Data Processing Agreement (DPA)

Template under Art. 28 GDPR. English courtesy translation; the German version is legally binding. The agreement is concluded per project in writing or text form. Project-specific details are added in Annex 1.

§ 1 Parties

Controller (client): the client as named in the proposal or main contract.

Processor (contractor): Zero-Point Computer GmbH (HAILEVEL), Prinzenallee 1, 40549 Düsseldorf, Germany, represented by its managing director Jabbar A. Bhikh, Düsseldorf Local Court HRB 35889.

§ 2 Subject matter and term

(1) The subject matter is the processing of personal data by the contractor as part of the services agreed in the main contract, in particular development, operation, maintenance and support of software, automations and AI-supported applications.

(2) The term corresponds to the term of the main contract. Obligations that by their nature continue shall survive.

§ 3 Nature, purpose, data types and data subjects

(1) Nature and purpose: collecting, storing, organising, retrieving, using, transmitting and erasing data, solely to provide the services.

(2) Data types (depending on the project): contact and master data, communication data, contract and billing data, usage and log data, content the client feeds into systems.

(3) Data subjects: employees, customers, prospects, suppliers and other contacts of the client.

(4) Special categories under Art. 9 GDPR are processed only if expressly agreed in Annex 1.

§ 4 Instructions

(1) The contractor processes the data only on documented instructions from the client, including transfers to third countries, unless required by law to do so. In that case it informs the client before processing unless the law prohibits this.

(2) Instructions are given in text form. If the contractor considers an instruction unlawful, it informs the client without delay and may suspend execution until confirmed.

§ 5 Confidentiality

The contractor only deploys persons who are bound to confidentiality or subject to a statutory duty of secrecy and have been instructed in data protection.

§ 6 Technical and organisational measures

The contractor takes appropriate measures under Art. 32 GDPR, in particular:

• Access protection through individual accounts, strong passwords and multi-factor sign-in where available
• Role and permission concept based on least privilege
• Encrypted transmission (TLS) and encryption of stored data at the providers used
• Separation of client data and of development, test and production environments
• Backups and recovery procedures at the respective provider
• Logging of administrative access where technically available
• Regular review and adaptation of the measures to the state of the art

The measures may be further developed as long as the level of protection is not reduced.

§ 7 Sub-processors

(1) The client approves the use of the following sub-processors insofar as required for the respective project:

• Lovable Labs Incorporated (development and hosting platform)
• Cloudflare, Inc. (delivery, network, security)
• Supabase, Inc. (database and backend)
• Microsoft Ireland Operations Ltd. (Microsoft 365, email and collaboration)

(2) Additional project-specific providers (e.g. AI model providers) are listed in Annex 1. The contractor informs the client of intended changes in advance in text form; the client may object within 14 days for good cause relating to data protection.

(3) The contractor contractually binds sub-processors to equivalent data protection obligations. For transfers to third countries it ensures appropriate safeguards, e.g. EU Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework.

§ 8 Assistance to the client

(1) Within reason, the contractor assists the client in fulfilling data subject rights (Art. 12 to 23 GDPR), in data protection impact assessments and in the obligations under Art. 32 to 36 GDPR. It forwards data subject requests without delay.

(2) The contractor reports personal data breaches without undue delay, at the latest within 48 hours of becoming aware, with the information available to it under Art. 33(3) GDPR.

(3) Assistance going beyond statutory obligations or caused by the client may be charged on a time-and-materials basis.

§ 9 Audit rights

The contractor provides the client with the information necessary to demonstrate compliance and allows audits after prior notice with reasonable lead time, during normal business hours and without disrupting operations. Evidence may also be provided through current certificates or reports of the sub-processors.

§ 10 Return and deletion

After the end of the services, the contractor returns or deletes all data at the client's choice unless there is a statutory obligation to retain it. Deletion is confirmed in text form upon request. Backups are deleted within the regular rotation cycles.

§ 11 Liability and final provisions

(1) Liability is governed by Art. 82 GDPR. Otherwise the liability provisions of the main contract or our terms apply.

(2) In the event of conflicts, this agreement takes precedence over the main contract in data protection matters.

(3) German law applies. Place of jurisdiction, where permissible, is Düsseldorf.

Annex 1 – Project-specific details

Specific data types, data subjects, additional sub-processors, server locations and special instructions are defined per project. Request the template from us at hallo@hailevel.ai.