Data Processing Agreement

Contracting parties and conclusion of the Agreement

This Agreement under Art. 28(3) GDPR is concluded between the Customer as controller and

Honeyfield GmbH
Strubergasse 26, 5020 Salzburg, Austria
FN 554194 t, Regional Court of Salzburg (Landesgericht Salzburg) · VAT ID ATU 76962217
represented by Ing. Vernes Perviz, BSc
Data protection contact: hello@honeyfield.at, +43 676 4600 960

as processor. The controller is the natural or legal person that opens the user account; its identity follows from the account and organization data provided at registration.

The Agreement is concluded upon registration: anyone who creates an account expressly confirms in doing so that they accept this Agreement together with the Terms of Service and the Privacy Policy. The time of acceptance and the accepted version are stored with the user account. A separate signature is not required; on request, we will provide a signed copy containing the controller’s details. To request one, write to hello@honeyfield.at.

§ 1 Subject matter, nature and purpose of the processing

1. The processor provides and operates the software-as-a-service platform “Honeyfield Marketing MCP” for the controller. Through the platform, the controller connects its own marketing, analytics and website accounts and has them read and managed by AI assistants it deploys.
2. The processor processes personal data solely to provide this service and solely on the instructions of the controller. No use for the processor’s own purposes takes place, in particular no profiling, no advertising, no training of AI models and no analysis across tenants.
3. The subject matter, nature and purpose of the processing, the categories of data subjects and the types of personal data are set out in § 1(1) and Annex 1.
4. Processing takes place exclusively in member states of the European Union unless § 6 provides otherwise. The production systems are operated in the AWS region Frankfurt am Main (eu-central-1).
5. This Agreement applies for the term of the underlying Main Agreement (Terms of Service) and ends with it. The obligations under § 8 and § 9 continue beyond that.

§ 2 Right to issue instructions

1. The controller is solely responsible for the lawfulness of the processing. It issues all instructions in writing or in text form; instructions in electronic form are sufficient.
2. Any action that the controller or a user authorized by it triggers via the platform’s interface, via its API or via a connected AI assistant also constitutes an instruction. The controller ensures that the assistants it deploys and the persons authorized to use them act only within the scope of its instructions.
3. The processor informs the controller without undue delay if it considers that an instruction infringes data protection provisions. It may suspend execution until the instruction is confirmed or amended.
4. The persons designated by the controller are authorized to issue instructions on the controller’s side; the processor’s management is authorized to receive instructions on the processor’s side.
5. The obligation to act on instructions also applies to transfers of personal data to a third country or an international organization. Where the processor is required to carry out processing by Union or member state law to which it is subject, it informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

§ 3 Confidentiality

1. For the processing, the processor only uses persons who are bound to confidentiality and familiar with the relevant data protection requirements. This obligation continues after the end of their activity.
2. Only persons who need access to production data to perform their duties are granted such access. Read-only analyses are carried out via a separate database access without write permissions; the controller’s credentials, which are stored in encrypted form, cannot be read this way.

§ 4 Technical and organizational measures

1. The processor implements the measures under Art. 32 GDPR described in Annex 2 and maintains them for the term of the Agreement.
2. The measures are subject to technical progress. The processor may adapt them provided that the agreed level of protection is not undercut. Material changes are documented and evidenced on request.

§ 5 Sub-processors

1. The controller consents to the use of the sub-processors listed in Annex 3.
2. The processor informs the controller in text form at least 30 days before engaging or replacing a sub-processor. The controller may object within 14 days of receipt on an important ground relating to data protection. If no mutually agreed solution is reached, the controller has a special right of termination effective as of the time of the change.
3. The processor contractually imposes on each sub-processor the same data protection obligations as set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of the GDPR. Where a sub-processor fails to fulfill its data protection obligations, the processor is liable to the controller for the performance of that sub-processor’s obligations.
4. Transfers to services with which the controller itself has a contractual relationship and which it connects via the platform, in particular Google, Meta, LinkedIn, Microsoft Clarity, DataForSEO and the controller’s own website and editorial systems, do not constitute sub-processing within the meaning of this Agreement. The processor accesses them solely with the credentials stored by the controller and on its instructions.

