Data Processing Agreement

Last updated: 2026-11-05
Effective date: 2026-11-05

1. Subject Matter and Scope

1.1. This Data Processing Agreement ("DPA") governs the Processing of Personal Data that Genz IT Solutions GmbH ("Provider", "Processor") processes via the hosted HotCodePush service ("Service") on behalf of the customer ("Controller").

1.2. This DPA applies exclusively to the Service. The following are not covered:

SDKs, CLI and API clients: The open-source software that the Controller embeds in its applications or runs on its own systems is subject solely to the applicable open-source licence. At runtime, its only data flow to the Provider is the device report and the update download described in Annex 1. That data flow is covered by this DPA.

1.3. This DPA applies uniformly to all plans. There are no tiered modules or plan distinctions.

2. Precedence

2.1. In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail insofar as the Processing of Personal Data is concerned.

3. Nature, Purpose and Duration of Processing

3.1. The nature, purpose and subject matter of the Processing as well as the categories of Personal Data and Data Subjects are set out in Annex 1.

3.2. Processing shall take place for the duration of the contractual relationship between the parties plus the deletion and retention periods set out in Section 13.

3.3. The sole purpose of the Processing is the provision of the Service commissioned by the Controller.

4. Instructions

4.1. The Provider shall process Personal Data solely on the basis of documented instructions from the Controller. This DPA and the Terms of Service constitute the initial instructions. Supplementary instructions shall be given in text form (§ 126b BGB (German Civil Code)).

4.2. The Controller is the sole Controller under data protection law for the data processed on its behalf. The Controller shall ensure that the Processing is based on a valid legal basis.

4.3. The Controller shall independently obtain and maintain all consents, notices and legal bases required under the GDPR and the TDDDG (German Telecommunications Digital Services Data Protection Act) for the collection and transmission of end-user data via the SDKs before embedding them in its applications.

4.4. The Provider shall inform the Controller without undue delay if, in the Provider's opinion, an instruction infringes applicable data protection law (Art. 28(3) sentence 3 GDPR). The Provider may suspend the Processing until the matter is resolved.

4.5. The Provider shall be entitled to refuse to carry out manifestly unlawful instructions until the Controller demonstrates their lawfulness or amends the instruction.

5. Confidentiality

5.1. The Provider shall ensure that all persons authorised to process Personal Data are bound by confidentiality obligations or are subject to an appropriate statutory duty of secrecy.

5.2. The confidentiality obligation shall survive the termination of the respective engagement.

6. Technical and Organisational Measures

6.1. Before commencing the Processing, the Provider shall implement the Technical and Organisational Measures (TOMs) described in Annex 2 for the protection of Personal Data in accordance with Art. 32 GDPR.

6.2. Amendments to the TOMs are permissible provided the level of security documented in Annex 2 is not reduced. Material changes shall be notified to the Controller.

7. Sub-processors

7.1. The Controller grants the Provider a general authorisation to engage Sub-processors. The current list is available at https://hotcodepush.com/legal/subprocessors and forms part of this DPA as Annex 3.

7.2. The Provider shall notify the Controller at least 30 days before the planned engagement of a new or changed Sub-processor in text form.

7.3. The Controller may object to the engagement of a new or changed Sub-processor on legitimate data protection grounds within the notice period in text form. If the parties are unable to reach an amicable solution, the Controller shall have an extraordinary right of termination with a pro-rata refund of fees already paid for the period after termination. The Provider is not obligated to maintain parallel operations or to engage alternative Sub-processors.

7.4. The Provider shall contractually ensure that Sub-processors are subject to the same data protection obligations as agreed in this DPA.

7.5. Webhook endpoints: Where the Controller configures outbound webhooks (for example to a chat or collaboration service or to its own URL), the Provider transmits the notification data to the endpoint chosen by the Controller on the Controller's instruction. The operators of such endpoints are recipients engaged by the Controller, not Sub-processors of the Provider.

7.6. Merchant of Record: Polar Software Inc. acts as an independent controller in the purchase process, not as a Sub-processor of the Provider.

7.7. Ancillary services: Routine ancillary services (cleaning, telecommunications, transport, security guarding) do not constitute Processing on behalf of the Controller within the meaning of Art. 28 GDPR, even if the service providers may incidentally have access to premises or infrastructure. The Provider shall ensure that data security is maintained in connection with such services.

8. International Data Transfers

8.1. Personal Data processed under this DPA is stored in the European Union (Annex 2). Where Personal Data is transferred to Sub-processors outside the EEA, or where a Sub-processor established outside the EEA can access it, the Provider shall ensure that an adequate level of data protection is maintained.

