Legal

Data Processing Agreement for Core (DPA)

under Art. 28 GDPR

Version 1.0 · Status: October 2026 (Stand: Oktober 2026)

Only the German text is legally binding. This English version is a convenience translation.

Customer (controller): the customer as stated at sign-up to Core ("customer").

Processor: OFFGROUND, Inh. Danijel Radulovic, Sallerweg 22, 81476 München, Germany ("OFFGROUND").

Data protection contact at OFFGROUND: info@offground.solutions

1 Subject matter and duration

1.1 OFFGROUND provides Core to the customer as hosted software (usage contract, "main contract"). In doing so, OFFGROUND processes personal data on behalf of the customer. This agreement governs the rights and duties concerning that processing.

1.2 The agreement applies where the customer is the controller within the meaning of the GDPR for the data in its Core installation. It begins with acceptance at sign-up and ends when OFFGROUND has deleted all data under section 11. This is usually 90 days after the main contract ends.

2 Nature and purpose of the processing

OFFGROUND hosts and operates the customer's Core installation. This includes storing, retrieving and transmitting the data to the users and guests set up by the customer (client portal, booking pages, chat, video calls, sending email), backup and restore, search, maintenance, updates and support on the customer's instructions. At the customer's request, Core generates transcripts and call notes of calls. Transcription runs within the installation itself and transmits no audio data to third parties.

3 Types of data and data subjects

3.1 Types of data: contact data (name, address, email, telephone, position, company), contract, project and task data, communication data (chat, comments, emails, calendar entries), booking data, time and personnel data of employees (working hours, absences, hourly rates), invoice and payment data, usage and log data (sign-ins, IP address, device and browser, activity log), call data and, if the customer switches it on and the participants consent, recordings and transcripts.

3.2 Data subjects: employees, partners and other users of the customer, the customer's clients and prospects and their contact persons, guests in chats, appointments and calls, persons who book appointments through booking pages, suppliers and service providers of the customer.

3.3 OFFGROUND does not deliberately process special categories of data (Art. 9 GDPR). If the customer enters such data, the customer is responsible for the legal basis and for the adequacy of the protective measures.

4 Instructions

4.1 OFFGROUND processes the data only on the customer's documented instructions. Instructions are this agreement, the use of Core's functions by the customer's users, and individual instructions from the admins in text form. The customer's admin accounts are authorised to give instructions.

4.2 If OFFGROUND considers an instruction unlawful, it informs the customer without delay and may suspend execution until the customer confirms or changes it.

4.3 OFFGROUND does not use the data for its own purposes. If OFFGROUND is required by Union or Member State law to carry out processing, it informs the customer beforehand, unless the law prohibits this.

5 Duties of the customer

The customer is responsible for the lawfulness of the processing, in particular for legal bases, consents (for example for call recordings), information to data subjects and lawful instructions. The customer keeps its record of processing activities and meets the notification duties towards supervisory authorities and data subjects (Art. 33, 34 GDPR).

6 Confidentiality

OFFGROUND commits all persons who may have access to the data to confidentiality and data protection. The commitment continues beyond the end of their work. For customers who are professional secret holders, OFFGROUND also offers the undertaking under § 203 StGB.

7 Security of processing

OFFGROUND implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. OFFGROUND may develop them further as long as the level of protection does not fall, and documents material changes.

8 Access by support

8.1 OFFGROUND signs in to the customer's Core application only with a support code created by an admin of the customer. The code is valid for 24 hours and the customer can revoke it at any time. Creating the code is an instruction of the customer.

8.2 OFFGROUND works as a separate support identity, never as a user of the customer. Financial data is hidden unless the customer releases it. Exports, changes to users and permissions, and deletion of data are blocked during a session. Every action and every block is recorded in the customer's activity log and visible to the customer.

8.3 The automated technical operation of the servers (updates, backups, monitoring) remains unaffected. It does not read content.

8a Importing emails through the central mailbox

8a.1 If an admin of the customer switches on email import, the customer receives its own import address. It is a plus address of OFFGROUND's central mailbox (core-in@offground.biz), which is hosted at webgo. Emails that the customer or its users send or forward to this address therefore pass through this mailbox first. They may contain personal data of the customer's contacts. Switching on and using the import address are instructions of the customer.

