Data Processing Agreement (DPA)

01Applicability and incorporation

This data processing agreement (DPA) applies between you as the customer (controller) and von Reyher Media UG (haftungsbeschränkt), Nonnendamm 33-35, 13627 Berlin (processor), if and to the extent you use Umfeld for business or professional purposes and process personal data of third parties in doing so. It automatically becomes part of the service contract upon its conclusion.

If you use Umfeld purely privately, the household exemption of Art. 2(2)(c) GDPR regularly applies; this DPA then has no effect and imposes no obligations on you. In case of conflict between this DPA and the terms of service, this DPA prevails for the processing of personal data on your behalf.

02Subject matter, duration, nature and purpose

The subject matter is the operation of Umfeld as a personal contact management service: storing and synchronizing your Google contacts, enriching them with context you record (relationships, notes, interactions, events), displaying and searching this data, and, where you use them, preparing it through AI features and making it available to AI clients you authorize.

The duration corresponds to the term of the service contract. This DPA ends with it; the deletion duties under section 10 remain unaffected.

03Categories of data and data subjects

• Data categories: contact master data (names, email addresses, phone numbers, postal addresses, organizations, birthdays, photos), context data you record (relationships, how you met, notes, interactions, life events, tasks, journal), derived values (such as contact scores).
• Data subjects: the contacts stored in your address book, in particular business partners, customers, colleagues, and other people in your professional network.

04Instructions

We process the data solely on your documented instructions. Using the features provided in Umfeld (such as syncing, editing, merging, deleting, enabling AI features, authorizing AI clients) constitutes such an instruction. We do not process the data for our own purposes.

If we consider an instruction unlawful, we will inform you without delay and may suspend its execution until clarified. If Union or Member State law exceptionally requires us to process the data, we will inform you of that requirement before processing, unless that law prohibits such information.

05Confidentiality

Persons authorized to access personal data are bound to confidentiality. We do not look at the contents of your account unless it is unavoidable for troubleshooting; even then, access is limited to the necessary minimum.

06Technical and organizational measures

We implement the measures described under "Data security" in our privacy policy, in accordance with Art. 32 GDPR, in particular:

• transport encryption (HTTPS/TLS with HSTS) for all connections
• database operated on an internal network not reachable from the internet, on servers in Germany
• server-side storage of Google OAuth tokens, never passed to the browser or third parties
• access only after authentication; AI access only after explicit, per-client revocable OAuth authorization
• restricted, key-based administrative server access
• full deletion cascade upon account deletion

We may evolve these measures as long as the agreed level of protection is not reduced.

07Sub-processors

You approve the use of the following sub-processors:

• Hetzner Online GmbH, Gunzenhausen (Germany): hosting of the application and database.
• OpenAI, L.L.C., San Francisco (USA): only where you use AI features, for generating contact overviews and semantic search; the transfer to the USA is safeguarded by EU standard contractual clauses, and under OpenAI's API terms the data is not used for model training.

Google LLC is not our sub-processor: synchronization with Google Contacts happens on your instruction using the Google account you connected; your own contract with Google governs. The same applies to AI clients you authorize yourself.

We will inform you of intended changes to sub-processors at least 30 days in advance in text form. You may object to a change for good data protection reasons; if the objection cannot be resolved amicably, you may terminate the service contract as of the effective date of the change.

08Assistance

We assist you, to the extent reasonable, in fulfilling data subject rights (Art. 12 to 22 GDPR), including through the export, correction, and deletion functions built into Umfeld, and with your obligations under Art. 32 to 36 GDPR, insofar as the necessary information is available to us. Requests from data subjects that reach us directly are forwarded to you without delay.

09Notification of data breaches

We will notify you without undue delay after becoming aware of a breach affecting personal data processed on your behalf, including the information required under Art. 33(3) GDPR to the extent available to us. Assessing and notifying supervisory authorities and data subjects is your responsibility as controller; we will support you in doing so.

10Deletion and return

Upon termination of the service contract we delete all data processed on your behalf completely, as described under "Retention period" in the privacy policy. Before termination you can save your data via the export function; your Google address book remains in your Google account in any event. Statutory retention obligations remain unaffected.

11Evidence and audits

On request, we will provide the information necessary to demonstrate compliance with this DPA, in particular descriptions of the technical and organizational measures. On-site audits are possible with reasonable advance notice during normal business hours, provided they do not disproportionately disrupt operations; they may be replaced by meaningful self-assessments or audit reports.

12Final provisions

German law applies. Amendments to this DPA require text form. Should individual provisions be invalid, the remainder of the agreement remains effective; the statutory provision replaces the invalid one.