Data Processing Agreement (DPA)

Section 1 Subject Matter and Duration of Processing

(1) Subject Matter: The processing of personal data takes place within the scope of using the cloud software "BISpicy Inventory Management", including – where used – the BIS Shop hosted by the Processor.

(2) Duration: Processing is carried out for the term of the main contract. After termination, all personal data will be deleted within 30 days, unless statutory retention obligations apply.

(3) Nature of Processing:

• Collection, storage, and use of customer master data
• Processing of order data and transactions
• Generation of invoices and delivery notes
• Transmission to shipping carriers for order fulfillment
• Automatic e-mail delivery of POS reports (cash journal, DATEV booking batches for POS revenue and cash movements, optionally DSFinV-K export) to recipients named by the Controller who have confirmed receipt themselves via link (only if BIS Insights is active); sent via the Controller's SMTP account, otherwise via the Processor's mail server. Transmission takes place on the Controller's instruction; recipients are not sub-processors of the Processor.
• Delivery of receipts to end customers at their request (if used at the till): transmission of a link to the digital receipt to the e-mail address entered by the end customer at the till, via the Processor's mail server. For this link delivery the address is not stored; to protect against abusive sending (Art. 32 GDPR), the Processor forms a pseudonymous check value (HMAC-SHA256) of the address, which it deletes after 48 hours, and logs time, device, receipt and delivery status for 90 days. A digital receipt sent by e-mail remains retrievable for at least 90 days from sending, even if the Controller has set a shorter validity. Transmission takes place on the Controller's instructions; the recipients are not sub-processors of the Processor. DIN A4 invoices sent by e-mail from the till are covered by the e-mail dispatch log.
• E-mail dispatch log (BIS ERP): Logging of every e-mail that the Processor sends, or attempts to send, via BIS ERP on behalf of the Controller – including DIN A4 invoices sent by e-mail from the till and e-mails of the appointment module – as proof of dispatch and of the dispatch result, for clarifying enquiries and for display in the e-mail history of the customer file. The content and attachments of the e-mails are not stored in the log; whether an e-mail was delivered or read is not recorded (no tracking, no read receipt). The log proves only acceptance by the sending mail server, not receipt by the recipient, and is not a reproduction of the e-mail; the retention of documents and business letters remains the Controller's responsibility. The log is not intended for monitoring the performance or behaviour of the Controller's employees.
• Archive storage "Legacy data from previous system" (only if used): receipt, unaltered storage and provision of the original exports of the Controller's previous POS or recording system uploaded by the Controller (e.g. DSFinV-K export, TSE export, journals, Z reports, programming logs, procedural documentation). This includes a checksum (SHA-256), an automated technical check of structure, completeness and period, a software-based deletion lock, logging of upload, retrieval and checks, an e-mail confirmation of receipt, and inclusion in backups and in the export package. The contents of the files are not analysed.
• E-mail archive (BIS Archiv, only if used): retrieval of the e-mails from the mailboxes connected by the Controller – for IMAP from the specified folder (default: inbox), for the Google interface from the entire mailbox excluding spam and trash –, unaltered storage of the archived messages including attachments with a checksum (SHA-256), and provision for finding and retrieval. An automatic pre-selection excludes messages from storage if the folder name, addresses or subject contain certain keywords (e.g. "privat", "betriebsrat", "newsletter"). It is a technical default setting, currently not configurable by the Controller, and not a promise that private or other messages not subject to retention are not stored. The Controller connects only mailboxes whose content it is entitled to archive and assesses permissibility itself (e.g. employee data protection, works agreement). The password or access token for the mailbox is stored in encrypted form.
