Data Processing Agreement

§ 1 Parties and Subject Matter

1. The subject matter of this Agreement is the processing of personal data by the Processor on behalf of the Controller in connection with the use of the BASIO SaaS platform, as described in BASIO's Terms and Conditions.
2. This DPA becomes an effective part of the contract upon conclusion of the main contract (subscription or pass) and confirmation in the order process, without the need for separate signature.

§ 2 Nature and Purpose of Processing

The Processor processes personal data exclusively to provide the contractually agreed SaaS services in accordance with BASIO's Terms and Conditions, in particular:

• storage, analysis and preparation of uploaded competition and project documents using AI models,
• making projects available to the Controller's team members,
• storage of the BASIO-GPT chat history per user,
• transfer of selected content to Microsoft 365, where triggered by the Controller,
• technical provision, backup and maintenance of the platform.

The Processor does not use the data to train AI models and does not use it for its own purposes.

§ 3 Type of Data and Categories of Data Subjects

Data

• account data of the Controller's users (name, email address, role in the team),
• content of the uploaded competition documents and project documents, including names and contact details contained therein,
• content created by users (analyses, concepts, notes, visualizations, chat messages),
• usage and log data,
• where a Microsoft account is connected: account identifier and access token.

Data subjects

Users and team members of the Controller, as well as project participants named in the documents and other natural persons of the Controller and its contractual partners.

§ 4 Term

The term of this DPA corresponds to the term of the main contract (subscription or pass under the Terms and Conditions). It ends upon termination of the main contract, without prejudice to continuing obligations under § 5 no. 5.

§ 5 Obligations of the Processor

The Processor undertakes to:

1. process personal data exclusively on the documented instructions of the Controller, unless required by law to process otherwise; the main contract, this DPA and the Controller's use of the platform features count as instructions;
2. ensure the confidentiality of the data and bind all persons involved in processing to confidentiality;
3. implement technical and organizational measures pursuant to Art. 32 GDPR (§ 6);
4. provide the Controller with reasonable assistance in responding to data subject requests (Art. 12–22 GDPR);
5. after termination of the main contract, keep the data available for viewing and downloading for a further 7 days and then keep it stored for 12 months so that the Controller can continue working if it books again; after that the data is deleted unless there is a statutory retention obligation. At the Controller's request, the Processor deletes the data earlier;
6. notify the Controller of personal data breaches without undue delay, and no later than 48 hours after becoming aware of them.

§ 6 Technical and Organizational Measures

The measures within the meaning of Art. 32 GDPR include in particular: encryption of data transmission (TLS/SSL); role-based access control at data level (projects are readable only by owners or team members, chat histories only by the respective user); securing internal interfaces with secret keys; storage of credentials for third-party services in encrypted credential stores; regular backups by the platform; ongoing review and improvement of the measures. The Privacy Policy of BASIO also applies.

§ 7 Sub-processors

The Controller authorizes the engagement of the sub-processors listed below. Agreements pursuant to Art. 28 GDPR are in place with all sub-processors. To the extent processing takes place outside the EU/EEA, it is safeguarded by an adequacy decision, the EU-US Data Privacy Framework, and/or EU Standard Contractual Clauses.

DPF = EU-US Data Privacy Framework · SCC = EU Standard Contractual Clauses. The current list of Base44's sub-processors is available at base44.com/dpa.

Transfers to Microsoft 365 triggered by the Controller itself are made to the Controller's own Microsoft account; to that extent Microsoft is not a sub-processor of the Processor.

The Processor will inform the Controller by email without undue delay after becoming aware of an intended engagement or replacement of a sub-processor. The Controller may object to the change in text form within 14 days of receiving the information, for good cause under data protection law. If the Processor is unable to provide the service without the sub-processor in question, or only with disproportionate effort, either party is entitled to terminate the contract for the affected services for good cause with reasonable notice; fees already paid in advance for the period after termination will be refunded on a pro-rata basis.

§ 8 Rights and Obligations of the Controller

1. The Controller has the right to satisfy itself that the technical and organizational measures are being complied with (audit right), in particular by requesting information. On-site inspections are possible with reasonable advance notice (at least 14 days) and with due regard for the Processor's business operations.
2. The Controller may request all information necessary to fulfil its data protection obligations.
3. The Controller remains the controller within the meaning of the GDPR for the data uploaded by it and its team members and ensures its lawfulness, in particular the authorization to upload competition documents (Terms § 11).
4. The Controller decides which persons to invite to its team; team projects are visible to all active team members.

§ 9 Notification of Data Breaches

If the Processor becomes aware of a personal data breach affecting data processed under this DPA, it informs the Controller without undue delay, stating the circumstances known to it, to enable the Controller to fulfil its notification obligations under Art. 33 and 34 GDPR.

§ 10 Final Provisions

1. German law applies.
2. Sections 19 and 20 of BASIO's Terms and Conditions apply accordingly to jurisdiction and supplementary provisions.
3. Should individual provisions of this DPA be invalid, the validity of the remaining provisions shall remain unaffected.

Effective: October 3, 2026 · Version 2 · cook up studio UG (haftungsbeschränkt) · Moritz Koch · info@basio.at