choicery.ai
DPA

This English version is provided for convenience. The German version is legally binding.

Data Processing Agreement (DPA)

Version: 1.0 Effective from: 2026-10-09 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany

This Agreement forms part of the Terms of Service and takes precedence over them in the event of conflicts.

Parties. Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany, trading under the name Choicery (hereinafter the "Processor" or the "Provider"), and the Customer within the meaning of the Terms of Service (hereinafter the "Controller" or the "Customer"). Section 5(4) applies to the position of a Customer that itself uses the platform as a processor for another organisation.

Section 1 Subject Matter and Duration of Processing

(1) Subject matter. The Processor provides the Controller with the Choicery platform at https://app.choicery.ai for creating, conducting and analysing quantitative surveys and conjoint studies (CBC, CBC Shop, MaxDiff, Anchored MaxDiff, DR-CBC, BW-CBC, hierarchical Bayes estimation, Latent Class, TasteNet, Interaction Search, market simulation, exports). In doing so, it processes personal data on behalf of the Controller. This Agreement governs the rights and obligations of the parties under Article 28 GDPR.

(2) Delimitation. This Agreement covers the processing of the study content, participant data and response data that the Controller collects, stores and analyses via the platform (Section 3). Account and contract data of the Customer and its users, billing metadata, support communication, the security and audit events and the error reports of the platform are processed by the Provider as controller for its own purposes; the Privacy Policy applies to these.

(3) Duration. This Agreement applies from its conclusion under Section 13 for the term of the contract of use under the Terms of Service. It ends only when the processing has been fully wound up, that is, after expiry of the retrieval and deletion periods under Section 10. Obligations which by their nature continue beyond the end of the Agreement (in particular confidentiality, deletion and demonstration of compliance) remain in force.

Section 2 Nature and Purpose of Processing

(1) Purpose. The processing serves exclusively the provision of the platform in accordance with the contract: creating and configuring studies, delivering the survey to participants, collecting and storing the responses, statistical analysis including hierarchical Bayes estimation, latent class models, TasteNet and market simulation, generating exports and replication packages, backup (point-in-time recovery of the database provider and the Processor's own backups), support at the request of the Controller, and security and integrity checks.

(2) Nature. The processing comprises collection, storage, organisation, alteration, analysis, making available to the Controller (exports), restriction and erasure. It is carried out automatically within the platform. Manual access by the Processor to content and response data takes place only on the instruction of the Controller, for example in support, or insofar as necessary for troubleshooting and security checks.

(3) No own purposes. Content and responses are not used for own purposes or for training models. Troubleshooting, security and aggregated usage statistics without content remain permitted. Account-related usage data of the Controller's users (which functions a user account uses) are not order data within the meaning of this Agreement (Section 1(2)); the Provider processes them as controller in accordance with the Privacy Policy.

Section 3 Types of Personal Data

(1) The following types of data are the subject of the processing on behalf of the Controller:

a) study content created by the Controller (questions, attributes, levels, texts, images, videos, introductory texts and privacy notices), insofar as it contains personal data; b) response data of the participants: choices, ratings, free-text entries and other information that participants provide in a survey; c) participant identifiers that the Controller assigns or passes via parameters of the survey link (such as panel codes or participant IDs), as well as the response identifier assigned by the system; d) response metadata: timestamps of start and completion, page times, status (complete, incomplete, deleted), checksum, assigned design version, campaign parameters of the survey link and coarse details of device type, browser and screen size, without the full browser identifier and without a device fingerprint; e) technical connection data when the survey is accessed (in particular the IP address), insofar as they are processed for the connection and for short-lived security controls such as rate limiting; f) data of other persons that the Controller stores in study content, exports or uploads.

(2) Excluded data. This Agreement does not cover special categories of personal data under Article 9 GDPR (such as health data, data on political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic and biometric data), data relating to criminal convictions and offences under Article 10 GDPR, protected health information within the meaning of HIPAA, payment card data, social security numbers, education data subject to the Family Educational Rights and Privacy Act (FERPA) and financial data subject to the Gramm-Leach-Bliley Act (GLBA). The Controller does not collect or process such data via the platform. Individual categories can be enabled only by a separate Enterprise contract after the affected sub-processors have approved the processing in writing.

