Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is concluded between the customer of the "Trusq" software as controller (hereinafter "Customer") and Trusq GmbH, Lohestraße 31, 90425 Nürnberg, registered in the commercial register of the Local Court of Nürnberg under HRB 46174, as processor (hereinafter "Trusq"). It forms part of the contract for the use of the software under the Terms & Conditions (hereinafter "Terms") and is concluded by confirmation during online registration (clause 1.5 c of the Terms), by acceptance of an offer from Trusq that refers to it, or by signature of both parties. The German version is the binding one (clause 13.3).

1. Subject matter and duration

1.1 Trusq processes personal data on behalf of the Customer to the extent required to provide the software under the Terms and the service description. The subject matter, nature and purpose of the processing, the categories of data and the data subjects are described in Annex 1.

1.2 The term of this DPA corresponds to the term of the contract for the use of the software. Obligations that by their nature continue beyond the end of the contract, in particular deletion under clause 11, remain in force.

2. Roles and responsibilities

2.1 The Customer is the controller within the meaning of Article 4 (7) GDPR. It is responsible for the lawfulness of the processing, for upholding the rights of data subjects and for informing its end customers, clients and users, including the notice about the use of the AI assistant (clause 6.3 of the Terms).

2.2 Trusq is the processor within the meaning of Article 4 (8) GDPR and processes personal data solely in accordance with this DPA and the Customer's documented instructions, unless Trusq is required to process by the law of the European Union or of a Member State. In that case Trusq informs the Customer of that legal requirement before processing, unless the law in question prohibits such information on important grounds of public interest.

3. Instructions

3.1 Documented instructions are this DPA, the Terms, the service description and the settings the Customer makes in the software (in particular channels, retention periods, controls of the AI assistant, deletion and export requests). Further instructions are given by the Customer in text form to privacy@trusq.de. Instructions may be given by the Customer's users with the role Owner or Admin and by persons the Customer names in text form.

3.2 Trusq informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions. Trusq may suspend the execution of such an instruction until the Customer confirms or changes it.

3.3 Trusq does not process the data for its own purposes. Excluded from this are data Trusq needs as controller to perform the contract with the Customer (the Customer's account, contract and billing data), which are described in the privacy policy.

3.4 Trusq does not use the Customer's data to train language models and contractually obliges any AI provider it uses not to use the data for training and to store inputs and outputs only to the extent and for the period stated in Annex 2 (clause 6.6 of the Terms).

4. Confidentiality

4.1 Trusq uses only persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of secrecy, and who have been informed of their data protection obligations beforehand.

4.2 For customers of the Kanzlei edition, the Professional Secrecy Annex (§ 203 StGB, § 62a StBerG, § 43e BRAO) applies in addition; Trusq provides it to Kanzlei customers when the contract is concluded. On questions of professional secrecy it prevails over this DPA (clause 1.4 of the Terms).

5. Technical and organisational measures

5.1 Trusq implements the technical and organisational measures described in Annex 3 in accordance with Article 32 GDPR and maintains them for the term of this DPA.

5.2 Trusq may adapt the measures to the state of the art provided the level of protection is not reduced. Material changes are recorded in Annex 3; the date on this page states the version.

6. Sub-processors

6.1 The Customer grants Trusq general authorisation to engage the sub-processors listed in Annex 2. Which sub-processors act for the Customer depends on the booked edition and the channels set up; this is stated per entry in Annex 2.

6.2 Trusq announces the addition or replacement of a sub-processor at least thirty (30) days before it is used, in text form, by email to the administrative contacts of the customer account, and updates Annex 2. The Customer may object in text form for an important reason within fourteen (14) days of receiving the announcement. As long as a timely objection has not been resolved, Trusq does not use the new sub-processor for the Customer's data. If the parties cannot find a solution within thirty (30) days of the objection, either party may terminate the contract for the use of the software in text form with fourteen (14) days' notice; under yearly billing Trusq refunds the pro-rata fee for the remaining term. If the Customer does not object in time, the sub-processor is deemed approved.

6.3 Trusq imposes on every sub-processor, by contract, data protection obligations corresponding to those of this DPA (Article 28 (4) GDPR) and remains responsible to the Customer for the performance of those obligations.

