Data Processing Agreement

§01Scope and Definitions

(1) This Data Processing Agreement ("DPA") governs the processing of personal data entrusted to the Processor in connection with the provision of services to the Controller as the controller within the meaning of data protection laws (in particular Art. 4 (7) of the GDPR).

(2) The Controller, as defined in this DPA, is any natural or legal person who enters into a contract with Melious AI GmbH (Saarland University, Campus Starterzentrum, Building A1 2, 66123 Saarbrücken, represented by its management) for services under which personal data is processed on behalf of the Controller.

(3) The Processor within the meaning of these General Terms and Conditions is Melious AI GmbH.

§02Subject Matter of the Contract and Scope of Processing

(1) The subject matter of the data processing is the processing of personal data as agreed upon in the main contract concluded between the parties.

(2) Processing shall be carried out exclusively on the documented instructions of the Controller and within the scope of the purposes and terms described in the main contract and this DPA.

(3) The Processor is entitled to anonymize and/or aggregate personal data, provided that this precludes the identification of data subjects. Such data is no longer subject to this DPA.

(4) The Processor's own processing of data for its own purposes shall take place only to the extent that it is permitted by law or covered by the consent of the data subject; such processing is not subject to this DPA..

(5) Data processing generally takes place within the EU or the EEA. Processing in third countries requires separate notification to the Controller and compliance with the relevant GDPR provisions (Art. 44 et seq., Art. 49 GDPR).

§03Controller's Instructions and Control Rights

(1) The Processor shall process personal data only in accordance with the Controller's documented instructions, unless there is a separate legal obligation to the contrary, in which case the Controller shall be informed of the applicable requirements (unless prohibited by law).

(2) Instructions that go beyond the contractual obligations set forth in this DPA require the Processor's consent and may be agreed upon in accordance with the procedures provided for in the main contract.

(3) If the Processor becomes aware of any instructions that violate applicable law, it shall inform the Controller and is entitled to suspend performance until the matter is clarified. The Controller bears sole responsibility for the legality of any instruction.

§04Responsibilities of the Controller

(1) The Controller is solely responsible for the lawfulness of data processing, the quality of the data provided, and the protection of the rights of data subjects in relation to the affected data subjects.

(2) The Controller shall provide the Processor with all information necessary for the performance of the contract in a timely and accurate manner.

(3) The Controller shall inform the Processor immediately upon discovering any errors or irregularities in data processing.

(4) Upon first request, the Controller shall indemnify the Processor against any claims by third parties and any fines, to the extent that these are based on errors on the part of the Controller or breaches of the Controller's obligations.

§05Confidentiality Obligation

The Processor shall ensure that all persons authorized to process the personal data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

§06Data Security

(1) The Processor shall implement appropriate technical and organizational measures in accordance with Article 32 of the GDPR to ensure the protection of personal data.

(2) Changes to the technical and organizational measures are permitted as long as an appropriate level of protection is maintained.

§07Use of Subprocessors

(1) The Processor is entitled, with the Controller's general consent, to engage subprocessors to process personal data. The current list of subprocessors is available on the Melious AI platform and is kept up to date at all times. Upon request, the Processor shall provide the Controller with access to this list and notify the Controller of any material changes.

(2) The Processor shall inform the Controller of any intended changes regarding the engagement or replacement of subprocessors, referring to the current list. If the Controller does not object to a planned change within 14 days of receiving the information, consent shall be deemed to have been granted. In the event of a justified objection, the Processor may terminate the contract with three months' notice.

(3) Contractual relationships with service providers that involve the inspection or maintenance of data processing procedures or systems by other entities, or other ancillary services, are generally not subject to approval, even if access to the Controller's data cannot be ruled out, provided that the Processor implements appropriate measures to protect the confidentiality of the Controller's data.

(4) Any subprocessor must be contractually bound in accordance with Art. 28 (3) of the GDPR. The Processor shall ensure that a level of protection consistent with the provisions of this DPA is agreed upon with each subprocessor.

