Data Processing Agreement in accordance with Article 28(3) GDPR

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these Standard Contractual Clauses (the “Clauses”) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29 (3) and (4) Regulation (EU) 2018/1725.

(c) These Clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the Clauses.

(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2

Invariability of the Clauses

(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation

(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively.

(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5

Docking clause

(a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

(b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

(c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6

Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7

Obligations of the Parties

7.1. Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (“personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

(a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least four weeks in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8

Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions

(c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

(1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a “data protection impact assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

(2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

(3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;

(4) the obligations in Article 32 Regulation (EU) 2016/679.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9

Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679 or under Articles 34 and 35 Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b) in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:

(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(2) the likely consequences of the personal data breach;

(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10

Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

(1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

(2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;

(3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

ANNEX I – LIST OF PARTIES

Controller (hereinafter referred to as “Client”):

The customer named in the order form

Processor:

• Name: ZEP GmbH
• Address: Stuttgarter Str. 41, 71254 Ditzingen, Germany
• Name, function and contact details of the contact person: Christian Bopp, Managing Director, support@zep.de
• Data protection officer: Kertos GmbH, Brienner Str. 41, 80333 Munich, Germany, contact: dsb@kertos.io

ANNEX II – DESCRIPTION OF THE PROCESSING

Preliminary note: scope of this Annex

This Annex describes the scope of the processing that may take place within the Software-as-a-Service solution “ZEP”. Which processing actually takes place in the individual case depends on

• the scope of functions ordered by the Client,
• the configuration settings made by the Client, in particular the absence reasons, additional fields and permissions defined by the Client itself, and
• the data entered by the Client or imported via interfaces.

Functions that have not been ordered are not activated. The Processor processes personal data exclusively on instructions and only for the purposes set out in Section 5.

1. Categories of data subjects

• Employees of the Client, including apprentices, interns, working students and fixed-term employees
• Freelancers and external service providers of the Client, to the extent that they are recorded in the solution as persons performing services
• Contact persons at the Client’s customers, including contact persons to whom the Client grants their own access to the solution
• Contact persons at the Client’s suppliers and service providers
• Other natural persons named by the Client or its employees in free-text fields, receipts, documents or additional fields

2. Categories of personal data

Personal data of the following categories are processed:

• Identification and contact data
• Employment and organisational data
• Access and authentication data
• Working time and attendance data
• Absence and leave data
• Location data
• Project, planning and activity data
• Remuneration, rate and cost data
• Payment and bank data
• Tax and social security data
• Travel, receipt and expense data
• Billing, invoice and quotation data
• Communication, case and document data
• Additional fields and free-text entries defined by the Client
• Usage, log and metadata

Which of these categories arise in the individual case depends on the preliminary note. In addition, the following applies:

• Location data only arise to the extent that the Client activates location transmission for a recording device or a mobile application.
• Remuneration, tax and social security data only arise to the extent that the Client uses the corresponding functions or imports them via a human resources management interface configured by the Client.
• The content and category of the data stored in additional fields and free-text entries are determined solely by the Client.

3. Special categories of personal data and safeguards applied

3.1 Health-related information

To the extent that the Client uses absence reasons relating to illness, health data within the meaning of Art. 9(1) GDPR are processed as part of absence management. In this case, the absence reason assigned by the Client as well as the period and extent of the absence are recorded.

Whether and to what extent such data are processed is determined solely by the Client. The Client defines the absence reasons and may change, rename or delete them at any time. It may dispense entirely with any differentiation by reference to illness. The default configuration of the solution contains absence reasons relating to illness; these may be removed or replaced by the Client.

3.2 Other special categories

The processing of other special categories pursuant to Art. 9(1) GDPR is not envisaged in the solution. In particular, the solution does not provide for the processing of biometric or genetic data or for the recording of information on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.

To the extent that the Client enters such information in free-text fields or in additional fields set up by the Client itself, this takes place outside the intended purpose of the solution and under the Client’s responsibility.