8a.2 A sorting service on OFFGROUND's own server reads the mailbox every minute. It checks every email with a self-operated virus scanner (ClamAV) and a block list (for example executable files, scripts, Office files with macros, shortcuts, disk images, HTML attachments and encrypted archives that cannot be checked) and hands clean emails to the customer's installation over a signed connection. The check runs only on OFFGROUND's server. No third party gets access to the content for it. If the scanner is down, the sorting service delivers nothing. The emails then stay in the mailbox.

8a.3 The sorting service deletes an email from the central mailbox as soon as it has handled it. Emails to unknown or not activated import addresses it deletes without keeping any content, and only counts them. If the customer's installation does not answer, OFFGROUND retries the hand-over for 72 hours and then deletes the email.

8a.4 Held emails (virus, blocked file, archive that cannot be checked, too big) are not handed over. The customer's admins are notified. OFFGROUND keeps the key details (sender, subject, size, reason, file names, name of the virus signature) for 30 days and the email itself for 14 days on OFFGROUND's server, as a rule encrypted. OFFGROUND then deletes both automatically. OFFGROUND may delete a held email earlier.

8a.5 Only authorised OFFGROUND administrators in the Control centre have access to held emails. They see the key details and the names and types of the attachments, never the content of the email rendered as a web page. They can release a held email to the customer's installation or delete it. Releasing an email flagged as a virus requires a separate confirmation. The customer's admins are told the outcome. Every access and every decision is recorded in OFFGROUND's log with the person and the time. OFFGROUND does not read an email beyond this.

9 Sub-processors

9.1 The customer gives OFFGROUND general authorisation to use sub-processors. Those used when the contract is concluded are listed in Annex 2. Optional services listed there are used only if the customer activates them.

9.2 OFFGROUND contractually binds each sub-processor to the same data protection duties as in this agreement (Art. 28 (4) GDPR) and is liable to the customer for the sub-processor's performance.

9.3 If OFFGROUND wants to engage or replace a sub-processor, it informs the admins in text form at least 30 days beforehand and updates Annex 2. The customer may object within 14 days for an important data protection reason. If the parties cannot agree, the customer may terminate the main contract for cause to the end of the billing period.

10 Transfers to third countries

The installation and its backups are located in the European Union. A transfer to a third country takes place only where Annex 2 names a third country for a sub-processor or optional service, and for optional services only after activation by the customer. It takes place only under the conditions of Art. 44 ff. GDPR, for example with an adequacy decision or standard contractual clauses.

11 Return and deletion

11.1 The customer can export its data at any time during the term. After the main contract ends, the data remains available to the admins for export for a further 90 days. In case of payment default, the 90 days count from the pause. OFFGROUND reminds the customer by email 30 and 7 days before deletion.

11.2 After that, or earlier on the customer's express instruction, OFFGROUND deletes the installation permanently, with database, files, search index, backups including the off-site copy, and keys. On request, OFFGROUND confirms the deletion in text form.

11.3 OFFGROUND's statutory retention obligations, for example for invoices, concern OFFGROUND as a controller and not this processing data.

12 Rights of data subjects

12.1 OFFGROUND supports the customer with appropriate technical and organisational measures in requests from data subjects. Core contains functions for export, correction and deletion or anonymisation of accounts. OFFGROUND provides further help on request.

12.2 If a data subject contacts OFFGROUND, OFFGROUND forwards the request to the customer without delay and does not answer it itself.

12.3 OFFGROUND also supports the customer with the security of processing, with notifications of breaches and with data protection impact assessments (Art. 32 to 36 GDPR), as far as the information is available to OFFGROUND.

13 Notification of personal data breaches

13.1 OFFGROUND notifies the customer of a personal data breach without undue delay and at the latest 48 hours after becoming aware of it, at the admin addresses in Core.

13.2 The notification contains, as far as known: the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences, the measures taken and proposed, and a contact person. OFFGROUND supplies missing information later.

13.3 OFFGROUND documents every breach with the facts and the countermeasures.

14 Evidence and audits

14.1 OFFGROUND demonstrates compliance with this agreement first by documents: this agreement, Annexes 1 and 2, information on request and, where available, audit reports or certificates.

14.2 If the documents are not sufficient, or a supervisory authority or a security incident requires it, the customer or an auditor it appoints who is bound to confidentiality may inspect the processing at OFFGROUND on site. The customer announces this in text form at least 30 days beforehand, audits during normal business hours and without disproportionately disrupting operations, at most once in 12 months unless there is an incident. The audit does not cover other customers' data. The data centre is audited through its own evidence. The customer reasonably compensates OFFGROUND's effort beyond the usual.

