Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data carried out by Firmendata UG (haftungsbeschränkt) ("Processor", "we", "FirmenData") on behalf of the Customer ("Controller", "you") in the course of using the FirmenData services.

Most data made available through the FirmenData services is personal data published in public registers (Handelsregister, Unternehmensregister, Unternehmensregister, etc.) and is processed by FirmenData as a controller in its own right under Article 4(7) GDPR. The Privacy Policy at firmendata.com/privacy-policy describes that processing. This DPA applies only to the limited categories of processing in which the Customer is the controller and FirmenData acts as processor on the Customer's behalf, as described in Annex 1.

By accepting the FirmenData Terms and Conditions, the Controller enters into this DPA with the Processor. The DPA is effective from the date the Controller first uses the FirmenData services and remains in force for the duration of those services.

Terms used in this DPA have the meaning given in Article 4 of Regulation (EU) 2016/679 (GDPR), unless otherwise defined herein. "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Sub-processor", and "Supervisory Authority" have the meaning given in the GDPR.

Subject matter: the Processor processes Personal Data on behalf of the Controller solely to provide the FirmenData services described in Annex 1.

Duration: this DPA applies for as long as the Processor processes Personal Data on behalf of the Controller, and ends together with the underlying contractual relationship subject to Section 11 (Termination).

The nature and purpose of the processing, the categories of Personal Data, and the categories of Data Subjects are set out in Annex 1.

The Controller:

• is responsible for the lawfulness of the processing of Personal Data by the Processor under this DPA, including establishing a valid legal basis under Article 6 (and, where applicable, Article 9) GDPR;
• shall issue documented instructions to the Processor in accordance with this DPA (the agreement to use the services constitutes such an instruction);
• shall inform the Processor without undue delay of any error or irregularity it discovers in the Processor's handling of Personal Data.

The Processor:

• processes Personal Data only on documented instructions from the Controller, unless required to do so by Union or Member State law, in which case the Processor shall inform the Controller of that legal requirement before processing (unless such law prohibits it on important grounds of public interest);
• shall inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law;
• ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implements the appropriate technical and organisational measures set out in Annex 2 ("TOMs") to ensure a level of security appropriate to the risk (Article 32 GDPR);
• engages Sub-processors only in accordance with Section 6;
• assists the Controller by appropriate technical and organisational measures, insofar as possible, in the fulfilment of the Controller's obligation to respond to requests for exercising Data Subjects' rights laid down in Chapter III of the GDPR;
• assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and the information available to the Processor;
• notifies the Controller without undue delay after becoming aware of a Personal Data Breach (Article 33(2) GDPR);
• at the choice of the Controller, deletes or returns all the Personal Data to the Controller after the end of the provision of services relating to processing, and deletes existing copies, unless Union or Member State law requires storage of the Personal Data;
• makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including inspections, in accordance with Section 9.

The Controller grants the Processor general written authorisation to engage Sub-processors. The current Sub-processors used by FirmenData as of the effective date of this DPA are listed in Annex 3.

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance, thereby giving the Controller the opportunity to object to such changes. Notification will be given by updating the Sub-processor list on this page or via email to the Controller's account email.

If the Controller objects to the change on reasonable grounds related to data protection, the Processor will use commercially reasonable efforts to make available a change in the services that avoids processing by the proposed new Sub-processor without unreasonably burdening the Controller. If the Processor cannot make available such a change within a reasonable period, the Controller may terminate the affected portion of the services in accordance with Section 11.

The Processor shall impose data-protection obligations on each Sub-processor that are no less protective than those set out in this DPA, in particular by way of a written contract pursuant to Article 28(4) GDPR.

Where a Sub-processor fails to fulfil its data-protection obligations, the Processor shall remain fully liable to the Controller for the performance of that Sub-processor's obligations.

Some Sub-processors are located outside the EU/EEA. Where Personal Data is transferred to such Sub-processors, the Processor uses appropriate safeguards under Chapter V of the GDPR, in particular Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional technical, organisational and contractual measures.

The Processor maintains a record of all categories of processing activities carried out on behalf of the Controller in accordance with Article 30(2) GDPR and makes that record available to the Controller on request.

The Controller has the right to verify the Processor's compliance with this DPA, in line with Article 28(3)(h) GDPR.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA, in particular by providing relevant policies, the current TOM description (Annex 2), the current Sub-processor list (Annex 3), and, where available, third-party audit reports.

If the Controller reasonably requires further information or an on-site inspection, the Parties shall agree on the time, scope and modalities of such inspection in good faith. On-site inspections are subject to reasonable advance written notice (at least 30 days, except in case of a substantiated suspicion of a material breach), and shall not unreasonably disrupt the Processor's business operations. Costs incurred by the Processor in connection with the Controller's audit shall be borne by the Controller, except where the audit reveals a material breach of this DPA by the Processor.

