DPA (Data Processing Agreement)

Agreement on the Processing of Personal Data on Behalf of a Controller

Between
‍
GAL Digital GmbH, Unter den Linden 26, 35410 Hungen-Obbornhofen, Germany

- hereinafter referred to as "Processor" -

and
‍
Customers and users of the "nele.ai" software

- hereinafter referred to as "Controller" –
‍

- Processor and Controller are hereinafter referred to as "Contracting Parties" -

All terms are gender-neutral.

‍
the following Data Processing Agreement is concluded:

Preamble and Scope

The processor processes personal data on behalf of the controller. The Data Processing Agreement specifies the data processing with regard to its subject matter and the claims and obligations between the contracting parties resulting from the data processing relationship.

The Data Processing Agreement does not apply if the GDPR is not applicable to the processing of personal data by the controller (for example, in the case of purely personal or household activities in accordance with Art. 2(2)(c) GDPR) and the processor therefore does not act as a processor within the meaning of Art. 4 No. 8 GDPR.

1. Terms and Definitions

a. "Data Processing" - In accordance with Art. 4(8) GDPR, "data processing" is to be understood as the processing of personal data pursuant to Art. 4(2) GDPR by the processor on behalf of the controller, regardless of the number of intermediate processors, in accordance with the subject matter of this Data Processing Agreement.

b. "Main Contract" - The term "main contract" encompasses all types of ongoing business relationships between the client and the processor, within the scope of which the processor processes personal data on behalf of and under the instructions of the client in accordance with the details regarding the subject matter of the data processing in this Data Processing Agreement. If the validity of this Data Processing Agreement has been limited elsewhere (i.e., within this agreement or outside, in other contracts or regulations) to certain types, categories, or specific business relationships, contracts, etc., these are to be understood as the main contract. The term "main contract" also includes ongoing individual orders from the client to the processor that are placed by the client within the framework of the main contract (e.g., in the case of framework agreements).

c. "Controller" - "Controller" is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing (Art. 4(7) GDPR).

d. “Personal Data” - "Personal data" (hereinafter also referred to as "data") means, in accordance with Art. 4(1) GDPR, any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

e. "Data Subjects" - In accordance with Art. 4(1) GDPR, data subjects (or "subjects") are persons who are at least identifiable by means of personal data. The persons affected by this data processing are determined by the subject matter of the data processing.

f. "Third Parties" - "Third parties" are, in accordance with Art. 4(10) GDPR, any natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

g. "Sub-processing" - If a processor has not been commissioned directly by the controller, but by a processor of the controller, this constitutes "sub-processing," and the processors following the first processor are referred to as "sub-processors."

h. "Electronic Format" - Declarations are deemed to have been made in "electronic format" in accordance with Art. 28(9) GDPR if the declaring person is identifiable and the electronic declaration format is suitable for proving the declaration. "Electronic format" is understood to mean, in particular, text form, an agreement stored on durable media (e.g., email), digital signing procedures, or the use of dedicated online functions (e.g., in user accounts).

2. Subject Matter of Data Processing

a. Data processing is carried out within the scope of the following legal relationship (Main Agreement):
Agreement on the use of the "nele.ai" software based on the nele.ai Terms of Use:
https://nele.ai/nutzungsbedingungen.

b. Detailed information regarding the subject matter of the processing carried out under this agreement, the personal data processed, the data subjects affected by the processing, as well as the nature, scope, and purpose of the processing, are governed by the specifications in the "Subject Matter of Data Processing" appendix.

3. Nature of Data Processing

Insofar as the controller acts as the controller of the data processing, it is responsible within the framework of this data processing agreement for compliance with the provisions of data protection laws, in particular for the lawfulness of the data processing and for the lawfulness of commissioning the processor. Insofar as the controller itself acts as a processor, it commissions the processor as a sub-processor. The controller of the processing may, on the basis of this data processing agreement, directly invoke the rights to which the controller is entitled against the sub-processor.

4. Authority to Issue Instructions

<a c776aed8-ac24-213e-54a0-233df3afbacb>a. </a>The processor may only process personal data within the framework of the main contract and the controller's instructions and only to the extent that processing is necessary for the main contract.

<b 3dff5c4e-d4e3-514a-cfdb-56944363a8e5>b. </b>Instructions are initially defined by the main contract or this data processing agreement and may subsequently be changed, supplemented, or replaced by the controller through instructions in written or electronic format (text form, e.g., email) to the processor or the entity designated by the processor.

<c 344de6e4-8343-9251-6bc3-6741894316b4>c. </c>Oral instructions may be given if required by the circumstances (e.g., urgency) and must be confirmed immediately in writing or in electronic form.

<d 1032eae4-5469-b242-1271-4aaa91839ba3>d. </d>If the processor is of the opinion, based on objective circumstances, that an instruction from the controller violates applicable data protection law, the processor will point this out to the controller immediately and provide a factual justification for its view. In this case, the processor is entitled to suspend the execution of the instruction until it is expressly confirmed by the controller and to refuse obviously unlawful instructions.

<e 9b451f3e-779a-9764-8f61-90a83acb65b0>e. </e>The processor may be obliged to carry out processing or disclose information by Union or Member State law and by administrative or judicial measures to which the processor is subject. In such a case, the processor shall inform the controller of the legal requirements of the mandatory legal obligation before processing, unless the relevant law or order prohibits such notification for reasons of important public interest; in the event of a prohibition on notification, the processor shall take the measures possible and reasonable for it to prevent or limit the legally mandatory processing.

<f d49cedda-0eb9-7b7f-4fb6-66afadd9b628>f. </f>The processor must document the instructions given to it and their implementation.

<g b616935c-e047-8644-b206-89540309de02>g. </g>The processor shall designate the contact persons authorized to receive instructions and is obliged to notify the controller immediately of any changes to these contact persons, their contact information, or their representatives in the event of a non-temporary absence or unavailability.