• Hosted BIS Shop – electronic withdrawal function (only if the Controller uses a BIS Shop): provision of the legally required "Withdraw from contract" function (Section 356a German Civil Code) in the Controller's shop: receipt of the withdrawal statement from its end customers, confirmation of receipt with time stamp and PDF, sending the confirmation of receipt to the address given by the end customer and a notification to the Controller, abuse prevention using counters based on pseudonymous check values (HMAC) (IP address, e-mail address; no plain-text IP), which are deleted after 25 hours at the latest, and – where the shop is connected to BIS ERP – transfer as a return. E-mails are sent via the Controller's SMTP access or, failing that, via the Processor's system mail server (Hetzner Online GmbH, see sub-processors); the withdrawal e-mails contain only a short summary, never the reason or free text. Data is stored in the shop database on the Processor's servers (DigitalOcean, Frankfurt).
• Hosted BIS Shop – customer accounts and orders (only if the Controller uses a BIS Shop): operation of the Controller's online shop on the Processor's servers (DigitalOcean, Frankfurt), in which customer accounts and orders of its end customers (purchasers, account holders) are created, stored and managed. The Controller alone determines the purposes and means of processing its end customers' data. Payment data is transmitted, on the Controller's instruction, to the payment providers set up by the Controller in the shop; these are the Controller's contractual partners and not sub-processors of the Processor.
• Hosted BIS Shop – mandatory e-mails and contact form (only if the Controller uses a BIS Shop): sending the shop's e-mails in the Controller's name: to its end customers the order confirmation (with name, billing and delivery address, ordered items, prices, payment instructions of the Controller, e.g. its bank details, and the legal texts stored by the Controller such as the withdrawal instructions and general terms and conditions), e-mails about the customer account and password (e-mail address, link with token; the password reset link is valid for 24 hours, the account confirmation link until the account is confirmed), and in addition forwarding of enquiries from the shop's contact form to the contact e-mail address stored by the Controller (sender's e-mail address and free text). The contact form stores neither the content nor the address of the sender; it only forwards (only a counter key is stored, see retention periods). The free text may contain content freely chosen by the sender, including special categories of personal data under Art. 9 GDPR. For each order confirmation sent, the Processor keeps a proof of dispatch (see Section 8 paragraph 5). E-mails are sent via the Controller's SMTP access or, failing that, via the Processor's system mail server (Hetzner Online GmbH, Germany, see sub-processors); no further sub-processor is engaged for this. The Controller's legal texts are stored as successive versions and never overwritten.
• Hosted BIS Shop – legal texts (only if the Controller uses a BIS Shop): Storage of the legal texts the Controller enters in BIS ERP (legal notice, privacy policy, terms and conditions, withdrawal instructions, shipping and payment terms) per language as successive versions and their delivery as publicly accessible pages of the Controller’s shop and in the order confirmation. The texts may contain personal data of the Controller and of persons named by it (e.g. name of the owner, authorised representatives or data protection officer, contact details) which the Controller intends for publication; the Controller is responsible for their accuracy.