§ 5a AI assistant deployed by the controller

1. The platform outputs the retrieved data to the AI assistant that the controller itself connects (for example Claude or ChatGPT). This transfer takes place on the controller’s instructions to a service that the controller has chosen itself and with which it has its own contractual relationship.
2. The controller is responsible for the legal basis for this transfer under data protection law, for concluding the necessary agreements with the provider of the assistant and for selecting the data processed there.
3. The processor does not transfer any data to providers of AI models unless the controller has set up such a connection.

§ 6 Transfers to third countries

1. Processing and storage take place in the European Union. Where individual sub-processors transfer data to a third country or do not rule out access from a third country, this is noted in Annex 3.
2. In these cases, the transfer is based on an adequacy decision or on Standard Contractual Clauses (SCCs) together with supplementary measures. The corresponding evidence is provided on request.

§ 7 Assistance to the controller

1. The processor assists the controller with appropriate measures in fulfilling data subject rights under Arts. 12 to 23 GDPR. If a data subject contacts the processor directly, the processor forwards the request without undue delay and does not respond itself.
2. The processor assists the controller with the obligations under Arts. 32 to 36 GDPR, in particular with the security of processing, with notifications to the supervisory authority and with data protection impact assessments (DPIAs).
3. The processor notifies the controller of personal data breaches without undue delay and no later than 48 hours after becoming aware of them, with the information required under Art. 33(3) GDPR to the extent available. Missing information is provided subsequently without undue delay.
4. The processor maintains a record of processing activities under Art. 30(2) GDPR and provides the information concerning the controller on request.

§ 8 Deletion and return

1. After the end of the service, the processor deletes or returns the personal data processed on behalf of the controller, at the controller’s choice. The periods and procedure are set out in Annex 4.
2. The controller can itself delete connected accounts, Workspaces and its user account in the platform at any time. Credentials for connected accounts are irrevocably removed in the process.
3. Data is retained beyond these periods only where a legal obligation requires it. In that case, the data is restricted and processed solely for the purpose of fulfilling that obligation.
4. Deletion is confirmed in text form on request.

§ 9 Evidence and audits

1. The processor demonstrates compliance with the obligations under this Agreement on request, in particular by providing current information on the measures under Annex 2 and evidence from its sub-processors.
2. The controller is entitled to verify compliance after giving timely notice, during normal business hours and without disrupting operations, including through an auditor bound by a confidentiality obligation who is not a competitor of the processor. One audit per calendar year is free of charge; further audits are charged according to effort unless there is a justified reason.
3. The processor cooperates in audits by the supervisory authority insofar as they concern the controller.

§ 10 Liability and final provisions

1. Liability is governed by Art. 82 GDPR and, in addition, by the liability provisions of the Main Agreement.
2. Amendments and additions must be made in text form. This also applies to any amendment of this clause. Amendments to this Agreement are notified to the controller in text form at least 30 days before they take effect; if the controller does not object within this period, the new version is deemed accepted. The notification expressly points out the right to object and the consequences.
3. Should any provision be invalid, the validity of the remaining provisions remains unaffected. The parties will replace the invalid provision with a valid one that comes closest to its economic purpose.
4. In the event of conflicts between this Agreement and the Main Agreement, this Agreement prevails insofar as the processing of personal data is concerned.
5. Austrian law applies, excluding its conflict-of-laws rules. The place of jurisdiction is the court having subject-matter jurisdiction for the processor’s registered office, unless mandatory statutory provisions provide otherwise.

Annex 1: Description of the processing

Purpose

Provision and operation of the platform: management of user accounts and Workspaces, connection of the controller’s accounts, reading of marketing, analytics and website data, execution of changes to these accounts on instruction, logging of usage and billing.