5. Preservation of Professional Secrecy

a. The following obligations in the "Preservation of Professional Secrets" section of this Data Processing Agreement apply if the data processed on behalf of the client contains professional secrets within the meaning of § 203 of the German Criminal Code (StGB). They bind the processor as well as the AI model providers it engages. If an agreement for the preservation of professional secrets has been concluded for an AI model with the respective provider, the model is marked in the nele.ai model overview as "suitable for professional secret holders." The respective provider's agreement applies supplementarily to these models.

b. The obligations regulated in the DPA regarding adherence to instructions (esp. clause 4), technical and organizational measures (clause 6 incl. TOMs appendix), information, cooperation, and notification obligations (clauses 7, 8), audits and inspections (clause 9), sub-processing relationships (clause 10), geographical scope/third-country transfers (clause 11), as well as data return and deletion (clause 14) expressly apply with equal strictness to professional secrets within the meaning of § 203 StGB. The processor ensures that these obligations regarding professional secrets are practically implemented, documented, and contractually enforced in the same way against sub-processors.

c. The contents of the provided professional secrecy agreements of the respective AI model providers are confidential and may not be publicly disclosed. Customers may only pass on this information if it is necessary for the contractual use of the services of nele.ai and the respective AI model providers, primarily for the fulfillment of legal obligations, for example towards their own end customers, authorities, or to legal advisors and data protection officers. In such cases, it must be ensured that the recipients are informed of the confidential nature of the agreements and that they enter into comparable confidentiality obligations or that such obligations already exist. The processor shall provide the client with the wording of the agreements for review after the client has confirmed the confidentiality in text form in accordance with this clause.

d. The obligations apply regardless of the time-related provisions of this Data Processing Agreement, even after the end of the contract, without time limit.

e. The processor may only gain knowledge of professional secrets to the extent necessary for the execution of the main contract and this Data Processing Agreement and for the fulfillment of contractual obligations.

f. The client instructs the processor that a breach of confidentiality obligations in accordance with the law and this Data Processing Agreement through a breach of secrecy or the utilization of third-party secrets pursuant to §§ 203(1), (4) sentence 1 StGB, § 204 StGB can be punished with imprisonment of up to one year, or in the case of § 204 StGB with imprisonment of up to two years, or with a fine. The penalty is increased to imprisonment of up to two years or a fine if the perpetrator acts with the intent of enrichment, even if it is for the benefit of third parties, or has the intent to harm another through the act.

g. If the processor engages third parties (e.g., subcontractors) who participate in the processor's data processing and may gain knowledge of professional secrets, it shall oblige the third parties to maintain confidentiality at least in text form. Furthermore, the processor shall inform the third parties of their obligations. Regardless of the aforementioned obligation, the client must have permitted the engagement of third parties. The client instructs the processor as a precaution that the involvement of third parties can lead to imprisonment of up to one year or a fine if a third party breaches confidentiality and the processor has not simultaneously ensured that the third party was obliged to maintain confidentiality (§ 203(4) sentence 2 no. 1 StGB). The penalty is increased to imprisonment of up to two years or a fine if the perpetrator acts with the intent of enrichment, even if it is for the benefit of third parties, or has the intent to harm another through the act (§ 203(6) StGB).

h. If an AI model ceases to be suitable for professional secret holders, the processor shall remove the marking according to letter a and cancel existing assignments of the model to users and user groups. Further use requires renewed approval by an administrator of the client. The processor shall inform the client of foreseeable changes before they become effective, and otherwise immediately upon becoming aware.

6. Technical and Organizational Measures (Security and Protection Concept)

<a c776aed8-ac24-213e-54a0-233df3afbb17>a.</a> The processor shall design its internal organization within its area of responsibility in accordance with legal requirements and shall, in particular, implement technical and organizational measures (hereinafter referred to as "TOMs") for the appropriate security, particularly the confidentiality, integrity, and availability of the controller's data, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of data subjects. The processor shall ensure the maintenance of these measures, particularly through regular, at least annual, evaluation. With regard to the protection of personal data, the TOMs include, in particular, access control, entry control, access authorization control, transfer control, input control, order control, integrity and availability control, separation control, and the safeguarding of data subject rights.

<b c776aed8-ac24-213e-54a0-233df3afbb1c>b.</b> The TOMs communicated by the processor at the time of contract conclusion define the minimum level of security owed by the processor. The TOMs may be further developed in line with technical and legal progress and replaced by adequate protective measures, provided they do not fall below the security level of the defined measures and significant changes are communicated to the controller. The description of the measures must be sufficiently detailed so that a knowledgeable third party can, based solely on the description, determine at any time without doubt that the required legal level of data protection and the defined minimum level of security are not being undercut.

<c c776aed8-ac24-213e-54a0-233df3afbb21>c.</c> The processor guarantees that employees, agents, and other persons working for the processor who are involved in the processing of data are prohibited from processing personal data outside of the instructions. The processor further ensures that the persons authorized to process the controller's data have been instructed in the legal and contractual data protection provisions and have been bound to confidentiality and non-disclosure, or are subject to an appropriate and equivalent legal duty of confidentiality. The processor ensures that persons used for data processing are continuously and appropriately guided and monitored regarding compliance with data protection requirements.

<d c776aed8-ac24-213e-54a0-233df3afbb26>d.</d> The processor ensures that the persons it employs for processing participate in recurring training and awareness-raising measures regarding the protection of personal data and compliance with legal data protection regulations with appropriate frequency.

<e c776aed8-ac24-213e-54a0-233df3afbb2b>e.</e> Processing of personal data outside the processor's premises (e.g., in a home office, mobile office, or via remote access) is permitted provided that the necessary technical and organizational measures are taken and documented, which appropriately account for the specificities of these processing situations and, in particular, enable sufficient control of the data processing (e.g., conclusion of an agreement on data protection in the home and mobile office with employees). The processor shall provide the controller with documentation of the implemented technical and organizational measures for such home, mobile, or other remote processing upon request.

<f c776aed8-ac24-213e-54a0-233df3afbb30>f.</f> Processing of personal data on private devices of the processor's employees and agents is not permitted.

<g c776aed8-ac24-213e-54a0-233df3afbb36>g.</g> Where required by law, the processor shall appoint a data protection officer who meets the legal requirements. The processor shall provide the controller with the contact information of the data protection officer and any subsequent changes.

<h c776aed8-ac24-213e-54a0-233df3afbb3b>h.</h> The processing processes carried out on behalf of the controller shall be documented by the processor to a reasonable extent in a separate record of processing activities and made available to the controller upon request.

<i c776aed8-ac24-213e-54a0-233df3afbb40>i.</i> Data, data carriers, and all copies thereof provided under the data processing agreement remain the property or in the possession of the controller, are subject to the controller's right of disposal, must be carefully stored by the processor, protected against access by unauthorized third parties, and may only be destroyed with the controller's consent. Destruction must be carried out in a data-protection-compliant manner such that the restoration of even residual information is no longer possible or expected with reasonable effort. Copies of data may only be created if necessary for the fulfillment of the processor's main and ancillary contractual obligations toward the controller (e.g., backups) and if the contractual and legal level of data protection is guaranteed.

