Data Processing Agreement (DPA) for vivotempo

Preamble

Bergx2 GmbH, Hochriesstr. 46, 85560 Ebersberg, Germany (hereinafter "processor"), operates the software as a service application vivotempo for leave management, time tracking, sick notes and other HR tasks. In the course of its use, it processes personal data on behalf of the customer (hereinafter "controller") within the meaning of Art. 4(8) and Art. 28 GDPR. This agreement sets out the obligations and rights of both parties under Art. 28(3) GDPR.

Section 1 Subject matter and duration of the processing

(1) Subject matter. The processor provides vivotempo to the controller as software as a service. In doing so, it processes the personal data described in Annex 1 solely on the controller's instructions.

(2) Duration. The agreement applies from the conclusion of the contract for vivotempo (main contract under the terms and conditions) and ends when that contract ends. The obligations regarding return and deletion (Section 10) and confidentiality (Section 5(2)) continue to apply beyond that.

Section 2 Nature and purpose of the processing

(1) The processor processes the data for the following purposes:

• Provision of vivotempo: leave and absence management, time tracking in the browser and at the terminal, sick notes, health bonus, reports and exports for payroll
• Sign-in and protection of accounts: password, second factor, passkeys and sign-in at the terminal
• Sending notifications in the app and by email
• Operation, security, error analysis and support

(2) The processor does not process the data for its own purposes, for example for advertising, profiling or selling data.

Section 3 Types of data and categories of data subjects

(1) Details are set out in Annex 1. Data subjects are the controller's employees, including former employees, and other persons to whom the controller grants access to vivotempo.

(2) Special categories of personal data (Art. 9 GDPR). Depending on the features used, vivotempo processes health data (sick notes with their period and, where applicable, certificates) and biometric data (a facial feature calculated from a camera image for signing in at the terminal, only if the controller enables this sign-in method; the camera image itself is not stored). The controller ensures that there is a legal basis for this; facial recognition generally requires the voluntary consent of the employees. vivotempo restricts access to these data to the roles authorised by the controller.

Section 4 Obligations and rights of the controller

(1) Responsibility and instructions. The controller is responsible for the lawfulness of the processing (Art. 24 GDPR). This agreement and the settings the controller makes in vivotempo, for example roles, permissions, enabled features and retention periods, constitute instructions. The controller issues further instructions in text form.

(2) Informing employees. The controller informs the data subjects about the processing in accordance with Art. 13 and 14 GDPR.

(3) Review. The controller reviews the measures in Annex 2 for their suitability for its processing and informs the processor of any concerns.

Section 5 Obligations of the processor

(1) Instructions. The processor processes the data only on documented instructions from the controller, unless required to do so by Union or Member State law; in that case, it informs the controller of that legal requirement before processing, unless that law prohibits this. If the processor considers an instruction to be unlawful, it informs the controller without undue delay (Art. 28(3) GDPR).

(2) Confidentiality. All persons with access to the data have committed themselves to confidentiality before starting their work (Art. 28(3)(b) GDPR).

(3) Security. The processor implements the technical and organisational measures set out in Annex 2 (Art. 32 GDPR) and adapts them to the state of the art without lowering the level of protection.

(4) Assistance. The processor assists the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular with data subject rights (Section 7), notifications of personal data breaches (Section 8) and a data protection impact assessment.

(5) Data protection officer. The processor's data protection officer is Zsu Sernc-Urban, who can be reached at the address above or by email to info@bergx2.de with the subject "Datenschutz".

Section 6 Sub-processors

(1) Authorisation. The controller authorises the sub-processors listed in Annex 3 (Art. 28(2) GDPR).

(2) Changes. The processor informs the controller in text form at least 30 days in advance of any intended addition or replacement of a sub-processor, namely to the email addresses of the administrators of the customer account.

(3) Objection. The controller may object to a change within this period for an important reason relating to data protection. If the parties cannot reach an amicable solution, the controller may terminate the main contract for cause.

