Part IV - Order Processing by Vendors

1. Introduction, Scope, Definitions
   1.1. CopeCart Pro Ltd (for this Part IV "Client") allows personal data to be processed by the Vendor (for this Part IV "Contractor") for the purpose of conducting business (the respective "Main Contract") on behalf of the Client. To execute the Main Contract, the Client commissions the Contractor with order processing pursuant to Art. 28 GDPR, provided that the legal requirements are met. In the event of contradictions, this data processing contract takes precedence over the Main Contract.
   1.2. The terms used in this contract are to be understood according to their definitions in the EU General Data Protection Regulation. In this sense, the Client is the "Data Controller" and the Contractor is the "Data Processor." Where declarations are to be made "in writing" below, this refers to the written form as per § 126 BGB. Otherwise, declarations can also be made in another form, provided that verification is ensured.

2. Nature and Purpose of Data Collection, Processing, or Use
   2.1. Nature and purpose of processing. The following processing activities are involved: collecting, recording, organizing, structuring, storing, adapting or altering, cross-selling, upselling, retrieving, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing, or destroying of data. The processing serves the following purpose: contract fulfillment, contract execution. Data subjects are affected by the processing.

3. Subject and Duration of Processing
   3.1. Subject of processing. The Contractor undertakes the following processing:
   3.2. General personal data:
   3.2.1. Name
   3.2.2. Date and place of birth
   3.2.3. or the domicile of a person
   3.3. Identification numbers
   3.4. Online data
   3.5. The processing takes place based on the main contracts existing between the parties.
   3.6. Duration: The processing begins on the date of the conclusion of the respective main contract and runs indefinitely until this contract or the main contract is terminated by one of the parties.

4. Obligations of the Contractor
   4.1. The Contractor processes personal data exclusively according to the contractual agreements or instructions of the Client unless the Contractor is legally obligated to process them in a specific manner. If such obligations exist for the Contractor, they must inform the Client before processing, unless informing is legally prohibited. Furthermore, the Contractor may not use the data provided for processing for other purposes, particularly not for their own purposes.
   4.2. The Contractor confirms that they are aware of the relevant general data protection regulations. They will observe the principles of proper data processing.
   4.3. The Contractor undertakes to maintain the strictest confidentiality when handling.
   4.4. Persons who can access the data processed on behalf must commit in writing to confidentiality, unless they are already subject to a corresponding obligation of secrecy by law.
   4.5. The Contractor ensures that the persons involved in processing are familiarized with the relevant data protection provisions and this contract before processing commences. The Contractor ensures that the personnel employed for order processing are adequately instructed with respect to fulfilling data protection requirements and are continuously monitored.
   4.6. In connection with order processing, the Contractor supports the Client in the creation and updating of the processing activities register and in conducting the data protection impact assessment. All necessary information and documentation must be provided and delivered to the Client without delay upon request.
   4.7. If the Client is subject to an audit by supervisory authorities or other entities, or if affected persons assert rights against them, the Contractor undertakes to support the Client to the necessary extent, insofar as the processing on behalf is concerned.
   4.8. The Contractor may only provide information to third parties or the data subject with the prior consent of the Client. The Contractor will immediately forward inquiries directed at them to the Client.
   4.9. Where required by law, the Contractor must appoint a competent and reliable person as the data protection officer. It must be ensured that no conflicts of interest exist for the officer. In cases of doubt, the Client may contact the data protection officer directly. The Contractor promptly provides the Client with the contact details of the data protection officer or explains why no data protection officer was appointed. The Contractor promptly informs the Client of any changes in the person or in the internal tasks of the officer.
   4.10. Order processing generally occurs within the EU or EEA. Transfer to a third country may occur only with the express consent of the Client and under the conditions of Chapter V of the General Data Protection Regulation as well as compliance with the provisions of this contract.
   4.11. If the Contractor is not established in the European Union, they appoint a responsible contact person in the European Union in accordance with Art. 27 of the General Data Protection Regulation. The contact details of the representative and any changes in the representative must be communicated to the Client without delay.