<j c776aed8-ac24-213e-54a0-233df3afbb45>j.</j> The processor is obliged to ensure the return or deletion of data and data carriers, which must be carried out immediately under this data processing agreement, also by sub-processors.

<k c776aed8-ac24-213e-54a0-233df3afbb4b>k.</k> The processor must provide proof of the proper destruction or deletion of data and files carried out under this data processing agreement and make it available to the controller upon request.

<l c776aed8-ac24-213e-54a0-233df3afbb51>l.</l> The right of retention is excluded with regard to the data processed on behalf of the controller and the associated data carriers.

<m c776aed8-ac24-213e-54a0-233df3afbb56>m.</m> The processor shall regularly provide proof of the fulfillment of its obligations to a reasonable extent, in particular the complete implementation of the agreed technical and organizational measures and their effectiveness (e.g., through regular checks, audits, etc.). The proof must be provided to the controller upon request. Proof may be provided through approved codes of conduct or an approved certification procedure.

n. Insofar as the security measures taken do not or no longer meet the processor's requirements or legal requirements, the processor shall notify the controller immediately.

<o c776aed8-ac24-213e-54a0-233df3afbb60>o.</o> The technical and organizational measures already existing at the time of conclusion of this data processing agreement are listed by the processor in the Annex "Technical and Organizational Measures" and accepted by the controller.

7. Information and Cooperation Obligations of the Processor

<a c776aed8-ac24-213e-54a0-233df3afbb6b>a.</a> The processor may only provide information to third parties or the data subject with the prior consent of the controller or in the case of mandatory legal obligations, court orders, or statutory requirements. If a data subject contacts the processor to exercise their rights (in particular rights to access, rectification, or erasure of personal data), the processor will refer the data subject to the controller, provided that the data subject can be attributed to the controller based on the information provided. The processor will forward the data subject's request to the controller immediately and support the controller to the extent reasonable and possible. The processor is not liable if the data subject's request is not answered by the controller, or is not answered correctly or in a timely manner, provided this is not the fault of the processor.

<b c776aed8-ac24-213e-54a0-233df3afbb70>b. </b>The processor must inform the controller immediately and in full if it identifies errors or irregularities in the processing of personal data regarding compliance with the provisions of this data processing agreement and/or relevant data protection regulations. The processor shall take the necessary measures to secure the personal data and mitigate potential adverse effects on the data subjects and shall coordinate this with the controller immediately.

<c a0bedcb2-0690-79b3-0d1e-01811ed1b051>c. </c>The processor will inform the controller immediately if a supervisory authority takes action against the processor and such action could affect the data processed for the controller. The processor shall support the controller in fulfilling its obligations (in particular regarding information and allowing audits) toward supervisory authorities.

<d 98d65c08-3a20-f30f-bba8-ee631272c97b>d. </d>Should the security of the controller's personal data be jeopardized by the actions of third parties (e.g., creditors, authorities, courts, etc.) (attachment, seizure, insolvency proceedings, etc.), the processor will immediately inform the third parties that the sovereignty and ownership of the data lie exclusively with the controller and, after consultation with the controller, take appropriate protective measures if necessary (e.g., filing objections, applications, etc.).

<e b7d792f7-606a-c5a7-7fd1-9a5d5fe22175>e. </e>The processor shall provide the controller with information regarding the processing of data under this data processing agreement that is necessary for the fulfillment of the controller's legal obligations (which may include, in particular, inquiries from data subjects or authorities and compliance with its accountability obligations for a data protection impact assessment) and shall support the controller in complying with the obligations set out in Art. 32-36 GDPR.

<f 4bd17e81-1084-efb3-3089-103dd3ac9e0a>f. </f>The processor's information obligations initially extend to information available to the processor, its employees, and agents. Information does not need to be obtained from third-party sources if the controller could obtain it within a reasonable scope and no other agreement has been made.

<g 6eed1756-d0e9-46f3-5a7b-27c57caf4fd9>g. </g>The processor must be able to demonstrate compliance with its contractual and legal obligations arising from the data processing at any time using appropriate means.

8. Measures in Case of Data Protection Risks or Breaches

<a 99d5112e-ed7c-e339-c94e-f02d6ab608bb>a. </a>In the event that the processor identifies facts that give reason to assume that the protection of personal data processed for the controller within the meaning of Art. 4 No. 12 GDPR could be breached, the processor must inform the controller immediately and in full, take necessary protective measures without delay, and support the controller in fulfilling its obligations, particularly in connection with reporting to competent authorities or data subjects.

<b da7c30b5-c11b-deeb-0713-c96fd3ef42c3>b. </b>Information regarding a (potential) breach of personal data protection must be provided immediately, generally within 24 hours of becoming aware of it.

<c d21f5296-171e-55ae-38bc-7c2aa0579a70>c. </c>The processor's report must contain at least the following information in accordance with Art. 33(3) GDPR:

<c a 381eba46-90a7-ef59-7068-cfa617025da3>a. </c>A description of the nature of the personal data breach, including, where possible, the categories of data concerned, the approximate number of data subjects, and the approximate number of personal data records concerned;

<c b 4c334efb-f7e4-258d-6926-91cf09bd83c9>b. </c>The name and contact details of the data protection officer or other point of contact for further information;

<c c 92a45dff-5c70-3d73-8744-4a0ff3f43f26>c. </c>A description of the likely consequences of the personal data breach (e.g., providing further details: identity theft, financial loss, etc.);

<c d 43cfff69-c777-c0e8-7360-7a4fa58571ae>d. </c>A description of the measures taken or proposed by the processor to address the personal data breach and, where appropriate, measures to mitigate its possible adverse effects.

<d 87a8abf5-e06d-0a8e-5d6d-64f70e3629b7>d. </d>Significant disruptions in the execution of the order as well as violations by the processor or its employees or agents of data protection regulations or the provisions made in this data processing agreement must also be reported immediately.

9. Audits and Inspections

<a 4a7e659c-6391-0d2e-2809-42e66f498411>a. </a>The controller has the right to verify compliance with legal requirements and the provisions of this data processing agreement, particularly the TOMs, at the processor's premises at any time to the necessary extent, either personally or through third parties, and to carry out the necessary checks, including inspections.

<b fba4bdbd-2a19-830b-a74b-56bd71d74230>b. </b>The processor must support the controller during audits and inspections to the necessary extent (e.g., by providing personnel and granting access and entry rights).

