Data Processing Agreement (DPA)

pursuant to Article 28(3) GDPR

Preamble

This Data Processing Agreement (hereinafter "DPA") specifies the data protection rights and obligations of the contracting parties in connection with the processing of personal data in the course of providing the software PLANKA as Software-as-a-Service (SaaS).

This DPA forms an integral part of the Terms and Conditions of PLANKA Software GmbH and becomes effective upon conclusion of the service agreement. It applies exclusively to the SaaS version. No data processing by the Provider takes place for the on-premise version.

§ 1 Contracting Parties

Controller: [Customer's company] [Name] [Address]

[Postal code] [City]

[Country] Email: [Email address] Phone: [Phone] VAT ID: [VAT ID] (hereinafter "Controller")

Processor: PLANKA Software GmbH Lindauer Str. 4 87439 Kempten, Germany Managing Directors: Lothar Hinz, N. Berglmeir Commercial Register: HRB 17740, Local Court (Amtsgericht) Kempten Email: privacy@planka.group (hereinafter "Processor")

§ 2 Subject Matter and Duration of Processing

2.1 Subject Matter

The Processor processes personal data on behalf of the Controller in the course of providing the SaaS software PLANKA pursuant to the service agreement and these provisions.

2.2 Duration

This DPA commences with the service agreement and ends upon its termination. The obligations under this DPA shall continue for as long as the Processor processes personal data of the Controller.

§ 3 Nature and Purpose of Processing

3.1 Nature of Processing

Processing includes the following activities:

• Storage and provision of data on the SaaS platform
• Technical processing for the rendering and functional delivery of the software
• Creation and restoration of data backups
• Technical logging for purposes of system security and error analysis
• Transmission of data in the course of service provision (encrypted data transfer)

3.2 Purpose of Processing

Processing is carried out exclusively for the purpose of providing and operating the PLANKA software for the Controller pursuant to the service agreement. No processing for the Processor's own purposes takes place.

§ 4 Categories of Data Subjects

The categories of persons affected by the processing include:

• Employees and staff of the Controller
• External contractors and consultants of the Controller
• Invited users and guest users
• Other persons whose data the Controller enters into the software

§ 5 Categories of Personal Data

5.1 Account Data

Username, email address, first and last name (if provided), profile picture (if uploaded), role and permissions within the instance.

5.2 Technical Access Data

IP address, browser type and version, operating system, time and duration of access, referrer URL.

5.3 User-Generated Data

Content created, edited, or uploaded by end users (boards, cards, comments, attachments, files). The nature and scope of this data are determined exclusively by the Controller.

5.4 Special Categories

The processing of special categories of personal data pursuant to Article 9 GDPR is not the subject of this DPA. Should the Controller enter such data into the software, this is the Controller's sole responsibility.

§ 6 Controller's Right to Issue Instructions

6.1 Binding Instructions

The Processor shall process personal data only on documented instructions from the Controller – including with regard to transfers of personal data to a third country or an international organization – unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

6.2 Issuance of Instructions

Instructions are generally issued through the service agreement and this DPA. Any additional individual instructions require written form (email suffices) and are to be directed to privacy@planka.group.

6.3 Obligation to Inform

If the Processor is of the opinion that an instruction from the Controller infringes the GDPR or other data protection provisions, the Processor shall inform the Controller without delay. The Processor is entitled to suspend the execution of the relevant instruction until it is confirmed or amended by the Controller.

§ 7 Confidentiality

7.1 Obligation of Confidentiality

The Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.2 Access Restriction

The Processor shall ensure that access to the Controller's personal data is limited to those persons who require such access for the performance of contractual obligations.

§ 8 Technical and Organizational Measures

8.1 Measures Pursuant to Article 32 GDPR

Taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

8.2 Specific Measures

The Processor implements in particular the following measures:

Confidentiality:

• Access control: Multi-factor authentication for administrative access, role-based permission management, individual user accounts
• Encrypted data transmission (TLS/SSL)
• Server access exclusively via SSH key authentication
• Firewall and Fail2ban (only necessary ports open)
• 2FA, SQL injection and CSRF/XSS protection
• Access control and permission management
• Separation of duties: Logical tenant isolation of customer instances, separate databases per customer instance

Integrity:

• Input control: Logging of changes to personal data within the application (audit logs)
• Transfer control: Encrypted transmission channels, no unencrypted data transmission

Availability and Resilience:

• Regular automated backups
• Redundant infrastructure at the hosting provider
• Monitoring and alerting for system outages
• Contingency plans for restoring availability

Procedures for Regular Review:

• Regular review and update of security measures
• Timely application of security updates
• Regular review of access permissions

8.3 Adaptation of Measures

The Processor shall regularly review the technical and organizational measures and adapt them to the current state of the art. The level of security may not be reduced.

§ 9 Sub-Processors

9.1 Approved Sub-Processors

The Controller hereby grants the Processor general written authorization to engage further processors (sub-processors), subject to the information obligation pursuant to § 9.3.

At the time of contract conclusion, the Processor engages the following sub-processors:

Announced change pursuant to § 9.3: The Processor intends to additionally engage netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, for server hosting and infrastructure; processing takes place in Germany. Hetzner Online GmbH remains engaged for part of the infrastructure. Engagement will not begin earlier than 14 days after this version is made known. This entry constitutes information within the meaning of § 9.3; the right to object under § 9.4 remains unaffected.

9.2 Independent Third-Party Controllers (Not Sub-Processors)

The following third parties process data as independent data controllers and are not subject to this DPA:

Only billing and licensing-related data is transmitted to PayPro Global (e.g., number of active user licenses). Personal data of end users or substantive usage data is not transmitted to PayPro Global.

9.3 Information Obligation Upon Changes

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 14 days before the planned change by email to the registered instance administrator and by notice on the Processor's website.

9.4 Right to Object

The Controller may object to the engagement of a new sub-processor within 14 days of receiving the information, provided there are legitimate data protection concerns. The objection must be in writing.

In the event of a substantiated objection, the Processor shall endeavor to find a solution that is reasonable for both parties. If no solution can be found and the service cannot be provided without the affected sub-processor, either party has the right to terminate the service agreement at the earliest possible date.

9.5 Obligations Towards Sub-Processors

The Processor shall ensure that each sub-processor is bound by a contract or other legal instrument under Union or Member State law to the same data protection obligations as those set out in this DPA, in particular providing sufficient guarantees that appropriate technical and organizational measures are implemented so that the processing meets the requirements of the GDPR.

Where the sub-processor fails to fulfil its data protection obligations, the Processor shall remain liable to the Controller for the performance of the sub-processor's obligations.

§ 10 Data Transfers to Third Countries

10.1 Principle

For Controllers located within the EU/EEA, personal data is processed exclusively on servers within the European Union.

10.2 Non-EU Customers

For Controllers located outside the EU/EEA, hosting may also take place in data centers outside the EU where this corresponds technically or contractually to the Controller's location. In such cases, the Processor shall ensure an adequate level of data protection through appropriate safeguards, in particular:

• Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR in the current version adopted by the European Commission
• Adequacy decisions of the European Commission pursuant to Art. 45 GDPR, where available
• Supplementary protective measures as required by CJEU case law

10.3 Transparency

The current processing location for the Controller's instance will be disclosed upon request.

§ 11 Assistance Obligations

11.1 Data Subject Rights

The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR, in particular:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Notification obligation (Art. 19 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

Where an end user contacts the Processor directly, the Processor shall refer the requester to the Controller and inform the Controller without delay.

11.2 Further Assistance Obligations

Taking into account the nature of the processing and the information available to the Processor, the Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, in particular:

• Security of processing (Art. 32 GDPR)
• Notification of a personal data breach to the supervisory authority (Art. 33 GDPR)
• Communication to the data subject (Art. 34 GDPR)
• Data protection impact assessment (Art. 35 GDPR)
• Prior consultation with the supervisory authority (Art. 36 GDPR)

§ 12 Notification of Data Breaches

12.1 Notification Obligation

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. Notification shall be made by email to the registered instance administrator.

12.2 Content of Notification

The notification shall contain at least:

• a description of the nature of the personal data breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned
• the name and contact details of the point of contact for further information
• a description of the likely consequences of the breach
• a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects

12.3 Documentation

The Processor shall document all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken.

12.4 Timeline

Initial notification to the Controller shall be made as quickly as possible, as a rule within 24 hours of becoming aware of the breach. Where the complete information cannot be provided simultaneously, the information shall be provided in phases without undue further delay.

§ 13 Deletion and Return of Data

13.1 Data Export

Upon termination of the service agreement, the Processor shall make personal data available to the Controller upon request in a machine-readable standard format. The supported export formats are described in the technical documentation on the Processor's website.

13.2 Export Period

The Controller has 30 days from termination of the service agreement to request the export of their data.

13.3 Deletion

After expiration of the export period or upon explicit instruction from the Controller, the Processor shall irreversibly delete all personal data, including all existing copies, unless Union or Member State law requires storage of the personal data.

13.4 Deletion Confirmation

The Processor shall confirm complete deletion in writing upon request by the Controller.

13.5 Backup Data

Data in backup systems shall be deleted no later than 30 days after deletion of production data.

§ 14 Audit Rights of the Controller

14.1 Obligation to Demonstrate Compliance

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

14.2 Audit Modalities

On-site inspections shall be conducted after at least 14 days' prior notice, with reasonable consideration for the Processor's business operations, and subject to confidentiality towards other customers. The Controller shall bear the costs of the audit unless the audit reveals a material breach of this DPA by the Processor.

14.3 Alternative Evidence

The Processor may also demonstrate compliance with its obligations by providing appropriate evidence, in particular:

• Current certifications or audit reports by independent third parties (e.g., ISO 27001, SOC 2), where available
• Self-assessments and documentation of technical and organizational measures
• Audit reports from the hosting provider

The provision of such evidence shall replace an on-site inspection unless the Controller raises substantiated doubts about the completeness or accuracy of the evidence.

14.4 Frequency

The Controller may conduct audits no more than once per calendar year unless there are concrete indications of a breach of this DPA.

§ 15 Liability

The liability of the parties is governed by the statutory provisions of the GDPR, in particular Article 82 GDPR, and by the liability provisions of the service agreement (Terms and Conditions).

§ 16 Final Provisions

16.1 Precedence

In the event of conflicts between this DPA and the service agreement (Terms and Conditions), the provisions of this DPA shall prevail on data protection matters.

16.2 Amendments

Amendments to this DPA require written form. The Processor may amend this DPA to the extent necessary to comply with changed legal requirements. The amendment procedure pursuant to § 18.3 of the Terms and Conditions applies accordingly.

16.3 Severability

Should individual provisions of this DPA be or become invalid, this shall not affect the validity of the remaining provisions.

16.4 Applicable Law and Jurisdiction

German law applies. Jurisdiction is determined by the provisions of the service agreement (Terms and Conditions).

Date of Agreement: 21.08.2026

Controller:

[Customer's company] [Name]

Processor:

PLANKA Software GmbH Lindauer Str. 4 87439 Kempten, Germany

Note: Placeholders ({{...}}) that are not populated at the time of contract conclusion are omitted entirely.

Annex 1: Current List of Sub-Processors

(As of: August 21, 2026)

Changes to this list will be communicated in accordance with § 9.3 of this DPA.