Data Processing Agreement

§ 1 Subject and Duration

1. This data processing agreement (“AVV”) specifies the data protection obligations of the parties from the service contract for lead generation concluded between the client and NOSA Partners GbR (“main contract”). It becomes part of the main contract by reference.
2. The term of this contract depends on the term of the main contract. It also applies as long as the processor processes the controller’s personal data.

§ 2 Type, purpose and scope of processing

1. Purpose: Collection, storage, allocation and transmission of interested party inquiries (“leads”) to the controller as well as the evaluation of the campaign and sales success within the framework of the main contract.
2. Type of processing: collecting, storing, organizing, transmitting, evaluating and deleting.
3. Types of data: contact details (first name, last name, telephone number, email address), company details, information from forms and qualification questions, proof of consent, lead status, information on business transactions and technical tracking data.
4. Categories of data subjects: interested parties and end customers of the controller as well as their contact persons.
5. Processing generally takes place in the European Union or the European Economic Area. If sub-processors process data in third countries in accordance with Annex 2, this only takes place under the conditions of Article 44 ff. GDPR.

§ 3 Instructions

1. The processor processes personal data exclusively within the framework of the main contract and according to documented instructions from the controller. Instructions are given in text form.
2. If the processor is of the opinion that an instruction violates data protection regulations, it will inform the controller immediately.

§ 4 Obligations of the processor

1. The processor obliges all persons who have access to the data to maintain confidentiality.
2. He takes the technical and organizational measures in accordance with Article 32 of the GDPR in accordance with Appendix 1 and adapts them to the state of the art.
3. He supports the controller within reason in answering inquiries from data subjects (Articles 12-23 GDPR) as well as in the obligations under Articles 32-36 GDPR.
4. He reports violations of the protection of personal data to the controller immediately, at the latest within 48 hours of becoming aware of them.
5. Upon request, he will provide the controller with the information necessary to demonstrate compliance with this contract. Inspections are carried out after timely notice during business hours and without disrupting operations.

§ 5 Sub-processors

1. The controller agrees to the use of the services listed in Appendix 2 as sub-processors, provided they are used for his order. Other platforms are mentioned there for transparency; Their role under data protection law depends on the specific use and the respective platform conditions.
2. The processor will inform the controller in advance in text form about the intended addition or replacement of further sub-processors. The controller can object within 14 days for important data protection reasons.
3. The processor contractually obliges sub-processors to an equivalent level of data protection.

§ 6 Rights and obligations of the controller

1. The controller is responsible for the lawfulness of the processing to the extent that it is based on his instructions, as well as for the processing of the lead data in his own systems.
2. He informs the processor immediately if he discovers errors or irregularities in the processing.

§ 7 Deletion and return

After the end of the main contract, the processor returns the data or deletes it at the controller's discretion, provided there is no legal obligation to store it. Data that is required to prove consent or to settle commission claims according to the main contract may be stored until the respective deadlines expire.

§ 8 Liability and final provisions

1. Art. 82 GDPR applies to liability. Otherwise, the liability provisions of the main contract apply.
2. In the event of any contradictions between this contract and the main contract, the provisions of this contract with regard to data protection take precedence.
3. Changes must be made in text form. German law applies. If a provision is invalid, the rest of the contract remains valid.

Appendix 1 – Technical and organizational measures (Art. 32 GDPR)

• Access and access control: access to systems only for authorized persons, personalized user accounts, two-factor authentication if offered by the service
• Password policy: strong, unique passwords and password managers
• Forwarding control: encrypted transmission (TLS/HTTPS)
• Input control: Traceability of changes via the protocol functions of the systems used
• Availability: Use of established cloud providers with their own data backup
• Data minimization: Collection of only the data necessary for lead generation
• Separation: Lead data from different clients are processed separately
• Regular review of the measures and deletion of data that is no longer required

Appendix 2 – Service providers and platforms

Depending on the agreed service and activated functions, only the services required are used. Mention in this appendix does not mean that every service for every client has access to personal data.

Sub-processors, insofar as the services are used by NOSA for the respective order:

• Google Ireland Ltd., Dublin (Google Sheets and Google Drive, as long as lead or pipeline comparison is set up)
• HighLevel Inc., Dallas, USA (CRM and contact management, if used in the customer project)
• Perspective Software GmbH, Berlin (funnels, landing pages and forms, if agreed)
• Make (automation of data transfer, if set up for the customer project)
• Vercel Inc., USA (hosting and technical provision of the NOSA portal)
• Supabase Pte. Ltd., Singapore (database, authentication and file storage of the NOSA portal)
• Plus Five Five, Inc. / Resend, USA (sending invitations, password emails and activated lead notifications from the NOSA portal)

Additional platform that the client can use for advertising and lead capture:

• Meta Platforms Ireland Ltd., Dublin (ads and instant forms; the advertising budget is paid directly to Meta by the client in accordance with the main contract)