Section 2 Categories of Data Subjects and Data

2.1 Categories of Data Subjects

• Customers/end customers of the Controller
• Carbon-copy recipients (CC/BCC) of the e-mails that the Controller sends to its end customers via BIS ERP (e.g. the end customer's accounting department or tax adviser)
• Suppliers of the Controller
• Employees of the Controller
• Contact persons at business partners
• Report recipients named by the Controller (e.g. tax advisor, accounting)
• Employees (including former employees), customers and business partners of the Controller recorded in the data of its previous POS or recording system (archive storage, only if used)
• Correspondence partners of the Controller (senders and recipients of archived e-mails) and third parties named in messages and attachments, e.g. applicants, employees and customers (e-mail archive, only if used)
• Consumers (end customers of the Controller's shops) who withdraw from a contract via the withdrawal function of a BIS Shop (if used)
• Purchasers, account holders and senders of the contact form in the Controller's BIS Shops (end customers and prospective customers; if used)
• Owners, authorised representatives, data protection officers and contact persons of the Controller, to the extent the Controller names them in its legal texts (BIS Shop, if used)

2.2 Categories of Personal Data

Data Category	Examples
Contact Data	Name, address, email, phone number
Contractual Data	Orders, invoices, customer numbers
Payment Data	Bank details, payment history (encrypted)
Card Payment Metadata (when POS integration is active)	Card type, masked card number (last four digits only), authorisation code, terminal result; where the cashier expressly chooses to send an incident report, additionally the terminal receipt with the card number shortened to its last four digits, terminal ID, time, amount and further data printed on the receipt (e.g. expiry date, authorisation, trace and receipt numbers, acquirer number, EMV data) (to clarify uncertain payments; the receipt text is deleted 18 months after the case is closed, at the latest when the tenant is deleted)
Shipping Data	Delivery addresses, tracking numbers
Appointment Data	Appointment bookings, assignment to customers and staff (if the appointment module is used)
Report recipients	E-mail address, time of consent/refusal/unsubscribe, creating user, delivery record per recipient, change log; reports contain the Controller's POS data incl. cashier names and the free-text reasons entered for cash movements
Receipt delivery to end customers (digital receipt by link)	E-mail address (for sending the link only, not stored), pseudonymous check value of the address (48 hours), delivery log without address: time, device, receipt, status (90 days); DIN A4 invoices from the till: see “E-mail dispatch log (BIS ERP)”
E-mail dispatch log (BIS ERP)	Recipient address, addresses of carbon-copy recipients (CC), number of blind-copy recipients (BCC, without addresses) and, where redirected in test mode, also the originally intended addresses; subject (may contain receipt or order numbers and names); type of e-mail; assignment to customer and document (receipt or order number); time; dispatch route (mail server of the Controller or of the Processor); dispatch result with reason (e.g. test mode, no dispatch route set up) and error category; technical error message from the mail server (only on failure). Not stored: content and attachments of the e-mail, delivery or read status, and IP addresses. For retention periods see Section 8 (6)
POS data from previous systems (archive storage, only if used)	Content of the uploaded original files as recorded in the previous system: individual sales records with operator ID and cashier names, customer details on receipts (e.g. name, address, VAT ID), payment methods, masked card details (where present), free-text notes, TSE logs with serial numbers; storage details: uploading user, time, file name, size, checksum, check result, recipients of the confirmation of receipt, access log
E-mail archive (BIS Archiv, only if used)	Sender, recipient, cc and bcc recipients (where contained in the original file), date, subject, message content and attachments of the archived e-mails (as an unaltered original file including the technical headers with transmission path and IP addresses), message ID; content and attachments may contain data of any kind, including special categories of personal data under Art. 9 GDPR (e.g. sick notes, application documents, health information) and details about third parties named in the messages; mailbox address, user name and access credentials for the mailbox (password or access token, encrypted); access log
Withdrawal statements (BIS Shop, only if used)	Name, e-mail address, order or contract reference, selected items (description, quantity), voluntary reason for withdrawal and free text on the scope, language, time of receipt, checksum of the statement; assignment to the order or customer account of the shop; processing log per statement (times of receipt, of sending the confirmation of receipt and of transfer to BIS ERP); pseudonymous check value (hash) of the e-mail address, stored for the duration of retention (limits the number of e-mails per recipient); abuse prevention: counters with pseudonymous check values (HMAC) (IP address, e-mail address), no plain-text IP, deleted after 25 hours at the latest
Customer accounts and orders (BIS Shop, only if used)	Customer account (name, e-mail address, addresses, telephone number where applicable, access credentials – password only as a hash); orders (name, billing and delivery address, ordered items, prices, payment and shipping method, order history, IP address at checkout); payment status and transaction identifiers of the payment provider (no full card data)
Mandatory e-mails and contact form (BIS Shop, only if used)	Order confirmation: name, billing and delivery address, e-mail address, ordered items, prices, payment instructions of the Controller (e.g. bank details/IBAN), legal texts of the Controller contained in the e-mail; account and password e-mails: e-mail address, link with token (password link valid for 24 hours, confirmation link until the account is confirmed); contact form: sender's e-mail address and free text, which may also contain special categories of personal data under Art. 9 GDPR (forwarding only, no storage); proof of dispatch for the order confirmation: pseudonymous check value (HMAC) of the recipient address (no plain-text address), checksum of the content, versions of templates, withdrawal instructions, general terms and conditions and shipping and payment terms, times and status of dispatch; abuse prevention: pseudonymous check value (HMAC) of the sender's IP address as counter key for the sending limit, no plain-text IP, deletion after 25 hours at the latest; limit per recipient: pseudonymous check value (HMAC) of the recipient address as counter key, no plain-text address, deletion after 25 hours at the latest
Legal texts (BIS Shop, only if used)	Content of the stored legal texts including the names and contact details they contain; version history with time and checksum
Login and session data	Login log per user of the Controller: e-mail address, IP address, browser or app identifier, time and result (login, failed attempt, start of block), retained for 90 days; on the user account the time, IP address (90 days at most) and number of logins; pseudonymous counters of the login protection (HMAC-SHA256, no e-mail address and no IP address in plain text; deleted 25 hours or 31 days after the last event)