3.3 Restrictions and safeguards applied

The following restrictions and safeguards apply to the processing pursuant to Section 3.1:

• Strict purpose limitation: Processing takes place exclusively for the purposes set out in Section 5 and on documented instructions from the Client.
• Role- and object-based authorisation concept: Access is controlled via user roles and via individual department-, project- and object-related permissions. The Client is responsible for defining the permissions.
• Separate visibility control: For each absence reason, the Client can specify whether its name is visible to other users. If visibility is deactivated, the absence is displayed without stating the reason.
• Restriction of onward transfer: Data are only transferred to human resources management, payroll or accounting systems to the extent that the Client has ordered, activated and configured the relevant interface.
• Access by the Processor: Client data are only accessed to the extent necessary for the provision of support, maintenance and troubleshooting services, in accordance with the principle of necessity and exclusively by persons bound by confidentiality.

4. Nature of the processing

Collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, analysis, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure and destruction.

Processing is carried out wholly or partly by automated means using data processing systems. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

5. Purposes of the processing

Processing is carried out for the purpose of providing and operating the Software-as-a-Service solution “ZEP” and, depending on the scope of functions ordered, comprises the following sub-purposes:

1. Provision, operation, maintenance and further development of the solution, including user management, authentication and authorisation control
2. Recording, approval and evaluation of working, project and attendance times, including breaks, overtime, absences and leave, as well as preparation of the related records
3. Planning and management of projects, cases, work packages, tasks and staff deployment, including plan/actual comparisons and availability planning
4. Recording, review and settlement of travel costs, expenses and receipts, including the processing of incoming receipts and receipt documents
5. Quotation, invoicing, payment and dunning processes, including electronic invoice formats, as well as provision of exports for financial accounting and payroll
6. Management of customer, supplier and contact person data as well as the related cases, documents and communication
7. Provision of evaluations, reports, overviews and search functions covering the data stored in the solution
8. Data exchange with third-party systems engaged by the Client and for which the Client has ordered and configured the interface, as well as provision of programmable interfaces for use by the Client
9. Provision of end-user access via web browsers, mobile applications, recording terminals and browser extensions, including temporary storage of recorded data on the end device to bridge a missing network connection
10. Provision of support, maintenance and troubleshooting services and ensuring availability, operational reliability and data security, including error analysis
11. Logging of changes to data records for the purpose of traceability and audit-proof record keeping

The scope of functions ordered in each case is set out in the service description or the order form, as amended from time to time.

6. Duration of the processing

6.1 Processing takes place for the term of the contract on the provision of the software solution separately agreed between the Client and the Processor.

6.2 During the term of the contract, the Client itself determines the retention period of the data it has entered. The solution does not enforce deletion after the expiry of specific periods. Compliance with statutory retention and deletion obligations is the responsibility of the Client.

6.3 After termination of the contract, the data are deleted or returned to the Client, at the Client’s choice. For the purpose of return, the Processor provides a complete export of the Client’s data.

7. Place of processing

Personal data are processed in data centres within the European Union, in the Frankfurt am Main region and, for backups, in the Paris region.

The sub-processors engaged by the Processor as well as any transfers to a third country and their legal basis are specified in Annex IV.

ANNEX III – TECHNICAL AND ORGANISATIONAL MEASURES, INCLUDING TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational security measures implemented by the processor(s) (including any relevant certifications) to ensure an appropriate level of protection, taking into account the nature, scope, context and purpose of the processing as well as the risks to the rights and freedoms of natural persons.

General

Our technical and organisational measures are based on established ISO 27001 standards.

The high level of protection of our measures is regularly reviewed and adapted to the current state of the art.

Employees are regularly trained in handling data requiring protection and are bound to confidentiality.

The handling of data and data processing systems is regulated in writing (data protection policies, work instructions, procedural guidelines) and is regularly reviewed.

Insofar as data processing takes place within the cloud services of the sub-processor Amazon Web Services EMEA SARL, the respective current technical and organisational measures of this sub-processor apply, which are described on the website https://aws.amazon.com/de/compliance/data-privacy-faq/.

