Version 4.0 — Dated 22 October 2026
This Agreement, including its Annexes 1 to 3, is concluded upon conclusion of the Main Agreement through its express incorporation into the Main Agreement. The version specified in the Main Agreement shall apply. No separate signature of this Agreement is required.
This Agreement is provided in German and English. The English version is a translation. In the event of any discrepancies between the language versions, the German version shall prevail.
Section 1 Subject Matter
In the course of providing services under the “SOFTWARE AS A SERVICE (SAAS) AGREEMENT” (hereinafter the “Main Agreement”), the Contractor is required to process personal data for which the Client acts as controller within the meaning of applicable data protection law (hereinafter “Client Data”). This Agreement specifies the data protection rights and obligations of the Client and the Contractor (hereinafter the “Parties”) in connection with the Contractor’s handling of Client Data for the performance of the Main Agreement.
Section 2 Scope of Processing
2.1. Kewano processes Client Data on behalf of and in accordance with the instructions of the Client within the meaning of Article 28 GDPR (processing on behalf of a controller). The Client remains the controller within the meaning of data protection law.
2.2. Kewano processes Client Data in the manner, to the extent and for the purpose specified in Annex 1 to this Agreement; the processing concerns the types of personal data and categories of data subjects identified therein. The duration of processing corresponds to the project duration under the Main Agreement.
2.3. Kewano reserves the right to anonymise or aggregate Client Data so that individual data subjects can no longer be identified, and to use such data in this form for the purposes of adapting the service to requirements, further developing and optimising it, and providing the service agreed under the Main Agreement.
The Parties agree that Client Data anonymised or aggregated in accordance with the above shall no longer constitute Client Data within the meaning of this Agreement.
2.4. The Contractor may also process Client Data outside the EEA in compliance with the provisions of this Agreement, provided that it informs the Client in advance of the location of the data processing and the requirements of Articles 44–48 GDPR are met or a derogation under Article 49 GDPR applies.
Section 3 The Client’s Right to Issue Instructions
3.1. Kewano processes Client Data in accordance with the Client’s instructions unless Kewano is required to carry out other processing under European Union law or the law of the Member State to which Kewano is subject. In the latter case, Kewano shall inform the Client of those legal requirements before processing, unless the relevant law prohibits such notification on important grounds of public interest.
3.2. As a general rule, the Client’s instructions are exhaustively set out and documented in the provisions of this Agreement and through the configuration of Kewano applications. The Client shall confirm individual oral instructions without undue delay, at least in text form.
3.3. Where individual instructions deviate from the provisions of this Agreement or impose additional requirements, they require Kewano’s prior consent and shall be handled in accordance with the change procedure specified in the Main Agreement. Under that procedure, the instruction shall be documented and the Client’s assumption of any resulting additional costs incurred by Kewano shall be agreed.
3.4. Kewano shall ensure that Client Data is processed in accordance with the Client’s instructions. If Kewano considers an instruction from the Client to be in breach of this Agreement or applicable data protection law, Kewano shall, after notifying the Client accordingly, be entitled to suspend execution of the instruction until the Client confirms it. The Parties agree that the Client bears sole responsibility for the processing of Client Data in accordance with its instructions.
3.5. As a general rule, instructions should be issued by the Client’s authorised representative or their deputy. On the Client’s side, authority to issue instructions generally rests exclusively with its management. In urgent cases, however, any other employee of the Client may also issue corresponding instructions if management is unavailable.
3.6. The Client’s instructions may only be issued to Kewano’s support team.
3.7. In urgent cases, the Client may also issue corresponding instructions to any other Kewano employee if the persons authorised to receive instructions under clause 3.6 could not reasonably be reached by the Client.
Section 4 Responsibilities of the Client
4.1. As between the Parties, the Client is solely responsible for the lawfulness of the processing of Client Data and for safeguarding the rights of data subjects. If third parties assert claims against Kewano arising from the processing of Client Data in accordance with this Agreement, the Client shall indemnify Kewano against all such claims upon first demand.
4.2. The Client is responsible for providing Kewano with Client Data in good time for the provision of services under the Main Agreement and for the quality of Client Data. The Client shall inform Kewano without undue delay and in full if, when reviewing the results of Kewano’s services, it identifies errors or irregularities relating to data protection provisions or its instructions.
4.3. Upon request, the Client shall provide Kewano with the information specified in Article 30(2) GDPR to the extent that Kewano does not already have it.
