Data processing agreement

Version 1.3-entwurf

Draft – to be reviewed legally before the pilot operation.Only the German version is binding.

1 Parties and subject matter

This agreement under Art. 28 GDPR applies between the organisation that uses simmpel AVA (controller) and Samuel Simm, Strauchergasse 18, 8020 Graz, email: simm.samuel@simmpel.at (hereinafter “operator”). Until a company is founded, a private person operates simmpel AVA. as processor. The subject matter is the provision of the application simmpel AVA including storage, evaluation and dispatch of the project data. The duration corresponds to the use of the application.

2 Nature and purpose of the processing, data and data subjects

Bills of quantities, invoices, inputs, logs, distribution lists and dispatches are processed. They may contain personal data, in particular names, functions, email addresses and telephone numbers of employees of the controller, of clients, contractors, planners and other project participants. The sole purpose is billing control and informing the project participants on behalf of the controller.

3 Obligations of the processor

The processor processes the data only on documented instructions from the controller – use of the application counts as an instruction –, commits all authorised persons to confidentiality, takes the measures under Art. 32 GDPR (point 6), supports the controller with requests from data subjects and with the obligations under Art. 32 to 36 GDPR, reports personal data breaches without undue delay, provides all information needed as evidence and allows audits by arrangement.

4 Sub-processors

The controller approves the following sub-processors: • OVH GmbH (OVHcloud), St. Johanner Straße 41–43, 66111 Saarbrücken, Germany; parent company OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the server (Public Cloud: compute instance) and storage of the encrypted backup (Object Storage) – server in the data centre in Frankfurt (Germany), backup in Gravelines (France). Agreement: data processing agreement of OVHcloud (annex to the general terms and conditions) in the version valid at the time of the order in October 2026. • Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, Germany; parent company Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France: sending of the e-mails (system e-mails and quantity reports) via SMTP, reports on undeliverable e-mails and spam; Brevo counts opens and clicks only anonymously, simmpel AVA does not evaluate opens – European Union. Agreement: data processing agreement (annex 3 of the general terms of use of the Brevo services) in the version valid when the account was opened in October 2026. The processor informs the admins by email in advance about intended changes; the controller can object within 14 days and in this case end the use. Sub-processors are subject to the same obligations.

5 Access by the operator (support access)

The processor only accesses project content if an admin of the controller grants time-limited access (24 hours or 7 days, limited to one project on request). Access is read-only, can be revoked at any time and is logged visibly in the audit log of the organisation.

6 Technical and organisational measures

• Encrypted transmission (HTTPS/TLS), passwords with Argon2id, second factor (mandatory for the operator). • Roles and rights per organisation, separation of the organisations in the application and additionally in the database (row level security). • Logging of logins and changes; limitation of failed attempts. • Daily encrypted backup with a copy at another EU location; restoration is tested quarterly. • Dispatch archive with checksums (SHA-256); hardened server, access only with a key.

7 End of processing

After the end of use, the data remain readable and exportable. They are deleted at the earliest 90 days after the end and only after notice by email to the admins; export is possible until then. Copies in backups are deleted when they expire.

8 Final provisions

Liability is governed by Art. 82 GDPR. Otherwise the terms of use apply; in the event of contradictions, this agreement takes precedence.