15 Liability

Between the parties, the liability rules of the terms and conditions apply as far as the law permits. Rights of data subjects under Art. 82 GDPR remain unaffected.

16 Final provisions

16.1 In case of conflict with the terms and conditions, this agreement and its annexes prevail on questions of data protection.

16.2 Changes and additions require text form, including electronic form (Art. 28 (9) GDPR). OFFGROUND changes Annex 2 under section 9.3.

16.3 German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. The place of jurisdiction is Munich where the law permits it.

16.4 If a provision is invalid, the rest remains valid.

16.5 The German version is authoritative.

The customer accepts this agreement at sign-up by clicking. OFFGROUND stores the time and version. Anyone who prefers to sign uses the field below.

Place, date, signature of customer: ____________________

Place, date, signature of OFFGROUND: ____________________

Annex 1: Technical and organisational measures (Art. 32 GDPR)

These measures describe the operation of customer installations of Core. Status: October 2026.

1 Confidentiality

Physical access. The servers are in a data centre of Contabo GmbH in the European Union. Physical access control lies there. OFFGROUND does not run its own server rooms.

Access to systems.

Each person signs in with a personal account. Passwords are stored only as bcrypt hashes.
Repeated failed attempts block sign-in temporarily (5 failed attempts in 15 minutes block the address for 15 minutes). Unknown addresses get the same answer in the same time as wrong passwords.
Two-factor authentication (TOTP) is mandatory for all staff accounts and enforced by the server. A sign-in with Google, where activated, counts as the second factor.
Sessions are limited (default: 14 days) and end after 24 hours without activity (default, adjustable by the admin). They also end on a password change or reset, a role change and archiving of the account. Admins can sign accounts out everywhere.
Links to reset passwords work once and for a limited time and are stored only as hashes.
The servers are managed only over encrypted SSH connections with keys. Root rights require an additional password prompt.

Access to data.

A permission grid with account types (admin, project lead, sales, member, partner, freely definable types) determines who sees and changes what. The server checks each request for the individual record. A hidden button is no substitute for a permission.
Only admins and project leads see financial data. Clients in the portal see only released content.
Automated tests check every interface against every account type.
Public links (quote, contract, portal, booking) are random, unguessable tokens. Signing and review links expire (default: 14 days). Requests are rate-limited.
Support enters the application only through the support code (section 8 of the DPA).

Separation. Each customer has its own installation: its own containers, its own database with authentication switched on, its own search instance, its own data storage, its own keys (session key, database passwords, keys for calls) and its own key for the backups. The networks of one installation do not reach any other installation.

Encryption.

All connections to the installation use TLS (HTTPS). Certificates are issued and renewed automatically for each address.
The media streams of calls are encrypted (WebRTC). They run through OFFGROUND's media server with its own key per installation. There is no end-to-end encryption.
Passwords (bcrypt), password reset links, device tokens and tokens of inbound webhooks are stored only as hashes. The backups are encrypted with a separate key per installation. Secrets are kept only in protected configuration files (permission 600), never in source code, logs or browser code.

Data minimisation. The search index contains only titles, names and numbers, never passwords, payment data, salaries, notes, email texts or chats. It follows deletions at once. The search software sends no usage data to its vendor.

2 Integrity

Transfer. The connection between an installation and OFFGROUND's management is signed (HMAC with timestamp and one-time nonce, tolerance 5 minutes). Session tokens never appear in addresses. Outbound webhooks go only to public addresses and are signed if the customer sets a secret. Exports are possible only for admins and are logged.

Input and change.

The activity log records sign-ins and failed attempts, changes to rights and roles, deletions, money transactions, exports, access by admins to other people's records, and changes to integration keys. It cannot be changed or deleted through any interface. Default retention: 2 years, adjustable.
For invoices, quotes and other records, the change history keeps earlier values.
Input is strictly validated, output is escaped, embedded HTML is sanitised.

Technical logs. Application and web server logs serve operation, troubleshooting and security. They contain no passwords and no message or document content. They contain technical details such as IP address, time and address requested, for public links their token, and for sending email the recipient address and subject. They are deleted after 30 days.

