Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") governs the processing of personal data by Linqbiz GmbH, Ried 1a, 6130 Schwaz, Austria (the "Processor") on behalf of the business customer (the "Controller") in connection with the use of Voovena, insofar as the customer enters personal data of their end customers, employees, suppliers or other project participants into the application. It is concluded in electronic form (Art. 28(9) GDPR) together with the main contract and forms part of it.

1. Subject matter and duration of the processing

The subject matter is the processing of personal data that the Controller stores, or has stored, in projects, messages, documents, images and appointments when using Voovena. The duration corresponds to the term of the main contract (subscription or use of the free tier) plus the wind-down period set out in section 10.

2. Nature and purpose of the processing, categories of data and data subjects

The sole purpose of the processing is the provision of the Voovena platform (project communication, image, document and appointment management, notifications). Categories of data processed: master and contact data (name, email address), communication content, uploaded images and documents (in which persons or property may be recognisable), appointment data and technical usage data. Data subjects: end customers, employees, suppliers and other project participants of the Controller.

The platform is not intended for special categories of personal data (Art. 9 GDPR); the Controller does not enter such data.

3. Instructions and obligations and rights of the Controller

The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects; in particular, the Controller ensures that an adequate legal basis exists for uploaded content. Instructions are generally given by using the functions of the application (creating, changing, sharing and deleting content); individual instructions going beyond this require text form. If the Processor considers an instruction to infringe data protection law, it informs the Controller and may suspend execution until the matter is clarified.

4. Obligations of the Processor

The Processor processes personal data exclusively on documented instructions of the Controller and not for any purposes of its own. It commits all persons authorised to process data to confidentiality, maintains a record of processing activities pursuant to Art. 30(2) GDPR and, taking into account the nature of the processing, assists the Controller in fulfilling its obligations under Art. 32 to 36 GDPR.

5. Sub-processors

The Controller grants general authorisation for the engagement of sub-processors. Currently engaged: (a) a hosting provider with servers located in Germany (operation of the application and database) and (b) an email delivery service with servers located in the EU. The Processor provides the current list on request.

The Processor gives advance notice in text form of intended changes (addition or replacement). The Controller may object on important data protection grounds; if no amicable solution is reached, either party may terminate the main contract with effect from the end of the current billing period. Obligations corresponding to this DPA are agreed with every sub-processor.

6. Place of processing and third-country transfers

Processing takes place exclusively in member states of the European Union or the European Economic Area. A transfer to third countries only occurs if the requirements of Chapter V GDPR are met (in particular an adequacy decision or standard contractual clauses) and the Controller has been informed in advance.

7. Assistance with data subject rights

The Processor assists the Controller with appropriate technical and organisational measures in responding to data subject requests (access, rectification, erasure, restriction, data portability). If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.

8. Technical and organisational measures

The Processor implements technical and organisational measures appropriate to the risk pursuant to Art. 32 GDPR, in particular: encrypted transmission (TLS), a role-based authorisation concept with project-related access levels, logging of material changes (audit log), regular data backups and restriction of access to administrative functions. The measures are kept up to date with the state of the art; an overview is provided on request.

9. Notification duties in the event of personal data breaches

The Processor informs the Controller without undue delay after becoming aware of a personal data breach and provides the information the Controller needs to fulfil its notification duties under Art. 33 and 34 GDPR (nature of the breach, categories and approximate number of records concerned, likely consequences, measures taken and proposed).

10. Deletion and return after the end of the contract

After termination of the main contract, the Processor returns the stored personal data at the Controller's choice via the export functions of the application or deletes it, at the latest 90 days after the end of the contract, unless a statutory retention obligation prevents this. On request, the Processor confirms the deletion in text form. Upon downgrade to the free tier, the data remains stored within the contractual framework.

11. Audit rights of the Controller

The Controller may verify compliance with this DPA to a reasonable extent. Audit claims are satisfied primarily through information and suitable evidence. On-site inspections are possible after prior notice with a reasonable lead time during usual business hours; they must not unreasonably disrupt business operations, and the Processor may reasonably charge for the effort of more than one audit per year.

12. Liability, precedence and applicable law

The liability of the parties is governed by Art. 82 GDPR; in all other respects the liability provisions of the GTC apply. Austrian law applies. In the event of conflicts between this DPA and the GTC, this DPA prevails in data protection matters.