Data Processing Agreement (DPA)

Version: October 2026

This Data Processing Agreement (hereinafter "DPA") is entered into between the customer using the capty platform (hereinafter "Controller") and

Frömmgen/Wintjens GbR
KWL Büro 0.05, Lothringer Str. 38
44805 Bochum, Germany
Email: hello@capty.ai
(hereinafter "Processor" or "capty")

The Controller and Processor are hereinafter referred to collectively as the "Parties".

This DPA supplements the main contract between the Parties (subscription agreement / Terms and Conditions, hereinafter "Main Contract") and governs the processing of personal data by capty on behalf of the Controller pursuant to Art. 28 GDPR.

Art. 1 – Subject Matter and Term

1.1 The subject matter of this DPA is the processing of personal data by capty in the course of providing the capty.ai SaaS platform in accordance with the services agreed in the Main Contract.

1.2 The term of this DPA corresponds to the term of the Main Contract.

Art. 2 – Nature, Purpose, and Scope of Processing

2.1 capty processes personal data solely for the purpose of providing the services agreed in the Main Contract and in accordance with the Controller's instructions.

2.2 Processing includes in particular:

• Storage and processing of media content uploaded by the Controller
• AI-assisted analysis and text generation based on uploaded content
• Management of user data, access rights, and workspace settings within the Platform
• Transmission of content to connected social media platforms at the Controller's instruction

Art. 3 – Categories of Personal Data and Data Subjects

3.1 Categories of personal data (to the extent provided by the Controller):

• Contact data (name, email address, company details)
• Media content that may contain personal data (images, videos, text)
• Usage and access data (roles, timestamps)

3.2 Categories of data subjects (to the extent provided by the Controller):

• Employees and users of the Controller
• Customers and contacts of the Controller who may appear in uploaded content

Art. 4 – Instructions

4.1 capty processes personal data solely on documented instructions from the Controller, including the instructions set out in this DPA and the Main Contract.

4.2 If capty considers that an instruction infringes the GDPR or other applicable data protection law, capty is entitled to suspend the execution of that instruction until the matter is resolved.

Art. 5 – Obligations of the Processor

capty undertakes to:

• process personal data only on documented instructions from the Controller;
• ensure that persons authorised to process data are bound by confidentiality;
• implement all technical and organisational measures required under Art. 32 GDPR (see Annex 2);
• comply with the conditions set out in Art. 28(2) and (3) GDPR for engaging sub-processors (see Art. 6);
• assist the Controller in fulfilling its obligations under Art. 32–36 GDPR;
• at the Controller's choice, delete or return all personal data after the end of processing (see Art. 9);
• make available to the Controller all information necessary to demonstrate compliance with this article and to allow for audits.

Art. 6 – Sub-processors

6.1 The Controller hereby grants general authorisation for the engagement of sub-processors. The sub-processors currently engaged are listed in Annex 1.

6.2 capty will inform the Controller of any intended changes to sub-processors (additions or replacements) with at least 14 days' notice by email. The Controller may object to an intended change in writing within this period for substantive reasons.

6.3 capty ensures that sub-processors are subject to the same data protection obligations set out in this DPA.

6.4 Onward chain at the provider for TikTok and LinkedIn. A data processing agreement under Art. 28 GDPR is in place with the provider named in Annex 1, BUNDLE SP. Z O.O. (bundle.social) — version v1.1 of 21 September 2026, issued to capty as customer. The provider in turn engages its own sub-processors; these are named individually in Annex 1a. It undertakes to announce changes to that set at least 14 days in advance, and capty passes such announcements on to the Controller under clause 6.2.

Art. 7 – International Data Transfers

7.1 Where the provision of services involves transfers of personal data to countries outside the EU/EEA, or where access from such countries cannot be excluded, the safeguards listed in Annex 1 apply.

7.2 capty ensures that appropriate safeguards pursuant to Chapter V GDPR are in place for such transfers (e.g. Standard Contractual Clauses, adequacy decision).

