Data Processing Agreement

This Data Processing Agreement ("DPA"), pursuant to Art. 28 GDPR, governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the FrameScope SaaS service ("Service") as described in the Terms of Service.

The Processor processes personal data on behalf of the Controller for the following purposes:

• Hosting and operating the FrameScope web application
• Storing and managing client project data (requirements, tasks, quotes, timelines, costs)
• Generating semantic search embeddings for content discovery (optional, subject to organization opt-out)
• Sending transactional emails on behalf of the Controller (invitations, notifications)
• Synchronizing calendar data when connected by users
• Generating audit logs for security and compliance

The following categories of personal data are processed:

• Registered users of the Controller’s organization
• Client contacts and stakeholders (names, emails in project data)
• External questionnaire respondents
• Meeting participants (imported from calendar/documents)

The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law.

The current list of sub-processors is provided in Annex III and on the Processor’s website.

Personal data may be transferred to sub-processors located outside the European Economic Area (EEA) only where adequate safeguards are in place:

• EU-US Data Privacy Framework (DPF): For sub-processors certified under the DPF, the transfer is based on the adequacy decision of the European Commission (Implementing Decision (EU) 2023/1795).
• Standard Contractual Clauses (SCC): For all US-based sub-processors, the Processor has concluded SCCs (Commission Implementing Decision (EU) 2021/914) as supplementary safeguards.

The Processor has conducted Transfer Impact Assessments for each US-based sub-processor, available upon request.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data. The notification shall include:

• The nature of the breach
• The categories and approximate number of data subjects and records concerned
• The likely consequences of the breach
• The measures taken or proposed to address the breach

The Processor shall assist the Controller in meeting its notification obligations under Articles 33 and 34 GDPR.

The Service provides the following self-service features for data subjects:

• Data export (Art. 20): JSON export of all personal data via the application
• Account deletion (Art. 17): Self-service account deletion with 30-day cascade purge
• Embedding opt-out (Art. 21): Organization-level toggle to disable AI processing
• Data rectification (Art. 16): Users can edit their profile and content directly

For data subject requests that cannot be fulfilled via self-service (e.g., requests from external respondents, restriction of processing), the Processor shall assist the Controller in responding within the legally required timeframes.

Upon termination of the Service:

• The Controller may export all data via the data export feature before account deletion
• Upon account deletion, all personal data is soft-deleted immediately and permanently purged after 30 days
• The Processor shall confirm deletion in writing upon request

Retention exceptions: Audit logs are retained for up to 90 days from the date of the event (automated deletion). Aggregated, anonymized data that can no longer be attributed to a data subject may also be retained.

The Parties’ liability is governed by the Terms of Service and applicable law, including Art. 82 GDPR.

This DPA shall be governed by the laws of the Federal Republic of Germany. The courts of Berlin shall have exclusive jurisdiction for disputes arising from this DPA.

To execute this DPA, contact privacy@27street.de.