Data processing agreement

Draft – review by a lawyer required. This agreement has not yet been legally reviewed. It describes how we process your data in FUBEXA ONE. You will receive the signed data processing agreement together with your FUBEXA ONE contract.

This translation is provided for convenience; in case of discrepancies the German version prevails.

Parties

Controller (“customer”): the business that concludes a contract for FUBEXA ONE with us (“main contract”, including our terms and conditions), also during the free trial period.

Processor (“FUBEXA”, “we”): FUBER LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom; registered with Companies House (England and Wales) 14783209.
Data protection contact: hello@fubexa.com

§ 1 Subject matter and duration

1. This agreement governs the obligations of the parties insofar as we process personal data on behalf of the customer under the main contract (Art. 28 GDPR). It applies to the FUBEXA ONE platform (web and app), its connections to the customer’s systems, the free trial period, the error scan and support.
2. The agreement begins with the main contract – in the case of a free trial, when the trial begins – and ends with it. Obligations that continue beyond this, in particular regarding return, deletion and confidentiality, remain in force until they have been fulfilled.
3. If this agreement and the main contract conflict, this agreement prevails in matters of data protection.

§ 2 Nature and purpose of the processing

1. We provide FUBEXA ONE to the customer as software over the internet (software as a service). The processing comprises collection via the interface, the app and the connections; storage, organisation, matching, analysis and display; transmission to recipients determined by the customer (for example by e-mail or as an export); backup; and deletion.
2. The sole purpose is to provide the agreed services: the modules of the selected plan (for example Sales, Warehouse, Finance, Staff and Cockpit), the connection to the customer’s systems, support, data backup and protection of the platform against misuse.
3. We connect to JTL-Wawi and DATEV on a read-only basis. We do not change any data there.
4. We do not use the customer’s data for our own purposes, in particular not for advertising, and pass it on only to the sub-processors under § 8.

§ 3 Types of personal data

Depending on the modules the customer uses:

• Customer data: name, address, contact details, sales contracts, signatures, deliveries, complaints;
• Employee data: name, role, store and contact details of the customer’s employees;
• Staff records: personnel file including tax identification number, social security number and bank details (IBAN), holidays and rota;
• Time and payroll data: working hours (clock-in and clock-out), corrections and their reasons, data for payroll preparation;
• Supplier data: contact persons at suppliers and manufacturers, orders, order confirmations;
• Payment data: payments, deposits, open items, cash book and the bookings read from DATEV;
• User accounts: name, login e-mail, password (stored only as a hash), two-factor authentication settings, sessions, IP addresses, device information and activity logs;
• Content: files and texts that the customer uploads or enters, for example photos, PDF documents and messages to support.

The customer decides whether to record special categories of personal data (Art. 9 GDPR), for example information on sick days. The measures in Annex 1 apply to such data in the same way.

§ 4 Categories of data subjects

• customers and prospective customers of the customer;
• employees of the customer, including former employees;
• users of FUBEXA ONE at the customer;
• contact persons at suppliers, manufacturers, service providers and other business partners of the customer.

§ 5 Instructions

1. We process the data only on documented instructions from the customer, including with regard to transfers to a third country, unless we are required to do so by Union or Member State law. In that case, we inform the customer of that legal requirement beforehand, unless that law prohibits this on important grounds of public interest (Art. 28(3)(a) GDPR).
2. Instructions are this agreement, the main contract and the settings the customer makes in FUBEXA ONE, for example on users, roles, modules, connections, deletions and exports. The customer gives further instructions in text form, for example by e-mail to hello@fubexa.com.
3. The owner of the customer account and the persons they designate for this purpose are authorised to give instructions.
4. If, in our opinion, an instruction infringes data protection law, we inform the customer without undue delay. We may suspend the instruction until the customer confirms or changes it.

§ 6 Confidentiality

1. All persons at FUBEXA who have access to the customer’s data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR). This obligation continues after their work ends.
2. Only persons who need access for their task receive it. FUBEXA staff see the customer’s data only in logged support sessions and only on a read-only basis (Annex 1).

§ 7 Technical and organisational measures

1. We take the measures pursuant to Art. 32 GDPR described in Annex 1.
2. We develop the measures further in line with the state of the art. We may change them provided that the level of protection does not decrease. We document material changes and inform the customer of them.

§ 8 Sub-processors

1. The customer authorises the sub-processors listed in Annex 2.
2. If we intend to engage additional sub-processors or replace existing ones, we inform the customer in text form at least 30 days in advance. The customer may object to the change for an important reason relating to data protection. If we cannot find a solution, the customer may terminate the main contract with effect from the date of the change.
3. We contractually bind every sub-processor to data protection obligations equivalent to those of this agreement (Art. 28(4) GDPR). We are liable to the customer for their compliance.
4. The providers of the customer’s systems, such as JTL-Wawi, DATEV or manufacturer portals, are not our sub-processors. The customer concludes the contracts with them itself.

§ 9 Place of processing and third countries

1. We are based in the United Kingdom. We store and process the customer’s data in an Oracle Cloud Infrastructure data centre in London. In addition, we keep a backup copy encrypted with AES-256 on a server rented by us in Istanbul (Türkiye); the key is not stored there, and the copy is deleted after 30 days (Annexes 1 and 2).
2. The European Commission has adopted an adequacy decision for the United Kingdom pursuant to Art. 45 GDPR; it is valid until 27 December 2031. If it ceases to apply, the parties will agree appropriate safeguards pursuant to Art. 46 GDPR without undue delay, for example the European Commission’s standard contractual clauses.
3. We transfer data to other third countries only if the conditions of Arts. 44 to 49 GDPR are met. Annex 2 states the respective basis.

