Data Processing Agreement

This Data Processing Agreement ("DPA") is concluded between NMA Venture Capital GmbH ("Processor"), residing at Am Sandtorkai 27, 20457 Hamburg, Germany, and the Customer using the Plietsch Platform ("Controller"), and forms part of the Terms of Service.

1. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller in the context of providing the Plietsch Platform SaaS platform (as described in the Service Description). The duration of this DPA corresponds to the duration of the main contract (Terms of Service).

2. Nature and Purpose of Processing

The Processor processes personal data solely for the purpose of providing the contractually agreed services, including:

• User account management and authentication
• Storage and processing of uploaded documents and task specifications
• AI-powered agent orchestration and data retrieval
• Delivery of transactional notification emails
• Payment and subscription management

Not covered by this DPA: the use of derived labels and anonymized structural statistics to improve the shared classification models under § 8 of the Terms of Service. For that use the Processor acts as controller in its own right on the basis stated there, not on the Controller's instruction. The Controller's permission for it, its limits (no message content, tenant-partitioned and re-derivable corpus, erasure within the stated periods, EU hosting, no third parties), the opt-out and the exclusion of Google-sourced data are set out in § 8 of the Terms of Service.

3. Categories of Data Subjects and Personal Data

Data subjects

Employees and representatives of the Controller; target contacts and team members whose data is uploaded or processed via agent tasks.

Categories of personal data

• Contact details (name, email address)
• Operational data (task configurations, target site credentials, scraping outputs)
• Usage logs (IP addresses, request parameters, execution metrics)
• Derived labels (decision identifier, proposed and chosen class or observed outcome, timestamps, tenant identifier; never message content) — processed on the Controller's behalf inside the Controller's tenant for calibration; their use for the shared models is the Processor's own controller-role use under § 8 of the Terms of Service

Anonymized structural statistics (aggregate figures such as thread length, participant count, reply latency and decision-class shares) are not personal data and are listed here only for completeness.

4. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions from the Controller
• Ensure that persons authorized to process personal data are bound by confidentiality agreements
• Implement appropriate technical and organizational security measures (Art. 32 GDPR)
• Assist the Controller in responding to data subject rights requests
• Delete or return all personal data upon termination of the contract
• Provide all necessary information to demonstrate compliance with Art. 28 GDPR

5. Sub-processors

The Controller hereby grants general authorization for the use of sub-processors. Current sub-processors include:

• UpCloud Ltd (Finland) — Primary server nodes (EU only)
• Mollie B.V. (Netherlands) — Payment processing (EU only)
• Resend Inc. (USA/EU) — Transactional email delivery (Standard Contractual Clauses basis)
• Cloudflare Inc. (USA) — CDN, DNS, and WAF security (Standard Contractual Clauses basis)
• Google Ireland Ltd. (Ireland) — Sub-processor infrastructure (EU datacenters)

The Processor will notify the Controller of any intended changes concerning additions or replacements of sub-processors, giving the Controller the opportunity to object to such changes.

6. Technical and Organizational Measures (TOMs)

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access control and principle of least privilege
• Regular security assessments and system trace audits
• Incident response and breach notification procedures
• Regular staff training on data protection

7. Transfers to Third Countries

Where personal data is transferred to sub-processors in third countries (e.g. the USA), such transfers are made on the basis of the EU-U.S. Data Privacy Framework adequacy decision, or Standard Contractual Clauses (SCC) adopted by the EU Commission.

8. Contact

For DPA-related inquiries: [email protected]