Data Processing Agreement (DPA) under Art. 28 GDPR

Last updated: [date of publication]

Between you, the customer using Capture under our terms (“you”, controller), and sourcenet.io UG (haftungsbeschränkt), Paul-Klee-Str. 14, 40822 Mettmann, Germany (“we”, processor).

This agreement forms part of our terms and applies with them, without a separate signature. If you would like a signed copy for your records, write to us at hello@sourcenet.io.

This English version is provided for information; the German version (Vertrag zur Auftragsverarbeitung) is binding.

1. Subject matter

1. We process personal data on your behalf to the extent that you and the people you invite enter or upload it in Capture. The subject matter, nature and purpose of the processing, the types of data and the data subjects are set out in Annex 1.
2. The term of this agreement follows the subscription under our terms. It continues to apply for as long as we keep data on your behalf, in particular in an archived workspace.
3. If you yourself use Capture on behalf of a third party, for example as a consultant for your client, we are your sub-processor. This agreement then applies accordingly; you make sure that your agreement with the third party allows this.

2. Instructions

1. We process the data only on your documented instructions, including with regard to transfers to a third country, unless EU or German law requires us to do otherwise. In that case we inform you beforehand, unless the law prohibits it.
2. Your instructions are this agreement, the terms and what you do in Capture: creating, changing, sharing, exporting, archiving data and having it deleted. The owner or an administrator of the workspace gives further instructions in text form.
3. If we consider an instruction to be unlawful, we tell you without undue delay. We may suspend it until you have confirmed or changed it.

3. Confidentiality

Everyone at our end who has access to the data is bound to confidentiality or subject to a statutory duty of secrecy. They access data only where the service requires it, for example for a support request or a fault.

4. Security of processing

1. We take the technical and organisational measures under Art. 32 GDPR described in Annex 2.
2. We may develop the measures further as long as the level of protection does not fall. We document material changes and share them with you on request.

5. Sub-processors

1. You agree to the sub-processors listed in Annex 3.
2. We announce a new sub-processor, or the replacement of an existing one, at least 30 days in advance by e-mail to the owner of the workspace. You may object for good reason relating to data protection. If we find no solution, you may terminate the subscription for cause before the change takes effect; we refund the price for paid time after that pro rata.
3. We bind every sub-processor by contract to the same data protection obligations as apply to us under this agreement. We are liable for it as for ourselves.

6. Transfers to third countries

We store the data in your workspace in the EU, in Frankfurt am Main. Processing outside the EU or the EEA takes place only where Annex 3 says so, and only with the safeguards of Art. 44 et seq. GDPR, such as an adequacy decision like the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. Assistance

1. Data subjects’ rights: if a data subject contacts us, we forward the request to you without undue delay and do not answer it ourselves, except on your instruction. With Capture’s functions and, where they are not enough, with our help, you can provide access, correct, export and delete data.
2. Your other obligations: we assist you with the security of processing, notifications of personal data breaches and data protection impact assessments (Art. 32 to 36 GDPR), as far as our part of the processing is concerned.
3. Assistance to the usual extent is included in the price. For exceptional effort that we did not cause, we may charge reasonable compensation by agreement.

8. Personal data breaches

1. If we become aware of a breach of the security of the data in your workspace, we notify you without undue delay, and at the latest within 48 hours, by e-mail to the owner and the administrators of the workspace.
2. As far as known, the notification states: what happened, which types of data and roughly how many people and records are affected, the likely consequences and what we are doing or propose to do about it. What we do not know yet, we provide as soon as we know it.
3. This allows you to meet your own 72-hour deadline for notifying the supervisory authority (Art. 33 GDPR).

9. Deletion and return

1. What happens to your data after a subscription ends is governed by our terms (Section 8): the workspace is archived and remains readable until the owner asks for it to be deleted. If nobody has signed in for five years, we ask the owner once; if the owner does not reply within three months, we delete it.
2. Return: on request we provide the data to you at any time in a common, machine-readable format, file attachments in their original format, free of charge.
3. Deletion: if the owner asks for deletion, we delete the data within 30 days and confirm this in text form. Copies in our backups are overwritten as they expire, after 14 weeks at the latest. Data we have to keep because of legal obligations is deleted when the obligation expires.