Section 3 Obligations of the Processor

The Processor undertakes to:

1. Instruction Binding: Process personal data only on documented instructions from the Controller (Art. 28(3)(a) GDPR)
2. Confidentiality: Ensure that all persons authorized to process data are committed to confidentiality (Art. 28(3)(b) GDPR)
3. Security Measures: Implement all technical and organizational measures required under Art. 32 GDPR
4. Sub-processors: Engage other processors only with prior consent of the Controller (Art. 28(2) GDPR)
5. Assistance: Assist the Controller in fulfilling obligations under Art. 32-36 GDPR
6. Deletion: Delete or return all personal data after termination of the contract
7. Accountability: Make available to the Controller all information necessary to demonstrate compliance

Section 4 Technical and Organizational Measures (TOMs)

The Processor has implemented the following measures pursuant to Art. 32 GDPR:

4.1 Confidentiality

• Physical Access Control: Data centers with physical access controls (DigitalOcean EU)
• Logical Access Control: Password-protected user accounts, optional two-factor authentication
• Authorization Control: Role-based permission system
• Separation Control: Tenant separation through individual databases
• Login protection: Password logins (BIS ERP, customer center, POS, warehouse app, web POS, super admin) are temporarily throttled after failed attempts (block of 60 minutes at most, escalating from 1 minute; counted per account and IP address, per IP address and per account); the counters hold only pseudonymous check values (HMAC-SHA256), no e-mail address or IP address in plain text, and are deleted 25 hours or 31 days after the last event; login log in the controller's tenant database (e-mail address, IP address, browser or app identifier), retained for 90 days. The login log serves the security of access (detecting misuse, tracing blocks); it is not intended for performance or behavior monitoring of the Controller's employees. Whether its use requires the involvement of the works council (Section 87(1) no. 6 BetrVG) is for the Controller to assess.
• E-mail dispatch log: log in the database of the respective tenant; read access only for users with the right to view customers, reference to a document only with the right to read it; blind-copy recipients displayed only as a number, technical error messages of the mail server displayed only as a category; no content, no attachments, no tracking; automatic deletion after the period (Section 8 (6))

4.2 Integrity

• Transfer Control: TLS 1.3 encryption for all data transmissions
• Input Control: Logging of all data entries and modifications
• Archive storage: SHA-256 checksum per file on receipt, software-based deletion lock and immutability (no edit or overwrite function, versioning with hash chain), log of upload, retrieval and checks; no hardware write protection (WORM storage) and no external time stamp
• BIS Shop – mandatory e-mails and contact form: proof of dispatch with a pseudonymous check value (HMAC) of the recipient address instead of a plain-text address, sending limits per e-mail type, recipient and shop against abuse, no addresses, tokens or contents of contact enquiries in plain text in logs, legal texts kept as versions without overwriting

4.3 Availability and Resilience

• Availability Control: 99.9% uptime guarantee, redundant systems
• Recoverability: Daily automatic backups, tested restoration procedures

4.4 Procedures for Regular Review

• Regular security audits
• Penetration tests by external service providers
• 24/7 system monitoring

