Data Processing Agreement (DPA)

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller in connection with the provision of the TradeFork software platform. The duration of processing corresponds to the term of the service agreement between the parties.

2. Nature and Purpose of Processing

Processing includes the following activities:

• • Provision and operation of the TradeFork SaaS platform (hosting, maintenance, updates)
• • User account management and authentication (login, password management)
• • License validation and management (activation, heartbeat checks)
• • Payment processing through the sub-processor Stripe
• • Sending transactional emails (confirmations, license keys, support)
• • Technical support and troubleshooting

3. Types of Data and Data Subjects

Categories of Personal Data

• • Email addresses
• • Password hashes (bcrypt)
• • IP addresses (server and access IPs)
• • Hardware IDs (hashed server identifiers for license binding)
• • Payment data (processed by Stripe, not stored by the Processor)
• • Usage data (audit logs: login timestamps, instance actions)
• • Technical metadata (browser type, operating system when accessing the dashboard)

Categories of Data Subjects

• • Customers (holders of a TradeFork subscription)
• • Trial users (users of the free trial period)
• • Dashboard users (persons accessing the TradeFork dashboard)

4. Controller Instructions

The Processor shall process personal data only on documented instructions from the Controller. Instructions may be issued in writing or in text form (e.g., via email to [email protected]). The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes data protection law.

5. Confidentiality

The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The confidentiality obligation shall continue after the termination of the agreement.

6. Technical and Organizational Measures (TOMs)

The Processor implements the following technical and organizational measures pursuant to Art. 32 GDPR:

• • Encryption: All data is encrypted in transit using TLS. Data at rest is stored on encrypted storage volumes.
• • Access control: JWT-based authentication, bcrypt password hashing, audit logging of all access.
• • Network security: Container isolation via Podman, dedicated internal network (172.20.0.0/16), firewall rules, no public database access.
• • Data separation: Each customer receives a dedicated, isolated server instance with a separate database.
• • Availability: Automated system monitoring, heartbeat checks, automatic restart on failure.
• • Input control: All administrative actions are logged with timestamp and user identifier in the audit log.
• • Pseudonymization: Hardware IDs are stored in hashed form and cannot be directly attributed to a natural person.

7. Sub-Processors

The Controller grants the Processor general authorization to engage further sub-processors. The Processor shall inform the Controller at least 14 days in advance via email of any intended changes concerning the addition or replacement of sub-processors. The Controller may object to such changes within 14 days of notification. The following sub-processors are currently engaged:

8. Data Subject Rights

The Processor shall assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR (access, rectification, erasure, restriction, data portability, objection). Requests from data subjects received directly by the Processor shall be forwarded to the Controller without delay.

9. Deletion and Return of Data

Upon termination of the service agreement, the Processor shall delete all personal data processed on behalf of the Controller within 30 days, unless statutory retention obligations require otherwise. At the Controller's request, data shall be returned in a common, machine-readable format before deletion. Deletion shall be confirmed in writing to the Controller upon request.

10. Audit Rights

The Controller has the right to verify compliance with this DPA and applicable data protection requirements. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR. Inspections may be carried out upon reasonable prior notice (at least 14 business days) and subject to appropriate confidentiality agreements.

11. Data Breach Notification

The Processor shall notify the Controller of any personal data breach without undue delay, and no later than 24 hours after becoming aware of it. The notification shall include at minimum: a description of the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken or proposed to address the breach.

12. Liability

The liability of the parties is governed by the provisions of the GDPR, in particular Art. 82 GDPR. The Processor shall be liable for damages caused by processing that does not comply with the GDPR or that results from a breach of obligations specifically directed at processors.

13. Applicable Law

This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is the registered office of the Processor, unless mandatory consumer protection laws dictate otherwise.