<c c00966e6-f4bc-8fc5-e709-40bb768662eb>c. </c>On-site audits shall take place during normal business hours and must be announced by the controller with reasonable notice (at least 14 days). In emergencies, i.e., if waiting would jeopardize the rights of the data subjects and/or the controller to an unreasonable extent, a reasonably shorter notice period may be chosen. Conversely, a longer notice period may be required (e.g., if extensive preparations are necessary or during holiday periods). Deviations from the notice period must be justified by the party requesting them.

<d a9a51fbb-d5ef-5081-66ae-69016dc2672c>d. </d>Audits are limited to the necessary scope and must take into account the processor's trade and business secrets as well as the protection of third-party personal data (e.g., other customers or employees of the processor). Avoidable operational disruptions must be prevented. As far as the occasion and purpose of the audit allow, audits should be limited to random samples.

<e bd3fe4fc-b70b-a6c2-6cb7-9f576c37ac15>e. </e>Only qualified persons who can identify themselves and are bound by confidentiality and non-disclosure agreements regarding the processor's trade and business secrets, internal processes, and personal data are permitted to conduct the audit. The processor may demand proof of such an obligation. Should the auditor commissioned by the controller be in a competitive relationship with the processor or if there is another justified reason for their rejection, the processor has the right to object to them.

<f aff90c33-3021-1f20-cbf4-9e741adbf660>f. </f>Instead of inspections and on-site audits, the processor may refer the controller to an equivalent audit by independent third parties (e.g., neutral data protection auditors), compliance with approved codes of conduct (Art. 40 GDPR), or appropriate data protection or IT security certifications pursuant to Art. 42 GDPR. This only applies if the referral is reasonable for the controller and the nature and scope of the audit and referrals correspond to the nature and scope of the controller's legitimate audit intent. The processor undertakes to inform the controller immediately of the exclusion of approved codes of conduct pursuant to Art. 41(4) GDPR, the revocation of a certification pursuant to Art. 42(7) GDPR, or any other form of cancellation or significant change to the aforementioned evidence.

<g 7bbf5d6d-1f67-c535-fd29-4b838338d916>g.</g> The controller shall generally exercise its right to audit no more frequently than every 12 months, unless a specific occasion (in particular a data breach, a security incident, or the result of an audit) makes audits necessary before the expiry of this period.

10. Sub-processing Relationships

a. Without prejudice to any restrictions in the main contract, the client expressly agrees that the processor may engage sub-processors as part of the data processing. The processor shall inform the client of new sub-processors with reasonable notice, which is generally 14 working days, and shall give the client the opportunity to review the sub-processors to a reasonable extent before they are engaged and to object to the engagement of the sub-processors if there is a legitimate interest. Information shall be provided via email to the owner and the administrators of the client's organization as well as to an additional address designated by the client. If the client does not object within the notice period, the sub-processor may be engaged. The client shall only exercise its right to object with regard to changes in compliance with the principles of good faith, reasonableness, and fairness.

b. If the processor uses the services of a sub-processor (e.g., a subcontractor) to carry out specific processing activities on behalf of the client, it must impose the same data protection obligations on the sub-processor by way of a contract or another legally permissible legal instrument as the processor has committed to in this Data Processing Agreement (in particular with regard to following instructions, compliance with TOMs, providing information, and allowing audits).

c. The processor shall carefully select the sub-processor, giving special consideration to their suitability and reliability in complying with the obligations of this Data Processing Agreement, as well as the suitability of the TOMs implemented by the sub-processor.

d. The transfer of personal data processed on behalf of the client to sub-processors is only permitted once the processor has verified that the sub-processor has fully fulfilled its obligations. The verification must be documented, and the documentation must be provided to the client upon request.

e. The processor must regularly verify the sub-processors' compliance with their obligations, in particular the TOMs, at least every 12 months to a reasonable extent. The verification and its result must be documented in a way that is comprehensible to a qualified third party. The documentation must be provided to the client upon request. Instead of conducting its own verification, the processor may refer to verification by independent third parties (e.g., neutral data protection auditors), compliance with approved codes of conduct (Art. 40 GDPR), or appropriate data protection or IT security certifications pursuant to Art. 42 GDPR. The processor undertakes to inform the client immediately of the exclusion of approved codes of conduct pursuant to Art. 41(4) GDPR, the revocation of a certification pursuant to Art. 42(7) GDPR, and any other form of cancellation or significant change to the aforementioned evidence regarding the subcontractor.

f. The responsibilities for fulfilling the obligations under this Data Processing Agreement and the law must be clearly regulated and delineated between the processor and the sub-processor.

g. The client's rights must also be effectively exercisable against the sub-processors. In particular, the client must be entitled to conduct audits, or have them conducted by third parties, at any time at the sub-processors to the extent defined in this Data Processing Agreement.

h. If the sub-processor fails to fulfill its data protection obligations, the processor shall be liable to the client for this.

i. Processing of personal data that has no direct connection to the provision of the main service under the main contract and for which the processor uses the services of third parties as a purely ancillary service to carry out its business activities (e.g., cleaning, security, maintenance, telecommunications, or transport services) does not constitute sub-processing within the meaning of the preceding provisions of this Data Processing Agreement. Nevertheless, the processor must ensure, e.g., through contractual agreements or notices and instructions, that data security is not compromised and that the requirements of this Data Processing Agreement and data protection regulations are met.

j. Sub-processing relationships that were communicated to the client upon conclusion of this Data Processing Agreement are deemed approved to the extent communicated, subject to the provisions of this Data Processing Agreement regarding sub-processing relationships.

k. The sub-processors used are listed in the "Sub-processors" appendix published at https://www.nele.ai/de/subcontractors. The processor updates the version in accordance with letter a.

l. The processor uses AI models only under the contractual condition and subject to any agreement to the contrary that inputs and outputs are not used by the providers of the AI models for training or improving models. Temporary technical intermediate storage, particularly in the context of so-called prompt caching, remains unaffected by this, provided it is limited to the duration intended by the respective provider.

11. Geographical Scope of Data Processing

a. Personal data is processed within the scope of the data processing in a member state of the European Union (EU) or in another contracting state of the Agreement on the European Economic Area (EEA) or Switzerland.

b. Processing may take place in third countries provided that the specific requirements of Art. 44 et seq. GDPR are met, i.e., in particular a) the EU Commission has determined an adequate level of data protection; b) on the basis of effective standard protection clauses (so-called Standard Contractual Clauses, SCC); or c) on the basis of recognized binding internal data protection rules.

c. The approval of sub-processing relationships by the client within the framework of this Data Processing Agreement also extends to the geographical scope of the data processing.

d. Data processing in countries other than those mentioned above, including by sub-processors, requires the prior approval of the client.

