Data Processing Agreement

The subject matter of this Data Processing Agreement (“DPA”) is the processing of personal data by the Processor on behalf of the Controller in connection with the use of the Nudgence Platform pursuant to the underlying main agreement (GTC).

The term of this DPA shall correspond to the term of the main agreement.

The Processor shall process personal data for the purpose of providing the Nudging and AI Coaching functionalities, including in particular:

• delivery of nudges and reminders;
• provision of the AI-supported coaching dialogue via the infrastructure of melious.ai;
• creation, storage and management of user accounts, including freely definable names, telephone numbers and email addresses;
• team assignments;
• feedback; and
• usage and interaction data within the Platform.

Documents provided by the Customer and content entered as part of the AI coaching functionality shall be processed exclusively for the purpose of providing the contractually agreed services.

Such data shall not be used to train generally available AI models or to develop or improve AI models for other customers.

Any processing for other purposes shall only take place on the documented instructions of the Controller or where required by applicable law.

Employees of the Controller who are registered as users of the Platform, including team members and team leads.

The following categories of personal data may be processed:

• name, including freely definable names;
• business email address;
• business mobile phone number;
• team and/or role assignment;
• usage and interaction data within the Platform, such as responses to nudges; and
• dialogue history with the AI Coach.

No special categories of personal data within the meaning of Article 9 GDPR are intended to be processed, unless such data are independently entered into the Platform by the Controller.

Nudgence is expressly not intended for the automated evaluation, monitoring or assessment of individual employee performance.

The Provider does not create employee profiles for the purpose of personnel decisions, performance assessments or comparable measures, unless such functionality is expressly agreed upon separately and implemented in compliance with applicable data protection law.

The Processor shall process personal data exclusively on documented instructions from the Controller, unless the Processor is required by applicable law to carry out processing otherwise.

The Processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality.

The Processor shall implement appropriate technical and organizational measures pursuant to Article 32 GDPR, as described in Annex 1 (Technical and Organizational Measures – TOMs).

The Controller agrees to the engagement of the following Subprocessors:

melious.ai (Saarbrücken, Germany): AI infrastructure; data processing within the European Union.

Brevo GmbH (Berlin, Germany): Delivery of emails and SMS; data processing within the European Union.

Neon Databricks GmbH (Munich, Germany; parent company Databricks Inc., San Francisco, CA 94105, USA): Provision and hosting of the serverless PostgreSQL database and vector database for the SaaS Platform; data processing within the European Union.

Vercel GmbH (Munich, Germany; parent company Vercel Inc., Walnut, CA 91789, USA): Website and application hosting, as well as storage of uploaded documents; data processing within the European Union.

Integrtr GmbH (Mannheim, Germany): Technical development, operation and maintenance of the Nudgence Platform, including application development, infrastructure management and technical support. Depending on the specific service configuration, access to personal data processed through the Platform may occur for the purpose of providing these services. Any access to personal data by integrtr is limited to what is necessary to provide the contracted technical services.

Any processing by additional Subprocessors shall take place exclusively in accordance with this DPA and the notification and objection procedures set out herein.

The Processor shall inform the Controller in advance of any intended changes concerning Subprocessors. The Controller may object to such changes for important reasons within 14 days of receiving the relevant notification.

Stripe is used exclusively for payment processing in connection with the conclusion and performance of the agreement between the Provider and the Customer. Stripe processes payment and billing data, but not employee data of the Customer, in connection with the Nudgence services. Stripe is therefore not engaged as a Subprocessor under this DPA in this respect. Stripe processes payment and billing data in its own capacity as a controller to the extent required for the provision of its payment services. Stripe does not process employee data of the Customer in connection with the Nudgence services.

The Controller shall be entitled to verify the Processor’s compliance with the obligations set out in this DPA, for example by requesting appropriate information or evidence, including certificates, audit reports or self-assessments.

The Processor shall notify the Controller without undue delay, and in any event no later than 24 hours after becoming aware, of any personal data breach affecting the processing of personal data under this DPA.

Upon termination of the main agreement, the Processor shall, at the Controller’s choice, delete or return all personal data processed on behalf of the Controller, including existing backup copies, to the extent technically feasible and unless retention is required by applicable law.

Personal data contained in backup copies shall be deleted as part of the Processor’s regular backup deletion cycle.

Deletion or return shall take place within 30 days after termination of the main agreement, unless a longer retention period is required by law.

The liability provisions of the main agreement shall apply accordingly to this DPA, to the extent legally permissible.

In the event of any conflict between this DPA and the main agreement with regard to the processing of personal data, the provisions of this DPA shall prevail.

This DPA shall be governed by the laws of the Federal Republic of Germany.

Nudgence is operated as a software-as-a-service platform by the Provider.

The Provider maintains appropriate organizational measures for the protection of personal data, including access authorization, confidentiality obligations, incident management and the management of data processing agreements.

Access to personal data is restricted to persons and service providers who require access for the performance of their contractual duties.

Access rights are granted according to the principle of least privilege.

Nudgence uses qualified technical service providers for software development, hosting, infrastructure, database services, AI/RAG functionality and communications as set out in this agreement.

Where such providers process personal data on behalf of Nudgence, they are contractually engaged as Subprocessors in accordance with Article 28 GDPR.

Technical security measures for the application and underlying infrastructure are implemented jointly by Nudgence and its contracted technical service providers, including integrtr, and the relevant infrastructure providers.

Measures include:

• authentication and authorization
• role-based access control
• encryption in transit
• encryption at rest where supported
• secure software development practices
• vulnerability and patch management
• logging and monitoring
• backup and recovery mechanisms
• environment separation.

All data is logically separated between individual customer environments and accounts.

Access to one customer's data by another customer is technically prevented through appropriate access control mechanisms.

Data backups are performed using the infrastructure and services of the designated technical providers. Backup retention periods and deletion procedures are defined according to the applicable infrastructure configuration.

Nudgence maintains procedures for identifying, assessing and responding to security incidents and personal data breaches.

Subprocessors are contractually required to notify Nudgence of relevant incidents without undue delay.

Personal data is deleted following termination of the contractual relationship in accordance with the applicable data protection law and the configured deletion and backup procedures.