(5) In the event of a transfer to third countries, the Controller authorizes the Processor to conclude the necessary agreements (in particular EU Standard Contractual Clauses) with subprocessors on behalf of the Controller. The Controller shall cooperate in fulfilling any obligations to cooperate under Art. 49 of the GDPR.

§08Rights of Data Subjects

(1) The Processor shall support the Controller, through reasonable technical and organizational measures, in fulfilling its obligation to respond to requests from data subjects to exercise their rights.

(2) If a data subject submits a request to exercise their rights directly to the Processor, the Processor shall forward this request to the Controller in a timely manner.

(3) The Processor shall provide the Controller with information regarding the stored Controller data, the recipients to whom the Processor discloses such data in accordance with the contract, and the purpose of the storage, unless the Controller already has this information or can obtain it on its own.

(4) The Processor shall enable the Controller, to the extent that this is reasonable and necessary, to correct, delete, or restrict the further processing of Controller Data in exchange for reimbursement of the verifiable expenses and costs incurred by the Processor as a result; or, at the Controller's request, the Processor shall itself carry out the correction, blocking, or restriction of further processing if and to the extent that this is impossible for the Controller to do so itself.

(5) To the extent that the data subject has a right to data portability with respect to the Controller's data under Art. 20 of the GDPR, the Processor shall, to the extent that is reasonable and necessary and upon reimbursement of the verifiable expenses and costs incurred by the Processor as a result, assist the Controller in providing the Controller's data in a commonly used and machine-readable format, provided that the Controller cannot otherwise obtain the data.

§09Processor's Obligations to Notify and Provide Assistance

(1) To the extent that the Controller is subject to a statutory reporting or notification obligation due to a personal data breach (in particular pursuant to Art. 33, 34 GDPR), the Processor shall promptly inform the Controller of any reportable events within its area of responsibility. Upon the Controller's request, the Processor shall assist the Controller in fulfilling these reporting and notification obligations to the extent that is reasonable and necessary, in exchange for reimbursement of the Processor's verifiable expenses and costs incurred as a result, as documented at .

(2) The Processor shall assist the Controller, to the extent that is reasonable and necessary, upon reimbursement of the verifiable expenses and costs incurred by the Processor as a result, in connection with any data protection impact assessments to be conducted by the Controller and any subsequent consultations with the supervisory authorities pursuant to Art. 35 and 36 of the GDPR.

§10Data Deletion Upon Termination of the Contract

(1) Upon termination of the contract, personal data shall be deleted in accordance with statutory requirements, unless statutory retention obligations apply.

(2) Documentation evidencing proper processing may be retained beyond the end of the contract.

§11Monitoring and Documentation Obligations

(1) The Processor shall provide the Controller with all necessary information to demonstrate compliance with GDPR obligations.

(2) The Controller may conduct an audit of the processing and the IT security measures (including inspections with prior notice and in compliance with trade secret protections), up to once a year or more frequently upon reimbursement of costs.

(3) Audits conducted by third parties are subject to strict confidentiality; the use of competitors is prohibited.

(4) Alternatively, the Processor may submit a certification or an independent audit report if this provides verifiable evidence of compliance with the obligations.

§12Term of the Contract and Termination

(1) This DPA applies for the duration of the main contract. Separate termination of this DPA is not permitted; if the main contract ends, this DPA shall also end accordingly.

§13Liability

(1) The liability provisions set forth in the main contract shall apply.

(2) The Controller undertakes to indemnify the Processor against claims by third parties and administrative sanctions, insofar as these are based on breaches of duty by the Controller.

§14Final Provisions

(1) Should any individual provisions of this DPA be or become invalid, the remainder of the contract shall remain valid. The invalid provision shall be replaced by a legally permissible provision that most closely approximates the economic purpose and complies with the requirements of Art. 28 of the GDPR.

(2) In the event of any conflict between this DPA and the main contract, the provisions of this DPA shall prevail.

(3) This DPA is available in both German and English. In the event of any inconsistency or divergence in interpretation between the two language versions, the German version shall prevail and is legally binding.