12. Obligations of the Controller

a. The controller must inform the processor immediately and in full if they identify errors or irregularities in the processing results, instructions, or processing procedures with regard to data protection regulations.

b. The controller shall designate the contact persons authorized to receive instructions and is obliged to notify the processor immediately of any changes to these contact persons, their contact information, or their representatives in the event of a non-temporary absence or unavailability.

c. In the event that the processor is held liable by data subjects, third-party companies, agencies, or authorities regarding claims arising from the processing of personal data under this data processing agreement, the controller undertakes to support the processor in defending against such claims to the extent possible, taking into account the degree of fault of the contracting parties.

13. Liability

The statutory liability provisions apply, in particular Art. 82 GDPR and, in the case of the engagement of a sub-processor, Art. 28 (4) sentence 2 GDPR.

14. Term, Survival After Contract End, and Data Deletion

a. This data processing agreement becomes effective upon its signing or conclusion in an electronic format.

b. The term and termination of this data processing agreement are governed by the term and termination of the main contract.

c. The right to extraordinary termination remains reserved for the contracting parties, particularly in the event of a serious breach of the obligations and requirements of this data processing agreement and applicable data protection law. A serious breach exists in particular if the processor fails to fulfill or has failed to fulfill the obligations specified in the data processing agreement and the agreed technical and organizational measures to a significant extent.

d. In the case of minor breaches of duty, extraordinary termination must be preceded by a warning of the breaches with a reasonable period for remedy, although a warning is not required if it is not to be expected that the complained breaches will be remedied or if they are so severe that it is unreasonable for the terminating party to continue the data processing agreement.

e. The termination of this data processing agreement, as well as the waiver of this formal requirement, must be made at least in electronic format.

f. Upon completion of the processing services under this data processing agreement, the processor shall, at the controller's choice, either destroy or return all personal data and copies thereof (as well as all documents, processing and usage results, and data sets that have come into its possession in connection with the order), unless there is a legal obligation to store the personal data; in this case, the processor shall inform the controller of the obligation and its scope, unless the controller can be expected to be aware of the obligation. Destruction or deletion must be carried out in a data-protection-compliant manner such that the restoration of even residual information is no longer possible and not to be expected with reasonable effort. The plea of a right of retention is excluded with regard to the processed data and the associated data carriers. With regard to deletion or return, the controller's rights of information, verification, and control apply in accordance with this data processing agreement.
‍
g. The obligations to protect confidential information arising from the data processing agreement shall continue to apply after the end of the data processing agreement, provided that the processor continues to process the personal data covered by the data processing agreement and compliance with the obligations remains reasonable for the processor after the end of the contract.

h. Documentation serving as proof of proper data processing and the assurance of the TOMs must be kept by the processor for at least three years beyond the end of the contract, in accordance with the respective retention and deletion periods known to the processor (or those that should have been known to them). The processor may hand over the documentation to the controller at the end of the contract for their own discharge.

15. DORA Regulation

If the controller is subject to financial regulatory requirements, the additional provisions in the appendix "Supplementary Agreement to the Data Processing Agreement of nele.ai regarding simple ICT services in accordance with the DORA Regulation" shall apply.

16. Final Provisions

a. The applicable law is determined by the main contract.

b. The place of jurisdiction is determined by the main contract.

c. This data processing agreement constitutes the entire agreement between the contracting parties. There are no side agreements.
‍
d. Upon the conclusion of this data processing agreement, all previous agreements concluded between the parties to this contract that govern the processing of personal data on behalf are superseded, if and to the extent that they concern the same subject matter of processing and unless otherwise expressly agreed in writing between the parties.
‍
e. Amendments and supplements to this data processing agreement, as well as the waiver of this formal requirement, must be made at least in electronic format.
‍
f. In the event of any contradictions, the provisions of this data processing agreement regarding data protection shall take precedence over the provisions of the main contract.
‍
g. Should one or more provisions of this data processing agreement be invalid or unenforceable, the validity of the remaining provisions shall not be affected. Instead, the invalid provisions shall be replaced by way of supplementary interpretation with a provision that comes as close as possible to the economic purpose recognizably pursued by the contracting parties with the invalid provision(s). If the aforementioned supplementary interpretation is not possible due to mandatory legal requirements, the contracting parties shall agree on a corresponding provision.

This data processing agreement is part of the main contract and becomes effective upon its conclusion.

Appendix: Subject Matter of Data Processing

The following information regarding the nature and purpose of the processing, the type of personal data, and the categories of data subjects defines the subject matter of the processing governed by the Data Processing Agreement. Changes to the subject matter of the processing and other procedural changes must be mutually agreed upon and documented by the contracting parties.

Purposes of Data Processing

Personal data of the client is processed on the basis of this Data Processing Agreement for the following purposes:
Provision of the "nele.ai" software as well as the applications, websites, and functions associated with it within the contractually agreed framework.

Types and Categories of Data

The types and categories of personal data processed on the basis of this Data Processing Agreement include:
a. User master data (information on person, company, address details).
b. User contact data (e.g., email addresses).
c. Content inputs by users in the context of using the software or application (e.g., prompts, uploaded files, contents of knowledge bases and permanent knowledge).
d. Log data (e.g., log files concerning logins, retrieval of data, or access times).
e. Meta and connection data (IP addresses, system and device-related information).
f. Telemetry data (data that allows for the monitoring and maintenance of the functionality and security of the software or application with regard to the contractually agreed use).
g. Audio data (in the event that user voice inputs are processed).
h. Image data (in the event that user image inputs are processed).
i. Outputs generated by AI models (AI outputs).
j. Special categories of personal data within the meaning of Art. 9 GDPR as well as professional secrets within the meaning of § 203 of the German Criminal Code (StGB), insofar as the client enters these in the course of use.

Categories of Data Subjects

The groups of persons affected by the processing of personal data on the basis of this Data Processing Agreement include:
a. Customers and users of the respective software or application.
b. Persons whose personal data is processed within the scope of the content entered by customers and users.