Section 5 Sub-processors

(1) The Controller consents to the engagement of the following sub-processors:

Sub-processor	Location	Processing Purpose
DigitalOcean LLC	Frankfurt (EU)	Backend hosting, database, file storage and cloud backups (Spaces, S3-compatible, Frankfurt)
Cloudflare, Inc. (engaged by DigitalOcean)	EU/USA (standard contractual clauses)	Content delivery network for file storage (delivery of images, downloads and files from DigitalOcean Spaces, e.g. product images of the BIS Shops; connection data/IP) and security and DNS services of the DigitalOcean platform – engaged by DigitalOcean as its own sub-processor; no separate contractual relationship with the processor
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen	Germany (EU)	E-mail sending and receiving (system mail server, if no own SMTP account is configured; mailboxes of the domains bispicy.com and bispos.app)
Stripe Payments Europe Ltd.	Dublin (EU)	Payment processing for software licenses
Google LLC (Firebase Cloud Messaging)	EU/USA (Standard Contractual Clauses)	Push notifications to connected POS devices (no personal content)
Anthropic PBC (only when AI features are used)	USA (Standard Contractual Clauses, Art. 46 GDPR)	AI-assisted recognition of incoming invoices, AI article creation and AI repricing. Submitted data is not used for model training (Anthropic Commercial Terms / DPA).
Fiskaly GmbH (when POS integration is active)	Germany / Austria (EU)	Cloud TSE (KassenSichV) and RKSV cloud signing
Shipping carriers (DHL, DPD, GLS, Hermes, UPS, FedEx) — when enabled	EU	Shipping label creation, track & trace (upon instruction)
Marketplaces, shops and ERP systems (Amazon, eBay, Etsy, Shopify, Magento, WooCommerce, Shopware, Gambio, Shopee, Whatnot, Odoo) — when enabled	EU / worldwide (depending on provider)	Order and article synchronization upon the Controller's instruction

(2) The Processor shall inform the Controller before engaging additional sub-processors. The Controller may object within 14 days.

(3) Note regarding shipping carriers: The transfer of recipient data to shipping carriers is made exclusively upon the explicit instruction of the Controller (by creating a shipping label in the software) for the purpose of fulfilling the shipping order.

Section 6 Rights of Data Subjects

(1) The Processor shall assist the Controller in fulfilling the rights of data subjects (Art. 12-22 GDPR):

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)

(2) The Processor provides an export function that exports all personal data in a machine-readable format (CSV/JSON).

Section 7 Notification Obligations in Case of Data Breaches

(1) The Processor shall notify the Controller of any personal data breach without undue delay, and no later than 24 hours after becoming aware of it.

(2) The notification shall contain at a minimum:

• Description of the nature of the breach
• Affected data categories and approximate number of records
• Likely consequences
• Measures taken or proposed to address the breach

Section 8 Deletion and Return of Data

(1) Upon termination of the main contract, all personal data shall be:

• Exported and handed over to the Controller in a common format upon request
• Irrevocably deleted after a period of 30 days

(2) Exceptions apply for data that must be retained for longer periods due to statutory retention obligations (e.g., invoices: 10 years).

(3) Archive storage "Legacy data from previous system": By uploading, the Controller instructs the Processor to keep the files unaltered. In derogation from paragraph 1 and Section 1 (2), these files are not deleted automatically after termination of the main contract; to that extent this agreement continues to apply until the files have been returned or deleted on the Controller's instruction. The Controller can download the files at any time; they are included in the export package. On express instruction in text form, the Processor deletes individual files or the entire archive earlier; the deletion is logged. The Controller can also delete individual files itself in the Customer Center; the deletion is logged. The Processor announces any deletion not instructed by the Controller in text form at least 30 days in advance. The retention obligations (in particular Section 147 of the German Fiscal Code, AO) lie with the Controller; the period displayed is calculated from the Controller's details, and whether it is extended in an individual case (Section 147 (3) sentence 5 AO) is for the Controller to assess. If the Controller informs the tax authority that the data are held by the Processor (Section 147 (6) AO), the Processor makes them available in accordance with that provision.

