Data Processing Agreement (DPA)

This data processing agreement pursuant to Art. 28 GDPR is concluded between the user of the Sanctions Compliance Platform as controller (hereinafter "Client") and Alexander Bergmann, Quellenstraße 7a, 70376 Stuttgart, Germany, as processor (hereinafter "Contractor").

This agreement forms part of the user contract under the Terms of Service. It is concluded when the Terms of Service are accepted; electronic form is sufficient (Art. 28(9) GDPR). On request, the Contractor provides a version for signature. The German version is legally binding.

This agreement covers the processing of personal data of third parties that the Client enters into the platform or has monitored (hereinafter "Client Data"). It governs the rights and obligations of the parties under data protection law with regard to this data.

This agreement does not cover the Client's account data or the data from official sanctions lists; the Contractor is itself the controller for this data (see Privacy Policy). In the event of conflicts between this agreement and the Terms of Service, this agreement takes precedence in matters of data protection.

Purpose: screening of persons, companies and other details against sanctions lists, storage of the search history, ongoing monitoring of selected entries with notification of status changes, and provision of the data export.

Nature of processing: receiving input via the web interface or the API, storing, matching, displaying, sending notifications by email, exporting and deleting.

Categories of data, to the extent entered by the Client: names and aliases, date and place of birth, nationality, addresses, contact details (email addresses, phone numbers), identification numbers (e.g. passport, identity card, tax and commercial register numbers, VAT ID, LEI, DUNS number) and financial identifiers (e.g. IBAN, BIC, crypto wallet addresses).

Categories of data subjects: business partners, customers, suppliers, employees and prospects of the Client and other natural persons screened by the Client, including representatives and beneficial owners of companies.

The platform is not intended for special categories of personal data (Art. 9 GDPR). The Client does not enter such data.

Processing lasts as long as the user contract. It takes place on servers in a data centre in the European Union. Email notifications are sent via a service provider in Switzerland, for which there is an adequacy decision of the European Commission (Art. 45 GDPR). Processing outside the EU or the EEA only takes place if the requirements of Art. 44 et seq. GDPR are met.

The Contractor processes Client Data only on documented instructions from the Client, unless required to do so by Union or Member State law. In that case, the Contractor informs the Client of that legal requirement in advance, unless that law prohibits such information.

The instructions result from the Terms of Service, this agreement and the Client's use of the platform's functions (e.g. searches, monitoring, export, deletion). The Client issues further instructions in text form to alexander.bergmann@scp.one.

If the Contractor considers that an instruction infringes data protection law, it informs the Client without undue delay. It may suspend execution of the instruction until the Client confirms or changes it.

The Contractor processes Client Data solely to provide the contractual services and not for its own purposes. Technical logging for error analysis and defence against attacks is part of providing the services.

Persons with access to Client Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Contractor implements the technical and organisational measures pursuant to Art. 32 GDPR described in section 11. It may develop them further as long as the level of protection is not reduced.

The Contractor assists the Client in fulfilling the rights of data subjects (Art. 12 to 22 GDPR). The Client can view, export and delete Client Data itself using the platform's functions. If a data subject contacts the Contractor directly, the Contractor forwards the request to the Client without undue delay.

The Contractor notifies the Client of a personal data breach concerning Client Data without undue delay after becoming aware of it. The notification contains, as far as known, the nature of the breach, the categories of data concerned, the approximate number of data subjects concerned, the likely consequences and the measures taken or proposed.

The Contractor also assists the Client with the security of processing, notifications to the supervisory authority, communications to data subjects, data protection impact assessments and prior consultations (Art. 32 to 36 GDPR), in each case within the scope of the information available to it.

The Contractor informs the Client by email at least four weeks in advance of any intended addition or replacement of a sub-processor. The Client may object within this period for an important reason relating to data protection. If no agreement is reached, either party may terminate the contract with effect from the date of the change.

The Contractor contractually imposes on each sub-processor data protection obligations equivalent to those of this agreement. It is liable to the Client for their compliance in accordance with Art. 28(4) GDPR.

On request, the Contractor makes available to the Client all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

The Client or an auditor mandated by it and bound to confidentiality may conduct audits, including inspections. These must be announced with reasonable notice, as a rule two weeks, and conducted without disproportionately disrupting operations. Where possible, evidence is first provided by written information and documentation.

The Client can retrieve Client Data at any time in a common, machine-readable format (JSON) using the export function in the account settings.

At the end of the contract, i.e. when the user account is deleted, the Contractor deletes or anonymises the Client Data unless there is a legal obligation to store it. Search texts in technical log files are deleted after 14 days, backups in accordance with section 11.

On request, the Contractor confirms the deletion to the Client in text form.

This agreement applies for the term of the user contract and beyond for as long as the Contractor processes Client Data. Amendments to this agreement follow the procedure for amendments to the Terms of Service.

Should any provision of this agreement be invalid, the validity of the remaining provisions remains unaffected. The law of the Federal Republic of Germany applies.