Data Processing Agreement

This agreement governs how ioumi processes the personal data of your end customers on your behalf. As a seller, you conclude it by agreeing to our General Terms and Conditions (AGB) (§ 17(2) of the General Terms and Conditions).

‍

Data Processing Agreement

(hereinafter the “Agreement”)

This Agreement is concluded between the Seller (hereinafter also the “Controller”) on the one hand and ioumi GmbH, FN 672206 p, Bahnhofstraße 8a, 6922 Wolfurt, Austria (hereinafter also the “Processor”) on the other hand. The Controller and the Processor are hereinafter also referred to individually as a “Party” and collectively as the “Parties”:

‍

§ 1 Subject Matter of the Agreement

(1) The Controller has engaged the Processor to provide services that are described in Annex ./1 to this Agreement (hereinafter the “Services”).

(2) Since, in the course of the Services to be provided by it, the Processor also obtains access to personal data processed by the Controller that are listed in Annex ./1 to this Agreement (hereinafter the “Personal Data”), or the Personal Data may otherwise be made available to the Processor, the conclusion of an agreement on data processing is required pursuant to Art. 28(3) of the General Data Protection Regulation (Datenschutz-Grundverordnung; Regulation (EU) 2016/679, hereinafter the “GDPR”).

(3) With regard to the Personal Data, the Processor expressly submits to the data protection obligations set out in § 2 of this Agreement.

‍

§ 2 Data Protection Obligations of the Processor

(1) The Controller may make the Personal Data available to the Processor for the provision of the Services. The Processor is therefore to be regarded as a processor within the meaning of Art. 4(8) GDPR. The Controller is a controller within the meaning of Art. 4(7) GDPR.

(2) The Processor undertakes to comply at all times with all obligations incumbent upon it as a processor under Austrian and European data protection law. Without limiting this general obligation, this applies in particular to the obligations expressly set out below.

(3) The Processor undertakes to process the Personal Data exclusively within the scope of the Controller's instructions. In principle, the permissible scope of processing of the Personal Data results from the contractual agreements concerning the Services. Changes regarding the data processing to be carried out by the Processor shall be issued by the Controller in writing or in text form.

(4) Any other processing or transfer of the Personal Data without an express instruction of the Controller, in particular any processing for the Processor's own purposes, is expressly prohibited. The Processor will use the Personal Data only to the extent strictly necessary for the provision of the Services. The Processor shall inform the Controller without undue delay if it considers that an instruction of the Controller infringes the applicable data protection law.

(5) If the Processor is obliged by mandatory statutory provisions to transfer or otherwise disclose Personal Data to third parties, it will, to the extent permitted, inform the Controller before making the respective transfer.

(6) With regard to the systems operated by the Processor on which the Personal Data are used, the Processor undertakes to take the data security measures required pursuant to Art. 32 GDPR, to review the data security measures taken periodically in light of the respective state of the art and, where necessary, to adapt them to the current state of the art. The Processor will document the security measures taken and retain this documentation for the term of this Agreement and for 12 months after this Agreement ceases to be in force. The specific technical and organizational data security measures taken by the Processor are set out in Annex ./2 to this Agreement.

(7) In connection with the use of the Personal Data, the Processor will only engage employees or other staff who have undertaken towards the Processor to maintain confidentiality and to comply with data secrecy (Datengeheimnis), in particular pursuant to § 6 of the Austrian Data Protection Act (Datenschutzgesetz, DSG). The obligation to comply with data secrecy must remain in force even after termination of the respective employment relationship and/or this Agreement.

(8) The Controller grants its consent to the engagement of the (sub-)processors listed in Annex ./3. The Processor undertakes to inform the Controller in advance of the engagement of (sub-)processors that are not listed in Annex ./3. The Controller may object to the engagement of a subprocessor for good cause within 14 days of receipt of the information. In the event of an objection, the Processor will endeavor to find a reasonable alternative. If such an alternative is not possible or cannot reasonably be expected of the Processor, either Party is entitled to terminate the usage relationship regarding the platform with a notice period of 30 days.

