Data Processing Addendum

This addendum is part of the Terms of Service. It applies when we, Dumpling Software UG (haftungsbeschränkt), process personal data on your behalf as your processor under Art. 28 GDPR. You are the controller.

1. Scope

We process the personal data you or your users put into AppGoat (for example team members’ account data and data from connected store accounts) only to provide the Service, for as long as you use it. The data subjects are your users and the people whose data you add.

2. Our obligations

• We process the data only on your documented instructions, which are the Terms and your use of the Service, unless the law requires otherwise.
• Everyone with access to the data is bound to confidentiality.
• We keep appropriate technical and organizational security measures (Art. 32 GDPR), including encryption in transit, encryption of stored credentials, access control and backups.
• We help you, where reasonable, to answer data subject requests and to meet your obligations under Art. 32 to 36 GDPR.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• When you delete your account, we delete the data, unless the law requires us to keep it.
• We give you the information you need to show compliance with Art. 28 GDPR. Audits are possible at your cost, with reasonable notice.

3. Sub-processors

You allow us to use the sub-processors listed on the sub-processors page. We bind them to the same data protection obligations. We update that page before we add or replace a sub-processor; you can object by email, and if we cannot resolve the objection, you can end the contract.

4. Transfers

Where data is transferred outside the EU/EEA, we use the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

5. Other

The liability rules of the Terms apply. If this addendum and the Terms conflict, this addendum takes precedence for data protection. Questions: support@appgoat.ai.