Soma1. Application and roles
This Article 28 GDPR agreement is between the customer identified in the order and EUTS UG (haftungsbeschränkt), at the address in the Impressum. It takes effect when incorporated into their agreement. Before processing begins, the parties must complete and approve the processing, security and provider schedules below. This public text is not a completed or signed customer-specific processing record.
The customer is controller, or processor for its own controller; EUTS is processor or sub-processor for customer personal data. Where the customer is a processor it must hold authority for the appointment. GDPR definitions apply. EUTS’s separate controller activities are covered by the privacy notice. Deutsche AVV-Fassung.
2. Documented instructions and confidentiality
EUTS must process personal data only on documented customer instructions, including for transfers, unless Union or Member State law requires processing. In that case EUTS must inform the customer beforehand unless prohibited on important public-interest grounds. EUTS must immediately inform the customer if an instruction infringes applicable EU or Member State data-protection law and suspend the disputed processing pending clarification where necessary.
Instructions include the agreed service, configuration and authorised support requests within the schedule. Customer data must not be used for EUTS’s independent model training, marketing or resale. Authorised personnel must be bound to confidentiality or an appropriate statutory duty, trained for their role and given only necessary access.
3. Security
EUTS must implement appropriate Article 32 safeguards, taking account of risk, state of the art, implementation costs and the nature, scope, context and purposes of processing. The completed TOM schedule must identify actual controls and evidence for the deployment. Material changes must not reduce the agreed level of protection. The customer must provide information needed to assess risks, especially sensitive data or vulnerable individuals.
4. Sub-processors
EUTS may appoint only sub-processors covered by the customer’s specific or general written authorisation. The initial approved list must identify legal entities, service, data, locations and transfer safeguards. With general authorisation EUTS must notify the customer directly at least 30 days before adding or replacing a sub-processor, allowing objections on reasonable data-protection grounds. Updating a website alone is not notice.
Before an affected provider processes data, the parties must resolve an objection through an alternative or agreed remedy. If no compliant solution is available, the customer may end the affected service and receive a proportionate refund of prepaid unused fees. EUTS must impose equivalent Article 28 duties by contract and remains fully liable to the customer for the sub-processor’s performance of them. See the provider disclosure.
5. Rights, assessments and cooperation
Taking account of the nature of processing, EUTS must assist the customer by appropriate technical and organisational measures, insofar as possible, in responding to data-subject rights. Requests received directly must be forwarded promptly; EUTS must not decide them independently except as instructed or legally required. EUTS must assist with Articles 32–36 obligations, including breach assessment, DPIAs and prior consultation, taking account of information available to it. Any separately agreed charge must not prevent mandatory assistance.
6. Personal-data breaches
EUTS must notify the customer without undue delay after becoming aware of a personal-data breach, through the customer’s agreed incident contact. EUTS must not wait for a complete investigation. Initial and subsequent notices must provide available details of the nature of the breach, affected data and individuals, likely consequences, containment or mitigation, and a contact for follow-up. Missing information may be provided in phases without undue further delay.
EUTS must contain and investigate incidents, preserve relevant evidence and support the customer’s assessment. The controller’s potential 72-hour supervisory-notification deadline under Article 33(1) GDPR is separate from the processor’s duty under Article 33(2); it is not a permitted waiting period for EUTS. Each party retains its own legally required notifications.
7. Evidence and audit
EUTS must make available all information necessary to demonstrate Article 28 compliance and allow and contribute to audits, including inspections by the customer or its mandated auditor. Reasonable confidentiality, scheduling and safety arrangements may protect other customers but must not defeat these rights. Reports and questionnaires can be used first where sufficient; there is no absolute annual limit, advance-notice bar for urgent incidents or exclusion of a regulator’s access.
8. Return, deletion and transfers
At the customer’s choice, EUTS must return or delete personal data after the services end and delete existing copies unless Union or Member State law requires storage. The schedule must set export format, completion dates, backup expiry and any legal holds. Retained copies remain protected, restricted to their lawful purpose and are not put back into active use; deletion instructions must be reapplied after restoration. EUTS must provide confirmation when agreed. See exit terms.
Processing locations and remote access must match the approved schedule. Any Chapter V transfer requires a valid mechanism and necessary assessment before access starts. The transfer page identifies official SCCs; merely linking to them does not complete a transfer agreement.
9. Required annexes
| Annex | Required deployment details |
|---|---|
| A — Parties and processing | Customer and upstream controller if relevant; contacts; authorised instructions; service and modules; subject matter, nature, purpose, frequency and duration; data subjects; data types and sensitive-data safeguards. |
| B — Security and retention | Actual TOMs, evidence, hosting and support locations; access model; incident contacts; active-data and log retention; export, deletion and final backup expiry; recovery responsibilities. |
| C — Providers and transfers | Approved provider legal entities, tasks, data and countries; authorisation and notice contacts; transfer mechanism, SCC modules and annexes, assessment and supplementary measures where necessary. |
Typical proposed scope may include CRM, projects, inventory, invoices, documents and approved AI assistance; data subjects may include staff, customers, suppliers and business contacts. These are examples for scoping, not authorisation for all modules or all data. Article 9/10 data, employee location, recordings and other high-risk processing need explicit assessment and agreement.
10. Duration and precedence
This DPA lasts while EUTS processes customer personal data, including protected retained copies. It prevails over conflicting commercial terms for data protection; mandatory GDPR duties, data-subject rights and executed SCCs cannot be restricted by an order or liability clause. The parties must identify in their executed agreement whether the English DPA or German AVV controls interpretation; the mandatory Article 28 duties apply in either language.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub