Data processing agreement

Stand: 07.10.2026 (as of 7 October 2026)

This English version is a convenience translation. Only the German version (Auftragsverarbeitungsvertrag) is legally binding. In the event of any discrepancy, the German version prevails.

Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28(3) GDPR

between

the customer as stated in the order or trial access – controller, hereinafter "Customer" –

and

DealPilot UG (haftungsbeschränkt), Uhlenbruch 15b, 33098 Paderborn, Germany – processor, hereinafter "DealPilot" –

1. Subject matter and duration

1. This agreement governs the processing of personal data by DealPilot on behalf of the Customer when providing the DealPilot CRM software as software-as-a-service (main contract: DealPilot's Terms of Service and any individual agreements). It also applies to free trial access.
2. This agreement applies for the term of the main contract (including trial access) and beyond for as long as DealPilot processes the Customer's personal data, in particular until complete deletion under section 12.
3. For outbound sales as a service (Module B of the Terms), this agreement only applies if the respective order provides that DealPilot acts as processor. [[ROLLE-VERTRIEBSDIENSTLEISTUNG]]
4. In the event of conflict, this agreement prevails over the main contract in matters of data protection.

2. Nature and purpose of processing

1. Nature of processing: collection (by entry or import by the Customer), storage, organisation, adaptation, retrieval, consultation, use, transmission on behalf of the Customer (e.g. sending emails, offers, invoices and dunning notices to recipients determined by the Customer), provision in the customer portal, backup, restriction, erasure.
2. Purpose: provision, operation, maintenance, backup and support of the Software so that the Customer can run its sales, offer, invoicing and commission processes.
3. DealPilot processes the data exclusively in member states of the EU or EEA unless expressly stated otherwise in Annex 2.

3. Types of data and categories of data subjects

Special categories of personal data (Art. 9 GDPR) are not subject to processing. The Customer undertakes not to store such data in the Software unless separately agreed.

4. Instructions

1. DealPilot processes the data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or member state law. In that case, DealPilot informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
2. The instructions are set out conclusively in this agreement and the main contract. Use of the Software's functions by the Customer and its users (e.g. import, deletion, export, sending) constitutes an instruction. The Customer gives further instructions in text form to info@dealpilot-sales.de.
3. DealPilot informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions. DealPilot may suspend execution until the Customer confirms or changes the instruction.
4. Instructions going beyond the contractually agreed scope of services are treated as a change request and may be charged separately.

5. Confidentiality

DealPilot only uses persons for processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and who have been familiarised with the relevant data protection provisions (Art. 28(3)(b), Art. 29 GDPR). This obligation continues after their engagement ends.

6. Technical and organisational measures

1. DealPilot takes all measures required under Art. 32 GDPR. The measures applicable at conclusion of this agreement are described in Annex 1.
2. The measures are subject to technical progress. DealPilot may replace them with equivalent or better measures; the level of security must not be reduced. Material changes are documented.

7. Sub-processors

1. The Customer grants DealPilot general authorisation to engage further processors (sub-processors). The sub-processors engaged at conclusion of this agreement are listed in Annex 2 and are deemed approved.
2. DealPilot informs the Customer in text form (e.g. by email or notice in the Software) at least 30 days in advance of any intended addition or replacement of a sub-processor. The Customer may object to the change in text form within this period for an important data protection reason. If the parties cannot agree, the Customer may terminate the main contract with effect from the date the change takes effect.
3. DealPilot contractually imposes on each sub-processor the same data protection obligations as set out in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). DealPilot remains liable to the Customer for the sub-processor's performance of its obligations.
4. Ancillary services used by DealPilot from third parties without access to Customer data (e.g. telecommunications, pure transport services) are not sub-processing within the meaning of this section.

8. Transfers to third countries

1. Processing outside the EU/EEA only takes place if the conditions of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 3 "processor to processor") with supplementary measures where necessary.
2. Currently, no Customer data is transferred to third countries. [[DRITTLAND-HOSTER: if the hosting provider is a US company, add the legal basis here and in Annex 2]]

9. Assistance with data subject rights

1. DealPilot assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR (Art. 12–23). The Software provides functions for searching persons, exporting data (access, portability), rectification, anonymisation or erasure, and recording objections (block list).
2. If a data subject contacts DealPilot directly, DealPilot forwards the request to the Customer without delay and does not respond itself unless instructed by the Customer.

10. Assistance with obligations under Art. 32 to 36 GDPR

Taking into account the nature of processing and the information available to it, DealPilot assists the Customer in complying with its obligations regarding security of processing, notification of personal data breaches, communication to data subjects, data protection impact assessments and prior consultation of the supervisory authority. Assistance not caused by a breach by DealPilot and going beyond the usual may be charged at cost.

11. Notification of personal data breaches

1. DealPilot notifies the Customer of a personal data breach without undue delay, at the latest within [[MELDEFRIST, max. 48 hours]] of becoming aware of it, to the admin email address stored by the Customer.
2. The notification contains, as far as available, the information under Art. 33(3) GDPR: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed, and a contact point. Information not yet available is provided without undue delay.
3. DealPilot takes the necessary measures without delay to secure the data and mitigate possible adverse effects. Notification to the supervisory authority and communication to data subjects are the Customer's responsibility.

