Data Processing Agreement under Art. 28 GDPR

Parties

Processor

Company

OneBob by Continua Systems GmbH

Address

Eduard-Rüber-Str. 7, 83022 Rosenheim, Deutschland

Commercial register

Amtsgericht Traunstein HRB 31098

VAT ID

DE354261061

Represented by

Thomas Nagel & Dr. Marc Walker

Contact

info@continua.systems, +49 8031 2821473

Controller

The controller is the respective holder of the OneBob account (the tenant). The controller's full details follow from the company data stored in the account and are set out by name in the version of this agreement available inside the account.

1. Preamble and subject matter

This agreement sets out the rights and obligations of the parties with respect to the processing of personal data that the processor carries out for the controller in providing the OneBob software (the "service"). It supplements the terms of service and takes effect when those are accepted.

The controller uses the service to run its own business processes (customer management, sales, projects, time tracking, personnel and travel expense accounting, and document storage). In doing so, the processor processes personal data exclusively for the controller and on the controller's instructions. The controller remains solely responsible for the lawfulness of the processing, in particular for the existence of a legal basis under Art. 6 GDPR.

This agreement is concluded in electronic form pursuant to Art. 28(9) GDPR. Acceptance is given by an explicit confirmation by the controller during registration or in the account settings. The processor permanently records the time of acceptance, the accepting person, their e-mail address, the IP address and the version of this agreement. That record serves both parties as evidence that the contract was concluded.

Unless this agreement provides otherwise, the terms of service and the privacy policy of the service apply in addition.

2. Subject matter, nature and purpose of the processing, and duration

The subject matter of the processing is the provision and operation of the service as a multi-tenant software-as-a-service application, including the storage, evaluation, transmission and deletion of the data entered or uploaded by the controller that this requires.

The processing is carried out solely for the purpose of making the contractually agreed functions of the service available to the controller. There is no processing for the processor's own purposes, in particular no profiling, no advertising and no training of artificial intelligence models.

The nature of the processing comprises in particular the collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission to recipients designated by the controller, restriction, erasure and destruction of personal data.

The duration of the processing corresponds to the term of the contract for use of the service. It begins when the account is provided and ends when the account ends. The provisions on erasure or return after termination (clause 11) remain unaffected.

3. Types of personal data

The processing covers the following types of personal data, to the extent the controller records them in the service or the functions it has enabled generate them:

• Master data of customers, prospects and their contact persons (name, role, company, address, further freely defined attributes).
• Communication data (e-mail addresses, telephone numbers, call and visit notes, tasks, appointments, calendar and booking data).
• E-mail content including attachments, where the controller enables mailbox synchronisation with Microsoft 365 or Google Workspace.
• Contract and revenue data (quotes, deals, prices, invoice line items, payment milestones, forecasts).
• Project and time tracking data (project assignments, recorded hours, hourly rates, approvals).
• Personnel and travel expense data of the controller's employees (personnel master data, absences, trips, receipts, reimbursement amounts), where the corresponding modules are used.
• Documents and files uploaded by the controller, including the personal data they contain.
• Usage and log data of the controller's user accounts (sign-in times, IP addresses, change logs), to the extent required for secure operation and for tracing changes.

4. Categories of data subjects

The processing concerns the following categories of data subjects:

• Customers and prospects of the controller, together with their contact persons and staff.
• Employees of the controller, including the users of the service.
• Suppliers, service providers and other business partners of the controller, together with their contact persons.
• Recipients of newsletters, invitations and other correspondence that the controller sends through the service.

5. Processing on documented instructions (Art. 28(3)(a) GDPR)

The processor processes personal data only on documented instructions from the controller. This also applies to transfers of personal data to a third country or an international organisation, unless the processor is required to do so by Union or Member State law to which it is subject. In that case, the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The controller's documented instructions follow from this agreement, from the terms of service and from the configuration of the account in the service. Enabling, configuring or disabling a function by an authorised user of the controller (for example mailbox synchronisation, the AI features or a connection to an accounting system) constitutes an instruction within the meaning of this clause. The processor records such changes in the account's change log.