Each Party's liability under this DPA is governed by the limitation of liability provisions of the underlying FirmenData Terms and Conditions, subject to mandatory statutory liability under the GDPR.

This DPA enters into force on the effective date stated above and remains in force for the duration of the Processor's provision of services to the Controller under the underlying FirmenData Terms and Conditions.

Termination of this DPA is effected by termination of the underlying contractual relationship. Sections that by their nature should survive termination (in particular sub-clauses on deletion, liability, records, governing law, and final provisions) survive termination of this DPA.

Upon termination, the Processor shall, at the choice of the Controller, delete or return all Personal Data processed on behalf of the Controller and delete existing copies, unless Union or Member State law requires storage.

This DPA is governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Exclusive place of jurisdiction for all disputes arising out of or in connection with this DPA is Berlin, Germany, to the extent permitted by law.

In the event of any conflict between the provisions of this DPA and the underlying FirmenData Terms and Conditions, the provisions of this DPA shall prevail with respect to the processing of Personal Data.

Should any provision of this DPA be or become invalid or unenforceable, the validity of the remaining provisions shall not be affected. The Parties undertake to replace the invalid or unenforceable provision with a valid and enforceable provision that comes closest in economic effect to the invalid or unenforceable provision.

Amendments and supplements to this DPA must be in text form (Article 28(9) GDPR, §126b BGB). This also applies to any amendment of this requirement of form itself.

Subject matter of the processing: provision of the FirmenData services described in the underlying Terms and Conditions, to the extent such provision involves processing of Personal Data by the Processor on behalf of the Controller.

Nature and purpose of the processing: the Processor processes Personal Data on behalf of the Controller in the following limited scenarios:

• Search and lookup queries submitted via the public REST API or the MCP server that contain personal identifiers chosen by the Controller (for example a board-member or shareholder name, or an email address used as an identifier). The Processor processes the query parameter values briefly to compute and return matching results.
• Webhook configuration data: webhook destination URLs configured by the Controller (which may identify individuals through path or query components chosen by the Controller) and delivery logs of payloads sent to those URLs.
• Content provided by the Controller in support requests, where such content contains Personal Data.

For the avoidance of doubt: the underlying register data (data about persons named in the public registers covered by FirmenData) is processed by the Processor as a controller in its own right and is therefore not within the scope of this DPA. This is described separately in the Privacy Policy.

Categories of data subjects:

• the Controller's employees, contractors and agents who interact with the FirmenData services on the Controller's behalf;
• third-party individuals whose personal identifiers the Controller chooses to include in query parameters or webhook configuration data;

Categories of Personal Data:

• personal identifiers (name, email address, role) submitted by the Controller as query input or webhook configuration;
• associated metadata (timestamp of submission, API key used, response status);
• free-text content provided by the Controller in support correspondence.

Duration: for the duration of the underlying services, subject to the retention periods set out in the Privacy Policy.

The Processor applies the following technical and organisational measures pursuant to Article 32 GDPR. Specific measures evolve over time as the state of the art changes; this list describes the current measures as of the effective date of this DPA.

1. Confidentiality (Art. 32(1)(b) GDPR)

• Access control: production systems are accessed only by authorised personnel using individual accounts secured by multi-factor authentication.
• Role-based access control with least-privilege defaults.
• Physical access control: production infrastructure is hosted in certified Hetzner data centres in Germany with multi-layer physical access controls.
• Transport encryption: all client-server communication uses TLS 1.2 or higher.
• Encryption at rest: production databases and object storage use encryption at rest.

2. Integrity (Art. 32(1)(b) GDPR)

• Input control: changes to data are auditable through application-level logging and (for register data) source provenance metadata.
• Transmission control: all internal service-to-service communication is encrypted in transit; production secrets are stored in a dedicated secrets manager.

3. Availability and Resilience (Art. 32(1)(b) GDPR)

• Backups: production databases are backed up on a regular schedule with off-site retention.
• Disaster recovery: documented recovery procedures with periodic restore tests.
• Monitoring: 24/7 automated monitoring of production systems with on-call alerting for security and availability incidents.

4. Procedures for Regular Testing, Assessing and Evaluating (Art. 32(1)(d) GDPR)

• Periodic review of TOMs and adjustment as the state of the art changes.
• Documented incident response procedure with post-incident review.
• Vulnerability management: dependency scanning and security patches applied promptly after disclosure.

5. Data Minimisation and Retention

• Only data necessary for the agreed processing purposes is processed.
• Data is deleted in accordance with the retention periods set out in the Privacy Policy.

The following Sub-processors are engaged by the Processor as of the effective date of this DPA. The current version of this list is available on this page; changes are notified in accordance with Section 6.

Note on Claude MCP Connector: when a Customer end-user enables the FirmenData connector inside Anthropic's Claude product, Anthropic processes the resulting Claude conversation content as a separate controller. This is not a Sub-processor relationship under this DPA and is described in Section 14 of the Privacy Policy.