(9) The obligations provided for the Processor in this § 2 shall also be agreed with the (sub-)processor in the respective agreements with any engaged (sub-)processors. Upon request, the Controller shall be granted inspection of the data protection-related parts of such agreements with (sub-)processors. The Processor undertakes to review compliance with the obligations under this § 2 by any engaged (sub-)processors regularly and at least once a year, and to inform the Controller of the results of such a review upon request.

(10) Notwithstanding the agreements concluded with any (sub-)processors, the Processor remains fully responsible towards the Controller for compliance with the obligations under this § 2. However, to the extent permitted by law, the Processor's liability is limited to gross negligence or intent and is capped in amount at the sum of the base fees (excluding transaction fees) that the Controller paid to the Processor in the twelve months preceding the event giving rise to the damage. In the event of joint and several liability of the Processor and the Controller towards third parties, the Parties will settle their internal relationship in proportion to their respective degree of fault. Liability under mandatory statutory provisions, in particular towards data subjects pursuant to Art. 82 GDPR, remains unaffected.

(11) Insofar as Personal Data are processed outside the Member States of the EU or the EEA, the Processor will ensure that either an adequacy decision within the meaning of Art. 45 GDPR exists or appropriate safeguards pursuant to Art. 46 GDPR are complied with.

(12) The Processor will support the Controller technically and organizationally in the event that data subject rights are asserted (e.g. requests for access, requests for erasure). Furthermore, the Processor will, where applicable, support the Controller in carrying out a data protection impact assessment pursuant to Art. 35 and 36 GDPR.

(13) The Processor will irretrievably delete the Personal Data (including any processing results and any copies of the Personal Data) on the instruction of the Controller or, at the latest, after termination of this Agreement. Before deletion, the Processor grants the Seller the opportunity to export the Personal Data during a period of thirty (30) days. By way of derogation, the Controller hereby instructs the Processor to archive documents that are subject to statutory retention obligations (in particular contracts, invoices, credit notes, payment receipts and the audit trail of electronic signatures), together with the master and contact data of the end customers required for this purpose, for the duration of the statutory retention period (currently seven years pursuant to § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO)). During archiving, these data are blocked and only stored; the Controller receives them upon request. After expiry of the period, they are deleted. It is clarified that the obligations under this § 2, irrespective of the validity of this Agreement, remain fully in force until the final deletion of the Personal Data at the Processor.

(14) The Processor will inform the Controller without undue delay, but at the latest within 24 hours, of any unauthorized access to the Personal Data and any breach or restriction of data security. In such a case, the Processor will support the Controller in fulfilling its obligations pursuant to Art. 33 GDPR and Art. 34 GDPR.

(15) Upon request, the Processor undertakes to provide the Controller with all information (in particular reports and certificates) necessary to verify compliance with the obligations under this § 2. An on-site inspection by the Seller is only permitted after prior notice of at least 30 days. The costs of an on-site audit shall be borne by the Seller.

‍

§ 3 Data Protection Obligations of the Controller

(1) The Controller is responsible for determining the purposes of processing and the legal bases for processing (including obtaining any consent) and shall ensure the lawfulness of the processing of the Personal Data towards the end customers.

(2) The Seller will fulfill its information obligations, in particular pursuant to Art. 13 and 14 GDPR, towards the end customers. Furthermore, the Seller is responsible for handling any other requests from end customers. The Processor will support the Controller in accordance with § 2 of this Agreement in responding to requests from end customers.

‍

§ 4 Final Provisions

(1) This Agreement is governed by Austrian substantive law.

(2) All disputes arising from this Agreement or relating to its breach or invalidity shall be decided exclusively by the courts having subject-matter jurisdiction for the registered office of the Processor.