ZEP has implemented the following technical and organisational measures within the meaning of Art. 32 GDPR to ensure encryption and pseudonymisation, confidentiality, integrity, availability and resilience, recoverability and corresponding review procedures:

1. Confidentiality (Art. 32(1)(b) GDPR)

1.1. Organisational governance

The aim is to ensure that the internal organisation meets the specific requirements of data protection.

a) Organisational instructions (ISO/IEC 27002:2022)

The objectives of data protection and information security are set out in data protection and information security policies and are binding on all ZEP employees. In addition, further organisational instructions are implemented to give employees specific requirements for the processing of personal data (e.g. Remote Work Policy).

b) Appointment of a data protection officer pursuant to Art. 37 GDPR

The management has appointed a data protection officer. The data protection officer works towards compliance with data protection provisions and performs the tasks set out in Art. 39 GDPR. These include, among other things, supporting the set-up and further development of a data protection management system, drafting, further developing and monitoring corresponding policies, and carrying out regular awareness-raising measures.

c) Obligation of confidentiality and data protection

All employees are obliged in writing to maintain confidentiality and data protection and to comply with other relevant laws when they receive their employment contract or, at the latest, when they start work. The obligation continues beyond the term of the employment relationship. Freelancers and external service providers are obliged in writing to maintain confidentiality on the basis of non-disclosure agreements (NDAs) and additionally sign a data processing agreement if they process personal data on behalf of ZEP GmbH.

d) Data protection training

Every employee of ZEP GmbH receives information and leaflets on data protection and confirms this with their employment contract. In addition, regular training sessions are held as awareness-raising measures. Employees from particularly sensitive areas such as human resources, product development or customer service also receive separate information and training on specific topics where required.

e) Restrictions on the private and business use of communication devices

ZEP GmbH provides its employees with laptops as communication devices. No company mobile phones are issued to employees. The use of private communication devices is excluded (accordingly, there are no BYOD rules). Employees of ZEP GmbH are not permitted to use the company email system for private purposes. The internet system and telephone services may only be used privately to a limited extent. Strict separation of private and business data must be observed. Furthermore, ZEP employees are not permitted to process personal data or other data of the customer, in particular data from the data processing relationship relating to the customer order, on private communication devices. Employees of ZEP GmbH undertake to comply with the Information Handling Policy, compliance with which is monitored to the extent permissible and necessary. The Information Handling Policy contains explicit examples of impermissible private use of the internet and of the company email system. The use of social media is also regulated there.

f) Reliability of personnel (pursuant to ISO/IEC 27002:2022)

ZEP GmbH ensures through appropriate measures before, during and after employment that all employees understand, meet and reliably implement the requirements of information security.
These include in particular:

• Screening: Prior to recruitment, appropriate screening of candidates is carried out (e.g. identity and reference checks) in accordance with applicable laws, regulations and ethical principles.
• Terms and conditions of employment: Employment contracts contain clear provisions on information security obligations, confidentiality obligations, responsibilities and rules of conduct.
• Information security awareness, education and training: Employees are regularly trained in information security and data protection topics to ensure lasting awareness and understanding of their obligations.
• Disciplinary process: Documented procedures exist for handling violations of security or data protection policies, including graduated sanctions.
• Responsibilities after termination or change of employment: Upon termination or change of employment, a documented offboarding process is carried out to ensure the revocation of access rights, the return of company property and the maintenance of confidentiality obligations.

1.2 Encryption and pseudonymisation of personal data

It is ensured that personal data are stored in the system only in a way that does not allow third parties to identify the data subject.

a) Key management (pursuant to ISO/IEC 27002:2022)

ZEP GmbH operates a documented procedure for the management of cryptographic keys throughout their entire lifecycle.
This procedure covers the generation, distribution, storage, use, modification, revocation, archiving and secure destruction of keys.

