Data Processing Agreement pursuant to Article 28 GDPR

between

the Contracting Party of User Flow as recorded in the user account
– hereinafter the "Controller" –

and

User Flow LT UG (haftungsbeschränkt)
Alt-Möllner-Straße 37–42, Gebäude B
23879 Mölln, Germany
Register court: Amtsgericht Lübeck, HRB 27853 HL
– hereinafter the "Processor" or "User Flow" –

– together the "Parties" –

§ 1Subject matter and conclusion

1.1 This Agreement sets out in detail the data protection obligations of the Parties in connection with the user agreement for the User Flow platform concluded between them (hereinafter the "Main Agreement") and the General Terms and Conditions applicable to it.

1.2 This Agreement is concluded at the same time as the Main Agreement. The Controller expressly consents to it during registration. A separate request is not required.

1.3 It applies to all processing of personal data carried out by User Flow on behalf of the Controller under the Main Agreement.

1.4 Where User Flow processes personal data as controller in its own right — in particular master, contract, billing and access data of the Controller as well as technical log and security data for the operation of the Platform — this Agreement does not apply. The Privacy Policy of User Flow applies to such processing.

1.5 In the event of contradictions between this Agreement and the Main Agreement, this Agreement shall take precedence in matters of data protection.

§ 2Subject matter, duration, nature and purpose of processing

2.1 Subject matter. The subject matter of the processing is the provision of the cloud-based software platform User Flow, including the modules booked by the Controller.

2.2 Duration. Processing begins upon conclusion of the Main Agreement and ends upon its termination and the subsequent erasure or return of data pursuant to § 11.

2.3 Nature and purpose. Processing comprises in particular:

• the collection, storage, organisation, structuring, retrieval, use, transmission, synchronisation, restriction and erasure of personal data,
• the management of user accounts, roles and permissions,
• the connection and embedded display of accounts of supported third-party platforms,
• the provision of CRM functions,
• the display, synchronisation and organisation of communication processes,
• the provision of analysis, reporting and statistics functions,
• the recording and evaluation of active usage times and processing operations,
• the planning and organisation of work assignments,
• the determination of business performance indicators,
• the management, storage and transfer of digital content,
• the publication of content on supported third-party platforms,
• the execution of the automation functions configured by the Controller,
• the automated translation of communication content, where activated by the Controller,
• and the technical operations required for provision, security and error remediation.

The purpose is exclusively the performance of the services agreed in the Main Agreement. No processing for User Flow's own purposes takes place.

2.4 Place of processing. Processing takes place in the Federal Republic of Germany. Processing by sub-processors outside Germany and transfers to third countries are set out in Annex 2; § 10 applies.

§ 3Categories of data subjects and types of data

3.1 Categories of data subjects

• users of supported third-party platforms with whom the Controller communicates or interacts (Fans),
• Creators whose accounts are managed within the Platform,
• users invited by the Controller, in particular Chatters,
• other persons whose data the Controller enters into the Platform,
• persons depicted in uploaded or transferred media.

3.2 Categories of personal data

• master data: aliases, nicknames, usernames, user identifiers, platform identifiers, Creator attributions,
• contact data of Invited Users: email address, display name,
• CRM data: list memberships, tags, internal notes, status information, categorisations, reminders, markings, priorities,
• communication content: text and image messages, other media content, message histories,
• communication metadata: times, status information, identifiers involved, processing users,
• subscription and contract information of data subjects,
• revenue and transaction information of data subjects,
• activity and interaction data,
• activity and time-tracking data of Invited Users,
• assignment and shift planning data,
• role and permission information,
• media content uploaded or transferred by the Controller,
• templates, scripts and trigger criteria stored by the Controller, including information required for this purpose such as dates of birth,
• technical connection, session and log data,
• and other information entered by the Controller.

3.3 Special categories of personal data. The Parties agree that communication content and uploaded media may contain special categories of personal data within the meaning of Article 9 (1) GDPR, in particular information about sex life or sexual orientation.

The Controller shall ensure that, in addition to a legal basis under Article 6 GDPR, an applicable exception under Article 9 (2) GDPR exists for such processing.