Art. 8 – Technical and Organisational Measures

capty implements the technical and organisational measures described in Annex 2 to ensure a level of protection appropriate to the risk. These measures may be further developed and adapted, provided the level of protection is not reduced.

Art. 9 – Deletion and Return of Data

9.1 Following termination of the Main Contract, capty deletes all personal data belonging to the Controller upon expiry of the 30-day export window set out in the Terms and Conditions, unless statutory retention obligations require further storage.

9.2 Upon written request by the Controller, capty will provide a data export in a machine-readable format to the extent technically feasible.

Art. 10 – Assistance and Audit Rights

10.1 capty will assist the Controller to a reasonable extent in responding to requests from data subjects and in fulfilling the obligations referred to in Art. 32–36 GDPR.

10.2 The Controller is entitled to verify capty's compliance with this DPA. Audits will be conducted with reasonable prior notice (at least 14 days) and during normal business hours. capty may alternatively provide evidence of compliance through certifications, audit reports, or equivalent documentation.

Art. 11 – Confidentiality and Liability

11.1 The liability provisions of the Main Contract and the statutory provisions of the GDPR (in particular Art. 82 GDPR) apply to the liability of the Parties under this DPA.

11.2 This DPA is governed by the laws of the Federal Republic of Germany. The exclusive place of jurisdiction is Bochum, Germany.

Annex 1: Current Sub-processors

Sub-processor	Purpose	Location / Transfer safeguard
Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany	Storage of media files uploaded by customers (images and video) on a server operated by capty. Hetzner provides the infrastructure only and takes no notice of the content. Status: a data processing agreement under Art. 28 GDPR is in place (version 1.2 of 16 Feb 2026, concluded on 12 Oct 2026).	Germany (Nuremberg data centre). No third-country transfer: under section 3 of the DPA, processing takes place exclusively in the EU/EEA; for a server location in the EU the provider processes server data solely within the EU, and support is likewise provided from within the EU. The sub-processors approved in Annex 3 of the Hetzner DPA relate exclusively to the Finland, USA and Singapore locations and therefore do not apply to our location. Provider certifications: ISO 27001, BSI C5 Type 2 attestation, Section 8a BSI-KritisV.
Hostinger International Ltd.	Website hosting and infrastructure for account, post and text data. Uploaded media files are not stored here.	EU (Lithuania)
Anthropic Ireland, Limited	AI-assisted processing of uploaded content and text generation; content is not used for model training	EU (Ireland), processing possibly US – Standard Contractual Clauses pursuant to Chapter V GDPR
Google Ireland Limited	AI-assisted analysis of uploaded video content (Gemini API); content is not used to improve products or train models	EU (Ireland), processing possibly third country – Standard Contractual Clauses pursuant to Chapter V GDPR
Brevo SAS	Delivery of transactional and product emails	EU (France)
BUNDLE SP. Z O.O. (bundle.social) UL. Hoża 86/410, 00-682 Warsaw, Poland · KRS 0001103308	TikTok and LinkedIn only: establishing the account connection (OAuth), publishing posts and retrieving the associated statistics; storage of the access tokens for the connected accounts. Instagram and Facebook run through our own Meta integration and not through this provider. Post content, post data, analytics and uploaded media are stored for publishing, scheduling, post history, analytics, debugging and support; logs and backups for 7 days; after the contract ends the organisation becomes eligible for deletion after 30 days. The provider does not use customer content or OAuth data to train third-party AI models. Status: a DPA under Art. 28 GDPR is in place (v1.1 of 21 Sept 2026).	Poland (EU) as contracting party. Production infrastructure in Germany (Hetzner, Frankfurt); administrative access restricted to personnel in Poland. Media is delivered through Cloudflare's global infrastructure. Further sub-processors established outside the EEA are listed in Annex 1a; transfers to them rely on Standard Contractual Clauses.
Social media platforms (Meta, LinkedIn, TikTok)	Transmission and publication of content solely on the controller's instruction; the platforms act as independent controllers in that respect	EU / US – see privacy policy
Paddle.com Market Limited	Payment processing and invoicing (Merchant of Record, independent controller)	United Kingdom – European Commission adequacy decision