• System Security Policy: An internal policy on the use of cryptographic methods and key management defines responsibilities, security requirements and permitted algorithms in line with the state of the art.
• Key generation and protection: Cryptographic keys are securely generated and stored to prevent unauthorised access, loss or disclosure.
  The master key for encrypted data stores is created and managed within the area of responsibility of the Infrastructure-as-a-Service (IaaS) provider. ZEP GmbH ensures that the provider implements appropriate technical and organisational measures in accordance with ISO/IEC 27001.
• Key lifecycle: Management covers all phases of the key lifecycle, from generation through active use to decommissioning and secure deletion. Key compromises are documented and lead to immediate protective measures.
• Use of cryptographic methods: Encryption methods, key lengths and protocols correspond to recognised best practices and are reviewed regularly to meet current security standards.
• Password policy: ZEP GmbH has a policy governing the selection of suitable passwords, the handling of passwords and the monitoring of passwords.

b) Database and storage encryption

All customer data are always encrypted “at rest” using AES-128-GCM. Only the systems intended for processing the data may use the encryption keys, in accordance with the principle of least privilege. Backups are only stored in encrypted form.

c) Data transmission via encrypted data networks or tunnel connections (“data in transit”)

All private data transmitted by the ZEP application to a customer or to other platforms via an insecure or public network are transmitted exclusively in encrypted form. This applies in particular to access to the customer and administration system. ZEP ensures the use of state-of-the-art encryption, depending on the encryption algorithm compatible on the customer side (currently HTTPS connections based on Transport Layer Security [TLS 1.2 or higher]; regarding “backward compatibility”, the customer is responsible for using state-of-the-art devices/browsers).

Administrative access to ZEP server systems and the transmission of backups take place exclusively via encrypted connections, e.g. a virtual private network (VPN). A VPN connection is used to access customer systems when working remotely. Only VPN servers under the direct control of ZEP are used. The use of public VPN providers is not permitted.

d) Encryption of mobile storage media

The use of mobile storage media is generally prohibited. In the exceptional case that such media are nevertheless used and ZEP data are used or processed on them, these storage media are used exclusively in encrypted form. This applies in particular to the use of USB sticks, external hard drives or similar devices. The use of private mobile storage media to store customer data is not permitted. This is governed by the Removable Storage Media Policy.

e) Encryption of storage devices on laptops

All laptops of key employees of ZEP GmbH are centrally managed and equipped with modern hard disk encryption.

f) Encrypted exchange of information and files

The exchange of information and files between the customer and ZEP GmbH generally takes place directly in encrypted form via the ZEP application (see c)). If personal data or confidential information of the customer must be transferred to servers and cannot be sent via TLS-encrypted HTTPS uploads, they are transferred using the Secure File Transfer Protocol (SFTP) or another state-of-the-art encrypted mechanism. The customer is responsible for requesting or providing this secure data transport where required.

g) Email encryption

In principle, all emails sent by employees of ZEP GmbH or from within the ZEP application are encrypted using TLS. Exceptions may apply if the receiving mail server does not support TLS. The customer must ensure that the mail server used for the order supports TLS encryption.

1.3. Physical access control

The Contractor does not use its own permanently installed server or data centre space. Personal data are processed exclusively on servers of certified external hosting or cloud service providers that operate their own physical security measures. The Contractor’s office serves exclusively as a co-working workspace without local storage of sensitive information. Only mobile end devices (laptops) are used on site, which are encrypted and protected against unauthorised access at all times. The office is protected by the following physical access control measures:

a) Electronic door locks

The entrance doors to the offices of ZEP GmbH are always locked and secured with security locks.

b) Controlled key distribution

Keys are distributed to ZEP employees centrally and in a documented manner.

c) Supervision and escorting of visitors

Persons who do not work for ZEP GmbH, such as external service providers or other visitors, may only enter the offices with prior approval and when accompanied by a ZEP employee.

d) Protection of areas with increased protection requirements

Cabinets with increased protection requirements, such as cabinets containing contract documents, are always locked after leaving or use. Access to these cabinets is granted only to authorised personnel. Increased protection requirements in non-technical areas are determined by a representative of management.