5. Notification Obligations
   5.1. The Contractor must inform the Client without delay about breaches of the protection of personal data. Reasoned suspicions must also be reported. The notification must be sent to an address specified by the Client within 24 hours after the Contractor becomes aware of the respective incident. It must include at least the following information:
   5.1.1. A description of the nature of the personal data breach, including, where possible, the categories of data protection concerned and the approximate number of data subjects affected, the affected categories, and the approximate number of affected personal data records;
   5.1.2. The name and contact details of the data protection officer or other contact point for further information;
   5.1.3. A description of the likely consequences of the personal data breach;
   5.1.4. A description of the measures the Contractor has taken or proposes to address the personal data breach, including, where applicable, measures to mitigate its possible adverse effects.
   5.2. Significant disruptions in order fulfillment and violations by the Contractor or its agents against data protection regulations or the provisions of this contract must also be reported without delay.
   5.3. The Contractor promptly informs the Client about inspections or measures by supervisory authorities or other third parties, to the extent they relate to order processing.
   5.4. The Contractor assures to support the Client in fulfilling its obligations under Art. 33 and 34 of the General Data Protection Regulation as far as necessary.

6. Technical and Organizational Measures
   6.1. The data security measures described in Appendix 1 are defined as binding. They define the minimum owed by the Contractor. The description of the measures must be so detailed that a knowledgeable third party can recognize at any time, based solely on the description, what minimum is owed. A reference to information that cannot be directly taken from this agreement or its annexes is not permissible.
   6.2. The data security measures may be adapted to the technical and organizational development as long as they do not fall below the level agreed here. Changes necessary to maintain information security must be implemented by the Contractor without delay. Changes must be communicated to the Client promptly. Significant changes must be coordinated between the parties.
   6.3. If the security measures taken do not or no longer meet the Client's requirements, the Contractor must inform the Client immediately.
   6.4. The Contractor guarantees that the data processed on behalf are kept strictly separate from other data inventories.
   6.5. Copies or reproductions may not be made without the knowledge of the Client. This does not apply to technically necessary, temporary copies, provided that impairment of the agreed data protection level is excluded.
   6.6. Processing of data in private residences is only permissible with prior written consent from the Client in individual cases. If such processing occurs, the Contractor ensures that a level of data protection and data security corresponding to this agreement is maintained and that the Client's control rights mentioned in this contract can be exercised unrestrictedly in the private residences concerned. Data processing on behalf of the Client using private devices is not permissible under any circumstances.
   6.7. Dedicated data carriers originating from or used for the Client must be specially marked and are subject to ongoing management. They must always be properly stored and not accessible to unauthorized persons. Inputs and outputs are documented.
   6.8. The Contractor must regularly, at least every 12 months, prove fulfilment of their obligations, particularly the complete implementation of the agreed technical and organizational measures and their effectiveness. Proof must be provided to the Client either every 12 months or any time upon request. Proof may be provided through approved codes of conduct or an approved certification process.

7. Relationships to Subcontractors
   7.1. The commissioning of subcontractors is only permitted with the written consent of the Client in each individual case.
   7.2. Consent is only possible if the subcontractor is contractually obligated to comparable data protection obligations, at least equivalent to those agreed in this contract. Upon request, the Client shall have access to the corresponding contracts between the Contractor and the subcontractor.
   7.3. The rights of the Client must also be effectively exercisable against the subcontractor. In particular, the Client must be authorized at any time to conduct checks at the subcontractors, to the extent specified herein, or have them carried out by third parties.
   7.4. The responsibilities of the Contractor and subcontractor must be clearly delineated.
   7.5. The further transfer of subcontracting services by the subcontractor within the scope of another subcontract is not permissible.
   7.6. The Contractor selects the subcontractor carefully, paying particular attention to the adequacy of the subcontractor's technical and organizational measures.
   7.7. The transfer of data processed on behalf to the subcontractor is only permitted if the Contractor has documented that the subcontractor has fully fulfilled its obligations. The Contractor must provide the documentation unsolicited to the Client.
   7.8. The commissioning of subcontractors, who do not exclusively provide processing services within the EU or EEA, is only permissible if the conditions laid down in Part IV Sections 4.10 and 4.11 of this Data Protection Regulation are met. It is permissible only if and as long as the subcontractor provides adequate data protection guarantees. The Contractor will inform the Client about what specific data protection guarantees the subcontractor provides and how proof thereof can be provided.
   7.9. The Contractor must regularly conduct, at least once every 12 months, an adequate review of the subcontractor's compliance with its obligations. The audit and its results must be documented so comprehensively that they are intelligible to a knowledgeable third party. Documentation occurs through an audit available in the system, conducted by the Contractor in the form of a self-audit.
   7.10. If the subcontractor does not meet its data protection obligations, the Contractor is liable to the Client for this.
   7.11. Currently, the subcontractors listed in Appendix 2 with name, address, and order content are engaged in processing personal data within the scope mentioned there by the Client. The other obligations of the Contractor towards the subcontractors mentioned herein remain unaffected.
   7.12. Only those services directly associated with the provision of the main service are considered subcontracts within the meaning of this contract. Ancillary services such as transport, maintenance, and cleaning as well as the use of telecommunications services or user services are not included. The Contractor's obligation to adhere to data protection and data security remains unaffected in these cases.

