Data Processing Agreement

Version: 6 October 2026

1. Parties and subject matter

This Data Processing Agreement ("DPA") is entered into between the Customer and Bytekontor GmbH, Bleicherwiesen 14, 31224 Peine ("Bytekontor"). It supplements the contract for Mobile Joe ("Main Agreement").

For the personal data covered by this DPA, the Customer acts as a controller or as a processor for a third party. Bytekontor acts as a processor or another processor.

The DPA applies to the extent that Bytekontor processes personal data on the Customer's documented instructions when providing Mobile Joe. Processing for which Bytekontor itself determines the purposes and means is governed by the Privacy Policy.

In the event of a conflict concerning processing on behalf of the Customer, this DPA prevails over the Main Agreement. Its Annexes form part of the DPA.

2. Term

The DPA applies during the term of the Main Agreement. It continues to apply thereafter for as long as Bytekontor processes personal data on the Customer's behalf.

3. Instructions

Bytekontor processes personal data only on the Customer's documented instructions. The Main Agreement, this DPA, the selected service configuration, SDK and API requests made in accordance with the contract, and instructions in text form constitute instructions.

This also applies to transfers of personal data to third countries.

If Union or Member State law requires Bytekontor to process data differently, Bytekontor informs the Customer before processing. This does not apply if that law prohibits such information on important grounds of public interest.

If Bytekontor considers an instruction unlawful, Bytekontor informs the Customer without undue delay.

4. Customer obligations

The Customer is responsible for the lawfulness of the processing and its instructions and for compliance with its obligations as a controller. If the Customer itself acts as a processor, it ensures that it may engage Bytekontor as another processor.

The Customer may have the data excluded under Annex 1 processed only if Bytekontor has agreed in advance in text form and the required safeguards have been agreed.

5. Confidentiality

Bytekontor grants access to personal data only to persons who need it for their tasks. Bytekontor commits those persons to confidentiality or ensures that they are under an appropriate statutory obligation of confidentiality.

6. Security

Bytekontor implements the technical and organisational measures required under Article 32 GDPR, in particular the measures described in Annex 2.

Bytekontor may change individual measures if this does not reduce the agreed level of protection. Bytekontor documents material changes.

7. Subprocessors

The Customer gives Bytekontor general authorisation to engage the companies named in the Subprocessor List. The current list is available at https://mobilejoe.dev/legal/subprocessors.

Bytekontor informs the Customer in text form before adding or replacing a subprocessor and gives the Customer a reasonable period to object on substantiated data protection grounds before the subprocessor is engaged. If the objection cannot be resolved and the affected service cannot be provided without the subprocessor, either party may terminate that service on the intended engagement date.

Bytekontor contractually binds subprocessors to a level of protection that corresponds to the applicable obligations under this DPA. Bytekontor remains responsible to the Customer for the performance of these obligations.

8. Assistance to the Customer

Taking into account the nature of the processing, Bytekontor assists the Customer as far as possible through appropriate technical and organisational measures in relation to the exercise of data subjects' rights.

Taking into account the nature of the processing and the information available, Bytekontor assists the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR.

If a data subject addresses a request directly to Bytekontor, Bytekontor forwards it to the Customer. Bytekontor does not respond to the request itself unless the Customer instructs it to do so or the law requires it.

The Customer may request assistance with access or erasure at [email protected]. The request must come from a person authorised for the Customer account and contain the available information needed to identify the data concerned. Bytekontor provides assistance to the extent that the data can be identified using the data processed; it does not collect additional identification data solely for this purpose.

9. Personal data breaches

Bytekontor informs the Customer without undue delay after becoming aware of a personal data breach involving personal data processed on the Customer's behalf and provides the available information that the Customer needs to comply with its obligations under Articles 33 and 34 GDPR.

10. Evidence and audits

Bytekontor makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Security, confidentiality and the rights of other Customers are protected during audits.

11. International transfers

The processing locations and intended transfer mechanisms of the subprocessors are set out in the current Subprocessor List. Bytekontor transfers personal data to third countries only subject to the conditions of Chapter V GDPR. This also applies if Bytekontor makes personal data available to a Customer established in a third country.