Individual instructions outside the configuration of the service are to be sent in text form to the contact address stated above for the processor. Verbal instructions must be confirmed in text form without undue delay. The processor may make instructions that go beyond the contractually agreed scope of services conditional on a separate agreement covering the additional effort.

If the processor is of the opinion that an instruction infringes the General Data Protection Regulation or other data protection provisions of the Union or the Member States, it informs the controller without undue delay (Art. 28(3), final sentence, GDPR). The processor is entitled to suspend execution of that instruction until the controller confirms or amends it.

6. Confidentiality (Art. 28(3)(b) GDPR)

The processor uses only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality to process personal data. The commitment is given before work is first taken up and continues to apply after the activity ends.

The processor ensures that the persons authorised to process personal data are made familiar with the applicable data protection provisions and are regularly made aware of how to handle personal data.

Access by the processor's personnel to the controller's stored data follows the need-to-know principle and occurs only to the extent necessary to provide the service, to remedy a fault or to answer a support request from the controller. Support access to the controller's account is logged.

7. Technical and organisational measures (Art. 28(3)(c), Art. 32 GDPR)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, the processor implements appropriate technical and organisational measures under Art. 32 GDPR.

The measures in place at the time this agreement is concluded are described in Annex 1 to this agreement. They form part of this contract.

The processor is entitled to adapt the measures to technical developments. The level of protection achieved must not fall below the level described. Material changes are documented and communicated to the controller on request.

8. Sub-processors (Art. 28(2), (3)(d) and (4) GDPR)

The controller grants the processor general written authorisation within the meaning of Art. 28(2) GDPR to engage other processors (sub-processors). The sub-processors engaged at the time this agreement is concluded are listed exhaustively in Annex 2 and are hereby approved.

If the processor intends to engage a further sub-processor or to replace an existing one, it informs the controller in advance by e-mail to the administrator address stored in the account. The controller may object to the change in text form within 30 days of receipt of the notice on important data protection grounds. If no objection is raised within that period, the change is deemed approved.

If the controller objects in time and the processor cannot reasonably provide the service without the sub-processor concerned, either party may terminate the contract for use with effect from the planned change date. Fees already paid in advance are refunded on a pro rata basis.

The processor selects sub-processors with due care, paying particular regard to the suitability of the technical and organisational measures they have taken. It contractually binds each sub-processor to data protection obligations that materially correspond to the obligations under this agreement, in particular to sufficient guarantees under Art. 28(4) GDPR. Where a sub-processor fails to fulfil its data protection obligations, the processor remains fully liable to the controller for the performance of those obligations.

Ancillary services that the processor obtains from third parties and that are not directed at processing the controller's personal data (for example telecommunications services, cleaning or maintenance services, and hardware maintenance) do not constitute sub-processing within the meaning of this clause. The processor nevertheless takes appropriate precautions to protect the data in those cases as well.

9. Assistance with data subject rights (Art. 28(3)(e) GDPR)

The processor assists the controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the controller's obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR.

For this purpose the service provides the controller with functions that let it view, rectify, export and erase the data stored about a data subject itself. In particular, the export function available in the customer record and in the personnel file produces a complete Art. 15 GDPR disclosure as a PDF document together with a machine-readable version and all files belonging to the data subject.

If a data subject approaches the processor directly, the processor forwards the request to the controller without undue delay and does not answer it itself, unless the controller has instructed it to do so.

Where a request causes effort beyond the self-service functions available in the service, the processor may charge the demonstrated additional effort at its usual rates. This does not apply where the effort is caused by circumstances for which the processor is responsible.

10. Assistance with the obligations under Art. 32 to 36 GDPR

Taking into account the nature of the processing and the information available to it, the processor assists the controller in complying with the obligations set out in Art. 32 to 36 GDPR.

