Provisions for the Processing of Personal Data on Behalf of a Controller Pursuant to Art. 28 DS-GVO

The following provisions shall apply in the event that Neo Commerce GmbH, Baierbrunner Str. 15, 81379 Munich, Germany (hereinafter “Contractor”) is commissioned by the Client to provide services in the area of AI-based product advice and product search for the Client’s online shop, in particular Shop Agent, Shopping Quiz and product configurators, as Software-as-a-Service (SaaS) on the basis of the user agreement for cloud software (the Contractor’s General Terms and Conditions), hereinafter “Main Agreement”.

Part of the performance of the Main Contract is the processing of personal data within the meaning of the General Data Protection Regulation (“GDPR”). In order to meet the requirements of the DS-GVO for such constellations, the following provisions shall apply and conclusively regulate the processing of personal data by the Contractor on behalf of the Customer.

1. Subject matter/scope of the order processing

1.1 The cooperation of the Parties in accordance with the Main Agreement entails that the Contractor obtains access to personal data of the Client (hereinafter “Client Data”) and processes such data exclusively on behalf of and in accordance with the instructions of the Client within the meaning of Art. 4 No. 8 and Art. 28 DS-GVO.

1.2 The processing of the Client Data by the Contractor shall be carried out exclusively in the manner specified in Appendix 1 and to the extent and for the purpose specified therein. The group of persons affected by the data processing is shown in Appendix 2 to this contract. The duration of the processing corresponds to the term of the main contract.

2. The client’s authority to issue directives

2.1 The Contractor shall process the Client Data only within the scope of the commission and exclusively on behalf of and in accordance with the instructions of the Client within the meaning of Art. 28 of the German Data Protection Regulation (Order Processing). In this respect, the Client shall have the sole right to issue instructions on the type, scope and method of the processing activities (hereinafter also referred to as “right to issue instructions”).

2.2 Instructions shall generally be issued by the Client in writing; instructions issued verbally shall be confirmed by the Client in writing. The persons authorized to give and receive instructions shall be determined upon request. In the event of a change or long-term prevention of the persons authorized to receive instructions, the successor or representative shall be named to the other party in text form without delay. The Client shall notify the Contractor of a change in the person authorized to issue instructions in good time. Until receipt of such notification by the Contractor, the designated persons shall continue to be deemed authorized to receive.

2.3 If the Contractor is of the opinion that an instruction of the Customer violates data protection provisions, it shall notify the Customer thereof. The Contractor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Customer.

3. Protective measures of the contractor

3.1 The Contractor is obliged to observe the statutory provisions on data protection and not to disclose information obtained from the Client’s domain to third parties or expose it to access by third parties. Documents and data shall be secured against disclosure to unauthorized persons, taking into account the state of the art.

3.2 Furthermore, the Contractor shall oblige all persons entrusted by it with the processing and fulfillment of this Agreement (hereinafter referred to as “Employees”) to maintain confidentiality in writing (confidentiality obligation, Art. 28(3)(b) DS-GVO) and shall ensure compliance with this obligation with due care.

3.3 The Contractor shall design its internal organization in such a way that it meets the special requirements of data protection. He undertakes to take all appropriate technical and organizational measures for the adequate protection of the Client Data pursuant to Art. 32 DS-GVO and to maintain these measures for the duration of the processing of the Client Data.

3.4 The Contractor reserves the right to change the technical and organizational measures taken, while ensuring that the level of protection required by Art. 32 GDPR is not undercut.

3.5 At the request of the Customer, the Contractor shall provide the Customer with suitable evidence of compliance with technical and organizational measures.

4. Information and support obligations of the contractor

4.1 In the event of significant disruptions, suspected material data protection breaches, or security-relevant incidents in the processing of the Client’s data by the Processor, by persons engaged by the Processor in connection with this agreement, or by third parties, the Processor shall notify the Client without undue delay upon becoming aware thereof, in written or electronic form. The same applies to audits of the Processor by the data protection supervisory authority. Notifications pursuant to Section 4.1 sentence 1 shall contain at minimum the information specified in Art. 33 para. 3 GDPR.

4.2 In the event of Section 4.1, the Contractor shall support the Client in the fulfillment of its clarification, remedial and information measures in this regard to the extent reasonable. In particular, the Contractor shall immediately implement the necessary measures to secure the data and to mitigate any possible adverse consequences for the data subjects, inform the Customer thereof and request the Client to issue further instructions.

4.3 The Contractor undertakes to provide the Client, upon the latter’s written request and within a reasonable period of time, with such information and evidence as may be required to carry out an inspection pursuant to Section 7.1 of this Agreement.

5. Other obligations of the contractor

5.1 The Contractor confirms that it has appointed a contact person for data protection. The contact details of the contact person for data protection are Sebastian Slomski, [email protected]. The Client shall be notified in writing of any change in the person of the contact person for data protection.

