Data Processing Agreement (DPA)

This is a courtesy translation. The German version is legally binding — read the German version.

This DPA pursuant to Art. 28 GDPR applies automatically between the customer (workspace owner, “controller”) and Jochen Maurer, Evereststrasse 41, 81825 Munich, Germany (“processor”) as soon as a workspace is created — no separate execution is required (self-executing). On request, we provide a countersigned copy: [email protected].

1. Subject matter and duration

Processing of task, account, and communication data for the operation of Agentda, for the duration of the contractual relationship including the read-only and grace phase until deletion.

2. Nature and purpose, data categories, data subjects

Hosting, storage, delivery of notifications. Categories: master data (name, email), task content including history and attachments, usage/log data. Data subjects: workspace members, guests (external task recipients), persons mentioned in tasks.

3. Obligations of the processor

Processing only on documented instructions (use of the service constitutes an instruction); confidentiality obligations; technical and organizational measures (encryption in transit and at rest, tenant isolation including row-level security, access on a need-to-know basis); support with data subject rights; notification of personal data breaches without undue delay; deletion or return after the end of the contract (export feature).

4. Sub-processors

The current list is published in the privacy policy (section 3) and is deemed approved. We announce changes at least 14 days in advance by email to the workspace admin; in case of a justified objection, a special right of termination applies.

5. Audit and verification rights

Verification through appropriate documentation; audits after reasonable notice to the extent required by law.

Version: July 2026 · Draft (beta) — legal review before launch