Sources of Processed Data

The data processed on the basis of this Data Processing Agreement is collected or otherwise received from the following sources or in the context of the following procedures:
a. Collection from data subjects.
b. Inputs or information provided by the client.
c. Inputs or information provided by the processor.
d. Collection in the context of using software, applications, websites, and other online services.
e. Receipt via transmission or other communication by or on behalf of the client.

Appendix: Technical and Organizational Measures (TOMs)

For the specific processing of data and the personal data processed within its scope, a level of protection appropriate to the risk to the rights and freedoms of the natural persons affected by the processing is guaranteed. To this end, the protection goals of confidentiality, integrity, and availability of systems and services, as well as their resilience in relation to the nature, scope, context, and purpose of the processing, are taken into account in such a way that the risk is permanently mitigated through appropriate technical and organizational remedial measures.

Organizational Measures

Organizational measures have been implemented to ensure an appropriate level of data protection and its maintenance.
‍
a. The processor has implemented an appropriate data protection management system or data protection concept and ensures its execution.
‍
b. A suitable organizational structure for data security and data protection is in place, and information security is integrated into company-wide processes and procedures.
‍
c. Internal security policies or guidelines are defined and communicated to employees as binding rules within the company.
‍
d. System and security tests, such as code scans and penetration tests, are conducted regularly and on an ad-hoc basis.
‍
e. Developments in state-of-the-art technology, as well as emerging threats and security measures, are continuously monitored and incorporated into the company's own security concept as appropriate.
‍
f. A concept exists to ensure the protection of data subject rights by the controller (particularly regarding access, rectification, erasure, or restriction of processing, data portability, withdrawals, and objections). This concept includes informing employees about information obligations toward the controller, establishing implementation procedures, designating responsible persons, and regularly monitoring and evaluating the measures taken.
‍
g. A concept exists to ensure an immediate response to threats and breaches of personal data protection in accordance with legal requirements. This concept includes informing employees about information obligations toward the controller, establishing implementation procedures, designating responsible persons, and regularly monitoring and evaluating the measures taken.
‍
h. Security incidents are consistently documented, even if they do not lead to an external notification (e.g., to the supervisory authority or affected persons) (so-called "Security Reporting").
‍
i. Service providers engaged for ancillary business tasks (maintenance, security, transport, and cleaning services, freelancers, etc.) are carefully selected, and it is ensured that they observe the protection of personal data. If service providers receive access to the controller's personal data during their activities or if there is otherwise a risk of access to personal data, they are specifically committed to secrecy and confidentiality.
‍
j. The protection of personal data is considered during the development or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.
‍
k. Software and hardware used are kept up to date, and software updates are performed without delay within a timeframe appropriate to the level of risk and any necessary testing. No software or hardware is used that is no longer updated by the providers regarding data protection and security concerns (e.g., expired operating systems).
‍
l. Standard software and corresponding updates are obtained only from trusted sources.
‍
m. A deletion and disposal concept is in place that complies with the data protection requirements of the processing agreement and the state of the art. The physical destruction of documents and data carriers is carried out in a data-protection-compliant manner and in accordance with legal requirements, industry standards, and state-of-the-art industrial norms (e.g., DIN 66399). Employees have been informed about legal requirements, retention periods, and, where applicable, specifications for data or device destruction by service providers.
‍
n. The processing of the controller's data that has not been deleted in accordance with the agreements of this data processing agreement (e.g., due to legal archiving obligations) is restricted to the necessary extent by blocking notices and/or segregation.

Data Protection at the Employee Level

Measures have been taken to ensure that employees involved in the processing of personal data possess the necessary expertise and reliability required under data protection law.
‍
a. Employees are committed to confidentiality and secrecy (data protection secrecy).
‍
b. Employees are sensitized and trained regarding data protection in accordance with the requirements of their role. Training and sensitization are repeated at appropriate intervals or as circumstances require.
‍
c. Keys, access cards, or codes issued to employees, as well as permissions granted regarding the processing of personal data, are collected or revoked upon their departure from the processor's service or upon a change in responsibilities.
‍
d. Employees are required to leave their workspace tidy, thereby preventing access to documents or data carriers containing personal data (Clean Desk Policy).

Physical Access Control

Physical access control measures have been implemented to prevent unauthorized persons from physically approaching systems, data processing equipment, or procedures used to process personal data.
‍
a. Personnel checks are conducted by security staff or at the reception desk.
‍
b. The issuance and return of keys and/or access cards are logged.
‍
c. Employees are required to lock devices or secure them specifically when leaving their workspace or the devices.
‍
d. Records (files, documents, etc.) are stored securely, e.g., in filing cabinets or other appropriately secured containers, and are adequately protected against access by unauthorized persons.
‍
e. Data carriers are stored securely and are adequately protected against access by unauthorized persons.

Access Control

Electronic access control measures have been implemented to ensure that unauthorized access (i.e., the mere possibility of use, utilization, or observation) to systems, data processing equipment, or procedures is prevented.
‍
a. A password policy stipulates that passwords must meet state-of-the-art requirements regarding minimum length and complexity.
‍
b. All data processing equipment is password-protected.
‍
c. Passwords are generally not stored in plain text and are only transmitted in hashed or encrypted form.
‍
d. Access credentials are deleted or deactivated once the user has left the processor's company or organization.
‍
e. Server systems and services are used that feature intrusion detection systems.
‍
f. Server systems and services are used that feature intrusion protection systems.
‍
g. Up-to-date anti-virus software is used.
‍
h. Use of hardware firewall(s).
‍
i. Use of software firewall(s).

Internal access control and input control (permissions for user rights to access and modify data)

Measures for access control have been taken to ensure that those authorized to use a data processing system can only access the data subject to their access authorization, and that personal data cannot be read, copied, altered, or removed by unauthorized parties during processing. Furthermore, measures for input control have been taken to ensure that it can be subsequently checked and determined whether and by whom personal data has been entered into, altered in, removed from, or otherwise processed in data processing systems.

a. A rights and roles concept (authorization concept) ensures that access to personal data is possible only for a group of persons selected based on necessity and only to the extent necessary.
b. The rights and roles concept (authorization concept) is evaluated regularly, at an appropriate frequency, and when the occasion requires (e.g., violations of access restrictions) and updated if necessary.
c. Logins to the data processing equipment or processing systems are logged.
d. The activities of administrators are appropriately monitored and logged within the scope of legally permissible possibilities and within the scope of technically reasonable effort.
e. It is ensured that it is traceable which employees or agents had access to which data and when (e.g., through logging of software usage or inference from access times and the authorization concept).

