Data processing agreement (DPA) under Art. 28 GDPR

between the Customer as controller or, insofar as it itself acts on behalf of third parties, as processor ("Customer") and ELEVAYTE Online UG (haftungsbeschränkt), Rüdigerstraße 16, 40472 Düsseldorf, as (further) processor ("PiPort").

§ 1 Subject matter, application and term

(1) PiPort processes personal data on behalf of the Customer within the framework of the contract of use for the PiPort service (Terms). This agreement applies insofar as PiPort processes personal data on behalf of the Customer. For businesses with a PRO bundle this is regularly the case; for them the agreement becomes part of the contract upon booking. If a consumer uses PiPort exclusively for personal or household activities, the GDPR does not apply to them as controller (Art. 2(2)(c) GDPR). If a consumer also processes data of third parties, they can conclude this agreement in the dashboard.

(2) This agreement runs as long as the contract of use and beyond that, as long as PiPort processes personal data of the Customer (§ 9).

(3) This agreement does not cover processing for which PiPort itself is responsible, in particular contract handling and billing with the Customer, the security of the Service including the detection of misuse, and the fulfilment of legal obligations. These are described in the privacy policy.

(4) In the event of conflicts, this agreement takes precedence over the Terms in matters of data protection.

(5) If the Customer in turn processes the data on behalf of a third party (e.g. as a service provider that manages devices of its clients), PiPort is a further processor (Art. 28(4) GDPR). The Customer passes on the instructions of its client and ensures that the client has agreed to the use of PiPort and of the sub-processors under Annex B. The Customer exercises the client's control and information rights on its behalf.

(6) For hosting and operation of the Service, PiPort uses ELEVAYTE Systems UG (haftungsbeschränkt), Rüdigerstraße 16, 40472 Düsseldorf, as service provider and thus as sub-processor. An agreement under Art. 28(4) GDPR with the same data protection obligations as in this agreement exists between the two companies. The other sub-processors (e.g. the data centre) are engaged by ELEVAYTE Systems UG; all are listed in Annex B.

§ 2 Nature, purpose and location of processing, data and data subjects

(1) The purpose of the processing is the provision of the Service: remote access to the Customer's devices via the relay, display and history of device data, notifications and the management of organisation and team.

(2) Nature of the processing: collecting, storing, displaying, transmitting to users of the Customer, passing through, deleting.

(3) Data categories:

(4) Not processed are passwords and private keys for signing in on the device; PiPort does not receive them. Contents of SSH sessions and the browser terminal are end-to-end encrypted; PiPort cannot read them. The relay merely forwards the contents of other TCP forwarding; if they are not encrypted by the transmitted protocol, they are briefly present in plain text in the relay's memory while doing so. PiPort does not store, log or analyse these contents; passing them through is processing within the meaning of this agreement.

(5) Data subjects: employees and agents of the Customer who use PiPort; invited persons; persons who use the Customer's devices or whose data appears in device names, host names or screen contents; for sub-organisations (Enterprise add-on), also the Customer's customers and their employees.

(6) Location: Processing takes place in the European Union, essentially in data centres in Germany. Processing in a third country takes place only through the sub-processors listed in Annex B and only if the requirements of Art. 44 et seq. GDPR are met.

§ 3 Instructions

(1) PiPort processes the data only on documented instructions from the Customer, including with regard to transfers to a third country, unless PiPort is required to process otherwise by Union or German law; in that case PiPort informs the Customer beforehand, unless that law prohibits this on important grounds of public interest.

(2) The instructions result from this agreement, the Terms and the settings that the Customer makes in the dashboard or via the API. The Customer gives further instructions in text form.

(3) If PiPort considers an instruction to be unlawful, PiPort informs the Customer without undue delay and may suspend its execution until the Customer confirms or changes it.

§ 4 PiPort's obligations

(1) PiPort commits all persons who have access to the data to confidentiality, unless they are under a statutory obligation of confidentiality.