Annex 1a: Sub-processors of the provider bundle.social

TikTok and LinkedIn are connected through BUNDLE SP. Z O.O. (bundle.social). That provider in turn engages the following sub-processors. The details come from the data processing agreement concluded with capty (v1.1 of 21 September 2026) and concern only processing connected with TikTok and LinkedIn.

The social media platforms themselves (Meta, TikTok, LinkedIn and others) are not treated as sub-processors of bundle.social under that agreement: they receive data on the customer's instruction and process it under their own terms.

Annex 2: Technical and Organisational Measures (TOMs)

capty implements at minimum the following measures at the time of processing:

• Encryption in transit: All data transfers between users and the Platform use TLS/HTTPS.
• Access controls: Access to the Platform and administrative systems is secured by authentication. Internal access rights are limited to the minimum necessary.
• Tenant separation: Customer data and workspaces are isolated from each other and cannot be shared across accounts.
• Data centre security (media files): The media files uploaded by customers are held on a server operated by capty in Hetzner Online GmbH's Nuremberg data centre. Hetzner provides the physical and infrastructural security there: an electronic access control system with logging, comprehensive video surveillance, a high-security fence around the data centre park, uninterruptible power from redundant UPS systems and backup generators, redundant cooling, early fire detection connected to a control centre, redundant network connectivity with permanently active DDoS detection, and a defined procedure for erasing and, where necessary, physically destroying storage media at the end of a contract. The provider is certified to ISO 27001 and holds a BSI C5 Type 2 attestation. The technical and organisational measures of the data centres are audited externally each year; the audit by TÜV Rheinland i-sec GmbH (report no. 63017991-01 of 19 February 2026) covers the Nuremberg site and identified no deviations.
• Operational responsibility for the media server: For a dedicated or cloud server, responsibility for the administration, maintenance and security of the server infrastructure rests with the customer under the data processing agreement with Hetzner — that is, with capty. This covers security updates, the authorisation concept, firewall configuration, logging, and backup and recovery in particular. Hetzner performs no administrative access on this server.
• Availability and backup: Account, post and text data are operated on infrastructure with Hostinger, where the hosting provider creates backups daily. No recovery time is contractually guaranteed; restoration depends on what the hosting provider can deliver. For the media files, capty is responsible for the backup and recovery concept itself. To that end, earlier versions of uploaded media are retained in Hetzner Object Storage in Germany (region NBG1) for up to 30 days, so that accidental deletion or overwriting can be undone. These versions are not used in normal platform operation and are deleted automatically once the period expires; if a version is restored, any deletion requests that still apply are re-applied. The object storage sits at the same location and under the same data processing agreement as the media server, and the provider holds the data there redundantly within its cluster system.
• Deletion: After the contract ends and the export window set out in the Terms has passed, data is deleted. For a cancelled trial, deletion happens immediately when the trial period ends (clause 6.4 of the Terms).
• Logging: System logs are written daily and overwritten on a rolling basis.
• Vulnerability management: Security-relevant updates are applied as needed by capty's technical director (CTO).
• Security incidents: capty's technical director (CTO) is responsible for handling security incidents, which are recorded through an internal reporting form. capty notifies the Controller without undue delay after becoming aware of a personal data breach, so that the Controller can meet its 72-hour notification duty under Art. 33(1) GDPR, and provides the information required under Art. 33(3) GDPR.
• Staff confidentiality: Persons with access to personal data are bound by confidentiality obligations.

These measures are reviewed regularly and updated as required. Further certifications (e.g. ISO 27001, SOC 2) are not currently in place.