(3) Minors. The Controller does not conduct studies that are specifically directed at minors and does not collect via the platform any data of persons under 16 years of age (European Economic Area) or under 13 years of age (USA). If a party becomes aware of such data, it arranges for their deletion and informs the other party.

Section 4 Categories of Data Subjects

a) participants in the Controller's surveys, that is, natural persons who access or answer a survey, including participants from panels of the Controller or of third parties; b) persons whose data the Controller stores in study content, uploads or exports; c) users of the Controller, insofar as their actions are visible in project data (for example as creator or editor of a project); their account data are processed by the Provider as controller under Section 1(2).

Section 5 Obligations and Rights of Instruction of the Controller

(1) Responsibility. The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects, in particular for

a) the legal basis for the collection under Article 6 GDPR and its documentation; b) informing participants under Articles 13 and 14 GDPR before the survey starts, including naming the controller in the survey's privacy notice (Section 5 of the Terms of Service); c) data minimisation in the study design and compliance with the exclusions under Section 3(2) and (3); d) responding to requests from data subjects; e) its own notification and communication obligations under Articles 33 and 34 GDPR and under applicable US state law; f) compliance with the Acceptable Use Policy, in particular when inviting participants; g) assessing whether a data protection impact assessment under Article 35 GDPR is required.

(2) Instructions. The Controller issues instructions primarily by using the platform (project configuration, activating and ending surveys, enabling embedded videos, export, editing and deletion of data). Instructions going beyond this are issued in text form (for example by e-mail) to info@choicery.ai. Instructions that exceed the agreed scope of services require an agreement on scope and any remuneration; the Processor notifies the Controller of this before execution.

(3) Persons authorised to issue instructions. The persons authorised to issue instructions are the owner of the workspace (workspace owner), the users to whom the workspace owner has granted administrator rights, and persons whom the Controller names to the Processor in text form.

(4) Customer as processor. If the Customer for its part processes the data on behalf of another organisation (for example as a market research institute, agency or service provider for a client), the Customer is the processor and its client the controller; the Provider is then another processor within the meaning of Article 28(4) GDPR. In that case the following applies:

a) The Customer warrants that its client has authorised the engagement of the Provider and that the contract between the Customer and its client contains obligations corresponding to the obligations under this Agreement. b) The Customer passes on its client's instructions to the Provider; the Provider accepts instructions exclusively from the Customer. c) The Provider addresses information, notifications and evidence under this Agreement to the Customer, who forwards them to its client. d) References to the "Controller" in this Agreement apply to the Customer accordingly.

(5) Transfer to a Google account chosen by the Controller. In the plans that include the Google Sheets connection, a user of the Controller with export rights for a project can connect a Google account of their choice. Before the first transfer, the platform shows the selected Google account, and the user confirms that they are authorised to transfer the project's responses to that account; the Processor stores the time and the text version of this confirmation. Each connection set up in this way is a documented instruction of the Controller within the meaning of Article 28(3)(a) GDPR to transfer the project's responses into a spreadsheet in that account's Google Drive and to update it there about every hour. Google is a recipient chosen by the Controller and acts under the Controller's own agreement with Google; for this transfer, Google is not a sub-processor of the Processor (Section 8). Whether the transfer to Google is lawful, including any transfer to third countries under Google's terms, is the Controller's responsibility. The instruction ends when the user ends the connection or the consent for Google ends; updates pause while the conditions of the connection (plan, export rights, project not in the trash, unchanged workspace) are not met. The Processor does not delete the spreadsheet in the Google Drive; it stays under the Controller's control, and Section 10 does not cover it.

Section 6 Obligations of the Processor

(1) Adherence to instructions (Article 28(3)(a) GDPR). The Processor processes the personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation. The only exception is where the Processor is required to process by Union or Member State law to which it is subject; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) Notice of unlawful instructions (Article 28(3), second subparagraph, GDPR). If the Processor is of the opinion that an instruction infringes the GDPR or other Union or Member State data protection provisions, it informs the Controller without delay. It may suspend execution of the instruction until the Controller confirms or amends it.

(3) Confidentiality (Article 28(3)(b) GDPR). The Processor ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and process the data only on instructions.