4.4. If Kewano is obliged to provide a public authority or a person with information concerning the processing of Client Data, or otherwise to cooperate with such bodies, the Client shall, upon first demand, assist Kewano in providing such information or fulfilling other obligations to cooperate.
Section 5 Personnel Requirements
Kewano shall bind all persons processing Client Data to confidentiality in respect of the processing of Client Data.
Section 6 Data Protection Officer and Data Protection Contact
6.1. The Contractor shall provide the Client with a means of contact for data protection enquiries in text form.
6.2. The Contractor shall inform the Client in text form without undue delay of the appointment of a data protection officer and of any changes to the relevant contact details.
Section 7 Security of Processing
7.1. In accordance with Article 32 GDPR, Kewano shall implement the necessary and appropriate technical and organisational measures (hereinafter “TOMs”) required to ensure a level of security appropriate to the risk to Client Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing Client Data, and the risks of varying likelihood and severity to the rights and freedoms of data subjects.
7.2. Kewano may change or adapt technical and organisational measures during the term of the Agreement, provided that they continue to meet the statutory requirements. The TOMs implemented by Kewano at the time of conclusion of the Agreement are set out in Annex 3 or in the sources specified therein.
Section 8 Engagement of Other Processors
8.1. The Client hereby grants Kewano general authorisation to engage other processors for the processing of Client Data. At the time of conclusion of the Agreement, Kewano uses the other processors listed in Annex 2 depending on the functionalities activated by the Client when using Kewano. Contractual relationships with service providers concerning the inspection or maintenance of data processing procedures or systems by other bodies, or other ancillary services, are generally not subject to authorisation, even if access to Client Data cannot be ruled out, provided that Kewano puts in place appropriate provisions to protect the confidentiality of Client Data.
8.2. Kewano shall inform the Client in electronic format of intended changes concerning the addition or replacement of other processors with 30 days’ notice. In exceptional cases, Kewano may inform the Client of intended changes with 10 days’ notice. The Client has the right to object in individual cases to the engagement of a potential other processor. The Client may only object on important grounds, which it must substantiate to Kewano. If the Client does not object within 5 working days of receipt of the notification, its right to object to the relevant engagement shall lapse. If the Client objects, Kewano may terminate the Main Agreement and this Agreement at the next possible termination date under the Main Agreement.
8.3. The agreement between Kewano and the other processor must impose the same obligations on that processor as those imposed on Kewano under this Agreement. The Parties agree that this requirement is met if the agreement provides a level of protection corresponding to this Agreement or imposes on the other processor the obligations set out in Article 28(3) GDPR.
8.4. Subject to compliance with the requirements of clause 2.4 of this Agreement, the provisions of this Section 8 also apply where another processor is engaged in a third country. The Client hereby authorises Kewano, as the Client’s representative, to conclude an agreement with another processor incorporating the EU Standard Contractual Clauses for the transfer of personal data to processors in third countries in their then-current version. The Client also agrees to cooperate, to the extent necessary, in fulfilling the requirements of Article 49 GDPR.
Section 9 Rights of Data Subjects
9.1. Kewano shall assist the Client through technical and organisational measures, to the extent reasonably possible, in fulfilling its obligation to respond to requests by data subjects to exercise their rights.
9.2. If a data subject submits a request to exercise their rights directly to Kewano, Kewano shall forward that request to the Client in a timely manner.
9.3. Kewano shall provide the Client with information concerning the Client Data stored, the recipients to whom Kewano discloses Client Data in accordance with the engagement, and the purpose of storage, unless the Client already has that information or can obtain it itself.
9.4. Kewano shall enable the Client to rectify, erase or restrict further processing of Client Data independently. If and to the extent that the Client is unable to do so, Kewano shall, at the Client’s request and to the extent reasonable and necessary, carry out the rectification, blocking or restriction of further processing itself.
9.5. Where a data subject has a right to data portability in respect of Client Data against the Client under Article 20 GDPR, Kewano shall, to the extent reasonable and necessary and against reimbursement of the demonstrable expenditure and costs incurred by Kewano, assist the Client in providing Client Data in a commonly used and machine-readable format if the Client cannot otherwise obtain the data.
Section 10 Kewano’s Notification and Assistance Obligations
10.1. Where the Client is subject to a statutory reporting or notification obligation arising from a breach of the protection of Client Data, particularly under Articles 33 and 34 GDPR, Kewano shall inform the Client in a timely manner of any reportable incidents within its area of responsibility. At the Client’s request, Kewano shall assist the Client in fulfilling its reporting and notification obligations to the extent reasonable and necessary and against reimbursement of the demonstrable expenditure and costs incurred by Kewano.