The processor notifies the controller of any personal data breach affecting the controller's data without undue delay after becoming aware of it, and in any event within 48 hours. Notification is sent by e-mail to the administrator address stored in the account and contains, to the extent available, a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where not all information is available at once, it is supplied without undue delay thereafter.

The processor assists the controller with a data protection impact assessment under Art. 35 GDPR and with prior consultation of the supervisory authority under Art. 36 GDPR by providing the necessary information about the processing, the systems used and the protective measures taken.

The processor implements the measures for the security of processing under Art. 32 GDPR described in Annex 1 on its own initiative and reviews their effectiveness regularly.

11. Return, complete data export and erasure after termination (Art. 28(3)(g) GDPR)

Throughout the term of the contract for use, the controller may at any time retrieve individual data sets itself through the export and reporting functions contained in the service, in common machine-readable formats.

Independently of that, the processor provides the controller on request with a complete export of all personal data processed on its behalf, including all files and documents uploaded by the controller. The export is provided in a common machine-readable format. The request must be made in text form by an administrator stored in the account. The processor makes the export available within 20 working days of receiving the request. On termination of the contract for use, the export is provided once free of charge.

The controller should request the complete export before the contract ends or within the erasure period below, so that provision can be completed before erasure.

Data portability and switching providers: the same export also serves to transfer the data to another provider. The processor does not obstruct a switch, does not make it subject to additional conditions and does not charge a separate switching fee for it. On request it explains the structure and meaning of the exported data fields to the extent necessary for the new provider to take the data over.

After the contract for use ends, the processor erases the personal data processed for the controller. Erasure takes place 30 days after the account ends. That period matches the period stated in the terms of service and at the same time gives the controller the opportunity to have an accidentally terminated contract restored or to request the export governed above.

Existing backup copies are overwritten in the course of the processor's regular rotation cycle. Until the respective cycle completes, the data remains contained there in encrypted form, but is held solely for restoration in the event of a fault and is not otherwise processed. Backup copies serve only the processor's operation of the service; the controller has no claim to the handover or restoration of a backup copy. The claim to a complete export under this clause remains unaffected.

Retention beyond the periods above occurs only where Union or Member State law requires the processor to store the data. In that case the data is blocked for the duration of the statutory retention period and processed solely for the purpose that requires the retention.

The processor confirms the erasure to the controller in text form on request.

12. Evidence and audit rights (Art. 28(3)(h) GDPR)

The processor makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

Evidence is normally provided by sending the current description of the technical and organisational measures, by answering an audit questionnaire in text form, and by producing available reports of independent third parties where such reports exist.

Where that evidence is not sufficient in an individual case, the controller may request an on-site audit or an audit by video conference. It must be announced at least 30 days in advance, takes place during normal business hours, must not disproportionately disrupt the processor's operations, and is limited to one audit per calendar year. An additional occasion arises in the event of a personal data breach or an order by a supervisory authority.

Because the service is multi-tenant, an audit must result neither in access to other tenants' data nor in the disclosure of third-party trade secrets. An auditor mandated by the controller must not be a competitor of the processor and must be bound to confidentiality before the audit begins.

The processor informs the controller without undue delay of inspections and measures by a supervisory authority insofar as they relate to processing carried out on behalf of the controller.

The processor may charge reasonable remuneration for the effort of an audit that goes beyond text form.

13. Place of processing and third-country transfers

The controller's data is processed in the European Union as a matter of principle. The application servers, the databases and the object storage for uploaded files are operated exclusively in data centres within the European Union.

Where sub-processors listed in Annex 2 are established in a third country or can access data from there, the processor bases the transfer on an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework where the provider concerned is certified under it, and additionally on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR together with appropriate supplementary measures.

The AI features of the service run on Amazon Web Services (Amazon Bedrock) in the Frankfurt region (eu-central-1), so the content is processed within the European Union. The sole exception is the optional deal enrichment, which relies on a live web search and is available only on infrastructure in the United States. It is triggered only when a user of the controller explicitly requests it, and the controller can disable it entirely in the settings. The standard contractual clauses apply to that transfer.

