Data processing agreement

Parties

Agreement under Art. 28 GDPR between the QCRM customer as controller (“Customer”) and Medcycle UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany, as processor (“Provider”). This is a translation; the German version is binding.

§ 1 Conclusion and application

This agreement forms part of the QCRM terms of use and is concluded together with them; no separate signature is needed. It applies for as long as the Provider processes personal data on the Customer's behalf and takes precedence over the terms of use in matters of data protection. On request, the Provider supplies a version signed by it.

§ 2 Subject matter, nature, purpose and duration

The subject matter is the provision of QCRM including the integrated AI telephony service Omnesto: hosting, storage, backup, maintenance and support, and the features the Customer uses (e.g. mailbox connection, outreach, AI features, phone assistant). The Provider processes the data solely to provide these services. The duration is the term of the main contract plus the time until deletion under § 11.

§ 3 Types of data and data subjects

Types of data: master and contact data; communication data (e-mails, notes, call summaries and, if the Customer enables recording, call recordings and transcripts); contract, offer and property data; appointments, tasks and documents; usage and log data; and any other content the Customer enters.

Data subjects: the Customer's employees and users and its customers, prospects, contact persons, business partners and callers.

The Customer processes special categories of personal data (Art. 9 GDPR) only where it has a legal basis for doing so.

§ 4 Instructions

The Provider processes the data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it informs the Customer of that legal requirement beforehand unless the law prohibits this. Instructions are this agreement, the terms of use, the Customer's settings and actions in the application and individual instructions in text form. If the Provider considers an instruction unlawful, it informs the Customer without delay and may suspend its execution until confirmed.

§ 5 Confidentiality

The Provider only uses persons who are bound to confidentiality or subject to a statutory duty of secrecy. Only persons who need it for operation, maintenance or support have access to the Customer's data, and only to the extent required.

§ 6 Technical and organisational measures

The Provider takes the measures under Art. 32 GDPR described in the annex. It may develop them further as long as the level of protection does not fall.

§ 7 Sub-processors

The Customer authorises the following sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – data centres, hosting and backup – Germany (QCRM and backups) and Finland (Omnesto)
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – sending system e-mails – Germany
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, involving Google LLC, USA – Gemini API for AI features, only when a user starts them – EU and USA
• Telnyx LLC, Chicago, USA – telephony and phone numbers for Omnesto – USA
• Eleven Labs Inc., New York, USA – speech recognition, speech synthesis and AI conversation for Omnesto – USA
• OpenAI Ireland Ltd., Dublin, Ireland, involving OpenAI, L.L.C., USA – AI analysis of call transcripts for Omnesto – USA

Telnyx, ElevenLabs and OpenAI are used only if the Customer uses Omnesto's telephony features. Mail providers that the Customer connects itself are not sub-processors of the Provider.

The Provider informs the Customer in text form at least 30 days before adding or replacing a sub-processor. The Customer may object within that period for an important data protection reason; if the parties cannot agree, the Customer may terminate the contract with effect from the change. The Provider binds each sub-processor by contract to the obligations of this agreement and is liable for it under Art. 28(4) GDPR.

§ 8 Third countries

Processing outside the EU and the EEA takes place only where the conditions of Art. 44 et seq. GDPR are met, in particular on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

§ 9 Assistance to the Customer

The Provider assists the Customer with appropriate measures in fulfilling data subjects' rights (Chapter III GDPR) and the obligations under Art. 32 to 36 GDPR. The Customer can largely carry out access, rectification, export and erasure itself in the application. If a data subject contacts the Provider, it refers them to the Customer and informs the Customer without delay.

§ 10 Personal data breaches

The Provider notifies the Customer of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as available, and takes containment measures without delay.

§ 11 Deletion and return

During the term, the Customer can export and delete data in the application. After the contract ends, the CRM features are locked; the data initially remains stored. After 30 days the Provider reviews it and deletes the data after prior notice in text form with a reasonable period. At the Customer's request, it hands the data over beforehand in a common format or deletes it earlier. Database backups are deleted or overwritten no later than 30 days after they were made. Statutory retention obligations remain unaffected.

§ 12 Evidence and audits

The Provider makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR and allows for audits. These are primarily carried out through information and suitable evidence, such as data centre certificates. On-site audits must be announced at least 30 days in advance and carried out during business hours without disrupting operations and while preserving the confidentiality of other customers' data; the Customer bears its own costs.

§ 13 Liability and final provisions

Liability is governed by Art. 82 GDPR and otherwise by the liability rules of the terms of use. German law applies; the place of jurisdiction is Berlin. For customers in Switzerland, this agreement is also an agreement under Art. 9 FADP. The German version is binding.

Annex: Technical and organisational measures

• Physical access control: operation solely in data centres of Hetzner Online GmbH in Germany and Finland with access control, video surveillance and security staff; the data centres are certified to ISO/IEC 27001. The Provider has no server rooms of its own.
• System access control: administrative server access only with SSH keys and only for named persons; firewall; database and cache are not reachable from the internet. Users sign in with a personal password stored only as a hash; new users receive a one-time password that must be replaced at the first sign-in and expires after seven days.
• Data access control: strict separation of different customers' workspaces; roles and permissions within a workspace (including administrator, employee, read-only); access data to third-party systems is stored encrypted.
• Transfer control: transmission only encrypted (TLS); connections between QCRM and Omnesto with signed requests and keys stored encrypted.
• Input control: logging of sign-ins and security-relevant events; activity history on core records.
• Availability control: daily database backups to a separate backup server in Germany; an additional backup before every update, checked for readability; containers restart automatically.
• Separation control: tenant separation in the application; separate development and production environments.
• Review: regular updates of operating system and software; automated tests before every release; review of the measures on significant changes.