8.2. For transfers to the USA, the Provider primarily relies on the EU-US Data Privacy Framework (DPF) for DPF-certified recipients. In addition, EU Standard Contractual Clauses (SCCs) pursuant to Implementing Decision (EU) 2021/914 (Module 3, Processor to Processor) are in place (Annex 4).

8.3. The Provider shall conduct a Transfer Impact Assessment for each third-country transfer and shall make the documentation available to the Controller upon request.

8.4. Supplementary addenda for transfers under the UK International Data Transfer Addendum (IDTA) and the Swiss revFADP shall be added as further annexes when there is an actual need.

9. Assistance with Data Subject Rights

9.1. The Provider shall assist the Controller with appropriate technical and organisational measures in fulfilling Data Subject requests (Art. 15–22 GDPR).

9.2. If the Provider receives a request directly from a Data Subject, the Provider shall forward it to the Controller without undue delay.

10. Personal Data Breach Notification

10.1. The Provider shall notify the Controller without undue delay and in any event no later than 48 hours after becoming aware of a Personal Data breach within the meaning of Art. 33 GDPR.

10.2. The notification shall contain at least:

a description of the nature of the breach, including the categories and approximate number of Data Subjects and data records affected,
the name and contact details of a contact person for further information,
a description of the likely consequences of the breach,
a description of the measures taken or proposed to remedy the breach and mitigate its effects.

10.3. Where not all information is available at the same time, the information may be provided in stages, without exceeding the 48-hour deadline for the initial notification.

11. Assistance with DPIAs and Prior Consultation

11.1. The Provider shall provide reasonable assistance to the Controller in carrying out Data Protection Impact Assessments (Art. 35 GDPR) and in prior consultations with Supervisory Authorities (Art. 36 GDPR), insofar as the Processing under this DPA is concerned.

12. Audit Rights

12.1. The Provider shall make available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. The primary means of verification shall be certificates, audit reports from independent third parties and questionnaires.

12.2. On-site audits are permissible as a last resort if the documentation-based evidence is insufficient. On-site audits are subject to the following conditions:

at least 30 days' advance notice in text form,
no more than once per calendar year, unless a concrete occasion requires an additional audit,
conducted during normal business hours,
the auditor shall be bound by a confidentiality obligation,
the costs of the audit shall be borne by the Controller.

13. Deletion or Return after Termination

13.1. After termination of the contractual relationship, the Controller shall choose within 30 days between export/return and deletion of the Personal Data processed on its behalf (Art. 28(3)(g) GDPR).

13.2. Export shall be provided in a machine-readable format appropriate to the respective data type (JSON or ZIP for metadata, the unmodified bundle files for bundles).

13.3. If the Controller does not make a choice within the 30-day period, the Provider shall delete the data from active systems after the period expires. Data of an organisation, app or account that the Controller deletes itself in the Service is removed from active systems seven days after the deletion. Within those seven days the Controller may have the deletion reversed via support. The 30-day period under Section 13.1 does not apply to such a deletion. A device that the Controller deletes in the Service is removed at once. Its identifier remains in the release's outcome records until the release's bundle is deleted (Section 2.6 of the Terms of Service) and in the monthly active device records until the end of the second calendar month after the month counted.

13.4. Backup carve-out: Data in automated backups shall be deleted during the regular rotation cycle. Backups are deleted at the latest twelve months after the deletion of the data from active systems. Offsite copies of bundle files are removed within 30 days of the deletion from active systems. In the meantime, the data shall be isolated, not actively processed and held solely for disaster recovery purposes. This is compatible with Art. 17 GDPR.

13.5. Statutory retention obligations (in particular §§ 147 AO, 257 HGB) shall remain unaffected.

14. Aggregation and Anonymisation

14.1. The Provider may use data arising in the course of the Processing in irreversibly anonymised form for statistical purposes (product improvement, marketing communications).

14.2. Personal end-user data shall not be used by the Provider for its own purposes. In particular, the Provider shall not use customer data for training, fine-tuning or improving AI or ML models. Where the Provider uses AI tools to process support requests, this concerns data the Provider processes as Controller. The Privacy Policy describes it.

15. Liability

15.1. The liability of the parties shall be governed by the provisions of the Terms of Service. Art. 82 GDPR shall remain unaffected.

16. Final Provisions

16.1. The laws of the Federal Republic of Germany shall apply.

16.2. The exclusive place of jurisdiction shall be Konstanz.

16.3. The authoritative language version of this DPA is the English version. The German version is for informational purposes only.

16.4. Should any provision of this DPA be or become invalid, the validity of the remaining provisions shall not be affected. The parties undertake to replace the invalid provision with a valid provision that most closely approximates the economic purpose of the invalid provision.