6. Subcontractor relationships

6.1 Subcontracting relationships within the meaning of this provision shall be understood to be those services which relate directly to the provision of the main service. This does not include ancillary services which the Contractor uses, for example, as telecommunications services, postal/transport services, maintenance and user service or the disposal of data carriers and other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, the Contractor shall be obligated to enter into appropriate and legally compliant contractual agreements as well as control measures to ensure data protection and data security of the Client’s data also in the case of outsourced ancillary services.

6.2 The Client agrees to the engagement of the following subcontractors under the condition of a contractual agreement in accordance with Art. 28 Para. 2-4 DS-GVO: https://docs.google.com/document/d/1oONs07og0OORo4MBYb5DGZZaMJAEBfMPxAmIxuH1B5o/

6.3 The Processor is entitled to engage additional sub-processors or to replace existing ones. The Processor shall notify the Client thereof in text form at least two weeks before the engagement. The Client may object for good cause until the planned engagement. If the Client does not raise an objection by then, consent to the change shall be deemed granted. In the event of a justified objection, the Processor shall be entitled to terminate the contractual relationship with four weeks’ notice to the end of a calendar month, provided that performance of the contractually agreed services without the use of the relevant sub-processor is unreasonable for the Processor. The Processor shall carefully select sub-processors based on their suitability and reliability. When engaging sub-processors, the Processor shall bind them to the provisions of this agreement and ensure that the Client may exercise its rights under this agreement — in particular its audit and inspection rights — directly against the sub-processors as well. Where sub-processors are to be engaged in a third country, the Processor shall ensure that an adequate level of data protection is guaranteed at the respective sub-processor (e.g. by entering into an agreement based on the EU Standard Contractual Clauses). Upon request, the Processor shall provide the Client with evidence that the aforementioned agreements with its sub-processors have been concluded.

7. Control rights

7.1 The Client shall be entitled to regularly assure itself of compliance with the provisions of this Agreement. For this purpose, it may, for example, obtain information from the Contractor, have existing test certificates from experts, certifications or internal audits presented to it or have the Contractor’s technical and organizational measures inspected personally or by an expert third party during normal business hours and after at least one week’s advance notice in consultation with the Contractor, provided that the third party is not in a competitive relationship with the Contractor.

7.2 The Client shall carry out inspections without cause no more than once a year and only to the extent necessary and shall take reasonable account of the Contractor’s operating procedures. The parties shall agree on the time and type of inspection in good time.

7.3 The Client shall document the inspection result and notify the Contractor thereof. In the event of errors or irregularities discovered by the Client, in particular during the inspection of order results, the Client shall inform the Contractor without delay. If facts are found during the inspection, the future avoidance of which requires changes to the ordered procedure, the Client shall inform the Contractor of the necessary procedural changes without delay.

8. Rights of affected persons

8.1 The Contractor shall support the Client as far as possible with suitable technical and organizational measures in fulfilling the Client’s obligations pursuant to Articles 12 to 22 and Articles 32 to 36 of the GDPR. The Contractor shall provide the Client with the requested information on Client Data without undue delay, but no later than within five (5) business days, unless the Client has the relevant information itself.

8.2 If the data subject asserts its rights pursuant to Articles 16 to 18 of the GDPR, the Contractor shall be obligated to correct, delete or restrict the Client Data without undue delay, at the latest within a period of fourteen (14) working days, upon instruction of the Client. The Contractor shall provide the Client with written evidence of the deletion, correction or restriction of the data upon request.

8.3 If a data subject asserts rights, such as the right to information, correction or deletion with regard to his data, directly against the Contractor, the Contractor shall forward this request to the Client without undue delay, but no later than within three (3) business days and shall await the Client’s instructions.

9. Term and termination

9.1 The term of this agreement corresponds to the term of the main agreement. If the main contract can be terminated by ordinary notice, the provisions on ordinary notice of termination shall apply accordingly. In case of doubt, a termination of the main contract shall also be deemed a termination of this contract and a termination of this contract shall be deemed a termination of the main contract.

9.2 The Client shall be entitled to extraordinary termination of this contract for good cause at any time. Good cause shall be deemed to exist if the Contractor fails to comply with its material contractual obligations, violates provisions of the GDPR with intent or gross negligence or is unable or unwilling to carry out an instruction of the Client. In the case of simple - i.e. neither intentional nor grossly negligent - violations, the Client shall first set the Contractor a reasonable deadline of at least fifteen (15) business days within which the Contractor can remedy the violation. After fruitless expiry of this period, the Client shall then be entitled to extraordinary termination.