8. Rights and Obligations of the Client
   8.1. The Client is solely responsible for assessing the permissibility of order processing and for safeguarding the rights of the data subjects.
   8.2. The Client issues all orders, partial orders, or instructions in documented form. In urgent cases, instructions may also be issued orally. The Client must promptly confirm such instructions in writing.
   8.3. The Client must promptly inform the Contractor if they detect errors or irregularities when checking the order results.
   8.4. The Client is entitled to monitor compliance with data protection regulations and the contractual agreements by the Contractor to a reasonable extent, in particular by obtaining information and inspecting the stored data and data processing programs, as well as other on-site checks. The persons entrusted with the control must be granted access and insight to the necessary extent by the Contractor. The Contractor is obliged to provide the information necessary to conduct an inspection, represent processes, and furnish proof.

9. Instructions
   9.1. The Client reserves the right to issue comprehensive instructions for the order processing.
   9.2. The Client and Contractor name in Appendix 3 the persons authorized to issue and receive instructions.
   9.3. In case of a change or long-term absence of the named persons, the other party must be informed without delay about any successors or representatives.
   9.4. The Contractor will notify the Client without delay if an instruction from the Client, in their opinion, violates legal regulations. The Contractor is entitled to suspend the execution of the respective instruction until it is confirmed or amended by the responsible person of the Client.
   9.5. The Contractor documents the instructions issued to them and their implementation.

10. Service Provisions
    The tasks and measures of the Contractor as part of order processing are carried out free of charge. No remuneration is paid.

11. Special Right of Termination
    11.1. The Client may terminate the main contract and this contract at any time without notice ("extraordinary termination") if the Contractor severely violates data protection regulations or the provisions of this contract if the Contractor cannot or is unwilling to follow a lawful instruction from the Client, or if the Contractor unreasonably refuses to fulfill the Client's control rights.
    11.2. A serious breach is deemed to exist, in particular, if the Contractor does not fulfill or has not fulfilled the obligations outlined in this contract, especially the agreed technical and organizational measures, to a significant extent.
    11.3. In the case of minor breaches, the Client must set a reasonable deadline for remedying the breach. If the remedy does not take place in time, the Client has the right to extraordinary termination under the terms of this section.
    11.4. The Contractor reimburses the Client for all costs incurred due to the premature termination of the main contract or this contract.

12. Termination of the Order
    12.1. Upon termination of the contractual relationship or at any time at the Client's request, the Contractor will destroy or hand over to the Client the data processed on behalf according to the Client's choice. All existing copies of the data are also to be destroyed. Destruction must be carried out so that restoration, even of residual information, is not possible with reasonable effort. Physical destruction must follow DIN 66399, with at least protection class 2 applying.
    12.2. The Contractor must ensure the immediate return of the goods equally for subcontractors.
    12.3. The Contractor must provide and promptly present proof of proper destruction to the Client.
    12.4. Documentation that serves to prove proper data processing must be retained by the Contractor according to the respective retention periods beyond the contract's end. The Contractor can hand them over to the Client at the end of the contract to relieve the Client.

13. Liability
    13.1. The Contractor bears the burden of proof that damage is not due to a circumstance attributable to them, as far as the concerned data were processed by them under this contract. As long as this proof is not provided, the Contractor shall indemnify the Client from all claims asserted against the Client in connection with order processing. Under these conditions, the Contractor also reimburses the Client for all legal defense costs incurred.
    13.2. The Contractor is liable to the Client for damages caused culpably by the Contractor, their employees, or subcontractors commissioned by them or used by them within the scope of fulfilling the contract.
    13.3. Part IV clauses 13.1. and 13.2. do not apply if the damage is caused by the proper execution of the ordered service or an instruction of the Client.
    13.4. The Client makes no warranties, representations, or recommendations regarding the products of the Contractor, their suitability for sale, or any other auxiliary claims and assumes no liability concerning the products to be sold.

