Data Processing Agreement (DPA)

As of: 21 September 2026 · Version 1.0 · Download as PDF

Translation of the German original dated 21 September 2026. The German version is legally binding.

Preamble

The Controller engages the Processor to provide the services specified in § 1 para. 1, in the course of which the Processor processes personal data of the Controller exclusively on the Controller's behalf and in accordance with its instructions. The Controller alone determines the purposes and means of the data processing. To this end, the parties conclude the following agreement within the meaning of Art. 28 paras. 3 and 4 GDPR, which specifies the main contractual relationship existing between the parties with regard to the processing of personal data on behalf of the Controller:

§ 1 Subject matter, purpose, duration and nature of the processing

(1) Subject matter of the agreement

1.1 The Processor provides the following services for the Controller: the provision and operation of the RocketFeed platform for the management, import, normalisation, mapping, optimisation, storage and distribution of product feeds, as well as for the connection of Google services, the analysis of aggregated KPI and performance data, plan management and billing, support, and logging, monitoring and error analysis. Optionally, AI-based optimisations of product data initiated by the Controller may be processed as suggestions via Mistral AI.

1.2 The provisions of this agreement apply to all activities that are connected with the main agreement concluded between the parties and in which the Processor and its employees, or persons engaged by the Processor, come into contact with personal data originating from the Controller, collected for the Controller, or otherwise processed on the Controller's behalf.

1.3 Processing operations in which the Processor itself determines the purposes and essential means of the processing and therefore acts as an independent controller are not covered by this agreement. This applies in particular to the initiation, establishment, performance and billing of its own contractual relationship, the fulfilment of commercial and tax law obligations, its own receivables management, its own marketing activities, and the general administration and protection of its own IT and business systems, insofar as these processing operations are not carried out on behalf of the Controller. Insofar as the Processor itself determines the purposes and essential means of such own processing operations, it bears sole responsibility under data protection law and does not act as a processor within the meaning of this agreement. The Processor shall also provide information on such processing operations in accordance with Art. 13 and Art. 14 GDPR.

(2) Purpose of the processing

2.1 Personal data is processed exclusively for the provision, operation, technical administration, maintenance, troubleshooting and contract-related technical improvement of the RocketFeed platform and for the performance of the services agreed in the main agreement. This includes in particular the registration and authentication of users and the management of user accounts and company affiliations. The purpose of the processing further comprises the technical assurance of the security and functionality of the platform. Processing for the Processor's own purposes independent of the provision of services, in particular for independent profiling, for its own marketing purposes or for training AI models with the transmitted data, is not covered. Any AI-based optimisations of product data are carried out exclusively on behalf of and in accordance with the instructions of the Controller.

2.2 In all other respects, the scope and purpose of the processing result from the main agreement concluded between the parties.

(3) Nature of the processing

3.1 The processing takes place in particular through the registration and authentication of the Controller. The Controller may register either by e-mail and password or via Google Login (OAuth 2.0). In the case of a Google Login, authentication is carried out by Google. The Processor then receives the Google account identifier and e-mail address back from Google. This account data is stored on the Hetzner infrastructure in Germany. Additional users can be added by the Controller via e-mail invitation with a one-time token. Furthermore, the plan status is retrieved and processed via Stripe. In this process, the account ID and the plan status are exchanged with Stripe. Payment and payment instrument data are processed and stored within the Stripe systems. In addition, the Controller's product feeds are imported from the Controller's shop or PIM. The import and storage take place entirely on the Hetzner infrastructure. Product data is transmitted to an AI service only if the Controller activates the relevant AI function or triggers it in an individual case. Only the product and prompt data required for the requested optimisation and a technically generated request identifier are transmitted. The Processor does not transmit any account, contract, billing or authentication data unless this is strictly necessary for technical reasons. The Controller must ensure that product data and custom prompts entered by it do not contain any personal data, or special categories of personal data, that are not required for the optimisation. Where product data is optimised by AI, the Processor transmits the data concerned and an internal prompt to Mistral AI and receives the optimisation suggestions in return. Optionally, at the express instigation of the Controller, selected product data required for the optimisation, an internal prompt, an optional custom prompt and a technically generated request identifier may be transmitted to Mistral AI SAS in the Europe region and processed there exclusively for the creation of optimisation suggestions on behalf of and in accordance with the instructions of the Controller. Direct customer identifiers are removed before transmission insofar as they are not required for the requested processing.