(3) This Agreement constitutes the entire agreement between the Controller and the Processor with respect to its subject matter. The provisions of this Agreement take precedence over any deviating provisions in the annexes to this Agreement and over provisions in other agreements between the Parties.

(4) Should any provision of this Agreement be or become void, ineffective or unenforceable in whole or in part, the validity, effectiveness and enforceability of all other remaining provisions shall not be affected. The void, ineffective or unenforceable provision shall be deemed replaced by the effective and enforceable provision that comes closest to the economic purpose pursued by the void, ineffective or unenforceable provision in terms of subject matter, extent, time, place and scope. The same applies to filling any gaps in this Agreement.

(5) This Agreement is provided in German and English. The English version is for information purposes only. Only the German version is legally binding.

‍

Annex ./1: Description of the Services and the Personal Data

Services Provided

Provision of the ioumi platform features for the Seller, in particular:

• Creation and management of contracts with end customers
• Delivery and signature capture with audit trail
• Payment processing via the external payment service provider
• Invoice creation and automatic payment collection
• Provision of the customer portal for end customers
• Email communication to end customers on behalf of the Seller

Purpose of Processing

Performance of the contractual relationship between the Seller and end customers via the ioumi platform, from contract creation through signature and payment to invoicing.

Duration of Processing

• for the duration of the contractual relationship between the Seller and ioumi
• after termination: export option for 30 days, followed by deletion pursuant to § 2(13) of this Agreement
• excluded are documents subject to statutory retention obligations (contracts, invoices, credit notes, payment receipts, audit trail): blocked archiving for seven years pursuant to § 2(13), followed by deletion
• ioumi forwards erasure requests from end customers to the Seller as the Controller

Data Subjects

• End customers of the Seller
• Contact persons and signatories at end customers that are businesses

Categories of Data Processed

• Master and contact data (name, address, email, phone number, company, VAT ID)
• Contract data (contract content, line items, services, terms, payment plan)
• Communication data (email content, documents)
• Payment data (payment method, amounts, status; full card numbers and bank account details are held by the external payment service provider, not by ioumi)
• Signature and audit trail data (IP address, timestamp, accepted documents, signature image or text)
• Usage data (login behavior in the customer portal, technical logs)

‍

Annex ./2: Technical and Organizational Data Security Measures

Confidentiality

• Encryption in transit: TLS 1.2 or higher for all connections to the platform
• Tenant separation: data are separated per seller account, role-based permissions within an account
• Documents and files are stored in non-public storage and can only be retrieved via signed, time-limited links
• Staff access: only for authorized staff and only to the extent necessary for the respective task
• Passwords: stored exclusively as hashes using a secure hashing method, no plaintext storage
• Two-factor authentication available for users of the platform
• End customers log in to the customer portal without a password via single-use, time-limited magic links
• Access tokens are not logged in plaintext

Integrity

• Transfer control: encrypted transmission (TLS)
• Input control: audit trail for all contract events (creation, sending, signature, modification)
• Versioning: immutable contract versions with timestamp, hash value of the signed document

Availability and Resilience

• Operation exclusively in data centers in the European Union
• Database and application: daily automatic backup, backups retained for seven days
• Documents and files: automatic backup twice a day to separate storage in the European Union
• Restoration from any available backup
• Round-the-clock monitoring of platform availability and of the validity of the TLS certificates
• Monitoring of system load and automatic capture of application errors

Procedures for Regular Review

• Regular updates of the platform and its dependencies
• Review of changes before release (code review, automated tests)
• Review of (sub-)processors at least once a year (§ 2(9))
• Data protection impact assessment in the event of material changes

‍

Annex ./3: (Sub-)Processors

ioumi uses (sub-)processors in particular for hosting, payment processing, email delivery as well as maintenance, technical operation and support of the platform. The Seller can obtain the complete and current list of all (sub-)processors with name, address, purpose and location of processing at any time upon request to datenschutz@ioumi.com. ioumi informs the Seller in advance by email about new or changed (sub-)processors pursuant to § 2(8).