BioCV Data Processing Agreement (DPA/AVV)

Parties:

(1) Customer (the controller), identified in the applicable Order; and

(2) BioCV GmbH, Rüsingstr. 45, 44894 Bochum, Germany (the processor, "BioCV").

This DPA forms part of the agreement between Customer and BioCV governing the provision of the Services (the "Agreement"). To the extent BioCV processes Personal Data on behalf of Customer subject to the GDPR/UK GDPR/Swiss FADP, the terms of this DPA apply.

1. Definitions

Capitalized terms not defined here have the meaning in the Agreement. "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and related terms have the meanings in the GDPR.

2. Roles; Processing on Documented Instructions

2.1 Customer is the Controller (or Processor on behalf of a third‑party Controller); BioCV is the Processor (or sub‑processor, as applicable).

2.2 BioCV shall process Personal Data only on documented instructions from Customer, including with respect to transfers to a third country, unless required by EU/Member State/UK law. In such case, BioCV shall inform Customer unless that law prohibits such notice.

2.3 Customer's instructions are documented in the Agreement, this DPA, and Customer's configuration and documented use of the Services.

3. Confidentiality

BioCV ensures that persons authorized to process Personal Data are bound by confidentiality obligations and receive appropriate data protection training.

4. Security

BioCV implements appropriate technical and organizational measures ("TOMs") as described in Annex 2 (Security Measures). Customer is responsible for properly configuring the Services and securing its own systems and credentials.

5. Sub‑processing

5.1 Customer authorizes BioCV to use sub‑processors listed at https://biocv.org/legal/subprocessors and to engage replacements/additions under this Section.

5.2 BioCV will impose data protection obligations on sub‑processors by written contract equivalent to this DPA and remains responsible for their performance.

5.3 Notice & Objection. BioCV will provide at least 30 days' advance notice of new sub‑processors by updating the URL above (or via in‑app/email notice). Customer may object on reasonable grounds relating to data protection. If the parties cannot resolve the objection, Customer may terminate the affected Services without penalty.

6. Assistance; Data Subject Requests

Taking into account the nature of processing, BioCV shall assist Customer by appropriate technical and organizational measures, insofar as possible, to respond to data subject requests under Chapter III GDPR. BioCV shall also assist with security, breach notifications, DPIAs, and prior consultations, taking into account the information available to BioCV.

7. Personal Data Breach

BioCV will notify Customer without undue delay after becoming aware of a Personal Data Breach. The notice will include information reasonably available to BioCV at the time and will be supplemented as more details emerge.

8. International Transfers

Where BioCV or its sub‑processors transfer Personal Data outside the EEA/UK/Switzerland, the parties will rely on appropriate safeguards, including the EU Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum or other lawful transfer mechanisms. The SCCs are incorporated by reference (Module 2 and, where Customer is a processor, Module 3). A Docking Clause applies.

9. Audits

Upon reasonable notice, and no more than annually (unless required by a competent authority or following a confirmed breach), BioCV shall make available information necessary to demonstrate compliance with this DPA and allow for audits by Customer or an independent auditor mandated by Customer, provided: (a) audits occur during normal business hours; (b) do not unreasonably interfere with operations; and (c) protect confidentiality and security. Reports and summaries provided by reputable third parties (e.g., cloud provider audit reports) may satisfy audit requests where appropriate.

10. Return or Deletion

At termination or upon Customer request, BioCV will delete or return Personal Data (at Customer's choice) after a reasonable export window (see Agreement). BioCV may retain copies to the extent required by law, subject to confidentiality and continued protection.

11. Liability; Order of Precedence

The DPA is subject to the limitations and exclusions of liability in the Agreement. In the event of conflict, this DPA prevails over the Agreement to the extent of the conflict concerning data protection obligations.

12. Governing Law

This DPA is governed by the laws specified in the Agreement. For SCCs, the governing law is that of an EU Member State that allows for third‑party rights; absent selection, German law applies.

Annex 1 – Details of Processing

Subject matter and duration: Processing of Personal Data to provide the Services during the term of the Agreement.

Nature and purpose: Hosting, storage, transmission, telemetry ingestion, analytics, support, security, and related processing necessary to provide and improve the Services.

Types of personal data: Identification (name, email), account metadata, device/user IDs, telemetry that may be linked to users, usage logs, support content.

Categories of data subjects: Authorized users, customer personnel, and other individuals whose data is provided by Customer in connection with the Services.

Special categories: Not expected. Customer shall not submit special categories unless expressly agreed.

Frequency: Continuous and as initiated by Customer's use.

Data retention: As set forth in the Agreement and this DPA.

Annex 2 – Technical & Organizational Measures (TOMs)

Annex 3 – Sub‑processors

See the current list at https://biocv.org/legal/subprocessors.