Data Processing Agreement

This is a translation for convenience. Only the German version is legally binding.

Data Processing Agreement under Art. 28 GDPR

between the customer of qutee.ai
– controller, hereinafter referred to as the Client –

and qutee.ai GmbH, Gerichtsstraße 2, 65185 Wiesbaden, Germany
– processor, hereinafter referred to as the Contractor –

Preamble

(1) The Contractor processes personal data on behalf of the Client. The Client has selected the Contractor as a service provider in accordance with its duty of care under Art. 28 of the General Data Protection Regulation (GDPR). In accordance with the will of the parties, and in particular of the Client, this agreement contains the commission for processing on behalf within the meaning of Art. 28 GDPR and governs the rights and obligations of the parties in connection with the data processing.

(2) Where this agreement uses the term “data processing” or “processing” (of data), this generally means the use of personal data. The use of personal data includes in particular the collection, storage, transmission, blocking and deletion of data, as well as anonymising, pseudonymising, encrypting or otherwise using data.

(3) This agreement is concluded when the Client accepts it electronically during signup in the qutee.ai application, or when the Client concludes a contract with qutee.ai to which this agreement is attached or which refers to it, for example by signing a service contract. Electronic form is sufficient (Art. 28(9) GDPR). The Contractor records which version of this agreement the Client accepted and when. All versions remain available at a fixed URL on qutee.ai.

1. Subject matter and duration of the commission

(1) Subject matter

The Client’s commission to the Contractor comprises the following work and/or services: provision of cloud-based business telecommunications solutions.

(2) Duration

The duration (term) of this commission corresponds to the term of the contract for the use of qutee.ai, i.e. the plan booked at signup or the service contract with offer, in each case including the Terms and the price list (hereinafter the Main Contract), unless obligations going beyond this arise from law or from provisions of this agreement.

2. Specification of the commission

(1) Nature and purpose of the intended processing

The nature and purpose of the processing of personal data by the Contractor for the Client are set out in the Main Contract, in particular in the description of the booked plan or in the offer.

The contractually agreed data processing takes place exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area. Any relocation to a third country requires the prior consent of the Client and may only take place if the specific requirements of Art. 44 et seq. GDPR are met.

(2) Types of data

The processing concerns the following types/categories of personal data:

• Master data
• Communication data (e.g. telephone, email)
• Contract master data (contractual relationship, interest in products or contracts)
• Customer history
• Contract billing and payment data
• Call content and, where provided for by the Client, audio recordings and transcripts of calls
• Appointment and calendar data

(3) Categories of data subjects

The categories of data subjects affected by the processing include:

• Employees of the Client
• Subscribers
• Customers of the Client
• Suppliers of the Client
• Customers and employees of customers of the Client
• Prospective customers
• Contact persons
• Callers who speak with the Client’s phone assistant

3. Technical and organisational measures

(1) The Contractor’s technical and organisational measures are documented in Annex 1 (TOMs) and become the basis of the commission when this agreement is concluded. Where an inspection or audit by the Client shows a need for adjustment, it must be implemented by mutual agreement.

(2) The Contractor must ensure security in accordance with Art. 28(3)(c) and Art. 32 GDPR, in particular in conjunction with Art. 5(1) and (2) GDPR. Overall, the measures to be taken are measures of data security and measures to ensure a level of protection appropriate to the risk with regard to the confidentiality, integrity, availability and resilience of the systems. The state of the art, the costs of implementation and the nature, scope and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons within the meaning of Art. 32(1) GDPR, must be taken into account. For details see Annex 1.

(3) The technical and organisational measures are subject to technical progress and further development. In this respect, the Contractor is permitted to implement alternative adequate measures. The security level of the specified measures must not be undercut. Significant changes must be documented.

4. Rectification, restriction and erasure of data

(1) The Client is solely responsible for safeguarding the rights of data subjects.

(2) The Contractor may not rectify or erase the data processed on behalf of the Client, or restrict its processing, on its own authority, but only on documented instructions from the Client. Where a data subject contacts the Contractor directly in this regard, the Contractor will forward this request to the Client without delay.

(3) Where included in the scope of services, the erasure concept, right to be forgotten, rectification, data portability and access must be ensured directly by the Contractor on documented instructions from the Client.

5. Quality assurance and other obligations of the Contractor

(1) In addition to complying with the provisions of this commission, the Contractor has statutory obligations under Art. 28 to 33 GDPR; in this respect, it ensures compliance with the following requirements in particular:

a) Written appointment of a data protection officer who performs their duties in accordance with Art. 38 and 39 GDPR. Mr Christian Müller, DEUDAT GmbH, Zehntenhofstraße 5b, 65201 Wiesbaden, Germany, is appointed as the Contractor’s data protection officer. The Client must be informed without delay of any change of data protection officer. The officer’s current contact details are easily accessible on the Contractor’s website.