e) Closed doors and windows

ZEP GmbH ensures that all windows and doors are closed or locked outside office hours.

f) Physical and environmental security of server systems in data centres

ZEP GmbH exclusively uses server systems of the data centre operator (AWS) that hold a valid ISO/IEC 27001:2022 certification and thus implement corresponding technical and organisational measures for physical and environmental security, e.g:

• The data centre and the systems used there are housed in inconspicuous buildings that cannot be recognised as a data centre from the outside, as no signs refer to them.
• The data centre itself is protected against unauthorised access by physical security measures both from outside (e.g. fences, walls) and inside the buildings.
• Access to the data centre is managed by electronic access controls and secured by alarm systems that trigger an alarm if the door is opened or held open.
• Access authorisation is granted by an authorised person and revoked within 24 hours of the deactivation of an employee or supplier record.
• All visitors must identify themselves and register and are always accompanied by authorised personnel.
• Access to these sensitive areas is additionally monitored by video surveillance.
• Trained security personnel guard the data centre and its immediate surroundings 24 hours a day, 7 days a week.

1.4 System access control

Access to the Contractor’s systems and applications takes place exclusively via secured remote connections. All users have individual user accounts and strong authentication procedures, such as multi-factor authentication. Password policies, automatic locking mechanisms and encrypted communication connections ensure that only authorised persons gain access to productive cloud services and administrative functions.

1.5 Data access control

It is ensured that persons authorised to use an automated processing system only have access to the personal data covered by their access authorisation.

a) Role and authorisation concept

i) Role and authorisation concept for the customer system

The Client’s administrators have a multi-level role concept for assigning rights and can distinguish between viewing and editing rights per function or area within ZEP for individual users.

ii) Role and authorisation concept for server/database systems

Access to the server/database system is generally restricted to a limited number of trained employees in product development and infrastructure.

b) Assignment of access rights

At ZEP GmbH, access rights are generally assigned on a “need-to-know” basis. Accordingly, access is only granted to persons who demonstrably need it and only for as long as they need it. The requesting person must provide a coherent justification of the need when submitting the request. The authorisation concept is role-based. Each employee is generally assigned a specific role. Permissions deviating from this role must be justified. Access authorisations are documented centrally and withdrawn by the administrator immediately once the need for access ceases. Access is limited to the minimum necessary privileges. Access to the server/database system is approved by management and generally follows the four-eyes principle. Administrators regularly check whether granted permissions are still required. When employees leave, the managers responsible for personnel inform the administrators or the HR department without undue delay of upcoming changes so that the corresponding permissions can be withdrawn. Permissions are withdrawn, where possible, within 24 hours of an employee’s departure.

c) Host-based intrusion detection system (IDS)

ZEP uses an intrusion detection system (IDS). It monitors minimum parameters such as suspicious log entries, signatures of known rootkits and Trojans, anomalies in the device file system or brute-force attacks. In the event of anomalies, the responsible employees (operations and product development) are informed immediately by email and/or other notification.

d) Network security

ZEP’s servers and databases are only deployed in private subnets without public IPs, which ensures that no services are directly accessible from the internet. Publicly accessible services are routed via load balancers or bastion hosts that only allow the protocols and ports required for the respective service. In addition, a web application firewall is used to protect against common web exploits and bots that could impair availability or compromise security.

1.6 Authorisation control

The use and processing of data protected under data protection law by unauthorised persons is prevented.

a) Use of authentication procedures

Personal data are always accessed via encrypted protocols: SSH, TLS 1.2 or higher, HTTPS or comparable protocols.

i) Authentication procedures for IT systems/laptops

• Authentication with user name and password in accordance with the password policy is the minimum security requirement.
• Depending on the capabilities of the laptop, alternative and secure authentication procedures can be activated.

ii) Authentication procedures for the customer system

(Customer system = access for the customer’s administrators and users)