(4) Security of processing (Article 28(3)(c), Article 32 GDPR). The Processor implements the measures described in the Technical and Organisational Measures; they form Annex 1 to this Agreement. The Processor may develop the measures further; the level of protection must not decrease in the process. Changes are documented with their date in the TOMs.

(5) Sub-processors (Article 28(3)(d), (2) and (4) GDPR). The conditions of Section 8 apply.

(6) Assistance with data subject rights (Article 28(3)(e) GDPR). Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR (access, rectification, erasure, restriction, data portability, objection). For this purpose the platform provides export, editing and deletion functions for response records. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay, insofar as it can be attributed to the Controller, and otherwise responds only by referring to its role as processor, unless it is legally obliged to respond itself.

(7) Assistance with security, notifications and impact assessment (Article 28(3)(f) GDPR). Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR, in particular

a) with the security of processing through the measures under paragraph 4; b) with the notification of personal data breaches under Section 7; c) with a data protection impact assessment by providing the description of the processing (Sections 1 to 4), the Technical and Organisational Measures and the list of sub-processors; d) with a prior consultation of the supervisory authority.

(8) Deletion and return (Article 28(3)(g) GDPR). Section 10 applies.

(9) Demonstration of compliance and audits (Article 28(3)(h) GDPR). Section 9 applies.

(10) Requests from authorities. If a supervisory authority, another authority or a court contacts the Processor with a request for information or disclosure concerning data of the Controller, the Processor informs the Controller without delay and forwards the request to the Controller so that the Controller can respond itself. This does not apply insofar as a statutory prohibition on notification exists; in that case the Processor limits itself to the information legally permitted. The Processor examines every request as to its legal basis and scope and discloses data only if and to the extent that it is legally obliged to do so, limited to the necessary minimum. Requests from authorities and courts of third countries are governed by Article 48 GDPR, Article 32 of Regulation (EU) 2023/2854 (Data Act) and Section 10 of the Terms of Service: disclosure takes place only on the basis of an international agreement, such as a mutual legal assistance treaty, or under the conditions of Article 32(2) and (3) Data Act.

Section 7 Personal Data Breaches

(1) Notification. The Processor notifies the Controller of any personal data breach affecting data of the Controller without undue delay after becoming aware of it. The notification is sent by e-mail to the address on file in the workspace owner's account.

(2) Content. The notification contains, insofar as known at the time of notification,

a) a description of the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; b) the contact point for further information: security@choicery.ai; c) a description of the likely consequences of the breach; d) a description of the measures taken and proposed to address the breach and to mitigate its adverse effects.

(3) Supplementary information. Information that is not available at the time of the initial notification is provided by the Processor without undue delay, including in phases.

(4) Assistance. The Processor provides the Controller with the information the Controller needs for its notifications to supervisory authorities and communications to data subjects under Articles 33 and 34 GDPR and under applicable US state law, and assists the Controller on request in communicating with the data subjects.

(5) No notification on behalf of the Controller. The Processor does not notify breaches to supervisory authorities or data subjects on behalf of the Controller without the Controller's instruction. The Processor's own statutory obligations remain unaffected.

(6) Mutual information. Security incidents and vulnerabilities are to be reported to security@choicery.ai. If the Controller detects indications of a breach in the platform (for example compromised credentials of its users), it informs the Processor without delay.

Section 8 Sub-processors

(1) General authorisation. The Controller gives general authorisation for the engagement of the sub-processors listed in the list Subprocessors and Recipients (Annex 2) with the services, data categories, locations and transfer bases described there. At the time of conclusion of the Agreement these are: netcup GmbH (application hosting and file storage), Ubicloud B.V. (database), coolLabs Solutions Kft. (deployment control with administrative remote access) and Greenmark IT GmbH (e-mail delivery and mailboxes). Polar Software, Inc. is listed as the Provider's processor for account, checkout and subscription data that the Provider processes as controller under Section 1(2); Polar does not receive any study or response data under Section 3 and is at the same time, as Merchant of Record, an independent controller for the sale. Google Ireland Limited is additionally listed as the Provider's processor for reach measurement on the marketing pages of the website; it receives no study, response or account data under this Agreement. The independent controllers listed separately in the list (Google and Microsoft for sign-in with the respective account), the participant-facing video providers, which receive data only after a click by the participant, and Google as a recipient chosen by the Controller for the Google Sheets connection (Section 5(5)) are not sub-processors.