b) Maintaining confidentiality in accordance with Art. 28(3) sentence 2(b), Art. 29 and Art. 32(4) GDPR. In carrying out the work, the Contractor only uses employees who have been bound to confidentiality and previously familiarised with the data protection provisions relevant to them. The Contractor and any person subordinate to the Contractor who has access to personal data may only process this data in accordance with the Client’s instructions, including the powers granted in this agreement, unless they are legally obliged to process it. The employees’ obligation must be demonstrated to the Client on request.

c) Implementation of and compliance with all technical and organisational measures required for this commission in accordance with Art. 28(3) sentence 2(c) and Art. 32 GDPR (details in Annex 1).

d) The Client and the Contractor cooperate with the supervisory authority on request in the performance of its tasks.

e) Informing the Client without delay about inspections and measures by the supervisory authority insofar as they relate to this commission. This also applies where a competent authority investigates the Contractor in the context of administrative offence or criminal proceedings relating to the processing of personal data in the processing on behalf.

f) Where the Client is itself subject to an inspection by the supervisory authority, administrative offence or criminal proceedings, a liability claim by a data subject or a third party, or another claim in connection with the processing on behalf by the Contractor, the Contractor must support it to the best of its ability.

g) The Contractor regularly checks its internal processes and the technical and organisational measures to ensure that processing within its area of responsibility complies with the requirements of applicable data protection law and that the rights of the data subject are protected.

h) Verifiability of the technical and organisational measures taken towards the Client within the scope of its inspection rights under section 8 of this agreement.

(2) The Contractor is obliged to support the Client in its duty to handle requests from data subjects under Art. 12–23 GDPR. In particular, the Contractor must ensure that the necessary information is provided to the Client without delay so that the Client can meet its obligations under Art. 12(3) GDPR in particular.

6. Working from home

(1) By concluding this agreement, the Client consents to the Contractor allowing its employees who are entrusted with processing personal data for the Client to process personal data in private homes (“working from home”), provided that paragraphs 2 to 4 are complied with.

(2) The Contractor must ensure that compliance with the contractually agreed technical and organisational measures is also guaranteed when the Contractor’s employees work from home. Deviations from individual contractually agreed technical and organisational measures must be agreed with the Client in advance and approved by the Client in text form.

(3) The Contractor ensures in particular that, when personal data is processed while working from home, storage locations are configured so that local storage of data on IT systems used at home is ruled out. Should this not be possible, the Contractor must ensure that local storage is exclusively encrypted and that other persons in the household have no access to this data.

(4) The Contractor is obliged to ensure that the Client can effectively inspect the processing of personal data on its behalf when employees work from home. The personal rights of the employees and of the other persons living in the respective household must be taken into account appropriately.

(5) Where subcontractors’ employees are also to work from home, paragraphs 1 to 4 apply accordingly.

7. Subcontracting

(1) Subcontracting within the meaning of this provision means services that relate directly to the provision of the main service. This does not include ancillary services that the Contractor uses, e.g. telecommunications services, postal/transport services, maintenance and user service, the disposal of data carriers, or other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, to ensure the data protection and data security of the Client’s data, the Contractor is obliged to put in place appropriate and lawful contractual agreements and control measures for outsourced ancillary services as well.

(2) The Contractor may only engage subcontractors (further processors) with the prior express written or documented consent of the Client. By concluding this agreement, the Client consents to the engagement of the subcontractors listed in Annex 2 (Subprocessors) in the version valid when the agreement is concluded, subject to a contractual agreement in accordance with Art. 28(2)–(4) GDPR.

Outsourcing to further subcontractors or replacing an existing subcontractor is permitted provided that:

• the Contractor notifies the Client of such outsourcing a reasonable time in advance in writing or in text form (e.g. by email to the address stored in the customer account) and
• the Client does not object to the planned outsourcing in writing or in text form to the Contractor by the time the data is handed over and
• a contractual agreement in accordance with Art. 28(2)–(4) GDPR is used as a basis.

(3) The transfer of the Client’s personal data to the subcontractor and the subcontractor’s first activity are only permitted once all requirements for subcontracting have been met.

(4) The Contractor must ensure that the provisions agreed in this agreement and any supplementary instructions of the Client also apply to the subcontractor.

(5) If the subcontractor provides the agreed service outside the EU/EEA, the Contractor ensures compliance with data protection law by appropriate measures. The same applies where service providers within the meaning of paragraph 1 sentence 2 are to be used.

(6) Further outsourcing by the subcontractor requires the express information and consent of the main Client (at least in text form); all contractual provisions in the contractual chain must also be imposed on the further subcontractor.

(7) The Contractor carries out regular checks of the subprocessors. These checks must be documented and made available to the Client on request.

8. Inspection rights of the Client

(1) The Client has the right to carry out inspections in consultation with the Contractor or to have them carried out by auditors to be named in each individual case. It has the right to satisfy itself of the Contractor’s compliance with this agreement in the Contractor’s business operations by means of spot checks, which must be announced in good time, at least 14 days in advance. Inspections for a specific cause are excluded from this.

(2) The Contractor ensures that the Client can satisfy itself of the Contractor’s compliance with its obligations under Art. 28 GDPR. The Contractor undertakes to provide the Client with the necessary information on request and in particular to demonstrate the implementation of the technical and organisational measures.