Transfer control

Measures for transfer control have been taken to ensure that personal data cannot be read, copied, altered, or removed by unauthorized parties during electronic transmission or during its transport or storage on data carriers, and that it can be checked and determined to which points a transmission of personal data by data transmission facilities is intended.

a. When accessing internal systems from outside (e.g., for remote maintenance), encrypted transmission technologies are used (e.g., VPN).
b. Emails are encrypted during transmission, meaning that the emails are protected on their way from the sender to the recipient from being read by anyone who has access to the networks through which the email is sent.
c. The transmission and processing of the Client's personal data via online services (websites, apps, etc.) is protected using TLS or an equivalently secure encryption.

Order control, purpose limitation, and separation control

Measures for order control have been taken to ensure that personal data processed on behalf of the Client is processed only in accordance with the Client's instructions. The measures ensure that personal data of the Client collected for different purposes is processed separately and that no commingling, merging, or other joint processing of this data contrary to the order occurs.

a. The processing processes carried out for the Client are documented separately to an appropriate extent in a record of processing activities.
b. Careful selection of sub-processors and other service providers.
c. Employees and agents are informed clearly and understandably about the Client's instructions and the permissible processing framework and are instructed accordingly. Separate information and instruction are not required if compliance with the permissible framework can be reliably expected anyway, e.g., due to other agreements or operational practice.
d. Compliance with the Client's instructions and the permissible framework for the processing of personal data by employees and agents is checked at appropriate intervals.
e. The deletion periods applicable to the processing of the Client's personal data are documented within the Data Processor's deletion concept, separately if necessary.
f. Necessary evaluations and analyses of the processing of the Client's personal data are, as far as possible and reasonable, processed anonymously (i.e., without any personal reference) or at least pseudonymized in accordance with Art. 4(5) GDPR (i.e., in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures that ensure that the personal data is not assigned to an identified or identifiable natural person).
g. The Client's personal data is processed logically separated from data of other processing procedures of the Data Processor and protected against unauthorized access or connection or merging with other data (e.g., in different databases or through appropriate attributes).
h. Productive and test data are stored strictly separately from each other in different systems. The productive systems are operated separately and independently of the development and test systems.

Ensuring the integrity and availability of data and the resilience of processing systems

Measures have been taken to ensure that personal data is protected against accidental destruction or loss and can be restored quickly in emergencies.

a. Fail-safe server systems and services are used, which are designed with redundancy.
b. The availability of data processing systems is permanently monitored and controlled, particularly regarding availability, errors, and security incidents.
c. Personal data is stored with external hosting providers. The hosting providers are carefully selected and meet state-of-the-art requirements regarding protection against damage from fire, humidity, power outages, disasters, unauthorized access, as well as data backup, patch management, and building security.
d. The processing of personal data takes place on data processing systems that are subject to regular and documented patch management, i.e., they are updated regularly.
e. The server systems and services used for processing are subjected to stress tests and hardware tests at appropriate intervals.
f. The server systems used for processing have protection against Denial of Service (DoS) attacks.
g. The server systems used for processing have an uninterruptible power supply (UPS) that is adequately secured against outages and ensures a controlled shutdown in emergencies without data loss.
h. Video surveillance at the server location.
i. Intrusion and contact detectors at the server location.
j. The server systems used for processing have adequate fire protection (fire and smoke alarm systems as well as appropriate fire extinguishing devices or equipment).
k. Server systems are used that have protection against moisture damage (e.g., moisture detectors).
l. Server systems and services are used that maintain a backup system at other locations where current data is kept, thus providing a functional system even in the event of a disaster.
m. The Client's data sets are protected by the system against accidental modification or deletion (e.g., through access restrictions, security queries, and backups).
n. Server systems and services are used that have an appropriate, reliable, and controlled backup and recovery concept.
o. Recovery tests are carried out at appropriate intervals to verify that data backups can actually be restored (data integrity of the backups).

Annex: Supplementary agreement to the nele.ai Data Processing Agreement regarding simple ICT services in accordance with the DORA Regulation

The Contractor acknowledges that the Client, as a financial entity, must meet specific regulatory requirements. This applies in particular to Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA Regulation). This regulation sets out minimum requirements for contractual agreements when commissioning ICT services, which also affect the Contractor's services. These regulations take precedence over the parties' contractual agreements, including all annexes in the "Main Agreement." The minimum contents described below shall become part of the Main Agreement upon conclusion of the Data Processing Agreement. The Contractor must carefully observe and comply with these.

1. Subject matter, nature, and quality of the ICT service

1.1. The Contractor shall provide the Client with the ICT services specified in the Data Processing Agreement, as described in the annex "Subject Matter of Data Processing" therein. This includes the provision of the "nele.ai" software and the associated applications, websites, and functions within the agreed scope. The rights and obligations of both parties regarding the ICT services are clearly defined in the Main Agreement. The contractual framework of the Main Agreement is determined by the individual agreement on service provision and the terms of use for nele.ai (https://www.nele.ai/de/nutzungsbedingungen).

1.2. Within the scope of the Main Agreement, the Contractor provides exclusively simple ICT services. These are defined as services that are not used to support critical or important functions pursuant to Article 3(22) of the DORA Regulation.

1.3. The Contractor undertakes to provide the services in the contractually agreed quality. In doing so, all legal regulations relevant to the Client, in particular regulatory requirements, as well as the Client's internal guidelines communicated to the Contractor, shall be observed. Should updates or adjustments to the service quality become necessary, these shall be determined by a corresponding contract amendment.

1.4. The Contractor shall ensure that its services are performed in such a way that the Client can fulfill its obligations toward customers and supervisory authorities. Changes or improvements to the standards must be mutually agreed upon by both parties and recorded in writing.

1.5. The Contractor warrants that it possesses all necessary permits and registrations to fulfill its obligations under the Main Agreement. Should it become necessary in the future to obtain additional permits or registrations, the Contractor undertakes to apply for and obtain them without delay.

2. Locations of service provision

2.1. The contractually agreed ICT services or the functions assigned to subcontractors are provided at the locations listed below:

3. Compliance with Laws, Standards, and Data Protection

3.1. The contractor undertakes to comply with all legal and other mandatory standards applicable to the client when providing the services, particularly regarding data protection and banking secrecy, even if these exceed the agreed standards. The client shall inform the contractor of all non-statutory standards to be observed before the conclusion of the contract or within a reasonable period before they come into effect.

