Data Processing Agreement (DPA)

§ 1 Subject Matter and Duration

The Processor processes personal data on behalf of the Controller within the fieldbrain platform. Processing includes: • Voice recordings and their transcription (Pulse) • Customer data and deal information (Radar) • Usage data for coaching analysis (Elevate) • User accounts and authentication data The duration of processing corresponds to the term of the master agreement.

§ 2 Nature and Purpose of Processing

Processing is carried out for the purpose of providing fieldbrain services: • Automatic transcription and AI-powered analysis of voice recordings • Management and analysis of sales pipelines and deals • Generation of AI-based coaching recommendations • User authentication and access control

§ 3 Categories of Data Subjects

• Employees/sales representatives of the Controller • Customers and business partners mentioned in voice recordings • Administrators and team managers

§ 4 Categories of Personal Data

• Contact data (name, email address) • Voice recordings and derived transcriptions • Business data (company name, deal values, sales notes) • Usage data (login times, feature usage) • Authentication data (encrypted passwords, OAuth tokens)

§ 5 Technical and Organizational Measures

The Processor ensures the following protective measures: Encryption: • TLS 1.3 for all data transmission (in transit) • AES-256 encryption for stored data (at rest) • Encrypted database backups Access Control: • Row-Level Security (RLS) at database level • Role-Based Access Control (RBAC) • Multi-factor authentication for administrators Server Location: • All data is stored and processed within the European Union (EU) • Hosting infrastructure in EU data centers Availability: • Automatic backups and disaster recovery • Monitoring and alerting systems • Regular security updates

§ 6 Sub-processors

The Processor engages the following sub-processors:

The Controller consents to the use of the listed sub-processors. Changes will be communicated in advance, and the Controller has the right to object.

§ 7 Obligations of the Processor

The Processor commits to: • Processing personal data only on documented instructions of the Controller • Ensuring all persons involved in data processing are bound by confidentiality • Implementing all necessary technical and organizational measures per Art. 32 GDPR • Assisting the Controller in fulfilling data subject rights • Notifying the Controller immediately of any data breaches • Deleting or returning all data upon termination of processing

§ 8 Rights of the Controller

The Controller has the right to: • Verify technical and organizational measures before and during processing • Obtain information and evidence of compliance • Conduct inspections or have them conducted by third parties • Instruct the Processor to rectify, delete, or restrict processing of data

§ 9 Data Export & Deletion

• The Controller can request a complete data export (CSV) via the platform at any time • All personal data will be deleted within 30 days after contract termination • Deletion will be confirmed in writing upon request • Statutory retention obligations remain unaffected

§ 10 Contact

Data Protection Contact: Patrick Maghazehi & Jonas Schindel fieldbrain Erich-Kästner-Str. 12 80796 Munich, Germany Email: hallo@fieldbrain.de Privacy inquiries: datenschutz@fieldbrain.de