(3) Measures that do not only concern the specific commission may be demonstrated by

• compliance with approved codes of conduct under Art. 40 GDPR;
• certification under an approved certification procedure under Art. 42 GDPR;
• current attestations, reports or report extracts from independent bodies (e.g. auditors, internal audit, the company’s own data protection officer, IT security department, data protection auditors, quality auditors);
• suitable certification by an IT security or data protection audit (e.g. according to BSI IT-Grundschutz).

(4) The Contractor is in particular obliged to ensure by contractual provisions that the inspection powers and rights of the Client and of supervisory authorities also apply to the subcontractor. It must also be contractually agreed that the subcontractor tolerates these inspections and any on-site inspections, which must be announced in good time, at least 14 days in advance. Inspections for a specific cause are excluded from this.

(5) The Client has the right to check the complete and contractual return and erasure of the data at the Contractor in accordance with section 11 of this agreement. This may also be done by inspecting the data processing systems at the Contractor’s premises. The on-site inspection should be announced by the Client with reasonable notice.

9. Notification of breaches by the Contractor

(1) The Contractor supports the Client in complying with the obligations set out in Articles 32 to 36 GDPR regarding the security of personal data, notification obligations in the event of data breaches, data protection impact assessments and prior consultations. These include, among others:

• ensuring an appropriate level of protection through technical and organisational measures that take into account the circumstances and purposes of the processing and the predicted likelihood and severity of a possible breach through security gaps, and that allow relevant breach events to be detected immediately
• the obligation to notify the Client without delay of any breach of data protection provisions, of the contractual agreements and/or of the instructions issued by the Client that has occurred in the course of processing data by the Contractor or other persons engaged in the processing. The Contractor’s notification to the Client must contain in particular the information under Art. 33(3)(a) to (d).
• the obligation to support the Client in its duty to inform the data subject and to provide it with all relevant information in this connection without delay
• supporting the Client with its data protection impact assessment
• supporting the Client in prior consultations with the supervisory authority

(2) The Contractor may claim remuneration for support services that are not included in the service description or are not attributable to misconduct by the Contractor.

10. Client’s authority to issue instructions

(1) The Contractor processes personal data exclusively within the framework of the agreements made and/or in compliance with any supplementary instructions issued by the Client. Processing for the Contractor’s own purposes does not take place. This excludes statutory provisions that may oblige the Contractor to process data otherwise. In such a case, the Contractor informs the Client of these legal requirements before processing, unless the law in question prohibits such notification on important grounds of public interest. Otherwise, the purpose, nature and scope of the data processing are governed exclusively by this agreement and/or the Client’s instructions. The Contractor is prohibited from processing data in any other way unless the Client has consented to this in writing.

(2) The Client confirms oral instructions without delay (at least in text form). The Contractor’s management is authorised to receive instructions and can be reached at [email protected]. In the event of a change of management or of the contact address, the Client must be informed of the successor or the new address without delay in text form.

(3) The Contractor must inform the Client without delay if it believes that an instruction violates data protection provisions. The Contractor is entitled to suspend the execution of the instruction concerned until the Client confirms or changes it.

11. Erasure and return of personal data

(1) Copies or duplicates of the data are not made without the Client’s knowledge. This excludes backup copies insofar as they are necessary to ensure proper data processing, and data required to comply with statutory retention obligations.

(2) After completion of the contractually agreed work, or earlier at the Client’s request, and at the latest upon termination of the Main Contract, the Contractor must hand over to the Client all documents that have come into its possession, processing and usage results created, and data sets related to the commission, or destroy them in compliance with data protection law after prior consent. The same applies to test and reject material. The erasure record must be presented on request.

(3) Documentation that serves as evidence of proper data processing in accordance with the commission must be retained by the Contractor beyond the end of the contract in accordance with the respective retention periods. The Contractor may hand it over to the Client at the end of the contract to discharge itself.

12. Right of retention

The parties agree that the Contractor’s defence of a right of retention within the meaning of § 273 BGB with regard to the processed data and the associated data carriers is excluded.

13. Liability

The liability rules under Art. 82 GDPR apply.

14. Miscellaneous

(1) Should the Client’s property at the Contractor be endangered by measures of third parties, for example by seizure or confiscation, or by other events, the Contractor must notify the Client without delay. The Contractor informs the third parties that responsibility for and ownership of the data lie exclusively with the Client.

(2) There are no oral side agreements. Changes and additions to this agreement and all its components must be made in text form. The Contractor notifies the Client of changes to this agreement in text form at least one month before they take effect. If the Client does not object in text form within four weeks of receiving the notification, the changes are deemed accepted; the Contractor points out this consequence in the notification. Section 7 applies to changes of subcontractors.

(3) Should one or more clauses of this agreement be invalid, this does not affect the validity of the remainder of the agreement.

Annexes

• Annex 1: Technical and organisational measures (TOMs)
• Annex 2: Subcontractors (Subprocessors)

All changes · For a signed copy as PDF, email [email protected].