Data Processing Agreement (DPA)

§ 1 Parties and roles

(1) The controller is the customer operating a YOWO7 workspace. The processor is YOWO7 e.U., Kinderheimgasse 76, 2732 Willendorf, Austria, registered seat Willendorf, commercial register court Regional Court Wiener Neustadt (Landesgericht Wiener Neustadt), FN 689952k, DUNS 30-326-6010 (hereinafter “YOWO7”).

(2) Where YOWO7 processes personal data on behalf of the customer, YOWO7 acts as processor. For the website, accounts, billing, and YOWO7’s own support, YOWO7 acts as controller; that is covered by the Privacy Policy.

§ 2 Subject matter, duration and nature of processing

(1) The subject matter is the provision of the YOWO7 SaaS platform (including CRM, inbox, forms, support widget, chat, projects, files, calendar, sales, automation, AI connection, API), including hosting, storage, transmission, and supporting AI features under the customer’s instructions.

(2) The duration matches the contract term plus the periods required for deletion or return after contract end.

(3) Nature of processing: collection, storage, retrieval, transmission, deletion, and other processing required to operate the service.

§ 3 Categories of personal data and data subjects

(1) Depending on the customer’s use, data types may include contact details, communication content, form and ticket data, files, calendar data, usage and technical metadata, and customer-defined custom properties.

(2) Data subjects typically include the customer’s clients, prospects, employees, suppliers and other contacts, as well as end users of public forms and the support widget.

(3) YOWO7 does not actively collect special categories of personal data (Art. 9 GDPR). If the customer stores such data, the customer remains responsible for lawfulness and instructions.

§ 4 Obligations of YOWO7

• Process data only on documented instructions of the customer, unless required by law
• Ensure persons authorised to process data are bound to confidentiality
• Implement technical and organisational measures under Art. 32 GDPR (see § 6)
• Assist the customer with data-subject rights, security incidents and, where reasonable, data protection impact assessments
• Inform the customer if an instruction appears to infringe data protection law

§ 5 Instructions

(1) Instructions are given through platform features, documented APIs, and in text form to hello@yowo7.com. The customer confirms oral instructions in text form without undue delay.

(2) The customer ensures that instructions are lawful and that it has the necessary rights in the data.

§ 6 Technical and organisational measures (TOMs)

YOWO7 implements appropriate TOMs, including encryption in transit and at rest, EU hosting of core systems, access control, malware scanning on uploads, audit logs, and backups. An overview is available at https://www.yowo7.com/en/security. YOWO7 may evolve TOMs provided the level of protection is not reduced.

§ 7 Subprocessors

(1) The customer grants general authorisation to engage the subprocessors listed in the current subprocessor list (https://www.yowo7.com/en/subprocessors).

(2) YOWO7 binds subprocessors contractually to at least the data protection level of this DPA.

(3) YOWO7 informs the customer of any intended addition or replacement of a subprocessor at least 14 days before it takes effect, by email to the workspace owner and by updating the subprocessor list. The customer may object to the change in text form within that period on important data-protection grounds. If the customer does not object in time, the change is deemed approved.

(4) In the event of a timely objection, YOWO7 will seek a reasonable remedy, for example by not using the subprocessor for the customer's data or by restricting the affected service. If no reasonable remedy is possible, either party may terminate the contract with respect to the affected service or in its entirety effective as of the date the change takes effect; fees paid in advance are refunded pro rata.

(5) Where a change is required at short notice for urgent reasons of security or availability or because a provider ceases unexpectedly, notice may exceptionally be given without undue delay after the change; the right to object under paragraphs 3 and 4 remains unaffected.

§ 8 International transfers

Storage and the backend (application, database, files, platform email, AI) are operated in the EU on Amazon Web Services in Frankfurt (eu-central-1). Server functions of the web frontends run at Vercel Inc. in the Frankfurt region (fra1). Static content is delivered via Vercel’s global CDN from the nearest edge location, so requests can be processed at locations outside the EU; for Vercel, the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) apply. Where auxiliary services transfer data to third countries, in particular the United States, this occurs only with appropriate safeguards (EU-US Data Privacy Framework and/or EU Standard Contractual Clauses). The mapping per provider is in the subprocessor list.

§ 9 Assistance with data-subject rights and DPIAs

(1) YOWO7 assists the customer with appropriate technical and organisational measures to respond to data-subject requests relating to data processed on the customer’s behalf. Requests received directly by YOWO7 that clearly concern the customer will be forwarded without undue delay.

(2) YOWO7 assists the customer with data protection impact assessments and supervisory consultations to the extent necessary and reasonable.

§ 10 Personal data breach notification

YOWO7 notifies the customer of a personal data breach without undue delay after becoming aware of it and provides available information needed for notifications to authorities and data subjects.

§ 11 Deletion and return

(1) After processing ends, YOWO7 deletes customer data or returns it at the customer’s choice, unless retention is required by law.

(2) After the contract ends, the customer may still export its data for 30 days (export period). If the workspace is no longer accessible, the customer contacts hello@yowo7.com for this purpose. Data is returned in a common, machine-readable format.

(3) After the export period ends, YOWO7 permanently deletes the customer data in the production systems within 14 days.

(4) Copies in backups (database backups including point-in-time recovery, and previous file versions) are automatically and permanently removed no later than 30 days after the data has been deleted from the production systems. Until then they are encrypted, access-restricted and used only for restoration.

(5) On request, YOWO7 confirms the deletion in text form.

(6) Data that YOWO7 processes as controller (in particular invoice and contract data) is subject to statutory retention periods; the Privacy Policy applies to it.

§ 12 Evidence and audit

On request YOWO7 provides suitable evidence (e.g. TOM descriptions, subprocessor information). Audits are primarily remote based on documented information. On-site audits are possible for legitimate cause after reasonable notice, during business hours and without disrupting operations; costs are borne by the customer unless a material deficiency is found.

§ 13 Confidentiality

YOWO7 treats customer data as confidential and does not use it for its own purposes outside instructed processing and the contracted platform features.

§ 14 Liability

Liability is governed by the Terms of Service to the extent permitted by law and by mandatory GDPR provisions.

§ 15 Final provisions

(1) Austrian law applies, excluding the UN Convention on Contracts for the International Sale of Goods, unless mandatory data protection law provides otherwise.

(2) If any provision is invalid, the remaining provisions remain in effect.

(3) In case of conflict between this DPA and the Terms of Service, the data-protection provisions of this DPA prevail.

(4) This DPA is available in German and English. In case of discrepancies between the versions, the German version prevails.