(4) Obligation. The processor contractually binds each sub-processor to the obligations of this agreement (Art. 28(4) GDPR).

(5) Third countries. Data are transferred to countries outside the EU or the EEA only if the conditions of Art. 44 to 49 GDPR are met, in particular on the basis of an adequacy decision, including the EU-US Data Privacy Framework, or the standard contractual clauses of the European Commission.

Section 7 Rights of data subjects

(1) The processor assists the controller with appropriate technical and organisational measures in fulfilling the rights under Chapter III GDPR (access, rectification, erasure, restriction, data portability, objection). For this purpose, vivotempo offers features for editing, exporting and deleting data, among others.

(2) If data subjects contact the processor directly, the processor forwards the request to the controller without undue delay and answers it only on the controller's instructions.

Section 8 Notification of personal data breaches

(1) The processor informs the controller without undue delay, where possible within 24 hours of becoming aware, of any personal data breach within its area of responsibility or at a sub-processor.

(2) The notification is sent in text form to the administrators of the customer account and contains, as far as known, the information required by Art. 33(3) GDPR: nature and scope of the breach, number of data subjects concerned, likely consequences and measures taken.

(3) Notifications to the supervisory authority (Art. 33 GDPR) and to data subjects (Art. 34 GDPR) are the responsibility of the controller; the processor assists the controller with all necessary information.

Section 9 Evidence and audits

(1) On request, the processor provides the controller with all information necessary to demonstrate compliance with the obligations under this agreement, in particular the current versions of Annexes 2 and 3 as well as certificates and audit reports of the data centre operators.

(2) After giving at least four weeks' notice, the controller may verify compliance with the measures, including on site during normal business hours. Audits must not disrupt operations disproportionately and take place no more than once per calendar year unless there is a specific reason. Auditors must be bound to confidentiality.

Section 10 Return and deletion

(1) During the term of the contract, the controller can edit and delete data in vivotempo itself and set retention periods for time entries and sick notes.

(2) After the end of the main contract, the processor returns the data at the controller's choice (export in a common, machine-readable format) or deletes them, no later than 30 days after the end of the contract, unless there is a legal obligation to store them.

(3) Backups are overwritten in the regular backup cycle, no later than after 30 days. On request, the processor confirms the deletion in text form.

(4) Statutory retention obligations of the processor, for example for billing records under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), remain unaffected.

Section 11 Liability and final provisions

(1) Liability is governed by the provisions of the main contract (terms and conditions) and Art. 82 GDPR.

(2) Amendments to this agreement must be made in text form. The processor announces new versions at least 30 days before they take effect (see "Effectiveness").

(3) In the event of conflicts between this agreement and the main contract, this agreement takes precedence in matters of data protection.

(4) Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.

(5) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. To the extent permitted by law, the place of jurisdiction is the processor's registered office.

Annex 1: Description of the processing

• Subject matter: provision of vivotempo as software as a service, including hosting, data storage, sign-in, notifications and support
• Duration: term of the main contract and no more than 30 days thereafter for return and deletion
• Nature of processing: collection, recording, storage, organisation, adaptation, retrieval, analysis, making available to authorised users, erasure
• Data subjects: employees of the controller (including former employees), administrators and other users to whom the controller grants access
• Master data: name, email address, employee number, department, role, entry and exit dates, country of work, time zone, profile picture
• Absences: leave requests and decisions with comments, leave balance and carry-over, other absences
• Working time: start, end, breaks, corrections, time and terminal of a booking, supplements and balances
• Health data (Art. 9 GDPR): sick notes with their period and uploaded certificates, sick days for the health bonus
• Sign-in data: email address, password (only as a hash), second factor (email address or Threema ID), public keys of passkeys
• Sign-in at the terminal: PIN, NFC card ID, QR code, Bluetooth device ID; if the controller wishes, a facial feature as a feature vector (biometric data under Art. 9 GDPR)
• Logs: change log with time and acting person, technical server logs (IP address, time, requested address)
• Notifications: notifications in the app and by email
• Storage location: database and file storage at Supabase in the EU (data centre in Paris, France), server functions at Vercel in the EU (Paris region)
• Third countries: Vercel Inc. and Supabase Inc. are based in the USA; access from there, for example for operation and support, is possible and safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. For Threema GmbH (Switzerland), there is an adequacy decision of the European Commission.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

The following measures apply to vivotempo. Implementation details, for example configurations, are not described publicly for security reasons; the controller receives them on justified request within the scope of Section 9.