(2) PiPort takes the technical and organisational measures under Art. 32 GDPR described in Annex A. PiPort may adapt them to technical progress as long as the level of protection does not decrease.

(3) PiPort supports the Customer with appropriate means in its obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments, insofar as the Service is concerned.

(4) PiPort has not appointed a data protection officer because the statutory requirements are currently not met. The contact person for data protection is Jonas Trettin, [email protected].

(5) PiPort keeps a record of processing activities under Art. 30(2) GDPR.

§ 5 Notification of personal data breaches

PiPort notifies the Customer of a personal data breach affecting the Customer's data without undue delay, at the latest within 48 hours of becoming aware of it, at the address of the organisation's owners stored in the dashboard. As far as known, the notification contains the information under Art. 33(3) GDPR; PiPort provides missing information as soon as it is available.

§ 6 Sub-processors

(1) The Customer gives PiPort general authorisation to use sub-processors. The sub-processors used at the time the contract is concluded are listed in Annex B and at piport.io/subprocessors; they are deemed approved.

(2) PiPort informs the Customer by email and on the page mentioned at least 30 days before a sub-processor is added or replaced. The Customer can object in text form on data protection grounds within 14 days of receipt. If the parties do not find a solution, the Customer can terminate the contract of use as of the date of the change; PiPort refunds fees paid in advance pro rata. In the event of imminent danger (e.g. failure of a provider), the period may be shorter. PiPort informs the Customer before the use in that case too and gives reasons for the urgency; the rights to object and to terminate remain.

(3) PiPort contractually binds each sub-processor to the same data protection obligations as in this agreement (Art. 28(4) GDPR). If a sub-processor fails to fulfil its obligations, PiPort is liable to the Customer for this as for its own conduct.

(4) Ancillary services such as telecommunications services without access to the data are not sub-processing.

§ 7 Evidence and audits

(1) On request, PiPort provides the Customer with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular the TOMs under Annex A and certificates of the sub-processors (e.g. ISO 27001 of the data centres).

(2) If this evidence is not sufficient in an individual case, the Customer may carry out audits including inspections itself or have them carried out by an auditor bound to confidentiality who is not a competitor of PiPort. Audits without a specific reason take place at most once per calendar year and must be announced 30 days in advance. In the event of concrete indications of a violation, after a personal data breach or at the request of a supervisory authority, an audit is possible at any time with advance notice appropriate to the occasion. Audits take place during normal business hours; the Customer avoids unnecessary disruption of operations and maintains the confidentiality of other customers' data.

(3) The Customer bears the costs of an audit unless it reveals a significant violation by PiPort.

§ 8 Rights of data subjects

(1) PiPort supports the Customer with requests from data subjects (Art. 12 to 23 GDPR). The Customer can handle many requests itself in the dashboard, for example by exporting, correcting or deleting users and devices.

(2) If a data subject contacts PiPort directly, PiPort forwards the request to the Customer without undue delay and does not answer it itself unless the Customer instructs it to do so.

§ 9 Deletion and return

(1) After the end of the services, the Customer decides whether PiPort returns all personal data from this assignment to it or deletes it (Art. 28(3)(g) GDPR). The return takes place through the export under § 17(4) of the Terms during the export period under § 17(5) of the Terms; data from § 2 of this agreement that cannot be exported there is provided by PiPort on request in a common format, insofar as third-party rights or the security of the Service do not prevent this. If the Customer does not make a choice, PiPort deletes after the export period has expired.

(2) The deletion covers all copies; backup copies are overwritten no later than 14 days after deletion in the live system. Data may only remain stored insofar as Union or German law requires this; it is blocked until then. On request, PiPort confirms the deletion in text form.

§ 10 Liability

Art. 82 GDPR applies to liability towards data subjects. Between the Customer and PiPort, § 18 of the Terms applies.

§ 11 Final provisions

(1) Changes to this agreement require text form; § 12 of the Terms applies accordingly.