12. Erasure and return

Bytekontor erases personal data processed on the Customer's behalf on the Customer's documented instructions. After the end of the processing, Bytekontor, at the Customer's choice, erases the data or returns it to the Customer and erases remaining copies. These obligations do not apply to the extent that Union or Member State law requires further storage. Personal data in backups is not processed for purposes other than restoration until the backups are overwritten in the ordinary cycle. Following restoration, personal data that was erased based on a Customer instruction or agreed erasure rules is erased again before productive use resumes.

Annex 1 – Description of processing

1. Subject matter and purposes

Bytekontor processes personal data to manage Customer Content, deliver it in Customer Apps and enable End Users to interact with that content. Pseudonymous identifiers are used to assign and synchronise user-specific states and for erasure, security and assistance with support requests.

2. Data subjects

  • End Users of Customer Apps;
  • persons named by the Customer in its own content.

Account data of persons who manage the Customer account for the Customer or act as contacts is generally processed under the Privacy Policy and not under this DPA. If a support request contains data processed on the Customer's behalf, the DPA applies to that part.

3. Categories of data

  • app-specific pseudonymous user and device identifiers and optional User References provided by the Customer;
  • app, device and SDK metadata: operating system, device manufacturer and model, version and build information, language and debug status;
  • interaction and search data: interactions with Customer Content and the status assigned to a pseudonymous identity, search terms, filters and sorting;
  • request and security data: IP address, timestamp, request identifiers, app assignment and security events;
  • content provided by the Customer to the extent that it contains personal data.

4. Processing operations

Collection, transmission, organisation, storage, linking of pseudonymous identities, retrieval, display, backup, export and erasure.

5. Excluded data

Without a separate agreement, the Service is not intended for the following End User Data:

  • special categories under Article 9 GDPR;
  • personal data relating to criminal convictions and offences;
  • credentials and authentication secrets;
  • payment data and complete financial data;
  • precise location data;
  • optional User References that do not meet the requirements of section 4 of the Terms of Service;
  • data whose processing creates a particularly high risk or triggers a statutory special obligation that has not been assessed in advance.

Annex 2 – Technical and organisational measures

1. Organisation and access control

  • Bytekontor restricts production, database, storage and monitoring access to named authorised persons with an operational need.
  • Accounts are assigned to individuals. Access that is no longer required is revoked.
  • Administrative access to systems that process Customer data is protected by multi-factor authentication.
  • Customers can access only the apps and content assigned to their account.

2. Authentication and tenant separation

  • Dashboard accounts use an email address and password. Passwords are stored as hashes.
  • Login sessions use signed, HTTP-only and SameSite-restricted cookies and are time-limited.
  • API requests use app-specific API keys. The application stores API keys in encrypted form.
  • The Dashboard and API verify assignment to the Customer or app.
  • The API, login and registration are protected by rate limits.

3. Transmission and storage

  • The website, Dashboard and API enforce HTTPS/TLS.
  • The database, database backups and object storage are encrypted at rest.
  • Credentials and cryptographic keys are stored in encrypted form.

4. Pseudonymisation and data minimisation

  • SDK identifiers are random or hashed and are processed in separate datasets for each Customer App.
  • Filters reduce personal data and credentials in application logs and error reports.

5. Logging and monitoring

  • The application and infrastructure log access, errors and security events for error analysis and protection against misuse.

6. Availability and restoration

  • Production data can be restored using continuous recovery points.

7. Secure development

  • Source code and dependencies are checked for security vulnerabilities based on risk.
  • Personal production data is not included in source code or test data.

8. Personal data breaches

  • Bytekontor investigates security incidents, limits their effects and documents decisions.
  • Bytekontor retains evidence only to the extent necessary.

9. Erasure

  • When a Customer account is deleted, its apps, content and associated personal End User Data are erased from active systems.
  • Customers can delete individual items of Customer Content in the Dashboard.
  • Backups are overwritten according to their defined cycle.

10. Review

Bytekontor regularly reviews the effectiveness of these measures.