With regard to this data, User Flow applies the protective measures described in Annex 1 and processes it exclusively to perform the services owed under the contract.

§ 4Rights and obligations of the Controller

4.1 The Controller is solely responsible for the lawfulness of the processing and for safeguarding the rights of data subjects (Article 24 GDPR).

4.2 The Controller is in particular responsible for:

• determining the purposes and essential means of the processing,
• the existence of a sound legal basis, including an exception under Article 9 (2) GDPR where special categories are processed,
• fulfilling the information obligations under Articles 13 and 14 GDPR towards data subjects,
• the permissibility of the selection criteria, content and methods of contact it uses, in particular when using the automation functions,
• compliance with employee data protection requirements, in particular section 26 of the German Federal Data Protection Act (BDSG) and existing co-determination rights, where it uses activity-related evaluations of persons working for it,
• granting, reviewing and withdrawing permissions within its organisation,
• and assessing whether a data protection impact assessment under Article 35 GDPR is required for its processing operations.

4.3 The Controller shall inform User Flow without undue delay where it identifies errors or irregularities in the processing.

4.4 Persons authorised to issue instructions on behalf of the Controller are those persons set up by it in the user account as having administration rights.

§ 5Instructions

5.1 User Flow processes personal data exclusively on documented instructions from the Controller, unless User Flow is required to process by Union or Member State law. In such a case, User Flow shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.2 The following constitute documented instructions:

• this Agreement and the Main Agreement including the General Terms and Conditions,
• the settings, configurations and permission assignments made by the Controller within the Platform,
• the modules and functions activated by the Controller,
• and individual instructions in text form.

5.3 Individual instructions shall be addressed to info@user-flow.de. User Flow documents the instructions issued.

5.4 Where User Flow considers that an instruction infringes data protection provisions, User Flow shall inform the Controller without undue delay. User Flow is entitled to suspend the execution of the instruction concerned until it has been confirmed or amended.

5.5 User Flow may make the execution of instructions that go beyond the scope of services agreed in the Main Agreement, or whose implementation causes significant additional effort, conditional upon separate remuneration.

§ 6Obligations of User Flow

6.1 User Flow processes personal data exclusively within the scope of this Agreement and the Controller's instructions.

6.2 User Flow implements the technical and organisational measures described in § 7 and Annex 1 pursuant to Article 32 GDPR.

6.3 User Flow supports the Controller, to the extent reasonable, in fulfilling its obligations under Articles 32 to 36 GDPR, in particular:

• in relation to the security of processing,
• in notifying personal data breaches to the supervisory authority (Article 33 GDPR),
• in communicating personal data breaches to data subjects (Article 34 GDPR),
• in carrying out a data protection impact assessment (Article 35 GDPR),
• and in prior consultation with the supervisory authority (Article 36 GDPR).

6.4 User Flow makes available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR.

6.5 User Flow maintains a record of all categories of processing activities carried out on behalf of the Controller pursuant to Article 30 (2) GDPR.

6.6 User Flow does not process personal data for its own purposes. In particular, no evaluation of communication content takes place for the purpose of creating personality, behavioural or marketing profiles, no consolidation across several controllers takes place, and no use for training AI models takes place.

6.7 User Flow designates the following contact point for data protection matters: info@user-flow.de.

A data protection officer has not currently been appointed; whether an obligation to appoint one exists is being assessed. User Flow will inform the Controller of any appointment and publish the contact details in its Privacy Policy.

§ 7Confidentiality

7.1 User Flow engages only persons who are bound to confidentiality or who are under an appropriate statutory obligation of confidentiality for the processing.

7.2 The confidentiality obligation is entered into in text form before the commencement of the activity and continues to apply after the activity has ended.

7.3 User Flow ensures that the persons authorised to process are familiar with the relevant data protection requirements and process personal data exclusively on the instructions of User Flow.

§ 8Technical and organisational measures

8.1 User Flow implements the technical and organisational measures described in Annex 1 pursuant to Article 32 GDPR.

8.2 The measures are subject to technical progress. User Flow is entitled to adapt or replace them provided that the agreed level of protection is not reduced.