3.2 The processing comprises the collection, recording, storage, organisation, retrieval, consultation, use, transmission, comparison, restriction, erasure or destruction of personal data, insofar as this is necessary for the provision of the service specified in § 1 para. 1 and agreed between the parties under the main agreement.

(4) Duration of the processing

4.1 This agreement commences upon signature of the main agreement concluded between the parties, or as soon as the Controller agrees to the terms of the main agreement in the course of registration, the creation of an account or another documented electronic contract conclusion procedure.

4.2 The term of this agreement corresponds to the term of the main agreement and thus to the duration of the commissioned processing. It ends only when all data of the Controller has been returned or erased in accordance with § 9, unless a statutory retention obligation applies.

§ 2 Categories of data processed and categories of data subjects

(1) Categories of data processed

For the service described in § 1 para. 1, which is governed by the underlying main agreement, the Processor may process in particular the following categories of personal data:

• Personal master data and communication data; in particular first name, last name, e-mail address, company name, Google account ID, and user and company affiliation
• Contract, plan and billing data; in particular account ID, plan information and plan status as well as, insofar as processed within Stripe, first name, last name, company name, address, e-mail address, VAT identification number and payment data
• Usage, log and error data; in particular function and error messages, synchronisation processes, login times, user ID, and technical data from cookies and local storage, including session ID, CSRF token, preferences and the most recently selected working context
• Content data, insofar as provided or processed in the course of the service; in particular product data, prices, stock levels, product descriptions, image and product URLs, categories and more

The processing of special categories of personal data within the meaning of Art. 9 para. 1 GDPR and of personal data relating to criminal convictions and offences pursuant to Art. 10 GDPR is not the subject of this agreement. The Controller may provide such data only after prior express agreement and the definition of additional protective measures.

(2) Categories of data subjects

Data subjects include in particular:

• customers, prospective customers, users of the platform, website visitors and contact persons of customers,
• employees, freelancers and other authorised users or contact persons of the Controller,
• other natural persons,

insofar as their data is processed in the course of feed processing, support communication, billing or use of the website.

§ 3 Processing on documented instructions

The Processor processes personal data exclusively on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union law or German law. If the Processor is legally required to carry out processing, it shall inform the Controller of that legal requirement before processing, unless the law in question prohibits such notification on important grounds of public interest. The initial instruction results from this agreement, the underlying main agreement and the settings and function calls made by the Controller within the platform. Further instructions may be issued in writing or in text form via the agreed contact or support channels. The Processor shall document the instructions issued to it. If the Processor is of the opinion that an instruction infringes the GDPR, the German Federal Data Protection Act (BDSG) or any other applicable data protection provision, it shall inform the Controller without undue delay. It is entitled and, insofar as carrying out the instruction would result in its own breach of the law, obliged to suspend implementation until the instruction has been confirmed, amended or withdrawn. Confirmation by the Controller does not oblige the Processor to carry out an unlawful instruction. In such a case, the parties shall coordinate the further course of action with each other without undue delay.

§ 4 Obligations of the Processor

(1) Processing only within the agreed scope

The Processor processes personal data of the Controller exclusively within the scope of the engagement defined in this agreement and in the main agreement. Further instructions are binding only insofar as they remain within the subject matter of the agreement and applicable data protection law. Changes to the subject matter, nature or purposes of the processing require a documented amendment of this agreement or its annexes.

(2) Confidentiality and security of personal data

The Processor grants its personnel access to the personal data being processed only to the extent strictly necessary for the performance, management and monitoring of this agreement and of the main agreement existing between the parties. The Processor ensures that all persons authorised to process the data commit themselves to confidentiality before commencing their activities or are subject to an appropriate statutory obligation of confidentiality. This obligation continues to apply after the end of their activities. Access authorisations must be limited to the extent necessary for the respective task and reviewed regularly.