6.4 Processing in a country outside the European Union and the European Economic Area takes place only where Annex 2 states this, and only on a basis provided for in Chapter V GDPR: for the WhatsApp channel of the standard edition the transfer from WhatsApp Ireland Limited, Trusq's contracting party, to the USA on the basis of the "WhatsApp Business Data Transfer Addendum" with the European Commission's standard contractual clauses and WhatsApp LLC's certification under the EU-US Data Privacy Framework; for the Instagram channel of the standard edition the transfer from Meta Platforms Ireland Limited, Trusq's contracting party, to Meta Platforms, Inc. on the basis of the European Commission's standard contractual clauses concluded by Meta and Meta Platforms, Inc.'s certification under the EU-US Data Privacy Framework. Trusq documents a transfer impact assessment for such transfers and makes it available to the Customer on request.

6.5 In the Kanzlei edition Trusq uses only sub-processors established in the EU, the EEA or a country covered by an adequacy decision, and no external AI provider (clause 5.3 of the Terms).

7. Rights of data subjects

7.1 Trusq supports the Customer with appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. For this purpose the software provides in particular functions to export and delete individual contacts; export and deletion of all data of the customer account are governed by clause 11.

7.2 If a data subject contacts Trusq directly, Trusq forwards the request to the Customer without undue delay and does not respond itself unless legally required to do so.

8. Assistance with further obligations

Taking into account the nature of the processing and the information available to it, Trusq assists the Customer in complying with the obligations under Articles 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations of the supervisory authority. For this purpose Trusq provides the Customer with the existing documentation, including Annex 3, the description of the AI functions (clause 6 of the Terms) and the transfer impact assessments under clause 6.4.

9. Personal data breaches

9.1 Trusq notifies the Customer of a personal data breach affecting the Customer's data without undue delay after becoming aware of it, and no later than 48 hours after becoming aware, by email to the administrative contacts of the customer account. The procedure is described in Annex 4.

9.2 The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. Where not all information is available, Trusq notifies in phases.

9.3 Trusq supports the Customer in notifying the supervisory authority and in communicating with data subjects, and preserves evidence of the incident.

10. Evidence and audits

10.1 Trusq makes available to the Customer all information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular Annex 3, the list of sub-processors and the available audit reports or certificates of the sub-processors.

10.2 The Customer may have audits, including inspections, carried out by itself or by an auditor bound to confidentiality, at most once per calendar year and additionally where there is a specific reason, with thirty (30) days' notice, during business hours and without disrupting operations or the data of other customers. Trusq may charge for audits that go beyond providing existing documentation on a time-and-materials basis.

10.3 Trusq submits to inspections by the competent supervisory authority and informs the Customer of inspections and enquiries by the supervisory authority that concern the Customer's data, where legally permitted.

10.4 If Trusq receives a request from an authority or a court for information about or disclosure of the Customer's data, Trusq informs the Customer without undue delay where legally permitted, refers the requesting body to the Customer and discloses data only to the extent Trusq is legally obliged to do so.

11. Deletion and return

11.1 During the term of the contract and for thirty (30) days after it ends, the Customer may request an export of its data in a common machine-readable format; Trusq makes it available within thirty (30) days (clause 8.1 of the Terms).

11.2 Trusq deletes the Customer's data no earlier than thirty (30) and no later than sixty (60) days after the contract ends, and where an export has been requested in time not before seven (7) days have passed since it was made available (clause 8.2 of the Terms). Backups are deleted in accordance with Annex 3. Trusq arranges deletion at its sub-processors in accordance with the contracts concluded with them (clause 6.3). Statutory retention obligations of Trusq remain unaffected; the data concerned is deleted once they expire.

11.3 On request, Trusq confirms the deletion in text form.

12. Liability

The liability of the parties is governed by clause 16 of the Terms and Article 82 GDPR.

13. Final provisions

13.1 Changes to this DPA require text form. Trusq may update Annexes 2, 3 and 4 under clauses 5.2 and 6.2 without reducing the level of protection.

13.2 In the event of a conflict between this DPA and the Terms, this DPA prevails on questions of data protection; the Professional Secrecy Annex prevails on questions of professional secrecy (clause 1.4 of the Terms).