3.2. The contractor undertakes to observe all relevant laws, regulations, and supervisory requirements for the protection of personal data when providing the contractually owed services. The data protection agreements existing between the contracting parties are authoritative and must be taken into account. Furthermore, the contractor undertakes to disclose to the client all information necessary for conducting a required risk analysis. Should systems, components, or processes be used in the provision of services that are not under the direct control of the contractor, the contractor is obliged to contractually impose corresponding data protection and data security measures on its own contractual partners. The contractor will regularly monitor compliance with these measures.

4. Information Security Management

4.1. The contractor is obliged to integrate the services to be provided for the client into its information security management. In doing so, it must take appropriate technical and organizational measures to ensure a level of protection commensurate with the risk. This concerns information security and the protection goals of availability, authenticity, integrity, and confidentiality of the client's data and information.

4.2. The probability of occurrence and the severity of a potential risk resulting from a breach of information security, as well as the state of the art and recognized standards for information security, must be taken into account. These standards include, for example, the IT-Grundschutz of the Federal Office for Information Security (BSI) and the international security standard ISO/IEC 2700X of the International Organization for Standardization. These measures also include strategies for the appropriate management of cyber risks.

4.3. Material changes that may affect the integrity, confidentiality, authenticity, or availability of the data must be communicated to the client in a timely manner. The client may only object to such changes for good cause, particularly if there are doubts regarding compliance with DORA requirements. The client has the right to request an up-to-date description of the measures taken at any time.

4.4. The contractor has implemented an appropriate procedure for testing digital operational resilience and conducts regular tests of all ICT systems and applications. The contractor reports on the progress and results of these tests to the client upon request.

5. Training and Instructions

5.1. The contractor undertakes to raise awareness among its personnel regarding ICT security aspects to the necessary extent and to ensure through training that this knowledge remains up to date.

5.2. Upon the client's request, the contractor will participate in the ICT security awareness programs and digital operational resilience training offered by the client in accordance with Art. 13 (6) DORA. Furthermore, the contractor shall ensure that the employees involved in providing services to the client and designated by the client also participate in the necessary ICT security awareness programs and digital operational resilience training.

5.3. If the contractor uses the client's ICT systems to provide the contractually owed ICT services, it is obliged to observe the applicable instructions and terms of use of the client.

6. Data Access, Retrieval, and Deletion

6.1. In the event of insolvency, liquidation, cessation of business operations of the contractor, or upon termination of the contractual agreement, the contractor remains obliged to maintain access to the client's personal and non-personal data until a complete restoration or return of this data has taken place. The client has the choice between the return of the data or its deletion.

6.2. The return of the data must take place in an easily accessible, common electronic format specified by the client. This can be done either directly to the client or to a third party designated by the client.

6.3. Upon the client's request, the contractor is obliged to irrevocably delete all remaining data sets of the client in accordance with the current state of the art. Furthermore, the contractor must provide proof of the proper deletion of the data upon the client's request.

7. ICT Incidents

7.1. The contractor is obliged to act without undue delay in the event of irregularities in information processing and all security-related events that constitute a breach of the protection goals of confidentiality, integrity, availability, or authenticity (referred to as an "ICT incident"). ICT incidents can be unplanned or unexpected events or a series of such events that impair the security of network and information systems and may pose a significant threat to the client's business operations.

7.2. The contractor must implement appropriate systems, processes, and responsibilities to identify and handle ICT incidents as well as, where applicable, payment-related operational or security incidents.

7.3. In the event of a major ICT incident, the contractor shall support the client and the competent authorities by providing all necessary information.

7.4. The contractor undertakes to inform the client in text form immediately and without additional costs in the event of an ICT incident related to the provided ICT services and to provide appropriate support. Should the ICT incident be subject to a reporting obligation under Art. 19 DORA, or should there be a possibility that such an obligation exists, the contractor shall support the client immediately and proactively in any necessary manner.

7.5. The contractor is obliged to provide the client with comprehensive support in the event of an ICT incident related to the ICT service provided to the client. This support includes providing information on the cause, severity, and duration of the incident. The contractor undertakes to provide this support at reasonable effort without additional remuneration.

7.6. The documentation and reporting of an ICT incident must include at least: a) a description of the incident, the affected information, the anticipated consequences, and the measures taken to remedy the effects, b) information from a failure or root cause analysis, c) any emergency contingency measures taken, and d) the name and contact details of the information security officer or another contact person.

7.7. Furthermore, the contractor must implement systems and processes for the detection and management of vulnerabilities, with critical vulnerabilities, their nature, and their remediation being reported to the client in a timely manner depending on their criticality.

8. Communication, Information, and Regulatory Inquiries

8.1. The contractor undertakes to direct information and notifications regarding information security to a point of contact designated by the client. The corresponding contact details will be provided to the contractor by the client either directly or via an individual agreement. In return, the contractor is obliged to designate its own contact persons for information security.

8.2. The contractor undertakes to provide the client, upon request, with all information necessary for maintaining an information register as required by the DORA regulation. Changes to this information must be communicated to the client without delay.

8.3. The contractor undertakes to cooperate fully with the competent authorities. This includes cooperation with supervisory and resolution authorities as well as other persons designated by them.

9. Right of Extraordinary Termination

9.1. In addition to the termination rights specified in the framework or individual agreement, the client has the right to terminate the contract extraordinarily for good cause, without any obligation to reimburse remanence or other costs, particularly if:
− The provision of services from a new location violates regulatory or data protection requirements applicable to this contract.
− Proven weaknesses in the contractor's ICT risk management occur, particularly regarding the assurance of availability, authenticity, security, and confidentiality of data, regardless of whether this concerns personal, other sensitive, or non-personal data.
− There is a material breach by the contractor or its subcontractors of applicable laws, other regulations, or the terms of this contract.
− A competent authority requires the client to terminate the contract in whole or in part.
− The competent authority can no longer effectively supervise the client due to the terms of the respective contractual agreement or the associated circumstances.
− Circumstances arise that are identified during the monitoring of ICT third-party risk within the meaning of Art. 3 No. 18 of Regulation (EU) 2022/2554 and which are likely to impair the proper provision of the functions and ICT services agreed upon in the contract. This includes material changes affecting the agreement or the contractor's circumstances, such as a change of control.

9.2. Extraordinary termination for the aforementioned reasons requires that the continuation of the contractual relationship is no longer reasonable for the client with regard to contractual performance. This applies in particular if the negative impacts on the client's risk profile or assessment are significant and lasting and cannot be mitigated by appropriate internal control and management measures in accordance with regulatory requirements.