(4) Withdrawal statements in the BIS Shop: During the term of the contract, the Processor automatically deletes withdrawal statements once three years have passed from the end of the year of receipt. On the Controller's instruction, the Processor places a retention hold against this deletion (e.g. in an ongoing dispute). When the contract ends, paragraph 1 applies as for all other data; the Controller may have the statements exported beforehand. If the shop is connected to BIS ERP, the statement is additionally held as a return in BIS ERP and follows the rules that apply there.

(5) Mandatory e-mails, contact form and customer accounts in the BIS Shop: The contact form does not store the content of the enquiry or the sender's address; the Processor only forwards the enquiry. To limit enquiries per sender, it stores a pseudonymous check value (HMAC) of the IP address as counter key for the sending limit in the shop database; likewise, to limit e-mails per recipient, a pseudonymous check value (HMAC) of the recipient address. Both are deleted after 25 hours at the latest; no plain-text IP, no addresses and no content of the enquiry are stored. The Processor deletes the outbox entries for account and password e-mails (without e-mail address and without token in plain text) after 7 days. For each order confirmation sent, it keeps, on the Controller's instruction, a proof of dispatch (pseudonymous check value (HMAC) of the recipient address instead of the address, checksum of the content, versions of the e-mail templates, the withdrawal instructions, the general terms and conditions and the shipping and payment terms) so that compliance with the information duties (Section 312m(2) German Civil Code) can be demonstrated. The proof of dispatch is not a copy of the e-mail; the Controller itself keeps a copy of the order confirmation as a business letter. During the term of the contract, the proof of dispatch is retained for six years from the end of the calendar year (Section 257(1) no. 3, (4) and (5) German Commercial Code; Section 147(1) no. 3, (3) and (4) German Fiscal Code) and deleted afterwards. The Processor stores the versions of the legal texts, including earlier versions, for the term of the contract, and versions referred to by a proof of dispatch at least as long as that proof. It deletes earlier versions not referred to by any proof of dispatch on the Controller's instruction. The Processor stores customer accounts and orders until the Controller deletes them or instructs their deletion. When the contract ends, paragraph 1 also applies to customer accounts, orders, proofs of dispatch and the versions of the legal texts; the Controller may have them exported beforehand.

(6) E-mail dispatch log (BIS ERP): Entries on invoices, orders, order confirmations and quotations that are assigned to a customer and were accepted by the sending mail server are retained by the Processor during the term of the contract until the end of the sixth calendar year after the year of sending (modelled on the retention period for commercial letters, Section 257 (4) and (5) of the German Commercial Code, HGB); the log is not a reproduction of the e-mail. All other entries – including those on e-mails that were not sent, were redirected in test mode or were rejected by the mail server, and on e-mails without a customer assignment – are deleted by the Processor 90 days after the attempt to send. Entries on e-mails of the appointment module have no customer assignment, are held in the Processor's central database and are deleted after 90 days, also after the end of the contract. Deletion is performed by a daily automatic run. If the Controller anonymises a customer, the Processor removes from that customer's entries all e-mail addresses, the subject and the technical error message; time, type, assignment to the document and dispatch result are retained until the end of the period. If the Controller deletes a customer without documents, that customer's entries are deleted as well. In the e-mail history of the customer file, only users with the right to view customers see the entries; blind-copy recipients appear there only as a number, technical error messages only as a category. When the contract ends, paragraph 1 applies.

Section 9 Audit Rights

(1) The Controller has the right to verify compliance with this agreement.

(2) The Processor shall provide the following for this purpose:

• Evidence of technical and organizational measures
• Current certifications and audit reports
• Upon request: on-site inspections (by appointment)

Section 10 Final Provisions

(1) Applicable Law: German law applies, in consideration of the GDPR.

(2) Amendments: Amendments to this agreement require text form.

(3) Severability Clause: Should individual provisions be invalid, the validity of the remaining provisions shall remain unaffected.