Data Processing Agreement (DPA)

This Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is concluded between the customer as controller (the “Controller”) and Bauer365 GmbH, Im Grund 4, 74199 Untergruppenbach, Germany, as processor (the “Processor”). It specifies the parties' data protection obligations in connection with the use of the Vendo4u platform and applies to all processing of personal data the Processor carries out on behalf of the Controller. In case of conflict with the main agreement, this DPA prevails on data protection matters.

The subject matter is the processing of personal data to provide the contractually agreed platform services (supplier profiles, directory, customer ratings, evidence documents, monitoring). The duration corresponds to the term of the main agreement; it ends upon its termination and the subsequent deletion or return of the data (Section 9).

Nature of processing: collection, storage, organisation, display, transmission to entitled buyers, export and deletion. Purpose: provision and operation of the platform under the main agreement — solely on the Controller's documented instructions and not for the Processor's own purposes.

• Contact and account data (name, email, phone, role) • Company/master data (company name, legal form, address, VAT ID) • Compliance/assessment information and evidence documents provided by users • Usage and log data (e.g. logins, profile views) • Billing-related data, where applicable

• Employees and contacts of the Controller (user accounts) • Contacts of the companies listed in a profile • Other natural persons whose data is contained in uploaded evidence documents

The Processor processes the data solely on the Controller's documented instructions and informs the Controller if it considers an instruction to be unlawful. All persons authorised to process the data are bound to confidentiality or under a statutory obligation of secrecy (Art. 28(3)(b), Art. 29, 32(4) GDPR).

The Processor maintains appropriate technical and organisational measures pursuant to Art. 32 GDPR — including role-based access control and tenant separation, password hashing (bcrypt), two-factor authentication (TOTP) and passkeys (WebAuthn), encryption of security-relevant secrets (AES-256-GCM), rate limiting on sign-in and registration functions, logging of administrative actions and transport-encrypted transmission (TLS).

A detailed, up-to-date description of these measures is provided by the Processor in text form on request at info@bauer365.de.

The Controller consents to the use of the sub-processors listed below. The Processor concludes Art. 28 GDPR agreements with them and informs the Controller of intended changes in good time so that an objection is possible.

Sub-processor – purpose – location/region: • dogado GmbH, Antonio-Segni-Strasse 11, 44263 Dortmund – hosting and server operation – Germany • Database and object storage for evidence documents are operated by the Processor itself on the infrastructure named above; there is no further sub-processor in this respect. • Stripe Payments Europe, Ltd., Ireland – payment processing – not currently used; it will be integrated once paid plans are enabled. • No external service provider is currently used for the delivery of system emails. No personal data is transferred to third countries outside the EU/EEA.

The Processor assists the Controller by appropriate technical and organisational measures in fulfilling data subject rights (Art. 12–23 GDPR) as well as data protection impact assessments and notification duties (Art. 32–36). It notifies the Controller of any personal data breach without undue delay after becoming aware of it.

After the end of processing, the Processor deletes the data or, at the Controller's choice, returns it, unless a statutory retention obligation applies. The Controller can also initiate access and erasure at any time via the platform's self-service functions (data export / delete account).

The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits — including inspections by the Controller or an auditor mandated by it — to a reasonable extent and with reasonable notice.

The law of the Federal Republic of Germany applies. Should individual provisions be invalid, the remainder of the agreement remains effective; the parties will replace the invalid provision with a valid one that comes closest to its economic purpose.