Data Processing Agreement

Last updated: 2026-02-24

This Data Processing Agreement ("DPA") is entered into between the Customer ("Controller") and Sealsport Solutions GmbH ("Processor") and supplements the Terms and Conditions. It governs the processing of personal data by the Processor on behalf of the Controller in accordance with Article 28 of the GDPR.

1. Definitions

  • Controller: The Customer who determines the purposes and means of processing personal data via the Sealsport platform.
  • Processor: Sealsport Solutions GmbH, which processes personal data on behalf of the Controller.
  • Personal Data: Any information relating to an identified or identifiable natural person processed through the Service.

2. Subject Matter & Duration

The Processor processes personal data on behalf of the Controller for the purpose of providing the Sealsport contract management platform. The duration of processing corresponds to the duration of the service agreement between the parties.

3. Scope & Purpose of Processing

The Processor processes personal data solely for the purpose of providing the Service as described in the Terms and Conditions. This includes:

  • Categories of data: names, contact details, contract data, and documents uploaded by the Controller
  • Data subjects: the Controller's employees, team members, contractors, and contractual partners referenced in uploaded documents

4. Processor Obligations

The Processor shall:

  • Process personal data only on documented instructions from the Controller, unless required by EU or member state law
  • Ensure that persons authorized to process the data have committed themselves to confidentiality
  • Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk
  • Not engage another processor without prior written authorization of the Controller
  • Assist the Controller in fulfilling obligations regarding data subject rights and data protection impact assessments
  • At the Controller's choice, delete or return all personal data after the end of the service, and delete existing copies unless storage is required by law
  • Make available to the Controller all information necessary to demonstrate compliance and allow for audits

5. Technical & Organizational Measures

The Processor implements the following measures to protect personal data:

  • Encryption of documents at rest using strong encryption algorithms
  • Access control via authenticated, time-limited signed URLs
  • Strict tenant isolation ensuring complete data separation between customers
  • Encrypted backups stored securely
  • Comprehensive audit logging of all data access events
  • Firewall protection and network security; database not exposed to public internet

6. Sub-processors

The Controller grants general authorization for the use of the following sub-processors. The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors, giving the Controller the opportunity to object.

  • Hetzner Online GmbH: Server hosting and infrastructure (Germany)
  • Google LLC (Gemini API): Optional AI-powered document analysis (endpoint in Germany, data not stored by Google)

7. Data Transfers

All data is processed and stored within the EEA (servers located in Germany). If any sub-processor requires data transfer outside the EEA, the Processor shall ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

8. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. The notification shall describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

9. Duration & Termination

This DPA shall remain in effect for the duration of the service agreement. Upon termination, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies, unless applicable law requires further storage.

10. Governing Law

This DPA is governed by the laws of the Republic of Austria and the GDPR. Any disputes shall be subject to the exclusive jurisdiction of the competent court in Linz, Austria.

Contact

Sealsport Solutions GmbH
Am Hohlweg 16
4221 Steyregg, Austria
Company register number (FN): FN 681761 s (Landesgericht Linz (Regional Court Linz))
Email: hello@sealsport.io