Data processing agreement (DPA)

§ 1 Subject matter, duration, location

(1) The processor (Honodo GbR, Lohwaldstr. 22, 86356 Neusäß, Germany) processes personal data on behalf of the customer in order to provide the Honodo platform to the customer in accordance with the Terms and Conditions.

(2) This agreement applies for the duration of the user agreement, including any trial period, and until complete deletion pursuant to § 8.

(3) Processing takes place exclusively in the European Union, on a server in the Falkenstein data centre (Germany). A relocation to a country outside the EU or the EEA only takes place with the customer's prior consent in text form and subject to the requirements of Art. 44 et seq. GDPR.

§ 2 Nature and purpose, data, data subjects

(1) Nature and purpose: storage, display, calculation, generation of documents (PDF, e-invoice), sending at the customer's instigation and deletion of data that the customer records in the platform – for managing the customer's projects, clients, quotes and invoices.

(2) Types of personal data:

• names, addresses, email addresses and telephone numbers of the customer's clients and contact persons,
• project, quote, fee and invoice data relating to individuals,
• data of the customer's users and employees (name, email, role, location assignment),
• data imported via interfaces, e.g. time entries from clockodo,
• contents of uploaded files such as logos and documents.

(3) Data subjects: the customer's clients, principals and contact persons, its employees and users, and other persons named in the customer's documents.

(4) Special categories of personal data (Art. 9 GDPR) are not subject to processing; the customer does not record such data in the platform.

§ 3 Instructions

(1) The processor processes the data only on documented instructions from the customer. The instructions are set out conclusively in the Terms and Conditions, this agreement and the customer's settings and actions in the platform. The customer issues further instructions in text form to info@honodo.de.

(2) If the processor is required by law to carry out other processing, it informs the customer in advance, unless the law prohibits this.

(3) If the processor considers an instruction to be unlawful, it informs the customer without undue delay and may suspend its execution until it is confirmed.

§ 4 Obligations of the processor

• It commits all persons who have access to the data to confidentiality, unless they are subject to a statutory obligation of confidentiality.
• It takes the technical and organisational measures pursuant to Art. 32 GDPR set out in Annex 1 and adapts them to the state of the art without falling below the level of protection.
• It does not use the data for its own purposes and does not pass it on to third parties, except to sub-processors pursuant to § 5 or on the customer's instructions (e.g. sending emails via the customer's mailbox, interfaces set up by the customer).
• It notifies the customer of personal data breaches without undue delay, if possible within 24 hours of becoming aware of them, with the information pursuant to Art. 33 (3) GDPR, insofar as available.

§ 5 Sub-processors

(1) The customer approves the use of the sub-processors listed in Annex 2.

(2) The customer grants a general authorisation for further or other sub-processors. The processor informs the customer in text form at least four weeks in advance. The customer may object within this period for an important reason under data protection law; if no agreement is reached, the customer may terminate the user agreement extraordinarily with effect from the time of the change.

(3) The processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement.

(4) Providers chosen by the customer itself (its own email mailbox, interfaces to ERPNext, Odoo or clockodo) are not sub-processors of the processor; the transfer to them takes place on the customer's instructions.

§ 6 Assistance to the controller

(1) The processor assists the customer with appropriate measures in responding to requests from data subjects (Art. 15–22 GDPR). If a data subject contacts the processor directly, it forwards the request to the customer without undue delay.

(2) It assists the customer with the obligations under Art. 32–36 GDPR (security, notifications, data protection impact assessment, consultation), taking into account the information available to it.

(3) The customer performs many tasks itself in the platform, such as access (view and PDF export), rectification and deletion of records.

§ 7 Evidence and audits

(1) The processor provides the customer on request with all information necessary to demonstrate compliance with this agreement.

(2) It allows for audits, including inspections, by the customer or an auditor appointed by the customer who is bound to confidentiality. Inspections must be announced with reasonable notice, as a rule four weeks, and take place during normal business hours without avoidable disruption of operations.

§ 8 Deletion and return

(1) After the end of the user agreement, the customer can export its data for 30 days (Terms § 9 (7)). After the export period has expired, access is closed and the account is initially archived; the data stored on the customer's behalf is then deleted. Archiving alone does not fulfil the deletion obligation. The customer may instead instruct return or earlier deletion. The only exception is data that the processor itself is legally obliged to store. The customer's retention obligations do not justify a blanket retention of all firm data by the processor.

(2) At the customer's request, the processor confirms the deletion in text form.

(3) Data in backup copies that cannot technically be cleaned up individually remains blocked for operational use and is overwritten in the documented backup cycle. In the event of a restoration, deletions already carried out are applied again before the data is used productively again.

§ 9 Final provisions

(1) Liability is governed by Art. 82 GDPR; otherwise the liability rules of the Terms and Conditions apply.

(2) In the event of contradictions, this agreement takes precedence over the Terms and Conditions in matters of data protection.

(3) Amendments to this agreement are governed by § 12 (2) of the Terms and Conditions.

Annex 1: Technical and organisational measures

• Physical access: The server is located in the data centre of Hetzner Online GmbH in Falkenstein; physical security (access control, fire protection, power supply) follows the measures of Hetzner as sub-processor.
• System access: Sign-in only with a personal account; passwords stored exclusively as a cryptographic hash; optional two-factor sign-in (TOTP); limitation of repeated sign-in attempts; all sessions ended on password change. Administrative access to the server only for the partners.
• Data access: role-based permissions assigned by the customer itself; permissions checked on the server.
• Separation: data of different customers is logically separated; every query is restricted to the respective customer.
• Transfer: transmission exclusively encrypted via HTTPS (TLS), HSTS in production.
• Input and integrity control: finalised invoices can no longer be changed; server logs for fault analysis and defence against attacks, deleted after 14 days.
• Application protection: HTTP security policies (including Content Security Policy), input validation, limitation of automated access.
• Review procedure: review and adjustment of the measures when the platform changes, at least once a year.

Annex 2: Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – provision of the server (Infrastructure as a Service) in the Falkenstein data centre, Germany.

As of 16 October 2026