Data Processing Agreement (DPA)

Version: August 2026

This agreement sets out the data protection obligations between a LinaFora business customer as controller or processor (“Customer”) and Martin Kühn – LinaFora as processor or sub-processor (“LinaFora”), insofar as LinaFora processes personal data for the Customer. It becomes part of the contract when agreed in the offer, upon registration or otherwise electronically.

1. Subject matter and duration

The subject matter is the processing of personal data for the provision and support of the booked LinaFora software and the associated storage, synchronisation, support, backup and output functions. The processing generally lasts as long as the underlying main contract, unless statutory retention obligations provide otherwise.

2. Nature and purpose of the processing

Depending on the functions activated, the processing comprises collecting, recording, organising, storing, displaying, transmitting, synchronising, exporting, backing up, restoring, restricting and erasing data. The purpose is solely the technically agreed provision of the LinaFora services and the execution of the Customer's documented instructions.

3. Types of personal data

Depending on the Customer's configuration, the following may in particular be processed: master and contact data, user and access data, employee/driver data, customer and recipient data, order and process data, vehicle and case data, location data, photos, signatures, documents, report data, invoicing and accounting data as well as freely defined form content.

The processing of special categories of personal data pursuant to Art. 9 GDPR is not envisaged as a standard purpose and requires express agreement before use.

4. Categories of data subjects

Depending on the use, those affected may in particular be employees, drivers, contractors, the Customer's contact persons, the client's customers, vehicle keepers/users, collection and handover personnel, invoice recipients and other persons whose data the Customer includes in its process.

5. Binding instructions

LinaFora processes personal data only on the Customer's documented instructions, unless a legal obligation requires different processing. The configuration and contractual use of the software are deemed to be documented instructions. If LinaFora considers an instruction to be unlawful under data protection law, the Customer is informed to the extent legally permitted.

6. Confidentiality

LinaFora ensures that persons authorised to process data are bound to confidentiality or subject to an appropriate statutory duty of secrecy.

7. Technical and organisational measures

Taking into account the nature, scope, circumstances and risks of the processing, LinaFora implements appropriate technical and organisational measures. These include, where relevant to the respective service, in particular:

• encrypted transmission via TLS/HTTPS,
• authentication and role-/account-based access control,
• logical separation of customer and account data,
• limiting administrative access to necessary cases,
• update and patch management for components controlled by LinaFora,
• backup/export and restore mechanisms to the extent offered,
• measures for detecting and handling security and availability incidents.

The measures are developed further in line with technical progress, without unreasonably falling below the agreed level of protection.

8. Sub-processors

The Customer grants LinaFora general authorisation to engage further processors insofar as this is necessary for the operation and provision of the services. The technical environment currently envisaged may in particular include:

• ALL-INKL.COM – Neue Medien Münnich: web hosting and email infrastructure, insofar as used for the respective service.
• Google / Firebase / Google Cloud: in particular authentication, Cloud Firestore, data storage and synchronisation and associated cloud services, insofar as activated.

LinaFora binds sub-processors to data protection obligations to the necessary extent. The Customer is informed in a suitable manner of material changes regarding sub-processors and may object for an important data protection reason. If no reasonable alternative is possible, the affected service may be terminated with regard to the processing concerned.

9. Transfers to third countries

Insofar as sub-processors process data outside the European Economic Area, LinaFora ensures that a transfer mechanism permitted under Chapter V GDPR is in place, for example an adequacy decision or appropriate safeguards such as standard contractual clauses.

10. Support for the Customer

LinaFora supports the Customer, to a reasonable and technically feasible extent, with requests from data subjects, data protection impact assessments, consultations with supervisory authorities and the fulfilment of information and documentation obligations, insofar as the support concerns the data processed by LinaFora. Extraordinary effort may be remunerated separately after prior agreement, provided LinaFora is not responsible for the cause.

11. Personal data breaches

LinaFora informs the Customer without undue delay after LinaFora has established a personal data breach in the processing system for which LinaFora is responsible, and provides the information available for assessment and, where applicable, notification.

12. Erasure and return

After the main contract ends, personal data processed on behalf is, at the Customer's choice, erased or – where technically provided for – handed over, unless a statutory obligation to continue storing it exists. Backup copies may persist for a limited technical rotation period and are not used for other purposes during that time.

13. Evidence and audits

LinaFora makes available to the Customer, to a reasonable extent, the information required to demonstrate compliance with Art. 28 GDPR. Audits should initially take place by way of documentation, information and existing evidence. On-site audits are possible where there is legitimate cause, with reasonable advance notice and while preserving the confidentiality of other customers.

14. Responsibility of the Customer

The Customer is responsible for the lawfulness of the processing, for fulfilling its information obligations, for selecting the data collected in the software and for issuing lawful instructions. It ensures that only authorised users obtain access and that personal data is not entered into LinaFora without the necessary legal basis.

15. Order of precedence

In the event of contradictions between this DPA and the main contract, the provisions of this DPA take precedence for questions of processing on behalf. In all other respects, the main contract remains unaffected.

This agreement is also provided in other languages. The translations serve comprehension only; the German version alone is authoritative and legally binding.