• Authentication with an email address
• Self-selected password in accordance with the customer’s internal requirements, taking into account internal rules on the number of characters and the use of numbers, letters and special characters
• Password reset via a reset link sent by email
• Account lockout after five failed login attempts
• In addition, the customer can control authentication and password security by integrating OAuth2. Two-factor authentication is also possible and recommended.

iii) Authentication for the server/database system

(Server/database system = access to the stored data by ZEP product development)

• Administrative access via VPN, SSH or AWS API
• Authentication with SSO (MFA enforced)

b) Designation of persons authorised for support and to issue instructions

Admin users of the customer can grant permission directly in ZEP to release data for support purposes. The customer service team of ZEP GmbH is obliged to accept orders or provide information only from the designated persons and to verify this.

c) Prohibition of disclosing passwords and using “shared accounts”

Both users of ZEP and employees of ZEP GmbH are prohibited from disclosing passwords for the use of ZEP and from using so-called “shared accounts” to access customer and administrative systems (i.e. exclusive use of personal and individual user logins when logging on to the system).

d) Automatic locking in case of inactivity

ZEP employees are instructed to always lock their laptops when they are not in use. In addition, an automatic screen lock is set up after 15 minutes of inactivity. Unlocking requires the authentication procedure described under “Authentication procedures for IT systems/laptops”.

e) Use of anti-virus software

Laptops of ZEP GmbH employees are equipped with state-of-the-art, up-to-date anti-virus software on all IT systems that are company-owned or used for business purposes. As a rule, no computers may be operated without resident virus protection, unless other equivalent state-of-the-art security measures have been taken or there is no risk. Specified security settings must not be deactivated or circumvented.

f) “Clean Desk Policy”

ZEP employees are required not to print out or store customers’ personal data locally, not to leave work materials lying around openly, and to store them properly. After use, documents containing personal data must either be stored in lockable cabinets or drawers or disposed of in compliance with data protection requirements.

g) Public wireless networks and connection to the company network

Public wireless networks are used exclusively via a VPN connection provided by ZEP GmbH.

1.7 Separation

It is ensured that personal data collected for different purposes can be processed separately and are separated from other data and systems in such a way that unplanned use of these data for other purposes is excluded.

a) Separation of development, test and production environments (pursuant to ISO/IEC 27002:2022)

• Development, test and production systems are logically and technically separated from each other.
• Production data may only be used in test or development environments if they have previously been fully anonymised or pseudonymised.
• Access to each environment is restricted to authorised roles and is reviewed regularly.
• Changes to systems or applications are first validated in a test or staging environment before being transferred to the production environment.
• Debugging or diagnostic tools may only be used in the production environment if this is technically indispensable, documented and approved.
• Transfers between environments take place in encrypted form or via trusted network connections.
• The entire change process is documented in the change management procedure and approved in a traceable manner.

b) Network segregation (pursuant to ISO/IEC 27002:2022)

ZEP GmbH separates its networks according to tasks. The following networks are used permanently: production environment (“Prod”) and test environment (“Test”). In addition to these networks, further separate networks are created as required, e.g. for restore tests and penetration tests. Depending on the technical possibilities, the networks are separated physically or by means of virtual networks.

c) Software-based client separation

ZEP GmbH ensures the separate processing and storage of data of different clients by means of logical client separation based on a multi-tenancy architecture. Data are assigned and identified per customer by means of a separate database, which excludes the risk of client separation being circumvented through programming errors. Regular security audits and mandatory code reviews (four- to six-eyes principle) additionally safeguard the architecture.

2. Measures to safeguard integrity

Integrity means ensuring the correctness/authenticity of the data and the proper functioning of the systems.

2.1 Transmission control

It is ensured that the confidentiality and integrity of private data are protected during transmission and during the transport of storage media.

a) Transport encryption (“data in transit”)

See “Encryption and pseudonymisation of personal data”; data integrity during transport is ensured by calculating checksums.

b) Prohibition of disclosure to unauthorised third parties

Personal data processed on behalf of the Client may only be disclosed within the scope of the instructions and to the extent necessary for the provision of the contractual services to the Client. In particular, the disclosure of personal data from the engagement to unauthorised third parties, e.g. by storing it in another cloud storage, is not permitted.