10.2. Kewano shall assist the Client, to the extent reasonable and necessary and against reimbursement of the demonstrable expenditure and costs incurred by Kewano, with any data protection impact assessments to be carried out by the Client and any subsequent consultations with supervisory authorities under Articles 35 and 36 GDPR.
10.3. If the security of the Client’s data is put at risk by measures taken by third parties, such as creditors, authorities or courts, including attachment, seizure or insolvency proceedings, Kewano shall inform those third parties without undue delay that control over and ownership of the data lie exclusively with the Client and, after consulting the Client, shall take appropriate protective measures where necessary, such as lodging objections or filing applications.
Section 11 Erasure of Data
11.1. Kewano shall erase Client Data upon termination of this Agreement unless Kewano is legally required to continue storing Client Data.
11.2. Kewano may retain documentation serving as evidence of the processing of Client Data in accordance with the engagement and applicable requirements even after termination of the Agreement.
Section 12 Evidence and Audits
12.1. Upon the Client’s request, Kewano shall provide the Client with all necessary information available to Kewano to demonstrate compliance with its obligations under this Agreement.
12.2. The Client may audit Kewano’s compliance with the provisions of this Agreement, including by means of inspections and particularly with regard to the implementation of technical and organisational measures, if and to the extent that Kewano cannot demonstrate compliance with its obligations by other means.
12.3. For the purpose of conducting inspections under clause 12.2, the Client may enter Kewano’s business premises in which Client Data is processed during normal business hours, Monday to Friday from 09:00 to 17:00, following timely prior notice in accordance with clause 12.5, at its own expense, without disrupting business operations and subject to strict confidentiality concerning Kewano’s business and trade secrets.
12.4. Kewano may, at its own discretion and taking into account the Client’s statutory obligations, withhold information that is sensitive in relation to Kewano’s business or whose disclosure would cause Kewano to breach statutory or other contractual provisions. The Client is not entitled to access data or information concerning other Kewano customers, information concerning costs, quality audit and contract management reports, or any other confidential Kewano data that is not directly relevant to the agreed audit purposes.
12.5. The Client shall inform Kewano in good time, generally at least two weeks in advance, of all circumstances relating to the conduct of the audit. The Client may conduct one audit per calendar year. Additional audits shall be subject to reimbursement of costs and coordination with Kewano.
12.6. If the Client commissions a third party to conduct the audit, the Client shall bind that third party in writing to the same obligations as those imposed on the Client towards Kewano under Section 12 of this Agreement. The Client shall also bind the third party to confidentiality and secrecy unless the third party is subject to a professional duty of confidentiality. At Kewano’s request, the Client shall provide Kewano with the agreements imposing those obligations on the third party without undue delay. The Client may not commission a competitor of Kewano to carry out the audit.
12.7. At Kewano’s option, compliance with the obligations under this Agreement may also be demonstrated, instead of by an inspection, by presenting an appropriate, current attestation or report from an independent body, such as an external auditor, internal audit function, data protection officer, IT security department, data protection auditor or quality auditor, or an appropriate certification based on an IT security or data protection audit, for example in accordance with BSI IT-Grundschutz (an “Audit Report”), provided that the Audit Report reasonably enables the Client to satisfy itself that the contractual obligations are being met.
Section 13 Term and Termination
The term and termination of this Agreement are governed by the provisions concerning the term and termination of the Main Agreement. Termination of the Main Agreement automatically also terminates this Agreement. This Agreement may not be terminated separately.
Section 14 Liability
14.1. The exclusions and limitations of liability under the Main Agreement apply to Kewano’s liability under this Agreement. Where third parties assert claims against Kewano arising from a culpable breach by the Client of this Agreement or of one of its obligations as controller under data protection law, the Client shall indemnify Kewano against those claims upon first demand.
14.2. The Client also undertakes to indemnify Kewano upon first demand against any fines imposed on Kewano to the extent that the Client shares responsibility for the infringement sanctioned by the fine.
Section 15 Final Provisions
15.1. If individual provisions of this Agreement are or become invalid or contain a gap, the remaining provisions shall remain unaffected. The Parties undertake to replace the invalid provision with a legally permissible provision that comes closest to the purpose of the invalid provision while meeting the requirements of Article 28 GDPR.
15.2. In the event of any conflict between this Agreement and other agreements between the Parties, particularly the Main Agreement, the provisions of this Agreement shall prevail.