12. Deletion and return after the end of the contract

1. After the end of the provision of services, the Customer may retrieve its data via the export function for 30 days (return). DealPilot then deletes all of the Customer's personal data including existing copies, unless Union or member state law requires storage.
2. For trial access: deletion 30 days after the beta workspace is locked, unless a subscription is taken out.
3. Backups are overwritten in the regular rotation no later than after [[BACKUP-AUFBEWAHRUNG]]. Until then, the data is protected from any further processing.
4. DealPilot confirms deletion in text form on request.

13. Demonstration of compliance and audits

1. On request, DealPilot provides the Customer with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular the current version of Annexes 1 and 2 and any available certificates or audit reports (e.g. of sub-processors).
2. The Customer or an auditor mandated by it who is bound to confidentiality and is not a competitor of DealPilot may carry out audits, including inspections. On-site audits must be announced with reasonable notice (usually 30 days, shorter where there is a specific reason), carried out during normal business hours and must not disproportionately disrupt operations. They are usually limited to once per calendar year unless there is a specific reason.
3. DealPilot may charge reasonable compensation for audits going beyond the provision of documents unless the audit reveals a material breach by DealPilot.
4. DealPilot submits to audits by supervisory authorities without restriction to the extent required by law.

14. Customer obligations

1. The Customer is solely responsible for the lawfulness of processing, in particular for having a legal basis, informing data subjects and complying with unfair competition law when making promotional calls.
2. The Customer informs DealPilot without delay if it discovers errors or irregularities in processing.

15. Liability

Liability of the parties towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the main contract (Section 15 of the Terms) apply unless Art. 82 GDPR mandatorily provides otherwise.

16. Final provisions

1. Amendments to this agreement must be in text form. The agreement is concluded electronically (Art. 28(9) GDPR).
2. Should any provision be invalid, the remainder of the agreement remains valid.
3. German law applies. The place of jurisdiction is [[GERICHTSSTAND]] to the extent legally permissible.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Status of measures: 7 October 2026. Placeholders must be filled with the hosting provider's actual details before go-live.

1. Confidentiality

Physical access control (data centres)

• Servers operated exclusively in data centres of [[HOSTER]] in [[SERVERSTANDORT]] (EU)
• Physical security of the data centre by the hosting provider: [[HOSTER-ZERTIFIZIERUNG, e.g. ISO/IEC 27001]], access control systems, video surveillance [[as stated by the provider]]
• DealPilot offices: [[BUERO-SICHERUNG, e.g. locking system, visitor policy]]

System access control

• Personal user accounts, no shared accounts
• Passwords stored exclusively as bcrypt hashes; minimum length 10 characters with letters and digits
• Rate limiting of login attempts (lockout after repeated failures per account and per IP address), protection against username enumeration
• Session cookie dp_session: httpOnly, SameSite=Lax, HTTPS only; session tokens stored in the database only as hashes (SHA-256); expiry after 30 days
• Deactivated users lose access immediately; a password change ends other sessions
• DealPilot's administrative access to servers only via encrypted connections with key authentication [[and two-factor authentication – verify]]

Data access control (permissions)

• Role-based access control (RBAC) with the roles Admin, Setter, Closer, Customer Portal and custom roles; server-side checks on every page view, action and export
• Setters only see their own leads or their team's pool; portal users only see appointments and deals released to them
• DealPilot staff access Customer data only where required for operation or support (need-to-know), [[logging of support access – define]]
• File uploads checked for file type and size

Separation control

• Each Customer workspace (including trial access) has its own database, separated from other customers
• Separate test and production systems; no real data in test environments

Pseudonymisation

• Anonymisation function for leads and contacts (e.g. after retention periods expire or on erasure request)

2. Integrity

Transmission control

• Encrypted transmission of all connections via HTTPS/TLS [[enable HSTS]]
• Email sending via [[MAILVERSAND-ANBIETER]] with TLS transport encryption
• Exports only with corresponding permission; exports are logged

Input control

• Audit log for changes to leads, status, assignments, deals, invoices, permissions, exports and data protection operations (user, action, object, old and new value, timestamp)

3. Availability and resilience

• Backups of databases and file storage: [[BACKUP-INTERVALL, e.g. daily]], retention [[BACKUP-AUFBEWAHRUNG]], storage [[BACKUP-ORT, e.g. separate location within the EU]], [[backup encryption – verify]]
• Regular restore tests: [[INTERVALL]]
• Deleted leads and contacts are first hidden (trash) and can be restored within a period
• System monitoring and outage alerts: [[MONITORING – define]]
• Disk encryption at the hosting provider: [[ENCRYPTION-AT-REST – verify]]

4. Procedures for regular testing, assessment and evaluation

• Review of these measures at least [[INTERVALL, e.g. annually]] and in case of material changes
• Timely application of security updates for software and dependencies
• Privacy by default: retention periods and block list (phone, email, domain) configurable in the Software
• Process for reporting and handling personal data breaches (section 11)

5. Organisational measures

• All employees committed to confidentiality and data protection
• Employee training [[INTERVALL]]
• Processor control: Art. 28 GDPR agreements with all sub-processors (Annex 2)
• Defined offboarding process (revocation of all access)

Annex 2: Sub-processors

Note on Stripe: Stripe (Stripe Payments Europe, Limited, Ireland) only processes the Customer's payments to DealPilot. Stripe only processes payment and billing data of the Customer itself, for which DealPilot is the controller (and Stripe partly an independent controller). Stripe has no access to the data the Customer stores in the Software and is therefore not a sub-processor under this agreement. Should the Software in future process payments of the Customer's own clients via Stripe, this annex will be updated in accordance with section 7.