2.2 Input control

The aim is to ensure that it can subsequently be checked and established which personal data have been entered into or modified in automated processing systems, at what time and by whom.

Logging and evaluation of system activities in the customer system

Many of the essential system activities are logged. The log entries contain at least: timestamp, user ID, access role, system component or function, activities performed. The logged activities include all input, modification and deletion actions relating to data, users, permissions or system settings.

3. Measures to ensure availability

The availability of services, functions of an IT system, IT applications or IT networks, or of information, is ensured if they can be used by users as intended at any time.

3.1 Availability control

Ensuring that personal data are protected against accidental destruction or loss.

a) Data backup procedures/backups

ZEP GmbH has implemented a state-of-the-art backup concept for the database with the customer data stored on it and for the storage medium with the documents stored there in order to ensure sufficient availability.

b) Geo-redundancy of the server infrastructure for production data and backups

In order to ensure geo-redundancy in the event of an unforeseen event, such as a natural disaster, ZEP GmbH ensures that appropriate spatial separation requirements are met with regard to the server infrastructure of production data and backups. This can be ensured by using different data centres at a sufficient distance or data centres with different availability zones. The backup system is designed so that, in the unlikely event of the failure of an AWS region, the data are not at risk thanks to backup replication across several AWS EU regions.

c) Capacity management

Capacity management is in place with monitoring and automatic scaling in the event of capacity bottlenecks.

d) Alert systems for monitoring the reachability and status of server systems

An alert system is in place to monitor the availability and status of the server systems. In the event of outages, the infrastructure department is notified automatically so that immediate action can be taken to resolve the problem.

e) IT incident management (“Incident Response Management”) (pursuant to ISO/IEC 27002:2022)

ZEP GmbH has a documented procedure for managing IT incidents and security-relevant events. This procedure covers the detection, reporting, analysis and handling of incidents affecting information security or the protection of personal data.
ZEP GmbH ensures that appropriate responsibilities, escalation paths and communication channels are defined in order to identify incidents promptly and respond appropriately.
In the event of a personal data breach, ZEP GmbH informs the controller without undue delay and provides all relevant information to support compliance with the notification obligations pursuant to Art. 33 and 34 GDPR.
Lessons learned from security incidents are documented, analysed and fed into the continuous improvement of organisational and technical measures in order to prevent similar incidents in the future.

f) Further measures to ensure availability in the data centres

An automatic fire detection and suppression system is installed in the data centre. The fire detection system uses smoke sensors throughout the data centre environment, in the mechanical and electrical infrastructure areas, in the cooling rooms and in the rooms housing the generators.

All power supply systems are designed redundantly. In the event of a power failure, an uninterruptible power supply (UPS) ensures that critical areas of the facility continue to be supplied with power. The data centre also has generators that can supply the entire facility with emergency power. The data centre is air-conditioned and temperature-controlled. Preventive maintenance is carried out to ensure continuous operation.

3.2 Recoverability

It is ensured that systems can be reliably restored in the event of a physical or technical failure.

Emergency plan (“Disaster Recovery Concept”)

There is a concept for dealing with emergencies/disasters and a corresponding emergency plan. ZEP GmbH ensures the restoration of all systems on the basis of data backups, generally within 4 hours (recovery time objective, RTO) after confirmation by ZEP GmbH support (incident acknowledgement). The recovery point objective (RPO) is set at 24 hours.

In an emergency, restoration is carried out from backups that can be loaded directly from AWS and imported into the respective ZEP instance.
Backups are created every night. They are retained daily for the first 14 days and thereafter weekly until week 19. The backups created are tested regularly.

