Data Processing Agreement

This DPA supplements the accepted Workspace Contract between the professional Workspace customer and Brockhaus Ventures UG (haftungsbeschränkt), operating the NOCTRA Intelligence product. It applies only where NOCTRA processes personal data on behalf of the customer within the meaning of Article 28 GDPR.

The customer is the controller where it determines the purposes and means of the covered processing; NOCTRA is the processor only for the activities listed in Annex 1. Mixed payment, legal-compliance, public-site, security and independent business activities remain outside this customer-processing annex and follow their applicable role and legal basis.

NOCTRA processes covered customer personal data only on documented instructions, including the Order, this DPA, authorized Workspace configuration and documented support requests, unless Union or Member State law requires processing. Where legally permitted, NOCTRA will inform the customer of such a requirement before processing.

If NOCTRA considers an instruction to infringe applicable data-protection law, it will inform the customer and may pause the affected instruction while the issue is resolved.

The customer is responsible for the lawfulness of its instructions, the legal basis for customer-controlled processing, required information notices, controller-side decisions on data-subject requests, appropriate Workspace roles and permissions, and avoiding personal data that is unnecessary for the instructed purpose. The customer must use Campaign and contact functions lawfully and must not treat this DPA as a legal basis for outreach.

The NOCTRA Platform is not designed for routine processing of special categories of personal data under Article 9 GDPR unless the parties expressly agree the purpose, instructions and safeguards. The customer must avoid unnecessary sensitive information in free-text fields. If the customer intentionally instructs such processing, it is responsible for an applicable legal basis and required safeguards. This clause does not claim that the Platform technically blocks such entries.

NOCTRA ensures that persons authorized to process covered data are bound by confidentiality or an appropriate statutory duty. Taking account of the state of the art, implementation costs, scope and risk, NOCTRA maintains the repository-evidenced measures described in Annex 2 and reviews them as the service changes.

The customer grants NOCTRA general written authorization to use subprocessors for covered processing. NOCTRA will engage a subprocessor under a written agreement imposing the data-protection obligations required by Article 28 GDPR for the relevant processing and remains responsible for that subprocessor’s performance as required by applicable law. The canonical current disclosure is maintained on the public Subprocessors page.

Before adding or replacing a subprocessor for customer personal data, NOCTRA will provide notice through the applicable contract or billing contact or a designated Platform notice channel with enough advance time, where practicable, for the customer to object on objectively justified data-protection grounds relating to the proposed processing. The parties will first seek a reasonable solution where practicable. Urgent security, legal or provider circumstances may require shorter notice. This clause creates no automatic penalty or suspension remedy.

Taking account of the nature of processing, NOCTRA will assist the customer through appropriate technical and organizational measures, insofar as possible, with requests to exercise data-subject rights. NOCTRA will forward requests relating to customer-controlled data and will not respond on the customer’s behalf unless instructed or legally required.

Taking account of the information available and the nature of processing, NOCTRA will assist the customer with applicable security obligations, personal-data-breach assessment and notification, data-protection impact assessments and prior consultation. NOCTRA will notify the customer without undue delay after becoming aware of a personal-data breach affecting covered customer data and provide available relevant information in stages where necessary.

After Platform Contract termination, the customer may request return through an available export and/or deletion as applicable. NOCTRA deletes or returns covered customer personal data according to the customer’s documented instruction and deletes existing active copies unless applicable law requires storage. The timing follows the technically available process and the nature of the instructed data; no universal post-termination access period is promised.

Legally required financial, tax, refund, correction, security, contract, audit or dispute evidence may be retained outside active processing. Retained data is restricted to the applicable retention or legal purpose and must not become ordinary active product data. Each evidence category follows its applicable statutory role and retention obligation; no single period applies to every category.

Deletion from backup or provider-held copies follows the technically applicable deletion process; no universal backup-deletion period is promised. Data awaiting deletion remains protected and is not restored to ordinary active use except where necessary for recovery, security or legal obligations.

NOCTRA will first make available existing compliance and security documentation reasonably necessary to demonstrate the Article 28 processor obligations. If that evidence is insufficient, the customer may conduct an audit itself or through an independent auditor bound by confidentiality, generally no more than once in any 12-month period. This frequency limit does not apply after a relevant incident, on a competent authority’s request, or where there is credible evidence of a material breach.

Audits require reasonable advance notice, take place during normal business hours, remain proportionate in scope and must not provide access to other customers’ data or compromise security. The customer bears its own audit costs. Extraordinary, demonstrable NOCTRA costs caused by a customer audit may be allocated to the customer where legally permissible, unless the audit identifies a material breach by NOCTRA. Statutory supervisory and authority rights remain unaffected.

NOCTRA will not make covered customer data available in a third country except on documented instructions and with a transfer basis and safeguards required by applicable law. Provider entities, processing regions and transfer mechanisms are not asserted until verified in the public Subprocessors disclosure and the applicable provider contracts.

Liability under this DPA follows the liability framework in the effective Platform Contract and mandatory data-protection law. For covered processor obligations, the executed DPA prevails over conflicting Platform Terms; the Order prevails only where it expressly and lawfully modifies the relevant provision.