Data Processing Agreement (DPA / AVV)

This Data Processing Agreement ("DPA") forms part of the LicenseMeter Terms and Conditions (the "Principal Agreement") between the Parties for use of the LicenseMeter service (the "Service"). It governs the processing of personal data carried out by the Processor on behalf of the Controller in connection with the Service, in accordance with Article 28 GDPR.

On the Controller's instruction, the Processor reads license, directory and activity metadata from the Controller's Microsoft 365 tenant and, where the Controller connects them, from further source systems, and presents the results as analyses, reports and exports. Mailbox, file and message content is never accessed; access to the tenant is technically limited to read-only permissions.

In doing so the Processor processes personal data on behalf of the Controller. The Parties enter into this DPA to meet the requirements of Article 28 GDPR. With regard to the processing of personal data, this DPA prevails over any conflicting provision of the Principal Agreement.

The subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects are set out in Annex 1. The processing is carried out for the term of the Principal Agreement and ends when that agreement ends, subject to Section 10.

The Processor processes personal data exclusively within the European Union / European Economic Area, save for the transfers described in Section 12. The Processor does not process the data for its own purposes.

The personal data is processed exclusively for the purpose described in Annex 1: identifying unused, oversized and misaligned license assignments and their cost. The Processor does not use the personal data to monitor or evaluate the performance or behavior of individual employees of the Controller, does not create profiles for such purposes, and does not provide the Service as a tool for performance or behavior monitoring. Activity metadata is processed solely to determine whether a paid license seat is used, unused or oversized.

The Controller is responsible for assessing the lawfulness of the processing and for safeguarding the rights of data subjects. The Controller retains sole control and ownership of the personal data.

The Controller's documented instructions are constituted by this DPA, the Principal Agreement and the configuration choices the Controller makes in the Service (for example which tenant and which optional source systems it connects, the price book it maintains and the exports it triggers). Additional or amended instructions must be issued in text form.

The Processor processes personal data only on the Controller's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which it is subject; in such a case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits it.

The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions. The Processor is not obliged to carry out a legal review of the instructions.

The Processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR). Access to the personal data is limited to those employees and contractors who need it to provide and operate the Service.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, the Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The measures in place are described in Annex 2.

The measures are subject to technical progress and further development. The Processor may implement adequate alternative measures, provided the security level is not reduced below that of Annex 2. Material changes are documented.

The Controller grants the Processor general written authorization to engage the sub-processors listed in Annex 3 for the processing on the Controller's behalf. Each sub-processor is bound by a contract imposing data protection obligations equivalent to those of this DPA, in particular sufficient guarantees under Art. 28(3) and (4) GDPR. The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.

The Processor informs the Controller of any intended change concerning the addition or replacement of a sub-processor at least thirty (30) days in advance, thereby giving the Controller the opportunity to object on reasonable data protection grounds. If the Controller objects and the Parties cannot agree on a solution, the Controller may terminate the affected part of the Service for good cause.

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising data subjects' rights under Chapter III GDPR (Art. 12 to 23).

Where a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not respond on the merits itself unless instructed by the Controller.

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with its obligations under Art. 32 to 36 GDPR, in particular the security of processing, the notification of personal data breaches, the communication of breaches to data subjects, data protection impact assessments and prior consultation.

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on the Controller's behalf. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it.

On termination of the processing, and at the Controller's choice, the Processor deletes or returns all personal data processed on the Controller's behalf and deletes existing copies, unless Union or Member State law requires storage. Disconnecting a workspace in the Service deletes all synchronized data immediately and irreversibly; remaining copies in routine encrypted backups are overwritten within the backup rotation window (currently around seven days).

Where the Service involves billing, the payment subprocessor named in Annex 3 retains invoice and transaction data for the period required by statutory tax and commercial-law retention duties, even after deletion of the workspace.

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

The Processor may satisfy this obligation in the first instance by providing this DPA, the security overview published at the /security page, the subprocessors' own certifications and audit reports (for example SOC 2 / ISO 27001), and written answers to security questionnaires. On-site inspections are carried out on reasonable prior notice, during business hours, without disrupting operations, and subject to confidentiality.

Primary storage and the core processing take place in the European Union (see Annex 2 and Annex 3). Where a sub-processor processes personal data outside the EU / EEA without an adequacy decision, such transfer is based on the European Commission's Standard Contractual Clauses (SCCs) together with any supplementary measures required, or on another valid transfer mechanism under Chapter V GDPR. The transfer mechanism applicable to each sub-processor is indicated in Annex 3.

Liability of the Parties is governed by Art. 82 GDPR and by the liability provisions of the Principal Agreement. The liability limitations and caps agreed in the Principal Agreement apply to claims under this DPA to the extent permitted by law.

This DPA takes effect together with the Principal Agreement and remains in force for as long as the Processor processes personal data on the Controller's behalf. In the event of a conflict between this DPA and the Principal Agreement regarding the processing of personal data, this DPA prevails. In the event of a conflict between this DPA and the SCCs, the SCCs prevail.

This DPA is governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction, where permitted, is the registered seat of the Processor. Should individual provisions be or become invalid, the validity of the remaining provisions is unaffected; the invalid provision is replaced by a valid provision that comes closest to its economic intent. Amendments must be made in text form.