(2) Choice of law and place of jurisdiction are governed by § 23 of the Terms.

(3) Annexes: Annex A Technical and organisational measures, Annex B Sub-processors.

Annex A to the DPA: Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality

• Physical access control: Servers in data centres of Hetzner Online GmbH in Germany with access control, video surveillance and ISO/IEC 27001 certification. The Service runs in a dedicated Kubernetes cluster at Hetzner in Germany. The database runs as the managed service MongoDB Atlas in Microsoft Azure data centres in Frankfurt am Main, also certified to ISO/IEC 27001. PiPort does not operate its own server rooms.
• System access control: Sign-in to the dashboard with a password, stored only as a bcrypt hash; session, access, device and enrollment tokens are stored only as hashes. Limits on sign-in and enrollment attempts (rate limits, e.g. enrollment 10 per minute and IP address). Two-factor sign-in for customers does not exist yet. Administrative access to the infrastructure only for authorised administrators of the Operator with personal accounts, keys and two-factor sign-in.
• Data access control: Roles in each organisation (owner, administrator, viewer); remote access and browser terminal only for owners and administrators. Every connection via the relay requires a signed grant (Ed25519) that is valid for 60 seconds, can be used only once and is bound to one device. Only released ports of a device are reachable. The relay only accepts browser connections from permitted origins.
• Separation control: All customer data is assigned to an organisation; every query in the backend is restricted to the organisation. Separate environments for development and production. No customer data in the operational metrics.
• Pseudonymisation and data minimisation: A device's hardware identifier is only transmitted as a salted SHA-256 hash. Error reports are cleaned of passwords, tokens and cookies before sending and contain only the internal ID of the account. The website does not log IP addresses.
• Encryption: All connections to website, dashboard, API and relay via TLS. SSH sessions, including in the browser terminal, are end-to-end encrypted between client and device; credentials for the device do not leave the browser.

2. Integrity

• Transfer control: Transmission only encrypted (see above). SSH host keys of the devices are confirmed on first connection and checked afterwards; a change triggers a warning.
• Input control: Logs of API and relay with internal IDs of account, organisation and device; where available, an audit log for actions on devices and host keys. Detection of cloned SD cards through hardware binding.
• Software on devices: The agent runs as its own system user without root privileges, with narrowly limited sudo rules for individual actions (e.g. restart).

3. Availability and resilience

• Operation in Kubernetes; Redis is self-hosted in the cluster at Hetzner in Germany. The database is a MongoDB Atlas replica set in the Azure region Frankfurt; connections to it are TLS-encrypted, the data is stored encrypted.
• Daily data backup, retention 14 days, stored outside the cluster.
• Monitoring with metrics, logs and alerts, error monitoring with Sentry (Annex B); server logs are retained for 30 days.
• Protection against overload through rate limits at the API and relay and through Cloudflare for website, dashboard and API.

4. Regular review

• Changes to the code only after review by a second person and with automated tests.
• Dependencies are regularly updated and checked for known security vulnerabilities.
• Defined procedure for personal data breaches with notification of customers within 48 hours (§ 5 of the DPA).
• Review of these measures at least once a year.

Annex B to the DPA: Sub-processors

As of: November 2026. The current list is available at piport.io/subprocessors. The first tier is the Operator ELEVAYTE Systems UG (first row); it engages the other providers.

Redis is self-hosted in the cluster at Hetzner; no further provider is involved for it.

Not sub-processors within the meaning of this DPA:

• Stripe (Stripe Payments Europe, Limited, Dublin, Ireland): Payment processing is processing under PiPort's own responsibility (contract handling) and that of Stripe as an independent controller. Stripe receives the Customer's billing data, but no device or usage data.
• Plausible: Plausible is self-hosted (stats.elevayte.systems) and measures, without cookies, only visits to the website piport.io, under PiPort's own responsibility; no external provider is involved.
• Monitoring (Grafana, Prometheus, Loki, Tempo): is operated in our own cluster; no external provider is involved.