(2) Advance notice. The Processor informs the Controller in advance of any intended addition or replacement of a sub-processor as soon as it becomes aware of the change, as a rule at least 14 days before it takes effect. The notice is sent by e-mail to the workspace owner and names the sub-processor and its service; the change is documented in the list. If a change is required without delay, for example because a sub-processor fails, discontinues its service or a security risk exists, the Processor may make the change and inform the Controller subsequently without undue delay; paragraph 3 then applies from receipt of that notice.

(3) Objection and termination. The Controller may object within 14 days of receipt of the notice on data protection grounds in text form to privacy@choicery.ai. If the parties do not reach agreement, either party may terminate the contract of use with effect from the time the change takes effect, or upon receipt of the termination if that time has already passed; the Controller sends its termination in text form to info@choicery.ai. Fees already paid are refunded only insofar as the law provides for this. The winding-up, in particular the retrieval and deletion of the data, is governed by the Terms of Service, the Data Act Exit and Switching Policy and Section 10 of this Agreement. If the Controller does not object in time, the engagement is covered by the general authorisation under paragraph 1.

(4) Contractual commitment. The Processor concludes with each sub-processor a contract under Article 28(4) GDPR that imposes on the sub-processor the same data protection obligations as this Agreement imposes on the Processor, in particular sufficient guarantees for appropriate technical and organisational measures. If a sub-processor fails to fulfil its data protection obligations, the Processor is liable to the Controller for the performance of the sub-processor's obligations.

(5) Location and third countries. The list shows for each sub-processor the location of processing, the country of the contracting party's registered seat and the transfer basis. Transfers to third countries are governed by Section 11.

Section 9 Audit Rights of the Controller

(1) Duty to inform. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and under this Agreement.

(2) Evidence first. Compliance is demonstrated first by documents, in particular

a) the Technical and Organisational Measures in their current version; b) the list Subprocessors and Recipients; c) the Retention and Deletion Policy; d) written information from the Processor; e) security and compliance evidence of the sub-processors, insofar as they make it available to their customers.

(3) Audits. If the evidence under paragraph 2 is insufficient in an individual case, the Controller may conduct an audit, including inspections, itself or through an auditor engaged by it who is bound to confidentiality and is not a competitor of the Processor. Inspections are primarily conducted remotely, for example by video conference and by review of documents; an on-site inspection takes place only if a remote audit is insufficient in the individual case. The following applies:

a) The audit is announced at least 30 days in advance in text form, stating its subject, scope, period and the auditor. b) It takes place during normal business hours on working days and does not disproportionately impair operations. c) Audits, including on-site inspections, take place no more than once in twelve months; this does not apply after a personal data breach or where a supervisory authority has ordered an audit. d) Tenant protection: the auditor is not given access to data of other customers or to the Processor's credentials and keys, and does not interfere with production systems. Technical security tests (such as vulnerability scans or penetration tests) are agreed in advance as to scope, timing, target systems and access. e) The data centres of the sub-processors are not the subject of inspections at the Processor; their evidence is provided under paragraph 2(e). f) The Controller notifies the Processor of any deficiencies identified.

(4) Costs. The provision of the documents under paragraph 2 is free of charge. The costs of an audit under paragraph 3, including the Processor's reasonable effort, are borne by the Controller; this does not apply where the audit establishes an infringement by the Processor of this Agreement or of data protection law. The Controller's rights under Article 28(3)(h) GDPR are not restricted by this cost provision.

Section 10 Deletion and Return

(1) During the contract. The Controller deletes responses, projects and exports itself via the platform. Responses are not deleted automatically during the term of the contract; they remain stored until the Controller deletes them, deletes the project, deletes the account or the contract ends. Responses deleted by the Controller are first moved to the project's bin, from which they can be restored. They are permanently deleted once the Controller deletes them in the bin or empties the bin. Imported responses are permanently deleted immediately, without the bin. Projects deleted by the Controller remain restorable for at least 30 days and are then permanently deleted, at the latest after 60 days. Further periods are set out in the Retention and Deletion Policy (Annex 3).