(3) Technical and organisational measures (TOM)

The Processor implements at least the technical and organisational measures set out in Annex I in order to ensure the security of the personal data in accordance with Art. 32 GDPR. The Processor may adapt the measures to technical developments, provided that the contractually agreed level of protection is not reduced. The Processor shall notify the Controller of any material changes that may adversely affect the security of the Controller's data before implementing them.

§ 5 Assistance to the Controller

(1) Data subject rights and other statutory assistance obligations

1.1 The Processor assists the Controller in fulfilling data subject rights under Chapter III of the GDPR, in particular requests for access, rectification, erasure or restriction of processing, data portability and the right to object pursuant to Art. 21 GDPR, insofar as the fulfilment of these rights concerns the processing of personal data by the Processor. To this end, the Processor shall, on documented instructions from the Controller, promptly implement the rectifications, erasures, restrictions or data transfers ordered by the Controller and ensure that corresponding orders are also implemented vis-à-vis engaged sub-processors.

1.2 In addition, the Processor shall, upon justified request, provide the Controller with the information necessary to fulfil the requirements of Art. 28 GDPR. This may be done in particular by means of suitable documentation, self-assessments, certifications, security concepts or audit reports.

1.3 If a data subject contacts the Processor directly and the request concerns data of the Controller, the Processor shall forward the request to the Controller without undue delay, unless there is a legal obligation to handle it directly. In doing so, the Processor supports the Controller and follows its instructions.

1.4 The Processor further assists the Controller with

• carrying out a data protection impact assessment where a form of processing is likely to result in a high risk to the rights and freedoms of natural persons;
• consulting the competent supervisory authority or authorities where the data protection impact assessment indicates that the processing would result in a high risk and the Controller does not take measures to mitigate the risk;
• the Controller's obligation to ensure that personal data is accurate and up to date, in that the Processor informs the Controller without undue delay as soon as it discovers that the personal data it processes is inaccurate or outdated;
• complying with the Controller's obligations under Art. 32 GDPR and Art. 36 GDPR, insofar as these obligations relate to the processing carried out by the Processor and the Controller cannot provide the assistance itself.

(2) Notification of personal data breaches

2.1 The Processor shall inform the Controller without undue delay as soon as it becomes aware of a personal data breach affecting personal data of the Controller.

2.2 The notification shall contain at least the following information, insofar as known to the Processor and ascertainable without disproportionate effort:

• a description of the nature of the personal data breach,
• where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned,
• a description of the likely consequences of the personal data breach, and
• a description of the measures already taken or proposed by the Processor to address the breach and, where applicable, measures to mitigate its possible adverse effects.

Information that cannot be provided immediately shall be provided subsequently without undue delay.

2.3 The Processor shall make its own notifications to supervisory authorities or data subjects only on documented instructions from the Controller, unless it is itself legally obliged to notify or cooperate. Statutory notification, disclosure and cooperation obligations remain unaffected.

§ 6 Sub-processors

(1) General authorisation

1.1 The Controller grants the Processor a general authorisation to engage the following sub-processors and services to the extent described in each case:

• Hetzner Online GmbH - for hosting, storage and backups of the platform
• Mistral AI SAS - for AI-based optimisation suggestions for product data
• Google Ireland Ltd. - for OAuth login, the Google Ads API and the planned Merchant Center API
• Stripe Payments Europe, Limited - for payment processing and plan management
• Calendly LLC - for appointment scheduling
• Atlassian Pty Ltd (Jira) - for support tickets
• PXCH Holding I, LLC (Encharge) - for sending the newsletter.

The contact details of these sub-processors and a specific description of the processing are provided separately by the Processor in a list designated as Annex II.

1.2 The Processor contractually obliges sub-processors in such a way that they are subject to data protection obligations corresponding to the obligations agreed in this agreement, ensuring in particular compliance with appropriate technical and organisational measures within the meaning of Art. 32 GDPR and adherence to the Controller's instructions.

1.3 The Processor shall expressly inform the Controller at least four weeks in advance of all intended changes and additions to the list in Annex II. The Controller may object within 14 calendar days on demonstrable data protection grounds. The parties shall endeavour to find an appropriate solution, in particular through additional protective measures, use of an equivalent alternative service or restriction of the affected function. If no reasonable solution is possible within a reasonable period, the Controller may terminate the service affected by the change for cause. For compelling reasons of security or operational stability, a change may exceptionally be made at shorter notice. In this case, the Processor shall inform the Controller without undue delay and give reasons for the shortened notice.

