Version 1.0 — Last updated: April 2026
Pre-executed by Processor. This DPA is signed in advance on behalf of KI·SUM·AI - Kisum GmbH and takes effect automatically when you sign up to or continue to use the ComplianceLint service. No counter-signature is required from your side. A printable copy is provided below.
This Data Processing Agreement (“DPA”) is entered into between:
The Processor and Controller are individually a “Party” and collectively the “Parties”.
Capitalised terms used in this DPA have the meanings given in Regulation (EU) 2016/679 (the “GDPR”) unless otherwise defined here. In particular:
The Customer is the Controller of the Personal Data processed by the Service in connection with the Customer's use of the Service. The Processor processes Personal Data on behalf of the Customer in accordance with this DPA, the Service order or terms of service, and the Customer's documented instructions.
This DPA applies to the extent that the Processor processes Personal Data on behalf of the Customer that is subject to the GDPR or to equivalent data-protection legislation of EU/EEA Member States, the United Kingdom, or Switzerland.
Subject matter. The Processor processes Personal Data only to provide, secure, support, bill for, and improve the Service in accordance with the terms of service and the Customer's documented instructions.
Duration. This DPA remains in force for as long as the Processor processes Personal Data on behalf of the Customer pursuant to the terms of service, and survives termination of the terms of service to the extent the Processor continues to hold Personal Data of the Customer (e.g. during the wind-down and deletion period defined in §13).
Purpose. The specific purposes of Processing are: account creation and authentication; performing automated and human-assisted compliance assessments on metadata describing the Customer's software project; storing and presenting the resulting findings; managing team membership and permissions; sending transactional emails; processing payments; and operating, securing, and supporting the Service.
Categories of Data Subjects: the Customer's personnel, contractors, team members, and authorised representatives who use the Service on behalf of the Customer; and individuals whose personal data may be incidentally referenced in compliance findings (e.g. project owners listed in metadata).
Categories of Personal Data:
The Processor does not knowingly process special categories of Personal Data within the meaning of Art. 9 GDPR, criminal conviction data within the meaning of Art. 10 GDPR, or personal data of children within the meaning of Art. 8 GDPR.
In addition to the obligations imposed on the Processor by the GDPR and other applicable data protection law, the Processor agrees that it shall:
The Processor maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, where appropriate:
A current detailed description of the Processor's technical and organisational measures is maintained internally and is available on written request to info@compliancelint.com from the Controller's authorised representative. The Processor may update its technical and organisational measures from time to time, provided that any update does not materially diminish the level of protection of Personal Data.
The Customer grants the Processor a general written authorisation to engage Sub-processors to assist in the provision of the Service, subject to this §8.
The current list of Sub-processors is maintained at /legal/sub-processors and forms part of this DPA. The Processor will notify the Customer in writing — either by email to the address on the Customer's account or by an in-product announcement that requires acknowledgement — of any intended addition or replacement of a Sub-processor at least 14 days in advance, except where the change is required by an urgent security or regulatory necessity, in which case the Processor shall give such notice as is reasonably practicable in the circumstances.
The Customer may object to the engagement of a new Sub-processor on reasonable data-protection grounds within the notice period. If the Parties cannot agree on reasonable accommodation, the Customer's sole remedy is to terminate the affected portion of the Service in accordance with the terms of service, with a pro-rated refund where contractually applicable.
The Processor shall ensure that each Sub-processor is engaged under a written contract that imposes data-protection obligations equivalent to those set out in this DPA, and shall remain fully liable to the Customer for the performance of each Sub-processor's obligations.
Where the Processor or any Sub-processor transfers Personal Data outside the European Economic Area, the United Kingdom, or Switzerland to a country that has not been the subject of an adequacy decision under Art. 45 GDPR (or its UK / CH equivalent), the Processor shall ensure such transfer is made subject to an appropriate Art. 46 GDPR transfer mechanism, including (as applicable) the Standard Contractual Clauses, the EU–U.S. Data Privacy Framework certification (where the recipient is certified), the UK International Data Transfer Addendum, and supplementary technical and organisational safeguards.