14. Provisions on Correction, Deletion, and Blocking of Data
    14.1. The Contractor corrects, deletes, or blocks the data processed under the order only according to the contractual agreement made or by instruction of the Client.
    14.2. The Contractor must follow the respective instructions of the Client at any time and beyond the termination of this contract.

15. Contractual Penalty
    For each culpable violation of an obligation under this data processing contract, the Contractor undertakes to pay the Client a contractual penalty whose determination is at the reasonable discretion of the Client and is subject to judicial review in case of a dispute. Claims that go beyond the contractual penalty remain unaffected. The contractual penalty has no influence on other claims of the Client.

16. Transfer to Third Countries
    To ensure an adequate level of data protection when transferring personal data to third countries, CopeCart Pro Ltd uses the standard contractual clauses approved by the European Commission. These clauses regulate the processing of personal data by our processors and ensure compliance with the data protection requirements of both the EU and the respective third country. We also refer to our General Terms and Conditions and our Privacy Policy.

17. Miscellaneous
    17.1. Both parties are obliged to treat all knowledge of trade secrets and data security measures of the other party obtained during the contractual relationship as confidential even after the termination of the contract. If there is doubt whether information is subject to confidentiality obligations, it shall be treated confidentially until released in writing by the other party.
    17.2. If the Client's property is threatened by measures of third parties (e.g., seizure or confiscation), by insolvency or settlement proceedings, or by other events, the Contractor must inform the Client without delay.
    17.3. Additional agreements must be made in writing.
    17.4. The right to withhold in the sense of § 273 BGB is excluded concerning the data processed on behalf and the associated data carriers.
    17.5. If individual parts of this agreement are invalid, this does not affect the validity of the rest of the agreement.

18. Appendix 1 – Technical and Organizational Measures
    The order-related technical and organizational measures to ensure data protection and data security, which the Contractor must at least establish and maintain continuously, are listed below. The aim is, in particular, to ensure the confidentiality, integrity, and availability of the information processed on order.
    Confidentiality (Art. 32 para. 1 lit. b GDPR)
    18.1. Access control: No unauthorized access to data processing systems, e.g., magnetic or chip cards: magnetic or, keys, electric door openers, security services or receptionists, alarm systems, video systems;
    18.2. Access control: No unauthorized use of systems, e.g., (secure) passwords, automatic lock mechanisms, two-factor authentication, encryption of data carriers: (secure) passwords, automatic lock mechanisms, two-factor authentication, encryption of data carriers;
    18.3. Access control: No unauthorized reading, copying, altering, or removal within the system, e.g., authorization concepts and needs-based access rights, logging access;
    18.4. Separation control separate processing of data collected for different purposes, e.g., multi-tenancy, sandboxing;
    18.5. Pseudonymization (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR) the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without using additional information, provided that the additional information is kept separately and is subject to appropriate technical and organizational measures;
    Integrity (Art. 32 para. 1 lit. b GDPR)
    18.6. Transfer control No unauthorized reading, copying, modification, or removal during electronic transmission or transport, e.g., encryption, virtual private networks (VPN), electronic signature: encryption, virtual private networks (VPN), electronic signature;
    18.7. Input control determination of whether and by whom personal data is entered, changed, or removed in data processing systems, e.g., logging, document management: logging, document management;
    Availability and Load Capacity (Art. 32 para. 1 lit. b GDPR)
    18.8. Availability control protection against accidental or deliberate destruction or loss, e.g., backup strategy (online/offline; on-site/off-site): backup strategy (online/offline; on-site/off-site), uninterruptible power supply (UPS), antivirus protection, firewall, notification routes and emergency plans;
    Fast Recoverability (Art. 32 para. 1 lit. c GDPR);
    18.9. Privacy Management;
    18.10. Incident Response Management;
    18.11. Privacy-friendly default settings (Art. 25 para. 2 GDPR);

19. Order Control
    19.1. No processing of data in the sense of Art. 28 GDPR without corresponding instruction by the Client, e.g., clear contract design, formalized order management, strict selection of service provider, obligation of persuasion in advance, follow-up checks.