13.3 This DPA is provided in German and English. In the event of discrepancies, the German version prevails.

Annex 1: Subject matter of the processing

Purpose and nature of the processing

• receiving, storing, displaying, assigning and answering messages from the booked channels (email, web form, Matrix; in the standard edition also WhatsApp and Instagram)
• managing cases (tickets), contacts, rules, deadlines and reporting
• AI functions under clause 6 of the Terms: classifying enquiries, generating replies and checking them against the Customer's content, hand-off to employees, summaries, knowledge-base proposals
• managing the Customer's user accounts
• creating backups, exports and deletions

Categories of data

• master data (name, company, role)
• contact data (email address, phone number, messenger identifiers)
• content data (messages, attachments, ticket history, knowledge-base content)
• usage and log data (IP address, timestamps, browser information, logs of access and actions in the software)
• special categories of personal data (Article 9 GDPR) only to the extent contained in end customers' messages; the Customer ensures that their processing is permitted

Data subjects

• end customers, clients, prospects and other persons who contact the Customer through the connected channels
• employees and other users of the Customer

Annex 2: Sub-processors

The list of sub-processors with address, task, categories of data, place of processing and transfer basis is maintained at trusq.de/en/sub-processors; its sections 1 to 3 form part of this DPA. Changes are governed by clause 6.

Annex 3: Technical and organisational measures

Physical access and infrastructure

• operation exclusively in data centres of Hetzner Online GmbH in Germany with physical access controls and ISO 27001 certification
• Trusq operates no servers holding customer data outside these data centres

System access

• personal user accounts; passwords of at least twelve characters, stored as Argon2id hashes
• two-factor authentication (time-based one-time codes) available to users of the software; mandatory for Trusq operator access no later than seven days after set-up
• access by Trusq staff to customer data through the operator console only with a documented reason, and logged; infrastructure access restricted to named persons and granted on a least-privilege basis

Data access and separation

• role-based permissions in the software (Agent, Lead, Admin, Owner)
• tenant separation at database level through row level security; customer data belongs to its customer account and can be retrieved only in that context
• separate environments for development, testing and production; no production data in test environments

Encryption

• transmission between browser and software and to sub-processors over TLS 1.2 or higher; email transport with TLS where the counterpart server supports it
• message texts are additionally stored encrypted at application level; channel credentials, email signing keys and two-factor secrets are stored encrypted
• file attachments are held in Hetzner's object storage with provider-side encryption
• database backups are created and stored encrypted

Input control and traceability

• logging of administrative actions, logins and data changes in a separate log, retained for at least two years
• logging of AI processing per case (model, decision, result of the check) without message content, retained for at least one year

Availability and recovery

• daily encrypted backup of the database and continuous archiving of transaction logs; documented and rehearsed restoration
• database backups are deleted no later than thirty (30) days after they are created and are used solely for restoration; deleted data may remain in a backup until then
• file attachments are not backed up separately

Deletion and retention

• the Customer can set retention periods for resolved and closed cases per customer account (minimum 30 days); without a setting, cases remain stored until a deletion request
• two-stage deletion: personal identifiers are anonymised immediately on a deletion request, the remaining data is permanently deleted within 30 days
• deletion after the end of the contract under clause 11

Organisation

• contact for data protection: privacy@trusq.de
• all employees and contractors committed to confidentiality before gaining access to systems; regular training
• procedure for detecting, containing and reporting personal data breaches (Annex 4)
• contracts under Article 28 GDPR with all sub-processors; regular review of the measures and of the list of sub-processors
• Kanzlei edition: additional measures under the Professional Secrecy Annex

Annex 4: Procedure for personal data breaches

Detection and escalation

• Indications from system monitoring, log analysis, reports by customers or end customers and reports by employees are forwarded without undue delay to the data protection contact and the technical management of Trusq.
• Within 24 hours of the indication, Trusq assesses whether a personal data breach has occurred, which customers are affected and how severe the incident is.

Containment

• Affected systems are isolated, compromised credentials revoked and the cause removed. Evidence (logs, timeline, affected records) is preserved and kept at least for the retention period of the log under Annex 3.

Notification of the Customer

• Trusq notifies the Customer under clause 9.1 without undue delay and no later than 48 hours after becoming aware, by email to the administrative contacts of the customer account, with the information under clause 9.2, in several steps where necessary.
• Notifying the supervisory authority under Article 33 GDPR and communicating with data subjects under Article 34 GDPR are the Customer's obligations as controller; Trusq supplies the information needed and assists with the wording.

Sub-processors

• If the incident occurs at a sub-processor, Trusq receives its report, assesses it and notifies the Customer under the same rules; Trusq remains the Customer's sole point of contact.

Follow-up

• After closure, Trusq documents the cause, course and measures and adapts the technical and organisational measures where necessary.