Data Processing Agreement

1. Scope and Parties

This Data Processing Agreement ("DPA") supplements the Terms & Conditions and governs the processing of personal data by Newmatik GmbH ("Processor") on behalf of the customer organization ("Controller") when using the Elexess Service. This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (GDPR).

2. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller for the purpose of providing the Elexess electronic component search service. Processing continues for the duration of the service agreement between the parties.

3. Nature and Purpose of Processing

The processing involves searching, aggregating, and displaying electronic component data from multiple suppliers, including pricing, availability, and technical specifications. This includes storing user account data, search queries, API usage logs, team membership data, and subscription billing references.

4. Types of Personal Data

The following types of personal data may be processed: user account data (email, name), search queries and usage patterns, team and organization membership data, billing references (Stripe customer IDs, subscription status), and technical metadata (IP addresses, user agents).

5. Categories of Data Subjects

Data subjects include the Controller's employees and authorized users of the Service.

6. Processor Obligations

The Processor shall: process personal data only on documented instructions from the Controller; ensure that persons authorized to process personal data are bound by confidentiality obligations; implement appropriate technical and organizational security measures (including encryption at rest via Supabase, encryption in transit via TLS, and row-level access control); assist the Controller in fulfilling data subject requests; delete or return all personal data upon termination of the service, at the Controller's choice; and make available all information necessary to demonstrate compliance with Article 28 GDPR.

7. Security Measures

The Processor implements the following security measures: encryption at rest (Supabase managed encryption), encryption in transit (TLS/HTTPS for all connections), row-level security policies enforced at the database level, PKCE authentication flow, optional multi-factor authentication (TOTP), role-based access control (admin/member), and regular security monitoring via Sentry.

8. Sub-Processors

The Controller authorizes the use of the following sub-processors:

• Supabase Inc. — Database, authentication, and edge functions, hosted in EU (eu-central-1, Frankfurt, Germany)
• Cloudflare, Inc. — Website hosting and CDN (global edge network, with EU Standard Contractual Clauses)
• Functional Software, Inc. (Sentry) — Error monitoring (EU ingest endpoint: ingest.de.sentry.io)
• Stripe, Inc. — Payment processing for subscriptions (PCI DSS Level 1 certified)

The Processor will inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

9. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

10. Audit Rights

The Controller has the right to conduct audits, including inspections, to verify the Processor's compliance with this DPA. The Processor shall cooperate with such audits and make relevant documentation available upon reasonable request.

11. Data Return and Deletion

Upon termination of the service agreement, the Processor shall, at the Controller's choice, return all personal data or delete it, and delete existing copies unless applicable law requires storage.

12. International Transfers

Primary data storage is in the EU (Supabase, Frankfurt). Where personal data is transferred outside the EU/EEA (e.g., Cloudflare edge caching, Stripe payment processing), appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as required by Chapter V of the GDPR.

13. Contact and Execution

To execute this DPA or for questions regarding data processing, contact Newmatik GmbH at service@newmatik.com. This DPA becomes effective upon the Controller's acceptance of the Elexess Terms & Conditions.