20. Appendix 2 – Subcontractors
    Marketing MBA, Office 1906 Jumeirah Business Centre 3, Cluster Y, Jumeirah Lake Towers, Dubai, United Arab Emirates. rp@aiv.group (CEO Raoul Plickat)
    20.1. Tools and programs used by the subcontractor processing personal data:
    20.1.1. Slack Technologies Limited: Salesforce Tower 60 R801, North Dock Dublin, Ireland privacy@slack.com
    20.1.2. Monday.com: MondayCom Ltd, 6 Yitzhak Sadeh Street, Tel Aviv-Yafo, 677750 https://monday.com/helpcenter/
    20.1.3. Notion: Hendrik Beck & Sascha Rehbock GbR, Hanauer Str.3, 61118 Bad info@getgamma.app
    20.1.4. Google: Google Workspace Google Analytics Google Tag Manager Google Ireland Limited Gordon House, Barrow Street Dublin 4 Ireland deutschland@google.com
    20.1.5. Zoom: Zoom Video Communications, Inc. 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA privacy@zoom.us
    20.1.6. Calendly: Calendly LLC,1315 Peachtree St NE, Atlanta, GA 30309, USA privacy@calendly.com
    20.1.7. WebinarJam: 7660 Fay Ave Ste H184, La Jolla, California, 92037, United States support@webinarjam.com
    20.1.8. Close CRM: Elastic Inc, PO Box 1145, Jackson, WY 83001, USA dpo@close.com
    20.1.9. Keeping: Katsu Ventures LLC, 90 State Street, Suite 700, Albany, NY 12207 support@keeping.com
    20.1.10. Active Campaign: Active Campaign LLC, 1 N Dearborn St Fl 5, Chicago, Illinois, 60602, United States help@activecampaign.com
    20.1.11. WebSMS: LINK Mobility Austria GmbH, Brauquartier 5/13, 8055 Graz, AUSTRIA office.at@linkmobility.com
    20.1.12. Slido: Cisco Systems, Inc, Legal Department, 170 West Tasman Dr, San Jose, CA 95134, USA support@slido.com
    20.1.13. Jotform: Jotform Inc. 4 Embarcadero Centre, Suite 780, San Francisco CA 94111 support@jotform.com
    20.1.14. WebFlow: WebFlow Inc, 398 11th Street, Floor 2, San Francisco, CA 94103 support@webflow.com
    20.1.15. Clickfunnels: Clickfunnels LLC, 3443 W Bavria St, Eagle, Idaho 83616, US support@clickfunnels.com
    20.1.16. funnelcockpit: Denis Hoeger Caballero, Nobelstr- 3-5, 41189 Mönchengladbach, Germany support@funnelcockpit.com
    20.1.17. Kajabi: Kajabi LLC, 333 El Camino Real Ste 200 Tustin California 92780, US support@kajabi.com
    20.1.18. AkcademyOcean: Netpeak Group Ltd, 43 Cherni Vrah bld, Sofia, Bulgaria gdpr@netpeak.net
    20.1.19. CopeMember: CopeMember Technology Ltd, Gialousas 63, 3071 Limassol, Cyprus info@copemember.com
    20.1.20. CopeCart Pro: CopeCart Pro Ltd. Ground Floor, 71 Lower Baggot Street, Dublin 2, Co. Dublin, D02 P593, Ireland
    20.1.21. Matomo: Matomo Ltd, 150 Willis St, Mount Victoria, 6011, New Zealand privacy@matomo.org
    20.1.22. cookiebot: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark mail@cookiebot.com
    20.1.23. Hotjar: Hotjar Ltd, Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St. Julian's STJ 3141 Malta support@hotjar.com
    20.1.24. Zapier: Zapier, Inc. 548 Market St. #62411. San Francisco, CA 94104- 5401, USA contact@zapier.com
    20.1.25. vimeo: Vimeo Inc, 330 W 34th St Fl 5, New York City, New York, 10001, USA support@vimeo.com
    20.1.26. vidalytics: Vidalytics LLC, 340 S Lemon Ave, Walnut, California, 91789, USA hi@vidalytics.com‍

21. Appendix 3 – Authorized Persons
    The following persons are authorized to issue and receive instructions: The person responsible for processing within the meaning of Art. 4 No. 7 GDPR22. Appendix 4 – Data Protection Officers
    The Contractor currently has an external data protection officer: Williams-Connect Management Janko Williams Straße der Jugend 18 14974 Ludwigsfelde contact@williams-connect.eu‍