This is a convenience translation; only the German version is legally binding. Read the German version (Vertrag zur Auftragsverarbeitung)

Data Processing Agreement

Data Processing Agreement pursuant to Art. 28 GDPR between the Customer (“Controller”) and Daniel Schenk, trading as QLYX Media, Goethestr. 10, 15831 Blankenfelde-Mahlow (“Processor”). It is agreed electronically when the Sendalo contract (main contract) is concluded (Art. 28(9) GDPR) and applies for its duration. Last updated: 19.10.2026.

1. Subject matter and duration

The Processor provides the Controller with the Sendalo software and, in doing so, processes personal data on the Controller’s behalf. The duration corresponds to the term of the main contract, including the deletion periods under no. 10. This agreement does not apply to processing for which the Processor is itself the controller (e.g. customer account, billing).

2. Nature and purpose of the processing

Storing, displaying, publishing and analysing social media content; retrieving and answering comments, reviews and messages; website chat, WhatsApp, Instagram and Facebook direct messages and emails from connected inboxes, including automatic replies by the AI assistant; answering and transcribing calls (AI phone add-on); comment automations with direct messages; providing a client portal with files, approvals, messages, electronic signatures and prize wheel; appointment booking including video appointments; link-in-bio pages and counting link clicks; managing ads; AI-assisted creation of texts, reply suggestions, alt texts, summaries and reports; sending notifications and booking confirmations.

3. Types of data and data subjects

• Data: names, contact details (email addresses, phone numbers, WhatsApp IDs), profile names and pictures, content of posts, comments, reviews, chats, emails and call transcripts, metrics for posts and ads, booking data, files, messages and documents exchanged in the client portal, evidence data of electronic signatures (name, signature image, time, IP address, document checksum), random visitor IDs of the website chat, referrer and time of link clicks, usage and log data.
• Data subjects: employees and customers of the Controller, followers and people who interact with its profiles, people who write to or call the Controller or use the chat, people who book appointments, click links or use the client portal.

Special categories of data (Art. 9 GDPR) are not intended to be processed. The Controller works towards ensuring that such data is not entered into Sendalo.

4. Instructions

The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless it is required to do so by Union or Member State law; in that case, it informs the Controller of that legal requirement before processing, unless that law prohibits this. Instructions result from this agreement and from the use and configuration of the features; individual instructions are given in text form. If the Processor considers an instruction to be unlawful, it informs the Controller without undue delay.

5. Confidentiality

All persons with access to the data are bound to confidentiality. Support access to the Controller’s data only takes place after the Controller has granted time-limited permission in the application and is logged.

6. Technical and organisational measures

The Processor takes the measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection does not decrease.

7. Sub-processors

The Controller approves the sub-processors listed in Annex 2. The Processor informs the Controller of new or changed sub-processors at least 14 days in advance in text form. The Controller may object for an important reason under data protection law; if no agreement can be reached, it may terminate the main contract with effect from the time of the change. The Processor contractually binds sub-processors to equivalent obligations and is liable for their compliance in accordance with Art. 28(4) GDPR. Transfers to third countries only take place under the conditions of Art. 44 et seq. GDPR.

8. Assistance

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects (among other things through export and deletion functions), with data protection impact assessments and in fulfilling the obligations under Art. 32 to 36 GDPR. If a data subject contacts the Processor directly, it forwards the request without undue delay. If the Controller cannot delete individual data (e.g. a single chat history) itself in the application, the Processor deletes it on instruction.

9. Personal data breaches

The Processor notifies the Controller of personal data breaches without undue delay, where possible within 48 hours of becoming aware of them, with the information under Art. 33(3) GDPR insofar as it is available, and supplements it as soon as further information becomes available.

10. Deletion and return

The Controller can export its data at any time. If it deletes its account, the Processor deletes the data immediately; if the main contract ends in another way, the Controller can still export its data for 30 days, after which it is deleted. This applies in each case unless Union or Member State law requires storage. Backups are overwritten after 30 days at the latest. On request, the Processor confirms the deletion in text form.

11. Evidence and audits

The Processor makes available all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, primarily through up-to-date documentation of the measures and evidence from the sub-processors. It allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it who is bound to confidentiality and is not a competitor of the Processor. On-site audits are possible after reasonable notice during normal business hours; each party bears its own costs.

12. Rights and obligations of the Controller

The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects, in particular for informing data subjects (Art. 13, 14 GDPR) and for any necessary consent. It informs the Processor without undue delay if it discovers errors or irregularities in the processing.

13. Liability and final provisions

Liability is governed by Art. 82 GDPR; otherwise, the liability rules of the main contract apply. In the event of contradictions, this agreement takes precedence over the main contract in matters of data protection.

Annex 1 – Technical and organisational measures

• Physical access control: operation exclusively in STRATO AG data centres in Germany with round-the-clock access protection (ISO/IEC 27001 certified data centres). No servers in office premises.
• System access control: server access only via SSH key, password login disabled, firewall with only the necessary ports, automatic lock after failed attempts, two-factor login for administrative accounts; in the application, login lockout, revocable sessions and optionally mandatory two-factor login for the team.
• Data access control: roles (admin, editor, read-only, client portal), strict separation of tenants in the application; client portal logins only see data of their own client; portal files are stored outside the public web directory and are only delivered after a permission check; support access only with the customer’s permission and with a log.
• Transfer control: transmission exclusively via TLS (HTTPS); connections to email servers only with TLS. Platform access tokens, WhatsApp credentials, passwords of connected email inboxes, own API keys and two-factor secrets are stored encrypted with AES-256-GCM, user passwords only as a scrypt hash.
• Input control: logging of logins, permission changes, publications and support access; logs are kept for 2 years.
• Availability: daily encrypted backup (AES-256), kept for 30 days, restoration tested regularly; monitoring of services; prompt installation of security updates.
• Separation control: data of different customers is logically separated; development and test environments do not use real data.
• Data minimisation: server log files are deleted after 7 days; portal files after the period set by the Controller; link clicks are counted without IP addresses.
• Review: the measures are reviewed and documented at least once a year and after significant changes.

Annex 2 – Sub-processors

The interfaces of social networks and of the WhatsApp Business Platform (Meta, TikTok, Google, LinkedIn, Pinterest, X), as well as the email providers of connected inboxes and the Controller’s telephone provider, are not sub-processors: the Controller uses these services on the basis of its own contracts, and Sendalo transmits the content there on its behalf. If the Controller adds its own Claude API key, it uses Anthropic on the basis of its own contract.