8.3 User Flow documents material changes and makes them available to the Controller upon request.

§ 9Sub-processors

9.1 General authorisation. The Controller grants User Flow general written authorisation to engage sub-processors pursuant to Article 28 (2) sentence 2 GDPR.

9.2 Existing sub-processors. The sub-processors engaged at the time the contract is concluded are set out in Annex 2. The current overview is available at https://user-flow.de/subprozessoren.html. The Controller authorises their engagement upon conclusion of this Agreement.

9.3 Changes. User Flow shall inform the Controller of the intended addition of a new sub-processor or the replacement of an existing one at least four weeks before processing begins, in text form or via the functions provided within the Platform.

9.4 Right to object. The Controller may object to the change in text form within four weeks of receipt of the information, on important data protection grounds.

In the event of an objection, the Parties shall endeavour to reach an amicable solution. Where no such solution is reached and User Flow cannot reasonably provide the service concerned without the sub-processor, either Party is entitled to terminate the Main Agreement with respect to the service concerned with one month's notice. Fees already paid in advance shall be refunded on a pro rata basis.

Where no objection is raised within the period, the change is deemed authorised. User Flow shall draw attention to the period and this legal consequence in the information provided under § 9.3.

9.5 Urgent cases. Where the engagement of a sub-processor at short notice is necessary to avert an immediate risk to the availability or security of the Platform, User Flow may engage that sub-processor in advance and inform the Controller without undue delay thereafter. The right to object under § 9.4 remains unaffected.

9.6 Obligations towards sub-processors. User Flow contractually imposes on each sub-processor data protection obligations substantially equivalent to those set out in this Agreement. Where a sub-processor fails to fulfil its obligations, User Flow remains liable to the Controller for the performance of those obligations.

9.7 No sub-processing. Services that User Flow obtains as ancillary services, such as telecommunications services, postal and transport services, maintenance or the disposal of data media, do not constitute sub-processing within the meaning of this Agreement. User Flow also takes appropriate protective measures in this respect.

9.8 Supported third-party platforms. The operators of supported third-party platforms are not sub-processors of User Flow. They process personal data as controllers in their own right. The connection is established exclusively at the instigation of the Controller; the Controller is responsible for the lawfulness of the associated transfers.

§ 10Transfers to third countries

10.1 Personal data is transferred to a third country only where the requirements of Articles 44 et seq. GDPR are met.

10.2 Where a sub-processor processes personal data outside the European Union or the European Economic Area, User Flow ensures that appropriate safeguards are in place, in particular an adequacy decision pursuant to Article 45 GDPR or standard contractual clauses pursuant to Article 46 (2) (c) GDPR.

10.3 Annex 2 sets out, for each sub-processor, the place of processing and, where a third-country transfer is involved, the applicable safeguard.

10.4 Translation function. The Controller acknowledges that the use of the translation function entails a transfer of the content to be translated to a third country and that such content may contain personal data including special categories within the meaning of Article 9 GDPR.

The function is optional. The Controller decides on its own responsibility whether to use it and may leave it deactivated without this affecting the use of the remaining functions.

10.5 Access from third countries by the Controller. Where the Controller engages persons outside the European Union or the European Economic Area and these persons access personal data via the Platform, this constitutes a transfer to a third country for which the Controller is responsible. User Flow merely provides the technical infrastructure in this respect.

§ 11Erasure and return

11.1 After the end of the processing, User Flow shall erase the personal data processed on behalf of the Controller or return it at the Controller's choice.

11.2 The Controller may retrieve the data within a period of 30 calendar days after the termination takes effect, using the export functions provided for this purpose. At the Controller's request, this period shall be extended by a further 30 calendar days.

11.3 After expiry of this period, the personal data processed on behalf of the Controller shall be erased or anonymised, unless a statutory retention obligation precludes this.

By way of derogation, data whose archiving the Controller has initiated by continuing its user account or by separate instruction shall be erased or anonymised in accordance with the Privacy Policy at the latest 24 months after the end of the contract.

11.4 User Flow may retain documentation serving as evidence of proper data processing beyond the end of the contract in accordance with the applicable retention periods.

11.5 Backups. Following erasure in the productive systems, personal data may still be contained in existing backups. Backups are automatically overwritten or deleted after one week. During this period, the data is not used for the active provision of services.