3 Availability and resilience

Backups: nightly per installation, database and files, kept for 14 nights, encrypted with the installation's key. In addition there is an encrypted off-site copy on a second, separate server of Contabo GmbH in the EU; the copy is deleted together with an installation. Restoring from a backup is documented and tested.
Operation: containers restart after faults and report their health. Each container has limits for memory, CPU and processes so that one installation does not affect another. CPU, memory, disk and load of the server are measured and monitored against thresholds.
Updates run in a controlled way per installation, with a backup beforehand and the possibility to roll back.
Dependencies are fixed to exact versions and checksums and are checked for known vulnerabilities before updates.

4 Network and systems

Only the shared web server (HTTP and HTTPS) is reachable from outside. Database, search and backend of an installation publish no ports. The data network of an installation is internal and not reachable from outside.
Rules of the server firewall prevent containers of an installation from reaching the server or other private networks. In addition, the hosting provider's firewall limits incoming traffic.
Containers run with Linux capabilities removed (only the necessary ones remain), without privilege escalation and, as far as the application allows, without administrator rights and with a read-only file system.
Brute-force protection and rate limits apply to sign-in and public pages.

5 Order control and organisation

Instructions and sub-processors are governed by contract. All persons with access are bound to confidentiality and receive only the rights they need.
Development and test systems use test data only. Customer data, access data and secrets do not go to third-party development tools.
Changes to Core are versioned, deployed traceably and tested automatically.
Security incidents follow a fixed procedure: detect, assess, contain, fix, inform the customer without delay and at the latest within 48 hours, document and review.
Deletion runs after the end of the contract are logged.
OFFGROUND aligns development and operation with the requirements of SOC 2 and ISO 27001. There is currently no certification.
The measures are reviewed at least once a year and on material changes.

Annex 2: Sub-processors

Status: October 2026. For each entry, OFFGROUND keeps the safeguards under Art. 44 ff. GDPR in the contract file.

Part A: Always in use

Name	Purpose and data	Location	Safeguard
Contabo GmbH	Hosting of the server on which the installation runs (database, files, backups, calls)	in the EU (data centres of Contabo GmbH, Germany/EU)	Data processing agreement under Art. 28 GDPR, processing in the EU
webgo GmbH	Hosting of the central mailbox for email import (core-in@offground.biz): the imported emails (sender, recipient, subject, content and attachments) until OFFGROUND's sorting service has retrieved and deleted them	Germany	Data processing agreement under Art. 28 GDPR, processing in Germany
webgo (webgo GmbH)	Sending system emails (invitations, password links, notifications, invoice and quote emails): recipient address, name, content and attachments of the emails sent	Germany	Data processing agreement
Contabo GmbH (second, separate server)	Encrypted off-site copy of the nightly backups: encrypted files only, the installations' keys are kept apart from them in a separate, additionally encrypted area	in the EU (data centres of Contabo GmbH, Germany/EU)	Data processing agreement under Art. 28 GDPR, encryption before leaving the server

Part B: Optional, only if the customer activates them

OFFGROUND provides these services to the installation only if it offers them and an admin of the customer switches them on or a user connects their account.

Name	Purpose and data	Location	Safeguard
Google Ireland Limited, Google LLC	Sign-in with Google, Google Calendar (read and write appointments), Gmail (import and send emails), Google Meet (meeting links): name, email address, calendar entries, emails chosen by the user	EU, USA	The customer's contract terms with Google, standard contractual clauses or adequacy decision
Microsoft Ireland Operations Limited, Microsoft Corporation	Sign-in with Microsoft, Outlook calendar (read and write appointments): name, email address, calendar entries	EU, USA	The customer's contract terms with Microsoft, standard contractual clauses or adequacy decision
Giphy, Inc.	GIF search in chat: search term and the server's address, when displaying the GIFs the user's IP address	USA	Standard contractual clauses
Google LLC (Places)	Address suggestions in the meeting location field: the beginning of the address typed (from 3 characters)	USA, EU	Standard contractual clauses or adequacy decision
Push services of browser vendors, for example Google, Mozilla, Apple, Microsoft	Browser notifications: the device's endpoint address and the encrypted content	depending on browser	The content is encrypted under the Web Push standard (RFC 8291) and cannot be read by the push service

Notes

Not sub-processors: Stripe (billing of the subscription; Stripe receives only contract and payment data of the customer itself, no content of the installation, and OFFGROUND is itself responsible for this, see the privacy policy), webgo for domain and DNS (no content; the mailbox for email import is listed in Part A), the call and transcription software (they run on OFFGROUND's server) and the retrieval of exchange rates (without personal data).
Webhooks set up by the customer go to recipients the customer determines itself. They are not sub-processors of OFFGROUND.