Neither the processor nor the AI providers it uses employ the controller's data to train models.

14. Liability, final provisions and governing law

The liability of the parties is governed by the terms of service unless this agreement provides otherwise. Art. 82 GDPR remains unaffected.

The controller is responsible for the lawfulness of the data processing and for safeguarding the rights of data subjects. In particular, it ensures that it has a legal basis for entering personal data into the service and that it has provided data subjects with the information required by Art. 13 and 14 GDPR.

Amendments and additions to this agreement require text form. The processor may adapt this agreement where this becomes necessary due to a change in the legal situation, requirements of a supervisory authority, or technical development of the service. An amended version receives a new version number; the controller is informed of the change and asked to accept the new version again in the account.

Should individual provisions of this agreement be or become invalid, the validity of the remaining provisions remains unaffected. The parties will replace an invalid provision with a valid one that comes closest to the economic purpose of the invalid provision.

In the event of contradictions between this agreement and the terms of service, the provisions of this agreement prevail on data protection matters.

This agreement is available in German and in English. The German version is authoritative and solely binding; the English version serves comprehension only.

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. To the extent legally permissible, the exclusive place of jurisdiction for all disputes arising from this agreement is the processor's registered office.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

The measures described below are implemented at the time this agreement is concluded. They apply to the service as a whole and therefore equally to every tenant.

The processor is not currently certified under ISO 27001, SOC 2 or TISAX and claims no such certification. The statements below describe only measures that are actually implemented.

Pseudonymisation and encryption (Art. 32(1)(a) GDPR)

• All communication between users' devices and the service runs exclusively over TLS. HTTP Strict Transport Security (HSTS) enforces the encrypted connection on subsequent visits as well.
• Connections to the sub-processors used (object storage, e-mail dispatch, AI services) are encrypted in transit throughout.
• Uploaded files and documents are stored encrypted in the object storage (encryption at rest).
• Passwords are never stored in clear text, only as a bcrypt hash with a cost factor of 12. "Remember me" tokens are stored only as a SHA-256 hash.
• Credentials for connected third-party systems (OAuth tokens, API keys) are stored encrypted and are never delivered to the browser.
• External addresses (URLs) and programming interfaces use only non-sequential, prefixed identifiers, so that an identifier reveals nothing about the data set or its size.

Confidentiality: physical access, system access, data access and separation control (Art. 32(1)(b) GDPR)

• Physical access control: the service runs exclusively in the data centres of a professional operator within the European Union. Physical access is controlled by the data centre operator through video surveillance, access sluices, visitor management and access authorisations. The processor keeps no hardware of its own on its business premises.
• System access control: access to the service requires a personal user account with a password. Minimum password strength requirements are enforced and the last five passwords may not be reused. Every account creation requires e-mail verification; an account without a confirmed address cannot sign in. Alternatively the controller can set up and enforce sign-in through its own identity provider (single sign-on).
• System access control: failed sign-in attempts are counted and met with a progressively increasing lockout. Forms and security-relevant endpoints are additionally protected against automated attacks by rate limiting and bot protection.
• System access control: sessions are held server-side, use cookies with the HttpOnly, SameSite and Secure attributes, run in strict mode (no client-supplied session identifiers) and are terminated automatically after 30 minutes of inactivity. All state-changing forms are protected by CSRF tokens.
• Data access control: within an account, a role-based permission system applies (administration, sales management, sales, project work) with additional fine-grained individual permissions. On top of that, a team-based visibility system (circles) governs which records a user may see at all. Personnel files are subject to a separate need-to-know grant and are not readable through the general administrator role.
• Data access control: a request for a record the user is not authorised to see is answered with "not found" rather than "access denied", so that the response reveals nothing about the existence of other parties' records.
• Separation control: the service is multi-tenant. Every record carries a tenant identifier, and every database query, file access and interface response is restricted to the tenant of the signed-in user. The restriction is not left to the individual developer but enforced by mandatory database helper functions that insert the tenant identifier themselves and reject its absence as an error. Compliance is additionally checked by automated tests and static code analysis.
• Separation control: test, development and production environments are fully separated. No production data is used in development.