10. Deletion and return after the end of the contract

10.1 After termination of the main contract at any time upon the Client’s written request, all documents, data and data carriers provided to the Contractor shall be returned to the Client or, upon the Client’s written request, deleted completely and irrevocably by the Contractor, unless a statutory retention period exists. This shall also apply to copies of the Client Data at the Contractor’s premises, such as data backups, but not to documentation that serves as evidence of the proper processing of the Client Data in accordance with the order. The Contractor shall confirm the deletion to the Client in writing.

11. Liability

11.1 The liability of the parties is governed by the main contract.

12. Final provisions

12.1 Amendments and supplements to this agreement must be made in writing. This shall also apply to any waiver of this formal requirement.

12.2 In case of doubt, the provisions of this agreement shall take precedence over the provisions of the main contract. Should individual provisions of this agreement prove to be invalid or unenforceable in whole or in part, or become invalid or unenforceable as a result of changes in legislation after conclusion of the agreement, this shall not affect the validity of the remaining provisions. The invalid or unenforceable provision shall be replaced by the valid and enforceable provision that comes as close as possible to the meaning and purpose of the invalid provision.

12.3 This agreement is subject to German law. The exclusive place of jurisdiction is Munich.

Attachments

• Appendix 1 - Specification of type, scope and purpose of data processing

• Appendix 2 - Description of the types of data and the categories of data subjects

Appendix 1 - Specification of type, scope and purpose of data processing

A. Data processing in relation to the Client

1. The Client receives personal access to the Contractor’s admin portal.

2. The Contractor creates a user profile for this purpose (types of data see Appendix 2).

3. Purpose: login, configuration of the services and support.

B. Data processing in relation to customers of the Client

B.1 General

1. The Contractor provides software that is integrated into the Client’s online shop. It enables website visitors to find products and get advice.

2. Depending on the Main Agreement, the Client uses one or more of these services: Shop Agent (B.2), Shopping Quiz (B.3), product configurator (B.4).

3. All services process technical data and pseudonymous identifiers (see Appendix 2). When integrating the services, the Client can specify that there is no consent to cookies (cookie consent). In this case, no user ID is stored in the browser. Personalisation and conversion tracking across several sessions are then not possible.

B.2 Shop Agent (AI-based shopping assistant)

1. Language models: Users ask questions as free text. The free text and the previous conversation are transmitted to language models (LLM) to generate the answer. The service providers used are listed under Section 6.2.

2. No model training: It is contractually ensured that third-party providers do not use the transmitted data to train their models.

3. No active request: The Shop Agent does not ask for personal data. If a user enters such data voluntarily, it is processed as part of the free text.

4. Personalisation: To improve the answers, earlier inputs of the same user can be taken into account, e.g. from the Shopping Quiz or earlier conversations. This requires a user ID (see B.1 No. 3).

5. Conversation histories: Conversation histories are stored to continue conversations, to provide the Client with analyses and to improve the quality of the answers for the Client. When integrating the services, the Client can specify that there is no consent to storage (chat consent). In this case, no chat messages are stored.

6. Retention period: The Client determines the retention period of the conversation histories. If no period is set, they are stored for the term of the Main Agreement and then deleted in accordance with Section 10.

7. Analytics, logs and backups: Pseudonymised usage events are recorded to measure usage and conversion. Debug logs and tracing data (technical metadata) are recorded for error analysis. Encrypted backups are created to ensure availability.

B.3 Shopping Quiz (guided product advice)

1. On request, users can have the results sent to them by email. To do so, they enter their email address in a form and agree to the Client’s privacy policy.

2. With the user’s consent, the Client may use the email address for its own marketing purposes.

3. Quiz answers and technical data are processed to provide the Client with analyses and performance data.

B.4 Product configurator

1. The user configures a product step by step, e.g. a kitchen. The user’s selections and technical data are processed.

2. The finished configuration is passed to the Client’s shop as a bill of materials (BOM). The Contractor does not store or send configurations.

Appendix 2 - Description of the types of data and the categories of data subjects

The categories of data subjects affected by the processing include:

• Website visitors and customers of the Client

• Employees of the Client (users of the admin portal)

The subject of the processing of personal data are the following types/categories of data:

• Technical data: Browser information (e.g. browser type, language), IP address (stored only in logs and deleted after 90 days), pseudonymous identifiers for session, conversation and user (stored on the Client’s domain). Applies to all services.

• Conversation histories: Free-text inputs of users and answers of the Shop Agent. Applies to the Shop Agent.

• Quiz and configurator inputs: Selected answers and options, product recommendation or bill of materials (BOM). Applies to the Shopping Quiz and the product configurator.

• Contact data: Email address, only if the user has results sent to them. Applies to the Shopping Quiz.

• Analytics events: Pseudonymised usage events. Applies to all services.

• Logs and tracing: Debug logs and tracing data (technical metadata incl. IP address, deleted after 90 days). Applies to all services.

• User data of the Client: Email address, password, first and last name, company and company address of the admin user. Applies to the admin portal.