Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between KONSOLE LABS GmbH ("Processor") and the Customer ("Controller") for the provision of the SuperSmart Cloud services.

This DPA reflects the parties' agreement regarding the processing of personal data by the Processor on behalf of the Controller in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data.
• "Sub-Processor" means any third party engaged by the Processor to process Personal Data.
• "Data Subject" means the natural person to whom the Personal Data relates.

2.1 Subject Matter: The Processor provides AI-powered content creation, transcription, text-to-speech, voice cloning, news aggregation, workflow automation, and content distribution services.

2.2 Duration: This DPA remains in effect for the duration of the main service agreement.

2.3 Nature and Purpose: Processing includes storage of user data, AI content processing, audio transcription, voice cloning, and content distribution.

The Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure authorized persons are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Not engage Sub-Processors without prior authorization
• Assist the Controller with Data Subject requests
• Assist with security, breach notification, and impact assessments
• Delete or return all Personal Data upon termination
• Allow for audits and provide compliance information

5.1 Authorization: The Controller provides general authorization for Sub-Processors. The Processor shall inform of any changes.

5.2 Sub-Processor Obligations: Each Sub-Processor is bound by equivalent data protection obligations.

For transfers outside the EEA, the Processor ensures safeguards through:

• EU-U.S. Data Privacy Framework for certified US processors
• Standard Contractual Clauses (SCCs) for other non-EU transfers
• Supplementary Measures where required

The Processor shall assist the Controller in responding to Data Subject requests including:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

In case of a personal data breach, the Processor shall:

• Notify the Controller without undue delay (within 24 hours)
• Provide information about the nature and scope of the breach
• Describe likely consequences and measures taken
• Cooperate with the Controller's investigation

The Controller has the right to:

• Request information demonstrating compliance
• Conduct audits with reasonable notice (30 days)
• Engage third-party auditors (bound by confidentiality)

Audits shall be conducted during normal business hours and shall not unreasonably disrupt operations.

Upon termination of the service agreement:

• Controller may request data export within 30 days
• Processor shall delete all Personal Data within 90 days
• Backups are deleted within 30 days of production deletion
• Data required for legal compliance may be retained as necessary

Liability for data protection breaches shall be governed by Article 82 GDPR and the main service agreement. The Processor shall be liable for damages caused by processing that violates GDPR or this DPA.

This DPA shall be governed by the laws of the Federal Republic of Germany. The courts of Berlin shall have exclusive jurisdiction.