11.6 User Flow confirms erasure in text form upon request.

§ 12Support with data subject rights

12.1 Where a data subject contacts User Flow directly to exercise rights under Articles 15 to 22 GDPR, User Flow shall forward the request to the Controller without undue delay or process it in coordination with the Controller.

12.2 User Flow supports the Controller with appropriate technical and organisational measures in fulfilling data subject requests, in particular through the search, export, rectification, restriction and erasure functions provided within the Platform.

12.3 User Flow does not decide on data subject requests independently, unless a statutory obligation to do so exists.

12.4 Where User Flow incurs effort for such support that goes beyond the provision of the regular Platform functions, User Flow may charge reasonable remuneration for it, unless the effort is attributable to fault on the part of User Flow.

§ 13Personal data breaches

13.1 User Flow shall inform the Controller without undue delay after becoming aware of a personal data breach affecting data processed on behalf of the Controller.

13.2 The notification shall contain, where available:

• a description of the nature of the breach,
• the categories and approximate number of data subjects and records concerned,
• the likely consequences,
• the measures taken or proposed,
• and a contact point for further enquiries.

13.3 Where not all information is immediately available, User Flow shall provide it without undue further delay.

13.4 User Flow shall take without undue delay the measures necessary to secure the data and to mitigate adverse effects, and shall support the Controller in fulfilling its notification and communication obligations under Articles 33 and 34 GDPR.

13.5 User Flow does not make notifications to supervisory authorities or to data subjects on behalf of the Controller independently, unless a statutory obligation to do so exists.

§ 14Evidence and audits

14.1 User Flow demonstrates compliance with the obligations under this Agreement in an appropriate manner upon request, in particular by means of:

• current self-assessments and the documentation of the technical and organisational measures set out in Annex 1,
• certificates, attestations or audit reports of the sub-processors engaged,
• or comparable evidence.

14.2 Where such evidence is insufficient in an individual case, the Controller may request a more extensive audit. The following applies:

• The audit requires a specific cause.
• It must be announced in text form with four weeks' notice.
• It shall take place during normal business hours and without disrupting operations.
• It is limited to once per year, unless there is a specific cause, in particular a personal data breach or an order of the supervisory authority.
• The Controller may appoint an auditor bound to confidentiality who is not in competition with User Flow.
• The costs of the audit shall be borne by the Controller, unless the audit reveals a breach for which User Flow is responsible.

14.3 Supervisory authority powers under Article 58 GDPR remain unaffected.

14.4 User Flow is entitled to withhold information whose disclosure would compromise the security of the Platform, trade secrets or the rights of third parties, in particular other customers.

§ 15Liability

15.1 Article 82 GDPR applies to the liability of the Parties.

15.2 In their internal relationship, the liability provisions of the Main Agreement apply additionally, insofar as Article 82 GDPR does not preclude this.

15.3 The Controller shall indemnify User Flow against third-party claims based on the Controller's failure to comply with its obligations under § 4, insofar as the Controller is responsible for such failure.

§ 16Final provisions

16.1 Term. This Agreement applies for the duration of the Main Agreement. The obligations under § 7, § 11 and § 15 continue to apply beyond the end of the contract.

16.2 Amendments. Amendments to this Agreement require text form. For adjustments that become necessary due to changed statutory or supervisory requirements, the procedure set out in § 22 of the General Terms and Conditions applies accordingly.

16.3 Annexes. Annexes 1 and 2 form part of this Agreement.

16.4 Applicable law and place of jurisdiction. The law of the Federal Republic of Germany applies. § 1.7 of the General Terms and Conditions applies to the place of jurisdiction.

16.5 Severability. Should individual provisions be or become invalid, the validity of the remaining provisions shall remain unaffected.

Annex 1 — Technical and organisational measures (Article 32 GDPR)

Last updated: 10/2026

The measures below describe the status implemented at the time the contract is concluded.

