Data Processing Agreement (DPA)

Pursuant to Art. 28 GDPR · Last updated: May 2026 · [PLEASE REVIEW: Have this checked legally]

1. Subject matter and duration

This Data Processing Agreement governs the processing of personal data by Luneeo Systems ("Processor") on behalf of the customer ("Controller") in connection with the use of the hainsoft.io platform. The duration corresponds to the term of the main contract (Terms of Service).

2. Nature and purpose of processing

The Processor processes personal data on behalf of the Controller for the purpose of operating the hainsoft.io platform. This includes in particular:

  • Storage and management of employee data (name, contact, payroll data)
  • Storage of the Controller's customer data
  • Processing of project, quote and invoice data
  • Time tracking and payroll preparation
  • Document storage (Hetzner Object Storage, Germany)

3. Obligations of the Processor

  • Process data only on documented instructions from the Controller
  • Ensure confidentiality of the data
  • Implement all required technical and organisational measures pursuant to Art. 32 GDPR
  • Not engage further processors without the Controller's consent
  • Support the Controller in fulfilling data subject rights
  • Delete or return all data upon termination of the contract

4. Technical and organisational measures (TOMs)

  • Access control (physical): Server infrastructure in certified data centres (Vercel, Supabase, Hetzner)
  • Access control (logical): Strong password policy, 2-factor authentication, JWT-based sessions
  • Authorisation control: Tenant isolation, role-based access control (RBAC)
  • Transfer control: TLS 1.3 for all data transfers
  • Input control: Audit log for all critical data changes
  • Availability control: Daily database backups, redundant infrastructure
  • Separation: Strict tenant separation via tenantId-based data isolation

5. Sub-processors

  • Vercel Inc. — Hosting/CDN (EU)
  • Supabase Inc. — Database hosting (Frankfurt/EU)
  • Hetzner Online GmbH — Object Storage (Nuremberg)
  • Upstash Inc. — Redis cache/rate limiting (EU)

The Controller hereby consents to the engagement of these sub-processors. Changes will be communicated with reasonable notice.