Categories of data subjects

• Users of the controller (employees, authorized third parties)
• Customers, prospects and website visitors of the controller, insofar as their data is contained in the connected accounts
• Persons who make contact via the controller’s forms, insofar as the corresponding features are used

Types of personal data

Nature of the processing

Collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure by transmission to the services connected by the controller and to the AI assistant deployed by it, restriction, erasure and destruction.

Annex 2: Technical and organizational measures

As of September 15, 2026. The information describes the state actually implemented.

Confidentiality

• System access control. Sign-in to the portal via email and password or via Google; passwords are stored exclusively as hash values. AI assistants access the platform via an authorization flow against the portal with short-lived access tokens that the client renews itself. Registrations are protected by a bot check, sign-in attempts by rate limiting.
• Data access control. Every call is assigned to a tenant and a Workspace; a permission gate checks, for each tool, the required data source, the plan and, for write calls, the approval. A write quota limits automated write access per Workspace and day and reports when it is triggered to operations.
• Separation control. Tenant separation at the data level; every query is bound to the tenant identifier. No analysis across tenants.
• Encryption. Transmission exclusively via TLS. The controller’s credentials are encrypted field by field with a managed key (automatic annual rotation, 30-day deletion period for the key); the database and its backups are additionally fully encrypted.
• Data minimization in logs. The usage log contains no content. In the change journal, large payloads such as customer lists, event lists and file contents are replaced by a description of their scope instead of being stored.

Integrity

• Input control. Write actions are recorded in the change journal with time, tool, parameters and acting person.
• Transfer control. Outgoing connections go only to the services connected by the controller; addresses are checked before retrieval to prevent requests to internal networks.
• Change control. Deployment exclusively via a pipeline with automated tests and an automated code review whose findings block deployment. Database changes are versioned and run before the service is switched over.

Availability and resilience

• Operation on managed containers behind a load balancer with health checks; automatic recovery of failed instances.
• Daily database backup with 14 days of retention and point-in-time recovery; deletion protection enabled for the database instance.
• Monitoring with alarms for server errors, unhealthy instances and the database’s storage, compute, connections and memory; alarms are routed to a continuously monitored channel.

Procedures for review

• Analyses on production data are carried out via a separate access without write permissions and with a time limit per query.
• Credentials and keys are kept in a managed secrets store, not in the source code.
• Data protection incidents and security reports are documented in a traceable manner.

Annex 3: Sub-processors

Not sub-processors

Google (Ads, Analytics, Search Console, Tag Manager, Business Profile), Meta, LinkedIn, Microsoft Clarity, DataForSEO and the controller’s website and editorial systems are not sub-processors of the processor. Access takes place solely with the credentials that the controller itself stores or releases via authorization, on its instructions and within the scope of the contracts it has itself concluded with these providers. The processor does not maintain its own accounts with these services through which the controller’s data would pass.

The list is nevertheless expressly included here so that the controller knows the complete data flow: it needs this information for its own record of processing activities and for the agreements it has to conclude with these providers itself. The same applies to the AI assistant it deploys (§ 5a).

Annex 4: Deletion concept

Version 1.3 of September 29, 2026. The information on services, data types, retention periods and sub-processors reflects the state of the platform as of this date. Changes to the technical and organizational measures are governed by § 4(2).

Changes: Version 1.1 of September 17, 2026 added Twilio Ireland Limited (SendGrid) to Annex 3 for sending system messages by email. Version 1.2 of September 18, 2026 adds the purpose of confirming the email address there; the group of sub-processors remains unchanged. Version 1.3 of September 29, 2026 adds to § 2(5) that the obligation to act on instructions also covers transfers to a third country or an international organization and that processing required by law is notified in advance (Art. 28(3)(a) GDPR), restates the obligations of sub-processors and the liability for them in § 5(3) in line with Art. 28(4) GDPR, clarifies in § 1(3) and § 6(1) where the subject matter and third-country aspects are set out, and adds alteration to the nature of the processing in Annex 1; the group of sub-processors remains unchanged.