(2) After the end of the contract. After termination of the contract of use, the data remain available to the Controller for retrieval via the export functions for 30 days. After expiry of the retrieval period, the Processor deletes all personal data of the Controller at the latest within 30 days, unless the Controller requests earlier deletion. If the Controller deletes its account itself, the grace period under Section 8(6)(c) of the Terms replaces the retrieval period: the account is locked until the Controller cancels the deletion and is then fully available again. If the Controller does not cancel the deletion, the account is permanently deleted after expiry of the grace period without undue delay, at the latest within 30 days; if the Controller chooses immediate deletion, at the latest 30 days after the request. Details, including the extension of the retrieval period and switching to another provider, are governed by the Data Act Exit and Switching Policy (Annex 4).

(3) Residual retention in backups. Deleted data may remain in backups until the respective backup expires and are deleted together with it. The Processor's own backups on the application server are retained for no longer than 30 days; copies on an encrypted external storage medium are replaced with each new copy and deleted after 45 days at the latest. During that time the data are not used for any other purpose. After a restore, documented deletions are carried out again.

(4) Statutory retention. Insofar as the Processor is required by Union or Member State law to retain data, it restricts the processing of the affected data to retention and deletes them once the obligation ceases to apply.

(5) Sub-processors. Deletion at sub-processors, including their backups, takes place in accordance with the periods agreed with them; otherwise paragraph 3 applies.

(6) Confirmation of deletion. On request, the Processor confirms the deletion in text form.

Section 11 Transfers to Third Countries

(1) Principle. The processing takes place in data centres in the European Economic Area: application server and file storage in Germany, database in Frankfurt am Main, deployment control by a service provider with its seat and control infrastructure in the European Union, e-mail delivery in Germany.

(2) Per recipient. The list Subprocessors and Recipients shows for each recipient the location of processing, the country of the contracting party's registered seat and the transfer basis. Changes are subject to Section 8.

(3) Remote access from third countries. At the database provider, the contracting party is Ubicloud B.V., with its seat in the Netherlands; the parent company has its seat in the USA, and remote access by the database provider's support from the USA is possible. These transfers to affiliated companies of the database provider are based on its intra-group standard contractual clauses (clause 6.1 of its data processing agreement). Insofar as a sub-processor or its sub-processor otherwise accesses data from a third country without an adequacy decision, the transfer is based on standard contractual clauses of the European Commission, unless an adequacy decision applies, such as the EU-US Data Privacy Framework in the case of certified recipients.

(4) Polar and recipients not covered. Polar Software, Inc. (USA) processes, as the Provider's processor, account, checkout and subscription data that the Provider processes as controller under Section 1(2); the transfer is based on the Standard Contractual Clauses under the Polar Data Processing Addendum (Module 2; Module 3 insofar as the Provider acts as processor in that respect). For the sale, invoicing, taxes and payment processing, Polar is, as Merchant of Record, an independent controller. This Agreement does not cover the independent controllers Google Ireland Limited and Microsoft Ireland Operations Limited (sign-in); the legal bases for their transfers are described in the Privacy Policy. For the Google Sheets connection, the Processor transfers responses on the Controller's instruction to the Google account chosen by the Controller (Section 5(5)); any transfer to third countries is then governed by the Controller's agreement with Google, and its lawfulness is the Controller's responsibility. Video providers that the Controller embeds in a survey receive data only when the participant starts playback by clicking; the Controller decides on the embedding and ensures the legal basis and the information of participants.

Section 11a Controllers outside the European Economic Area

(1) Scope. The processing by the Processor is subject to the GDPR (Article 3(1) GDPR). If the Controller is established outside the European Economic Area, the provision of personal data to the Controller (in particular exports and access to response data from the Controller's country of establishment) constitutes a transfer under Chapter V GDPR. The transfer is permissible without further safeguards if an adequacy decision of the European Commission applies to the Controller's country of establishment or if the Controller is covered by such a decision, for example as an organisation certified under the EU-US Data Privacy Framework. In all other cases, the parties agree the Standard Contractual Clauses under paragraph 2 as a contractual safeguard under Article 46(2)(c) GDPR. This also applies where the processing by the Controller itself is subject to the GDPR under Article 3(2) GDPR, until the European Commission adopts specific standard contractual clauses for that case; from the date those clauses apply, they replace the Clauses under paragraph 2.