15.3. This Agreement replaces all agreements previously concluded between Kewano and the Client under Article 28 GDPR, particularly those concluded on the basis of a contract template provided by Kewano.
Annex 1 Purpose Nature and Scope of Data Processing Types of Data and Categories of Data Subjects
Purpose of Processing
The underlying purpose of processing is set out in the service description of the Main Agreement.
Categories of Data
The categories of data affected by processing depend on the Client’s use of Kewano. The following categories of data may be subject to processing:
1. Employee data
- Full name and contact details: surname, first name, addresses, telephone numbers, email addresses.
- Employment-related information: position, department, salary data, working time records.
- Social security data: social security numbers, health insurance data.
2. Customer data
- Identification data: name, address, telephone number, email address.
- Transaction data: purchase history, payment data, delivery information, email correspondence.
3. Supplier data
- Company-related data: company name, contact persons, addresses, telephone numbers, email addresses, email correspondence.
- Contract data: contractual terms, payment terms, history of business relationships.
4. ERP system user data
- Login information: username, passwords (encrypted), access rights.
- Activity data: log files concerning user actions within the system, activity timestamps.
Categories of Data Subjects
The categories of data subjects affected by processing depend on the Client’s use of Kewano. The following categories of data subjects may be affected:
- Customer contact persons
- Supplier contact persons
- Employees of the Client
- Website visitors
- Other prospective customers or interested persons
Annex 2 Authorised Subprocessors
At the time of conclusion of the Agreement, Kewano uses the processors listed below:
Google Cloud EMEA Limited (Google Cloud)
- Purpose: All data associated with our solution
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Microsoft Ireland Operations Limited (Microsoft Azure, Azure OpenAI Service and Microsoft Teams)
- Purpose: Hosting, storage and processing of all data arising from the use of Kewano, and the use of Azure OpenAI and Microsoft Teams.
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
HubSpot Ireland Limited
- Purpose: Emails, telephone calls, LinkedIn messages, documentation of appointments
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Bitwarden Inc.
- Purpose: API keys
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Olinda SAS (Qonto)
- Purpose: Bank account details and invoices
- Access: Management of Kewano GmbH
- Data location: EU + USA
Yousign SAS
- Purpose: Contracts
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Linear Orbit, Inc.
- Purpose: User feedback and bugs
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
PostHog Inc.
- Purpose: Product analytics / usage statistics
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Functional Software, Inc. (Sentry)
- Purpose: Error tracking / performance monitoring
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Langdock GmbH
- Purpose: Internal AI chat
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
netcup GmbH
- Purpose: Data migration and backups
- Access: Management and authorised employees of Kewano GmbH
- Data location: EU
Annex 3 Technical and Organisational Measures under Article 32 GDPR
Under the provisions of the EU General Data Protection Regulation (Article 28 GDPR), the Client must, before data processing begins, verify whether the Contractor has implemented and complies with appropriate technical and organisational measures to safeguard the confidentiality, integrity, availability, resilience and recoverability of the data. The result of this assessment must be documented. The following self-assessment is provided to facilitate that review.
At the time of conclusion of the Agreement, Kewano has implemented the technical and organisational measures (TOMs) described below:
All employees of the company are bound to confidentiality and to compliance with data protection requirements under the GDPR, the German Federal Data Protection Act (BDSG) and other laws relating to data protection, and receive ongoing instruction on data protection requirements. Data processing takes place in a certified data centre. The data centre is certified in accordance with DIN EN/ISO IEC 27001 and is subject to regular annual reviews.
Outside operating hours, the building is protected against unauthorised entry by a central locking system with security locks. The data and data processing systems are located in a secured and certified data centre. The building’s doors are secured.
The allocation and management of keys follow a defined process governing the granting and withdrawal of access authorisations for premises both at the beginning and at the end of an employment relationship.
Measures to control access to desktop computers and networked systems are implemented through a secure password with minimum length and complexity requirements. Two-factor authentication is also used where possible, and a password manager is used to generate random, complex passwords.
All server and client systems are protected by firewalls that are continuously maintained and supplied with updates and patches. Access from servers and clients to the internet and access to those systems via the internet are also protected by firewalls. This also ensures that only the ports required for the relevant communication can be used. All other ports are blocked accordingly.
Permissions are generally granted on a need-to-know basis. Accordingly, access rights to data, databases or applications are granted only to persons who maintain and administer those data, applications or databases, or who work in development.
A role-based authorisation concept allows differentiated assignment of access rights and ensures that employees receive access rights to applications and data according to their respective responsibilities and, where applicable, on a project-specific basis.