Data Processing Agreement

§ 1 Subject, Duration, Instructions

(1) Subject. uRemoTech processes the Customer's personal data for the provision of the following services:

• RemoStack: recording the Customer's requirements, refining them with AI support, generating a preview, determining the cost range, as well as handover to uRemoTech.
• Operation of software created: operation of the application created for the Customer under Part B of the RemoStack Terms, including the data processed within it.

(2) Duration of storage and processing. For the term of the respective contract; beyond that, until complete return/deletion, as defined in § 5.

(3) Instructions. Processing takes place solely on documented instructions from the Customer, issued via the application or in text form.

§ 2 Nature of Processing, Types of Data, Data Subjects

(1) Activities. Collection, storage, organization, querying, use, transmission to sub-processors, deletion; including logging, caching, as well as processing of inputs by AI services.

(2) Data types. Basic/contact data, project and requirement descriptions, usage/system data (logs), file contents (provided by the Customer). For an application operated by uRemoTech, the data types follow from its service description. Special categories of data (Art. 9 GDPR) are not intended to be processed.

(3) Data subjects. Employees/agents of the Customer, external personnel (e.g., contractors), contact persons, as well as, for an application operated by uRemoTech, its users.

§ 3 Obligations of uRemoTech (Processor)

(1) Confidentiality. Processing is carried out only by persons bound by confidentiality.

(2) Security (TOM). Appropriate measures according to Art. 32 GDPR; see Annex 1.

(3) Sub-processors. General authorization. The categories of sub-processors engaged are listed in Annex 2. Individual sub-processors are named upon request in text form. uRemoTech shall inform the Customer about intended changes (additions/replacements) at least 14 days before they take effect, in text form, stating the processing category, region (EU/EEA/third country), and applicable safeguards (e.g., Art. 46 GDPR). The Customer may object to a change for good cause. In the event of a justified objection, uRemoTech may deactivate the affected function (e.g., the AI-supported refinement of the requirements) for the Customer; other services remain unaffected.

(4) Data breaches. Immediate notification, generally within 48 hours after becoming aware, including details as required by Art. 33 GDPR.

(5) Data subject rights. Support with Art. 15–21 GDPR requests within a reasonable period.

(6) DPIA/Authorities. Support in accordance with Art. 35/36 GDPR.

(7) Evidence/Audits. Customer audits are excluded unless a legal right to audit exists.

(8) Third-country transfers. Transfers outside the EEA only on the basis of safeguards under Art. 46 GDPR (particularly EU Commission SCCs) and, where applicable, additional measures; see Annex 2 for details.

(9) No purpose change/training. No own purposes; no training of AI models on customer content without the Customer's explicit consent.

(10) Return/deletion. Support according to § 5.

§ 4 Obligations of the Customer (Controller)

(1) Legal basis/information. The Customer is responsible for lawfulness, transparency, and data subject information.

(2) Instructions/account. Management of tenants/roles/permissions; instructions from the Customer may only be issued by authorized persons.

(3) Special data. The Customer shall not upload or process special categories of personal data in uRemoTech systems without a separate written agreement.

§ 5 Return and Deletion of Data

(1) During the term. RemoStack provides the project description for download. For an application operated by uRemoTech, § 20 of the RemoStack Terms applies.

(2) After contract termination. Deletion of personal data no later than within 60 days, unless retention obligations apply; backups are overwritten on a rolling basis. Deletion confirmation available upon request in text form.

(3) Retention obligations. Statutory obligations (e.g., billing records) remain unaffected.

§ 6 International Processing/Region

RemoStack as well as the customer applications operated by uRemoTech run in a data center in Germany. Certain functions use sub-processors in accordance with Annex 2. Any access from third countries occurs solely based on EU Commission SCCs and additional measures.

§ 7 Liability/Compensation

The liability provisions of the main contract apply. Unaffected: Art. 82 GDPR (internal relationship).

§ 8 Final Provisions

(1) Order of precedence. This DPA takes precedence over the General Terms and Conditions in case of contradictions.

(2) Form. Amendments/instructions via the application or in text form.

(3) Governing law/jurisdiction as per the main contract.

(4) Severability. The invalidity of individual provisions shall not affect the validity of the remainder of the agreement.

Annex 1 Technical and Organizational Measures

Measures under Art. 32 GDPR, as of September 1, 2026.

Confidentiality

• Physical access. Processing takes place in a data center in Germany whose operator controls and logs physical access. uRemoTech maintains no server rooms of its own for this purpose.
• System access. Access to the application runs through a central identity management system with personal accounts and a password policy. Access to the production systems is limited to the uRemoTech personnel entrusted with them and takes place through personal accounts.
• Data access. Within the application, roles and permissions govern which data a user sees and edits. Assignment of roles lies with the Customer.
• Separation. The data of different customers is separated by tenant and checked against the user's tenant on every access.
• Commitment. All persons entrusted with the processing are bound by confidentiality.

Integrity

• Transport. Data traffic is encrypted throughout via TLS; certificates are renewed automatically.
• Input. Changes to the data are made through the application and are attributable to the account that triggered them; system access is logged.
• Transfer. Transmission to third parties takes place exclusively to the sub-processors listed in Annex 2.

Availability and Resilience

• Backup. The databases are backed up regularly; backups are overwritten on a rolling basis.
• Operation. The application runs in a Kubernetes cluster with automatic recovery of failed instances.
• Monitoring. Operation and platform are monitored continuously; around 150 alert rules report incidents to those responsible for operations.
• Updates. The platform receives ongoing security updates; updates to the application are reviewed before deployment and applied during operation.

Review and Evaluation

• Processor control. Sub-processors are selected according to their safeguards and bound by contract under Art. 28 GDPR.
• Review. The measures in this annex are reviewed and updated as circumstances require and whenever architecture or operation changes.

Annex 2 Sub-Processors

As of September 1, 2026.

uRemoTech names the providers engaged, with company name and address, upon request in text form.