8. Sub-processors

8.1 The Customer authorises the sub-processors listed in Annex 1. Services marked as optional are used only if the Customer activates the corresponding function.

8.2 SimpliServ shall notify the Customer in text form of any new or replacement sub-processor at least 4 weeks in advance (by email, a notice in the software or an update of this page). Within this period, the Customer may object for a compelling reason relating to data protection law. If the parties cannot reach a solution, the Customer may terminate the Main Contract for the affected service for good cause.

8.3 SimpliServ shall contractually impose on each sub-processor the same data protection obligations as set out in this agreement and shall be liable for their compliance.

8.4 The following do not constitute sub-processing: ancillary services without access to customer data (e.g. telecommunications) and services with which the Customer concludes its own contract and which the Customer connects itself. The Customer is solely responsible for such services.

9. Assistance to the Customer

9.1 SimpliServ assists the Customer by appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR). For this purpose, the software provides functions for viewing, exporting, rectifying and erasing data. If a data subject contacts SimpliServ directly, SimpliServ shall forward the request to the Customer without undue delay.

9.2 SimpliServ assists the Customer with the security of processing, the notification of personal data breaches, data protection impact assessments and prior consultations (Art. 32 to 36 GDPR).

9.3 SimpliServ may charge for assistance that goes beyond the functions of the software and customary information on a time-and-materials basis, unless such assistance results from a breach by SimpliServ.

10. Personal Data Breaches

10.1 SimpliServ shall notify the Customer of a personal data breach without undue delay and no later than 24 hours after becoming aware of it. The notification shall contain, insofar as known, the information pursuant to Art. 33(3) GDPR.

10.2 SimpliServ shall take immediate measures to contain the breach and mitigate its consequences.

11. Evidence and Audits

11.1 Upon request, SimpliServ shall make available to the Customer the information necessary to demonstrate compliance with this agreement. As a rule, the annexes, written information and the certificates of the data centres are sufficient for this purpose.

11.2 The Customer or an auditor engaged by the Customer and bound to confidentiality may carry out on-site inspections: with at least 14 days' notice, during business hours, without disrupting operations, and as a rule no more than once per year. Each party bears its own costs.

12. Deletion and Return

12.1 During the term, the Customer may export its data itself at any time (e.g. CSV, PDF documents).

12.2 After termination of the Main Contract, SimpliServ shall delete the Customer's data within 90 days, unless the Customer requests its return beforehand or a statutory obligation requires its retention. Data in backups is overwritten upon expiry of the backup retention period, at the latest after a further 90 days. Cash register data is archived in a tamper-proof manner for the statutory retention period and only deleted afterwards.

12.3 The Customer fulfils its own retention obligations (e.g. for invoices and point-of-sale data) by exporting the data in good time. Upon request, SimpliServ shall confirm the deletion in text form.

13. Liability and Final Provisions

13.1 Liability is governed by Art. 82 GDPR. Otherwise, the liability provisions of the Main Contract apply.

13.2 In the event of conflict, this agreement takes precedence over the Main Contract in matters of data protection.

13.3 Amendments must be made in text form. Should any provision be invalid, the remaining provisions shall remain valid.

13.4 This agreement is governed by Austrian law, excluding its conflict-of-laws rules. The place of jurisdiction is Graz, to the extent permitted by law.

13.5 SimpliServ's data protection contact: Luca Malli, Managing Director, datenschutz@simpliserv.com. SimpliServ GmbH is currently not required to appoint a data protection officer.

Annex 1: Sub-processors

The Customer authorises the following service providers. “Always” means the service is used for every customer. “Optional” means the service is used only if the Customer activates the corresponding function.

Not sub-processors

Services that the Customer books and connects itself are not sub-processors of SimpliServ. These include Stripe, Mollie and SumUp (payments), Lexware, ZIR, VeloConnect, JTL-Wawi, WooCommerce, Shopify and Wix (interfaces), DHL and Österreichische Post (shipping), JobRad and leasing checks, bank account retrieval and Microsoft 365 (the Customer's mailbox). For these services, the Customer concludes its own contract with the provider.

Self-hosted

PDF generation, search, real-time notifications, document editing, video appointments and email hosting run on SimpliServ's own servers at Hetzner in Germany.

Annex 2: Technical and Organisational Measures (Art. 32 GDPR)