(2) Right to object

2.1 The Controller may object to the engagement or replacement of a sub-processor for important data protection reasons within 14 calendar days of receipt of the information.

2.2 If no objection is raised within the time limit, the change is deemed approved.

(3) Obligations of sub-processors

3.1 The Processor contractually obliges sub-processors in such a way that their data protection obligations essentially correspond to those of this agreement.

3.2 The Processor remains responsible to the Controller for compliance with the obligations by the sub-processors it engages.

(4) No sub-processing

Ancillary services without a direct connection to the main processing do not constitute sub-processing within the meaning of this agreement, in particular telecommunications, postal, transport, maintenance, payment, insurance, legal advisory or tax advisory services, unless they are specifically engaged to process personal data of the Controller.

§ 7 Data processing in third countries, outside the EEA/EU

The Processor generally processes data of the Controller within the European Union or the European Economic Area. A transfer to a third country or access from a third country is permitted only on documented instructions from the Controller or within the framework of a sub-processor approved under this agreement, and requires compliance with Art. 44 - Art. 49 GDPR. Where no adequacy decision pursuant to Art. 45 GDPR exists, the Processor ensures an adequate level of protection through appropriate safeguards pursuant to Art. 46 GDPR, in particular through the applicable standard contractual clauses of the European Commission. In doing so, the Processor assesses whether, taking into account the circumstances of the transfer, supplementary technical, organisational or contractual measures are required and implements them where necessary. The Processor shall also inform the Controller of the transfer instrument used for the respective recipient. If its validity lapses or it can no longer be complied with, the Processor shall notify the Controller without undue delay and suspend the affected transfer unless another valid instrument is provided without undue delay. These obligations also apply to further processors and their sub-processors.

§ 8 Control and information rights of the Controller

(1) General right to request evidence

1.1 The Controller is entitled to verify compliance with this agreement and the statutory requirements to the extent necessary.

1.2 To avoid unnecessary administrative effort, such verification shall primarily be carried out by means of:

• information provided by the Processor,
• submission of suitable documentation,
• security or data protection concepts,
• certificates,
• audit reports or
• standardised self-assessments

in each case upon corresponding request by the Controller.

(2) On-site inspections

2.1 If suitable evidence pursuant to § 8 para. 1 no. 1.2 is insufficient, or if there is a justified reason, in particular following a personal data breach or in the case of concrete indications of a breach of contract, an on-site inspection is permissible.

2.2 Such on-site inspections must be announced with reasonable notice, carried out during normal business hours and limited to the necessary scope. Unannounced inspections by competent supervisory authorities and urgent inspections for good cause remain unaffected.

2.3 The Processor shall cooperate in the on-site inspection and remedy any identified breaches without undue delay.

§ 9 Erasure and return after termination of the agreement

After completion of the processing of personal data or after the end of this agreement, the Processor shall erase all personal data of the Controller processed in the course of this processing relationship or, at the Controller's choice, return it to the Controller, unless a statutory retention obligation requires longer storage. The erasure covers in particular the Controller's data stored in production, including user accounts, original and optimised feeds, prompts and AI outputs, rules and configurations, API keys and tokens, and log and error data. The Processor shall document the performance of the erasure or return in writing or in text form and provide evidence thereof to the Controller.

§ 10 Liability

The Processor is liable to the Controller for damage suffered by the Controller as a result of processing of personal data that is not in accordance with the agreement or with instructions, in accordance with the statutory provisions and the liability provisions agreed in the main agreement. If the Processor proves that it is not in any way responsible for the circumstance giving rise to the damage, its liability lapses. The Controller and the Processor undertake to indemnify each other internally to the extent that one of them is solely or predominantly responsible for a breach of data protection provisions or of the provisions of this agreement.

§ 11 Final provisions

Should individual provisions of this agreement be or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected. The parties shall replace the invalid or unenforceable provision with a valid provision that comes as close as possible to the economic and legal purpose of the original provision.