Integrity: transfer and input control (Art. 32(1)(b) GDPR)

• Transfer control: data is transmitted to third parties only at the controller's instigation (for example e-mail dispatch to recipients it selects, handover to an accounting system it has connected) or to the sub-processors named in Annex 2.
• Transfer control: files are delivered to the browser only after a permission check and a tenant check. Large files are delivered through time-limited, signed references that cannot be retrieved without a valid signature.
• Transfer control: the browser is protected by a Content Security Policy, X-Frame-Options (DENY), X-Content-Type-Options and a restrictive referrer policy. Inline scripts are excluded, so injected code cannot execute.
• Input control: every state-changing operation is logged in an audit trail. The change log records who performed which action on which object and when, and is available to the controller's administrators inside the account.
• Input control: all database queries use parameterised statements exclusively; user input is escaped according to its output context. Colour values and links entered by users are sanitised separately.
• Application integrity: changes to the source code pass through an automated approval gate consisting of a test suite and static code analysis before they are deployed.

Availability and resilience (Art. 32(1)(b) and (c) GDPR)

• Operation takes place in a data centre with uninterruptible power supply, backup generator, early fire detection, an extinguishing system and redundant network connectivity.
• Automated backups of the database are created regularly and kept separately from the production system. The backup and restore procedure is documented.
• Uploaded files are held in redundant object storage.
• The service sits behind upstream protection against denial-of-service attacks and a web application firewall.
• Long-running processing is not executed in the web process but handled by supervised background workers with bounded runtime and automatic restart. This prevents a single task from affecting the availability of the service.
• Operational and error logs are kept, rotated automatically and evaluated in order to detect faults early.

Procedures for regular testing, assessment and evaluation (Art. 32(1)(d) GDPR)

• Before every deployment the service passes an automated test suite and static code analysis. Violations of tenant separation, of the permission checks and of the safe-output rules are treated as failures and block the deployment.
• Dependencies and runtime environments are updated regularly; security-relevant updates are applied promptly.
• The processor maintains a publicly available vulnerability disclosure policy including a security.txt under RFC 9116, so that security researchers can report weaknesses in a structured way.
• Incoming reports are assessed, prioritised and tracked; remediation is documented.
• Data protection incidents are recorded, assessed and reported under a defined procedure (see clause 10 of this agreement).
• The technical and organisational measures are reviewed at least annually and whenever there is cause, and adjusted where necessary.

Annex 2: Sub-processors

The sub-processors below are generally authorised by the controller under clause 8 of this agreement. Changes are notified under the procedure set out there.

Not listed as sub-processors

• Microsoft Clarity: the processor uses Microsoft Clarity exclusively on its publicly accessible marketing and registration pages, and only with the consent of the individual visitor. Clarity is never loaded on the signed-in pages of the service. It therefore receives no data of the controller and is not a sub-processor under this agreement. Its use is described in the processor's privacy policy.
• Lexware Office and SevDesk: these accounting systems are contacted only where the controller connects its own account with them to the service. In that case the controller maintains its own contractual relationship directly with the provider concerned and, by connecting, instructs the processor to transmit the data it selects there. The processor does not engage these providers itself and does not include them as sub-processors.
• Microsoft 365 and Google Workspace: a connection to mailbox and calendar is established only where a user of the controller sets it up. The contractual relationship for those services exists directly between the controller and the provider concerned.
• Stripe and subscription payments: processing the payments for use of the service concerns the processor's own contractual relationship with the controller as its customer and is not processing on the controller's behalf. For that payment and invoicing data the processor is itself the controller. Stripe acts as a payment service provider on its own responsibility and is subject to its own regulatory duties, among them payment services law, anti-money-laundering and fraud prevention. Data that the processor handles on behalf of the controller, in particular customer, contact and employee data, is never transmitted to Stripe. Details of payment processing are set out in the processor's privacy policy.