Data Processing Addendum

The parties are your organization (“Customer”) and Stefan Rack, operator of Intelext, Oeder Weg 43, 60318 Frankfurt am Main, Germany. Customer acts as controller or as a processor authorized by its controller. Intelext acts as processor or subprocessor.

Intelext processes Customer Personal Data only to provide, secure, support, export, and delete the requested service. The Terms, product settings, and authorized written requests are Customer’s documented instructions, including for transfers. Intelext will tell Customer if an instruction appears unlawful and pause it where necessary. If law requires other processing, Intelext will notify Customer unless law prohibits notice.

Intelext acts separately as controller for account administration, security, direct communications, and optional analytics. The Privacy Notice covers those activities. Customer must have a lawful basis, provide required notices, and submit only data it may lawfully share.

Under Article 28 GDPR, Intelext will:

• Limit processing to documented instructions and bind authorized people to confidentiality.
• Maintain security measures appropriate to the risk under Article 32 GDPR.
• Help Customer respond to data-subject requests and meet security, breach, impact-assessment, and supervisory-consultation duties.
• Notify Customer without undue delay of a personal-data breach, with available details and updates.
• Provide compliance information and allow audits, including inspections, by Customer or its appointed auditor.

Assistance takes account of the processing and information available to Intelext. Audits must protect other users’ data and avoid unnecessary disruption. These arrangements do not limit statutory audit or supervisory rights.

Technical measures include authenticated access, user-scoped database policies, restricted service credentials, and TLS for network transport. Automated checks cover code changes. Production changes use controlled deployment workflows. These measures do not make the beta suitable for patient data or regulated record systems.

Customer gives general authorization for the relevant providers on the Subprocessors page. Intelext must bind subprocessors to equivalent data-protection duties and remains responsible as Article 28 GDPR requires. Intelext will notify Customer before adding or replacing a subprocessor and allow an opportunity to object on data-protection grounds. If no suitable alternative exists, Customer can stop the affected feature or end its use of the service.

Transfers outside the EEA require a lawful safeguard, such as an applicable adequacy decision or EU Standard Contractual Clauses. The Subprocessors page identifies provider locations and unconfirmed account-specific details. This DPA does not itself establish a transfer safeguard for a provider.

At the end of processing, Intelext will return or delete Customer Personal Data at Customer’s choice, unless law requires retention. Customer can request an export before deletion. The Privacy Notice states the local retention periods. Provider copies, including backups and security logs, follow separate provider rules described on the Subprocessors page.

This DPA controls conflicts about Customer Personal Data. Mandatory data-protection rights remain unaffected. Send instructions and questions to stefan@intelext.io.