(1) Subject. uRemoTech processes the Customer’s personal data for the provision of the SaaS platform Talyrix (profile/CV management, exports, tenant-based access control, optional AI features, document conversion).

(2) Duration of storage and processing. For the term of the service agreement; beyond that, until complete return/deletion, as defined in § 5.

(3) Instructions. Processing takes place solely on documented instructions from the Customer, issued via the application or in text form.

(1) Activities. Collection, storage, organization, querying, use, transmission to sub-processors, deletion; including logging, caching, PDF→DOCX conversion.

(2) Data types. Basic/contact data, profile data/CVs, roles/qualifications, usage/system data (logs), file contents (provided by the customer). Special categories of data (Art. 9 GDPR) are not intended to be processed.

(3) Data subjects. Employees/agents of the Customer, external personnel (e.g., contractors), contact persons.

(1) Confidentiality. Processing is carried out only by persons bound by confidentiality.

(2) Security (TOM). Appropriate measures according to Art. 32 GDPR; see Annex 1.

(3) Sub-processors. General authorization. uRemoTech shall inform about intended changes (additions/replacements) at least 14 days before they take effect, in text form, stating the processing category, region (EU/EEA/third country), and applicable safeguards (e.g., Art. 46 GDPR). The Customer may object to a change for good cause. In the event of a justified objection, uRemoTech may deactivate the affected function (e.g., document conversion) for the Customer; other services remain unaffected. The naming of individual sub-processors will be provided upon request in text form.

(4) Data breaches. Immediate notification, generally within 48 hours after becoming aware, including details as required by Art. 33 GDPR.

(5) Data subject rights. Support with Art. 15–21 GDPR requests within a reasonable period.

(6) DPIA/Authorities. Support in accordance with Art. 35/36 GDPR.

(7) Evidence/Audits. Customer audits are excluded unless a legal right to audit exists.

(8) Third-country transfers. Transfers outside the EEA only on the basis of safeguards under Art. 46 GDPR (particularly EU Commission SCCs) and, where applicable, additional measures; see Annex 2 for details.

(9) No purpose change/training. No own purposes; no training of AI models on customer content without the Customer’s explicit consent.

(10) Return/deletion. Support according to § 5.

(1) Legal basis/information. The Customer is responsible for lawfulness, transparency, and data subject information.

(2) Instructions/account. Management of tenants/roles/permissions; instructions from the Customer may only be issued by authorized persons.

(3) Special data. The Customer shall not upload or process special categories of personal data in uRemoTech systems without a separate written agreement.

(1) During the term. Export functions available (PDF at any time; DOCX/Word depending on plan).

(2) After contract termination. Deletion of personal data no later than within 60 days, unless retention obligations apply; backups are overwritten on a rolling basis. Deletion confirmation available upon request in text form.

(3) Retention obligations. Statutory obligations (e.g., billing records) remain unaffected.

Primarily EU/EEA. Certain functions use sub-processors within the EU region (see Annex 2). Any access from third countries occurs solely based on EU Commission SCCs and additional measures.

The liability provisions of the main contract apply. Unaffected: Art. 82 GDPR (internal relationship).

(1) Order of precedence. This DPA takes precedence over the General Terms and Conditions in case of contradictions.

(2) Form. Amendments/instructions via the application or in text form.

(3) Governing law/jurisdiction as per the main contract.

(4) Severability. The invalidity of individual provisions shall not affect the validity of the remainder of the agreement.