10. Evidence and audits

1. We provide you with all information you need to demonstrate compliance with this agreement. This includes these annexes, further documents on request and the certificates and audit reports of our sub-processors, for example those of Google Cloud (including ISO/IEC 27001 and SOC 2).
2. If this evidence is not sufficient, you or an auditor bound to confidentiality who is not our competitor may carry out an audit at our premises: with reasonable notice, usually four weeks, during our business hours and at most once a year, unless there is a specific reason. You bear the costs of the audit.
3. We check our sub-processors’ data centres through their certificates and audit reports, not on site.

11. Liability and final provisions

1. Liability is governed by our terms (Section 13) and Art. 82 GDPR.
2. If this agreement and the terms contradict each other on data protection, this agreement prevails.
3. Otherwise the final provisions of the terms apply (Section 16).

Annex 1: Subject matter, nature and purpose of the processing

Subject matter and purpose: providing Capture, a web application for recording, planning and evidencing savings in procurement, under the terms.

Nature of the processing: storing, displaying, changing, organising, searching, exporting, backing up and deleting; sending the e-mails Capture triggers (invitations, password resets, notifications); support, including through the chat in Capture.

Types of data:

• Users: name, e-mail address, profile picture, role in the workspace, who invited them and when, last sign-in, sign-in data (password only as a hash, times and IP addresses of sign-ins);
• Work content: initiatives, savings, tasks, comments and the change log, with the people responsible and assigned; free text may contain further information about people;
• Suppliers: company details; later contact persons with name and contact details;
• File attachments: offers, contracts and other documents you upload; they may contain any personal data;
• Invitations: the invitee’s e-mail address, who invited them, expiry time.

Special categories of personal data (Art. 9 GDPR) are not intended. If you upload such data, for example in a document, you make sure there is the necessary legal basis.

Data subjects: your staff and the other people you invite to a workspace (such as clients, consultants, auditors); contact persons at suppliers; people named in content or documents.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

As of 28 October 2026. The measures describe our system as it is; we develop them further (clause 4.2).

Confidentiality

• Data centres: the data is stored with Google Cloud in Frankfurt am Main. Google is responsible for access control, building and hardware security, evidenced by certificates such as ISO/IEC 27001 and SOC 2. We run no servers ourselves.
• Separation of customers: every workspace is separated from all others. Security rules on the server enforce the separation, not the application in the browser: anyone who is not a member of a workspace receives none of its data, not even with a request they build themselves.
• Roles and permissions: four roles per workspace (administrator, buyer, finance, guest) with graded permissions; only administrators change roles, categories and settings. Initiatives, savings and tasks cannot be permanently deleted in the application; file attachments are deleted only by administrators and, for their own uploads, by buyers.
• Sign-in: through Google Identity Platform; passwords stored only as a hash. Invitation and reset links are random (256 bits), stored only as a hash, single-use and time-limited.
• Files: only members of the workspace find and open attachments, through a link that cannot be guessed. Uploaded files cannot be overwritten.
• Encryption: in transit (TLS) and at rest (Google Cloud’s default).
• Administrative access: all accounts with access to systems or data are protected by two-step sign-in. Only those who need access for their task have it.
• Support: we never change accounts or workspaces (members, owner, export, deletion) on the strength of a chat message alone; the user does it in the application, or we confirm it by e-mail to the address stored in the account.

Integrity

• Change log: every change to initiatives, savings and tasks is logged with the person and the time. Entries can only be added, not changed or deleted, and only in one’s own name; the server checks the time.
• Tested rules: every change to the security rules is automatically checked against a test suite before release and only then released by hand.
• Alerts: changes to security rules, permissions, keys and sign-in trigger an immediate alert by e-mail and chat.

Availability and resilience

• Backups: daily backups, kept for 14 weeks; in addition, restore to any point in time within the last seven days; a written restore procedure.
• Delete protection: the database is protected against accidental deletion.
• Infrastructure: the database runs regionally, spread across several zones in Frankfurt.

Procedures for regular review

• Incidents: we assess every indication of a personal data breach immediately and notify you of breaches within 48 hours (clause 8).
• Review: we review these measures at least once a year and after every material change to the system.
• Data protection by design: new functions collect only what they need; defaults are the most data-protective ones.

Annex 3: Sub-processors