(2) Standard Contractual Clauses, Module 4 or Module 3. Module 4 (transfer from processor to controller) of the Standard Contractual Clauses under Implementing Decision (EU) 2021/914, in their current version, applies to the transfer from the Processor to the Controller. If the Customer is itself a processor under Section 5(4), Module 3 (transfer from processor to processor) applies instead. The Clauses are incorporated into this Agreement by this reference. The Processor is the data exporter, the Customer the data importer. The optional Clause 7 (docking clause) and the option in Clause 11 (independent dispute resolution body) are not agreed. For Clause 17, the law of the Federal Republic of Germany is chosen; for Clause 18, the courts of the Federal Republic of Germany are chosen.

(3) Annexes. Annex I.A is completed with the details of the parties: for the data exporter from the heading of this Agreement, for the data importer with the organisation name and address that the Customer provides when purchasing a paid plan (classification under Section 1(2b) of the Terms of Service) and with the e-mail address on file in the account. The description of the transfer under Annex I.B follows from the details in Sections 1 to 4 and Section 10. Annex II is the Technical and Organisational Measures.

(4) Precedence. In the event of conflicts between this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

Section 11b CCPA Service Provider Addendum

Insofar as the Controller is a "business" within the meaning of the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 et seq., "CCPA") and personal information of consumers resident in California is processed via the platform, the following applies in addition. The Processor acts as a "service provider" within the meaning of Cal. Civ. Code § 1798.140. This Section implements the contractual requirements of 11 CCR § 7051(a); terms in quotation marks have the meaning given to them in the CCPA and its implementing regulations. The Service Provider certifies that it understands the restrictions of this Section and will comply with them, and contractually binds sub-processors that process such information to corresponding restrictions.

(1) Specific business purposes. The Business makes personal information available to the Service Provider exclusively for the following limited and specific "business purposes":

a) hosting and operating the Business's survey projects on the platform; b) delivering the surveys to participants and collecting and storing the responses; c) calculating statistical analyses, estimates and simulations on the data of the respective project; d) generating exports, reports and replication packages for the Business; e) support at the request of the Business; f) security, integrity checks, prevention of abuse and keeping of audit records; g) backup (point-in-time recovery of the database and the Service Provider's own backups); h) deletion and return under Section 10.

General references to this Agreement or to the Terms of Service do not extend these purposes.

(2) Prohibition of selling and sharing. The Service Provider will not "sell" the personal information and will not "share" it for cross-context behavioural advertising.

(3) Purpose limitation. The Service Provider will not retain, use or disclose the personal information for any purpose other than the business purposes specified in paragraph 1, including for its own commercial purposes. The only exceptions are processing that the Service Provider is legally required to carry out and the detection and prevention of security incidents and fraudulent or illegal use.

(4) Direct business relationship and prohibition of combining. The Service Provider will not retain, use or disclose the personal information outside the direct business relationship between the Service Provider and the Business and will not combine it with personal information that it receives from other persons or collects from its own interaction with consumers, except as expressly permitted by the CCPA and its implementing regulations.

(5) Same level of protection. The Service Provider complies with the provisions of the CCPA and its implementing regulations applicable to it and provides the personal information with the same level of protection as the CCPA requires of a business. This includes reasonable security procedures under Cal. Civ. Code § 1798.81.5 in accordance with the Technical and Organisational Measures, cooperation in responding to consumer requests under paragraph 9, and cooperation with cybersecurity audits, risk assessments and the Business's obligations regarding automated decisionmaking technology under the CCPA implementing regulations, insofar as those obligations apply to the Business and concern the service.

(6) Right of oversight of the Business. The Business may take reasonable and appropriate steps to ensure that the Service Provider uses the personal information in a manner consistent with the Business's obligations, including regular assessments, audits or technical tests. Section 9 applies to notice, conduct, tenant protection and costs; automated scans and security tests of production systems are agreed in advance under Section 9(3).