• Physical access control: the servers are located in the service providers' data centres (Amazon Web Services via Supabase, Vercel) with certified physical security, including ISO/IEC 27001 and SOC 2. The processor's business premises are secured against unauthorised access; visitors are accompanied at all times.
• System access control: sign-in with a personal account and password, optionally with a second factor (email code, Threema, passkey) and a lock after five failed attempts; terminals sign in with their own device key; only a few authorised persons have administrative access to the service providers.
• Data access control: separation of customers at database level (row level security); graded roles (employee, team lead, HR, administrator) with fine-grained permissions; health data and sign-in features only for authorised roles; automated tests of the access rules with every change.
• Separation control: data of different customers are processed logically separately; every access is bound to the respective customer.
• Encryption: all connections are encrypted with TLS; the database and file storage are encrypted at rest; passwords are stored only as a hash.
• Input control: changes to employee data, requests, time entries and settings are recorded in the change log with time and acting person; corrections to time entries remain traceable.
• Transfer control: data are transmitted only in encrypted form; exports and reports are available only to authorised roles; no data are passed on without a contractual basis.
• Order control: data processing agreements with all sub-processors (Annex 3) and their regular review.
• Availability and resilience: operation at service providers with redundant infrastructure and continuous monitoring; regular backups of the database; terminals buffer bookings during a connection loss and transmit them afterwards.
• Recoverability: the backups allow the data to be restored after an incident.
• Review and evaluation: appointed data protection officer, defined procedure for personal data breaches, automated tests before every release, regular security reviews of the access rules.
• Data minimisation and deletion: configurable retention periods for time entries and sick notes, return and deletion after the end of the contract in accordance with Section 10.

Annex 3: Sub-processors

As of: 14 October 2026

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA: hosting of the application and server functions (Paris region, France) and delivery of the website; processes all data while handling requests as well as server logs. Basis: data processing agreement, EU-US Data Privacy Framework, standard contractual clauses.
• Supabase Inc., USA: database, sign-in and file storage in the Paris data centre (France, Amazon Web Services); processes all data listed in Annex 1. Basis: data processing agreement, EU-US Data Privacy Framework, standard contractual clauses.
• Scaleway SAS, Paris, France: sending of emails (notifications, codes, links); processes email address, name and message content. Basis: data processing agreement.
• Threema GmbH, Churerstrasse 82, 8808 Pfäffikon SZ, Switzerland: delivery of sign-in codes via Threema, only if users choose Threema as their second factor; processes Threema ID and code. Basis: adequacy decision of the European Commission for Switzerland.

In addition, emails pass through a forwarding service operated by Bergx2 GmbH itself. Other service providers without access to data from vivotempo, for example for payment processing of the customer account (Mollie), for public holiday data or for checking the VAT identification number (VIES), are not sub-processors within the meaning of this agreement.

Effectiveness

This agreement becomes part of the contract when the main contract is concluded (registration under the terms and conditions); conclusion in electronic form is sufficient (Art. 28(9) GDPR).

In addition, the customer's administrators can accept the agreement explicitly in the customer account. The version, date and time, the accepting person, the customer and a checksum of the accepted version are stored.

The processor announces new versions in text form at least 30 days before they take effect; administrators are asked to accept them again in the customer account.

At the customer's request, the agreement can additionally be signed by hand or with a qualified electronic signature; the electronic acceptance remains unaffected.

Versions

• Version 1.0 of 14 October 2026: first version