§ 10 Assistance to the customer

1. We assist the customer with appropriate technical and organisational measures in responding to requests from data subjects (Arts. 12 to 22 GDPR). The customer can handle much of this directly in FUBEXA ONE, for example access, rectification, erasure and export.
2. If a data subject contacts us directly, we forward the request to the customer without undue delay. We reply to the data subject only on the customer’s instructions.
3. We assist the customer with its obligations under Arts. 32 to 36 GDPR (security of processing, notifications, data protection impact assessment, prior consultation), taking into account the information available to us.

§ 11 Notification of personal data breaches

1. We notify the customer of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, in text form to the e-mail address of the account owner.
2. The notification contains, as far as known, the information required by Art. 33(3) GDPR. We provide any missing information as soon as it becomes available.
3. We take measures without undue delay to remedy the breach and mitigate its consequences, in consultation with the customer. The customer notifies the supervisory authority and data subjects; we assist the customer in doing so.

§ 12 Data export, return and deletion

1. The owner of the customer account can request a complete export of their company’s data in FUBEXA ONE at any time: every table as a CSV file and every stored file in its original form. Access credentials such as password hashes are not included. We provide the export within 24 hours of the request.
2. When the main contract ends, we return the customer’s data on request as an export under paragraph 1. We delete the customer’s data 30 days after the end of the contract, unless Union or Member State law requires storage. Copies in backups are deleted when the backups expire as scheduled (Annex 1).
3. If we discontinue FUBEXA ONE, we provide the customer with the complete export under paragraph 1 at least 90 days in advance.
4. On request, we confirm the deletion to the customer in text form.

§ 13 Evidence and audit rights

1. On request, we make available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
2. The customer, or an auditor appointed by the customer who is bound to confidentiality, may verify compliance with this agreement after giving reasonable notice, during normal business hours and without disproportionately disrupting operations.
3. Audits at our sub-processors are governed by their terms. Where available, we provide their certificates and audit reports for this purpose.

§ 14 Liability

1. The parties are liable to data subjects in accordance with Art. 82 GDPR.
2. As between the parties, each party bears the part of the damage corresponding to its share of responsibility (Art. 82(5) GDPR).
3. Otherwise, the liability provisions of the main contract (§ 11 of the terms and conditions) apply, insofar as Art. 82 GDPR does not preclude this.

§ 15 Final provisions

1. Amendments and additions to this agreement must be made in text form. This also applies to any waiver of this form requirement.
2. The law of the Federal Republic of Germany applies. To the extent permitted by law, the place of jurisdiction is the customer’s registered office.
3. If any provision of this agreement is invalid, the remainder of the agreement remains valid.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Separation of customers

• Each company has its own database with its own database role. Data of different customers is never stored in the same database.
• Shared platform tables, for example for accounts and billing, are additionally separated per company by row-level security.

Encryption

• All connections to the platform are encrypted (TLS).
• Sensitive staff details, such as tax identification number, social security number and IBAN, as well as access credentials for connected systems are additionally stored sealed with AES-256-GCM.
• We store passwords only as hashes.

Access control

• Roles and permissions: each user sees and edits only what their role allows. The customer assigns the roles.
• Two-factor authentication: mandatory for FUBEXA staff, optional for the customer’s users.
• Protection against password guessing: after 5 failed attempts the account is locked for 15 minutes.
• FUBEXA staff access the customer’s data only in logged support sessions, on a read-only basis.

Logging and integrity

• Logins, failed attempts, changes, exports and support access are recorded in an audit log that cannot be altered afterwards.
• Time entries cannot be changed; corrections are only possible with a reason and remain traceable.

Protection against attacks

• A web application firewall (WAF) detects suspicious requests, for example mass login attempts or requests for unknown pages, and blocks their source automatically: for increasing periods, and permanently if repeated.
• Cloudflare additionally protects the platform against DDoS attacks.

Connections

• JTL-Wawi and DATEV are connected on a read-only basis; we do not change any data there.

Availability and backup

• Every night we back up all databases and stored files. The latest backup is encrypted with AES-256 on the platform server, and a copy is kept on a second server rented by us in Istanbul (Türkiye). The decryption key is kept only on the platform side, not on that server. The copies in Istanbul are deleted after 30 days.
• If the latest backup is older than 26 hours, we are warned automatically.
• The platform runs in an Oracle Cloud Infrastructure data centre in London. Oracle is responsible for the physical security of the data centre.

Deletion and retention

• Customer data: deleted 30 days after the end of the contract (§ 12).
• Backups on the platform server: deleted after 14 days.
• Encrypted backup copies in Istanbul: deleted after 30 days.
• Export files: deleted 7 days after they are provided.
• Logs of requests to the platform including IP address: deleted after 30 days.

Organisation and review

• Staff are bound to confidentiality (§ 6) and receive only the permissions they need for their task.
• We review the measures regularly, in particular after changes to the platform. Automated tests check, among other things, the separation of companies and the permissions of roles.

Annex 2: Sub-processors

By default, the AI assistant uses our own language model on our servers; no data is transferred to third parties. An external AI provider is only switched on by agreement with the customer and is added to this annex beforehand in accordance with § 8.

Version: draft of 18 October 2026