The Customer authorises the Processor to enter into the relevant transfer mechanism on behalf of the Customer where necessary to permit the use of Sub-processors listed at /legal/sub-processors.
Taking into account the nature of the Processing and the information available to the Processor, the Processor shall assist the Customer by appropriate technical and organisational measures in:
The Processor may charge a reasonable fee for assistance that is materially beyond the standard product-functionality channels and that is requested as a bespoke engagement. Standard product-functionality channels (in-product export, deletion, data subject communication) are provided at no additional charge.
The Processor will provide the Customer with information reasonably necessary to demonstrate compliance with this DPA and Art. 28 GDPR, in the following forms (in order of preference):
The Processor shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification shall describe, to the extent then known: the nature of the breach, including categories and approximate numbers of Data Subjects and records concerned; the likely consequences of the breach; and the measures taken or proposed to be taken to address the breach and mitigate its possible adverse effects.
The Processor maintains a documented breach-notification procedure aligned to Art. 33 GDPR; further detail is available on written request to info@compliancelint.com.
Upon termination of the terms of service, the Customer may request the return or deletion of its Personal Data processed by the Service. The Customer can self-serve such return / deletion using the in-product data-export (/api/v1/user/export or equivalent UI control) and account-deletion (/api/v1/user/delete or equivalent UI control) functions.
In the absence of a specific instruction, the Processor will delete Personal Data on the schedule described in the privacy policy at /legal/privacy (in particular §6a Retention) or, where Personal Data forms part of records the Processor is required to retain under Union or Member-State law (including § 257 HGB, § 147 AO, § 14b UStG), the Processor shall continue to store such Personal Data in pseudonymised form for the duration of the statutory retention period as permitted by Art. 17(3)(b) GDPR.
Each Party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability provisions of the terms of service. In no event shall the limitations of liability in the terms of service be interpreted to limit (i) any party's liability for fines imposed by a Supervisory Authority directly on that party, (ii) liability that cannot be excluded under applicable law, or (iii) liability for breach of obligations under Art. 82 GDPR.
This DPA enters into force when the Customer first signs up to the Service or, for existing customers, on the effective date stated above. It terminates automatically when the underlying terms of service terminate, except that §7 (Security), §12 (Personal Data Breach), §13 (Return and Deletion), and §14 (Liability) survive for so long as the Processor continues to hold the Customer's Personal Data.
This DPA is governed by the laws of the Federal Republic of Germany, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods. Exclusive jurisdiction lies with the courts of München, Germany, to the extent permitted by applicable law.
Where the underlying terms of service specify a different governing law and jurisdiction, the data-protection obligations under the GDPR continue to apply independently of that choice of law to the extent required by Art. 3 GDPR.
In the event of any conflict between this DPA, the terms of service, and any annex, the order of precedence is: (i) any explicit Standard Contractual Clauses or other statutorily-prescribed clauses adopted by the Parties for international transfers; (ii) this DPA; (iii) the terms of service.
The Processor pre-executes this DPA on its own behalf as of the version date stated above. The Customer is deemed to have entered into and accepted this DPA on behalf of itself and its authorised affiliates by signing up to or continuing to use the Service.
The Customer may request a counter-signed PDF copy by emailing info@compliancelint.com with the Customer's legal name, registered address, and authorised signatory.
Pre-executed by Processor:
KI·SUM·AI - Kisum GmbH
Sonnwendjochstr. 6, 81825 München, Germany
Authorised signatory: the managing director (Geschäftsführer) of KI·SUM·AI - Kisum GmbH
Effective date: April 2026 (Version 1.0)
For questions about this DPA, requests for a counter-signed copy, or requests for additional documentation, please contact info@compliancelint.com with the subject line “DPA inquiry”.