1.Confidentiality (Article 32 (1) (b) GDPR)

1.1 Physical access control

• The application, database and storage infrastructure is operated exclusively in data centres in Germany. Physical access protection is ensured by the respective data centre operator; corresponding evidence is available.
• User Flow's workplaces are located in lockable business premises to which only authorised persons have access.
• Where activities are carried out outside the business premises, this takes place exclusively via secured access and in accordance with documented requirements; third-party access to devices and documents must be excluded.
• Personal data is not stored on local devices as a matter of course.

1.2 System access control

• Access to all systems takes place exclusively via personal, non-shared user accounts.
• Two-factor authentication is in place for all administrative accounts of User Flow.
• Two-factor authentication is available for customers' user accounts.
• Minimum password complexity requirements are enforced during registration.
• Passwords are stored exclusively in hashed form; recovery in plain text is not possible.
• Automatic logout takes place after a defined period without user activity.
• Automated access and abusive login attempts are prevented by a bot detection procedure.
• When a person leaves, all access rights are withdrawn without undue delay; withdrawal is governed by a documented procedure.

1.3 Data access control

• Access to personal data takes place exclusively via a role-based permission system applying the principle of least privilege.
• The Controller grants, changes and withdraws permissions within its organisation independently.
• The group of persons at User Flow with access to productive customer data is limited to those expressly authorised and is reviewed regularly.
• Administrator access to user accounts takes place exclusively on a specific occasion and is logged, including the time, the person accessing and the account concerned.
• No unprompted access to user accounts takes place.

1.4 Separation control

• The data of different controllers is processed in logically separated form. Access to data of another controller is technically excluded.
• Development and test environments are separated from the productive environment.
• No productive customer data is used in development or test environments.

1.5 Pseudonymisation and encryption

• All data transmissions between devices and the systems of User Flow are transport-encrypted (TLS).
• The database is additionally stored encrypted at rest.
• Access credentials for accounts of supported third-party platforms are stored exclusively in encrypted form and processed server-side.
• Backups are stored in encrypted form.

2.Integrity (Article 32 (1) (b) GDPR)

2.1 Transfer control

• Personal data is transmitted exclusively in encrypted form.
• Transfers to supported third-party platforms take place exclusively at the instigation and in accordance with the configuration of the Controller.
• Transfers to sub-processors take place only to the extent necessary and on the basis of a contract pursuant to Article 28 GDPR.
• No transport of physical data media takes place.

2.2 Input control

• Security-relevant operations are logged.
• Within the Platform, it is traceable which user created, edited or used records.
• Administrator access is logged separately.

3.Availability and resilience (Article 32 (1) (b) and (c) GDPR)

• Backups are created hourly, stored in encrypted form and automatically overwritten or deleted after one week.
• Restoration from backups has been tested.
• The infrastructure is protected by a firewall or comparable protective mechanisms.
• Systems and services are monitored; automatic alerts are triggered in the event of disruptions.
• Technical errors are recorded and evaluated via a monitoring system.
• The data centres have uninterruptible power supply, fire protection and air conditioning measures in accordance with the standards of the respective operator.

4.Procedures for regular review (Article 32 (1) (d) GDPR)

• A record of processing activities pursuant to Article 30 GDPR is maintained.
• A documented erasure concept exists.
• Documented processes exist for detecting, assessing and handling security incidents.
• All persons involved in the processing are bound to confidentiality in text form.
• The technical and organisational measures are reviewed and adjusted on a case-by-case basis and whenever material changes are made to the Platform.
• The engagement of new sub-processors is assessed under data protection law before processing begins.

5.Processing control

• Contracts pursuant to Article 28 GDPR are in place with all sub-processors.
• The sub-processors engaged are set out in Annex 2 and kept up to date at https://user-flow.de/subprozessoren.html.
• Instructions of the Controller are documented.

Annex 2 — Sub-processors

Last updated: 10/2026

The current version is available at https://user-flow.de/subprozessoren.html.

Notes

• Regarding no. 8: The translation function is optional. Where the Controller does not activate it, no transfer to this sub-processor takes place.
• Providers that process personal data as controllers in their own right are not listed as sub-processors. These include the operators of supported third-party platforms and the Telegram messenger service, where a customer requests support via that channel.
• The service used for source code management does not process productive data of the Controller and is therefore not listed.

User Flow LT UG (haftungsbeschränkt) · DPA Version 1.00 · Last updated 10/2026