(7) Notification of inability to comply. If the Service Provider determines that it can no longer meet its obligations under the CCPA and this Section, it notifies the Business without delay.

(8) Right to remediate. Upon notice, the Business is entitled to take reasonable and appropriate steps to stop and remediate unauthorised use of personal information by the Service Provider. This includes the right to require the Service Provider to confirm that personal information of consumers whose valid deletion request the Business has complied with is no longer retained or used.

(9) Consumer requests. The Service Provider enables the Business to comply with consumer requests under the CCPA (access, deletion, correction, limitation) through the export, editing and deletion functions of the platform and through assistance under Section 6(6). The Business informs the Service Provider of requests in whose fulfilment the Service Provider must cooperate and provides the information required for this. Requests that consumers direct to the Service Provider directly are forwarded by the Service Provider to the Business, insofar as they can be attributed to the Business, and the Service Provider informs the consumer that it cannot process the request itself as a service provider.

Section 11c US State Processor Terms

(1) If the Controller is a "controller" under the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.), the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.), the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Chapter 541), the Oregon Consumer Privacy Act (ORS 646A.570 et seq.) or a comparable comprehensive privacy law of a US state, this Agreement is the contract between controller and processor required by those laws. The Processor acts as a "processor". The Agreement sets out the instructions for processing (Sections 2, 5 and 6), the nature and purpose of processing (Section 2), the type of data (Section 3), the duration (Section 1), the duty of confidentiality (Section 6(3)), deletion and return (Section 10), the provision of the information necessary to demonstrate compliance and the enabling of assessments (Section 9), and the binding of sub-processors by written contract and the opportunity to object (Section 8).

(2) The Processor assists the Controller with notification obligations under the privacy and breach notification laws of the US states by notifying security incidents under Section 7 and providing the information required for notifications. It also provides the information that the Controller needs for "data protection assessments", insofar as they concern the service.

(3) The Processor does not sell personal data, does not process it for targeted advertising, does not make decisions that produce legal or similarly significant effects concerning consumers and does not carry out profiling for its own purposes within the meaning of those laws; preference estimates that the platform calculates on behalf of the Controller remain the Controller's processing.

Section 12 Liability

(1) Towards data subjects, the parties are liable under Article 82 GDPR; this liability is not limited by this Agreement or by the Terms of Service.

(2) As between the parties, the liability provisions of the Terms of Service apply to claims arising from or in connection with this Agreement, including recourse under Article 82(5) GDPR. Claims under the Standard Contractual Clauses under Section 11a remain unaffected.

(3) For sub-processors, the Processor is liable under Section 8(4).

Section 13 Conclusion and Miscellaneous Provisions

(1) Conclusion. This Agreement is concluded in electronic form (Article 28(9) GDPR) by the Customer accepting the Terms of Service including this Agreement upon registration or upon a later update. No signature is required. Individual agreements in an Order Form take precedence over this Agreement (Section 1 of the Terms of Service).

(2) Record of the version. The Provider records the accepted version of this Agreement and the time of acceptance and retains this record until three years after the end of the calendar year in which the Agreement ended.

(3) Amendments. Amendments and additions to this Agreement require text form. Section 17 of the Terms of Service applies to amendments by the Provider. The Annexes are updated under Section 6(4) (Technical and Organisational Measures), Section 8 (sub-processors) and Section 17 of the Terms of Service (Retention and Deletion Policy, Data Act Exit and Switching Policy); every change is documented with its date.

(4) Contract language. The language of the contract is German. The English version of this Agreement is provided for information; in the event of discrepancies, the German version prevails.

(5) Choice of law and place of jurisdiction. Section 20 of the Terms of Service applies. Section 11a(2) applies to the Standard Contractual Clauses.

(6) Severability clause. Should a provision of this Agreement be invalid, the remainder of the Agreement remains valid. The invalid provision is replaced by the statutory provision.

Annexes

The Annexes form part of this Agreement in their current version published at the respective address. Changes are announced under Section 8 of this Agreement (sub-processors) or Section 17 of the Terms of Service (Retention and Deletion Policy, Data Act Exit and Switching Policy); the Processor may adapt the Technical and Organisational Measures under Section 6(4) without reducing the level of protection.