4. Measures for review and evaluation

Description of the procedures for regularly reviewing, assessing and evaluating the effectiveness of the technical and organisational measures.

a) Data protection and information security system

A data protection and information security system has been set up for the planning, implementation, evaluation and adjustment of measures in the area of data protection and data security.

b) Risk management

As part of its ISO/IEC 27001-certified information security management system, ZEP GmbH operates a documented process for identifying, assessing and treating risks. The effectiveness of the technical and organisational measures taken is reviewed regularly and adjusted where necessary to permanently ensure the security of the processing of personal data. In addition, the ZEP application is subjected to regular penetration tests in order to identify and address potential risks.

c) Independent review of information security (pursuant to ISO/IEC 27002:2022)

i) Conducting audits

• Internal audits on data protection and information security are carried out regularly. The audits are carried out on the basis of common audit criteria/schemes (in particular statutory requirements of the GDPR, security standards, etc.) and examine in particular the completeness and accuracy of policies and concepts as well as the documentation of and compliance with the corresponding processes.
• ZEP GmbH subjects its ISMS to regular external reviews (external audits) by an independent, accredited certification body as part of its ISO/IEC 27001 certification (initial certification, surveillance and recertification audits). The certificate is linked here.

ii) Review of compliance with security policies and standards (pursuant to ISO/IEC 27002:2022)

Compliance with the applicable security policies, standards and other security requirements in the processing of personal data is reviewed regularly. Where possible, this is done on a random and unannounced basis.

iii) Procedures for the continuous improvement of the data protection and information security management system

The data protection and information security processes also include a regular review and evaluation of the technical and organisational measures taken. There is also an improvement and suggestion scheme in which employees can participate. In this way, ZEP GmbH ensures the continuous improvement of its processes for handling personal data.

d) Contract monitoring

It is ensured that personal data processed on behalf of the customer can only be processed in accordance with the customer’s instructions.

i) Processing on behalf of the Client

Employees of ZEP GmbH are instructed to use the Client’s personal data only on documented instructions within the framework of the data processing agreement and the usage agreement. Under the data processing agreement, ZEP accepts the Client’s instructions both in writing and via the electronic formats offered by the Contractor. Oral instructions are only permitted in urgent cases and must be confirmed by the Client without undue delay in writing or in an electronic format offered by ZEP.

ii) Careful selection of suppliers

In the case of outsourcing, suppliers/third parties are engaged on the basis of a careful selection procedure in cooperation with management and the data protection officer according to defined criteria, in particular with regard to data protection and IT security, specifically:

• Review of the documentation of and compliance with the technical and organisational measures pursuant to Art. 32 GDPR
• Depending on the level of protection and the scope of the personal data, only ISO/IEC 27001-certified companies are engaged wherever possible (applies in all cases to data centres)

To prevent risks, a risk assessment of the respective suppliers is also carried out as part of the process if the third-party provider regularly works with personal data.

iii) Processing on behalf pursuant to Art. 28 GDPR

Subcontractors are engaged and used exclusively in accordance with the data processing agreement between ZEP GmbH and the customer, the statutory provisions and after conclusion of a corresponding data processing agreement pursuant to Art. 28 GDPR between ZEP GmbH and the subcontractor. Where possible, this agreement shall regularly take into account at least the following aspects:

• Agreement on effective audit rights (corresponding to the rights of the Client, if possible including on-site inspections)
• Agreement on corresponding audit and information rights when engaging further subcontractors
• Agreement on contractual penalties for violations, where necessary and possible
• Processing exclusively on documented instructions
• Exclusion of impermissible processing steps
• Prohibition of making copies of personal data (other than backup copies)
• Obligation of the subcontractor’s employees to maintain confidentiality
• Cooperation in safeguarding the rights of data subjects
• Appointment of a data protection officer where required by law
• Obligation to provide information in the event of notifiable personal data breaches pursuant to Art. 33 and 34 GDPR, operational disruptions and other irregularities in the handling of personal data
• Ensuring the deletion/destruction of data after completion of the engagement

iv) Regular checks / requesting evidence

Before the start of the engagement and regularly thereafter, ZEP GmbH will satisfy itself of, or obtain evidence of, compliance with the technical and organisational measures of the subcontractors it engages.

ANNEX IV – LIST OF SUB-PROCESSORS

The controller has authorised the use of the following sub-processors: