Data processing agreement

1. Parties and scope

This agreement is between the business that has an account at 402lounge ("you", "the controller") and Florian Baraz, Gurlittstr. 6, 27474 Cuxhaven, Germany ("we", "402lounge", "the processor"). It is part of the terms of service and applies as long as we process personal data on your behalf under them (Art. 28 GDPR).

It covers the personal data in Annex 1: what you, your agents and your people put into 402lounge, and what 402lounge creates for you from it, for example receipts and monthly documents.

It does not cover data we process as a controller in our own right: visits to our website, security logs, the proofs and acceptances with which an agent signs up, the directory and the register, totals about payments to listed sellers, our own invoices and books, and reports under the Digital Services Act. Our privacy notice describes those.

If this agreement and the terms differ on the protection of personal data, this agreement applies.

2. Your instructions

We process the data only on your documented instructions. Your instructions are the terms, this agreement and the settings and requests you, your agents and your people make in 402lounge, through the dashboard, the API or the MCP server. Further instructions need text form, for example an email to privacy@402lounge.com.

You instruct us to keep your receipts and documents, with their archive files, as long as your company has a paid plan or the archive, and without either to delete those of a year on 31 January of the next year, never earlier than 30 days after a paid plan or the archive ended and always after a notice. Invoices and credit notes issued in a seller's name stay for that seller while it keeps its records with us, as its own records, and you no longer see them. Your company keeps its own duty to retain its records and can download them at any time.

If we believe an instruction breaks data protection law, we tell you without undue delay and may wait to follow it until you confirm or change it.

We process the data in other ways only where the law of the EU or of Germany requires it. Then we tell you before we do, unless that law forbids it.

3. Confidentiality

Everyone who can access the data on our side is bound to confidentiality, by contract or by law, and may use it only as this agreement allows. Today that is Florian Baraz alone.

4. Security

We protect the data with the technical and organisational measures in Annex 3 (Art. 32 GDPR). We may change them as technology moves on, as long as the level of protection does not go down.

5. Other processors

You allow us to use the other processors in Annex 2. We tell you at least 30 days before we add or replace one, by a notice in your account and by email to your company's confirmed address. You can object within that time for a reason in data protection law. If we cannot meet the objection, you can end the contract before the change takes effect, and we refund what you paid for the time after it.

We bind every other processor to the same data protection duties as this agreement, in a contract that meets Art. 28 (4) GDPR. We remain responsible to you for them.

6. Data outside the EU

Some processors in Annex 2 are based in the USA or can access data from there. Each transfer rests on the adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 where the processor is certified under it, and otherwise on the standard contractual clauses of the European Commission (Art. 46 (2) (c) GDPR). You can ask us for a copy.

7. Helping you

We help you, as far as we can with reasonable effort, to answer requests from people who use their rights under Art. 15 to 22 GDPR. Most of this you can do yourself in 402lounge: the export of your company's data, removing people and agents, and closing your company. If a person asks us directly about data under this agreement, we send the request on to you.

We help you with security, with reporting a breach to the authority and to the people concerned, with impact assessments and with prior consultations (Art. 32 to 36 GDPR), with the information we have.

8. Breaches

If we become aware of a breach of the security of the data under this agreement, we tell you without undue delay and within 48 hours at the latest, by email to your company's confirmed address. We tell you what happened, which data and how many people are affected as far as we know, what it may lead to and what we did or suggest. What we do not know yet, we send as soon as we know it.

9. At the end

When the contract ends, you have 30 days to download your data, as the terms say. A company that closes in 402lounge keeps access until the end of the month in which these days end. After that we delete the data under this agreement, except receipts and documents, which follow on the first 31 January after the closing, and what the law requires us to keep. Database backups that still hold it run out as Annex 3 says. Until then we do not use them for anything but a restore, and data that a restore brings back is deleted again.

10. Proof and audits

We give you the information you need to show that we keep this agreement. Once a year, or after a breach, you or an auditor bound to confidentiality may check this, with at least 30 days' notice, during normal business hours and without disrupting the service. Audits are at your cost. We can first offer documents or a written report that answers your questions.

11. Liability and term

Liability follows the terms of service, unless Art. 82 GDPR requires otherwise. This agreement runs as long as we process personal data on your behalf. German law applies, and the place of jurisdiction is the one in the terms.

Annex 1: Data and people

Annex 2: Other processors

Signing in with Google and buying a plan through Polar are not processing on your behalf. Google for its sign-in and Polar Software, Inc. as seller of paid plans (merchant of record) act as controllers in their own right.

Annex 3: Technical and organisational measures

Access. Only Florian Baraz has administrative access to the accounts at the processors in Annex 2, each protected with a second factor. Keys for the database are kept in the secret store of Cloudflare and never in the code. Only the server holds the key that can write to the database. Agents and people read only the data of their own company, enforced in the database by row level rules.

Sign-in. Agents prove their wallet with a signature or a payment. Session tokens are stored only as hashes and stop working after 90 days or when revoked. People sign in with a link by email, with Google or with a wallet. Every write needs a valid session.

Transport and storage. All traffic runs over HTTPS. The database and the archive are encrypted at rest by their providers. Backups are also encrypted with a key that only Florian Baraz holds, kept apart from the systems.

Integrity. Issued documents cannot be changed in the database. Each one carries the hash of its content and of the company's document before it. Archive files are written once and never overwritten. Code and database schema are under version control.

Availability. The database is backed up every night. Daily backups run out after 35 days, the backup of the first day of each month after twelve months. How to restore is written down.

Separation. Every record belongs to one company and is read only with that company's rights. Development and tests run apart from production, and tests remove their data.

Minimal data. An account needs only an agent name and a wallet. IP addresses in the security log are hashed with a key that changes every day, and deleted after 30 days.

Deletion. Deletion runs on fixed schedules: removed agents after 7 days, sign-in codes and challenges within a day, single payments of wallets outside 402lounge after 90 days, receipts and documents of companies without a paid plan or the archive on 31 January for the year before, accepted terms and wallet proofs three years after the end of the year the account ended.

Monitoring. Jobs and checks run on schedules. If reading the chain falls behind, an exchange rate is missing or the monthly documents or the archive fail, an incident opens and the operator gets an email. A public status page shows the state.

Review. We check these measures at least once a year and whenever the service changes in a way that matters for them.