Annex 1 — Processing Overview

Purpose of Processing

Provision of the Service commissioned by the Controller: storage of the Controller's application bundles and their delivery as over-the-air (OTA) updates to the end-user devices running the Controller's applications.

Categories of Data Subjects

End users of the Controller's applications
Employees and agents of the Controller, insofar as their Personal Data is contained in bundles

Categories of Personal Data

The following categories describe exclusively data that the Provider processes as Processor on behalf of the Controller.

Update-Delivery Data
Technical data that an installed application sends to the Service in order to receive updates and to report their outcome, in particular:

a device identifier that the SDK generates at random on the device, or an identifier that the Controller's application sets. The identifier is not derived from hardware characteristics. The SDK performs no device fingerprinting,
platform and operating system version,
version and build number of the application binary,
SDK version,
the native fingerprint of the application binary, a hash of its native layer that determines update compatibility. It describes the build, not the device or the person,
the update channel,
custom attributes that the Controller's application sets,
outcome events (update downloaded, applied or failed),
the country derived from the request on the server, kept for statistics,
IP addresses, processed when a request is served.

Monthly active devices are counted as one device per application per calendar month. No raw outcome event is retained. Counters per release are kept, and an outcome record per device and release holds the first outcome event of each type.

Bundles
The Controller's application bundles (JavaScript, HTML, CSS and assets), insofar as they contain Personal Data (for example accidentally hard-coded keys, debug data or personal test data).

Webhook Payloads
Notification data that the Service transmits to endpoints configured by the Controller (Section 7.5), insofar as it is personal.

Demarcation — the Provider as Controller

The following data categories are processed by the Provider as an independent Controller and are not covered by this DPA:

Account and organisation metadata
Authentication data (session/API tokens, SSO attributes)
Console and CLI telemetry
Support data

In this regard, the Privacy Policy and the Terms of Service apply.

Data Export Format

Machine-readable, appropriate to the respective data type (JSON or ZIP for metadata, the unmodified bundle files for bundles). Alternative formats by arrangement.

Annex 2 — Technical and Organisational Measures (TOMs)

The measures below describe the minimum level of security in accordance with Art. 32 GDPR. Changes shall not reduce the level documented in this Annex (see Section 6.2). Supplementary details are documented in the Security Policy at https://hotcodepush.com/legal/security-policy.

Confidentiality

Access control: Multi-factor authentication (MFA) for all administrative access to production systems. Principle of least privilege.
Bundles: Purpose-limited processing for storage and delivery. No access by the Provider's personnel (including contractors) outside of a support case with the Controller's express authorisation.
Employee obligations: All employees with access to Personal Data are bound by confidentiality obligations.
Password policy: Minimum length and complexity in accordance with the state of the art. Passwords are stored exclusively in hashed form. Use of a password manager.

Integrity

Encryption in transit: TLS 1.2 or higher for all data transmissions.
Encryption at rest: Industry-standard encryption for stored data.
Code signing: The Controller may sign its bundles with its own key pair. Where enabled, the SDK verifies the signature on the device before applying an update. The private key remains with the Controller. The Provider never holds it.
Input control: Logging of which data was entered, modified or deleted, when and by whom.

Availability and Resilience

Data location: Bundles and files are stored in object storage within the European Union. The database is operated in Frankfurt, Germany. Further compute and storage services and the encrypted offsite backups run on cloud infrastructure in France and Germany. Requests are processed at the edge location nearest the caller.
Fail-open delivery: An outage of the Service never breaks an installed application. Devices keep running their current update and stop receiving new ones until the Service is restored.
Redundancy: Use of redundant server systems and services.
Backup and recovery: Regular, encrypted backups with a documented recovery plan. Regular restore tests.
DDoS protection: Protection measures against denial-of-service attacks.
Hosting: Production systems are operated with carefully selected infrastructure providers (Section 7).

Regular Review Procedures

SOC 2 and ISO 27001: Genz IT Solutions GmbH undergoes annual SOC 2 Type II audits and holds ISO 27001 certification. Both cover the Service. The current report and certificate are available on request under NDA.
Penetration tests: Annual external penetration tests (from 2026). Reports available under NDA.
Monitoring: Continuous monitoring of systems for security incidents.
TOM review: Regular review and update of the Technical and Organisational Measures.

Data Separation

Production and test data are stored strictly separated in different systems.
Data of different customers is processed with logical separation.

Annex 3 — Sub-processors

The current list of Sub-processors is available at the URL referenced in Section 7.1.

Annex 4 — EU Standard Contractual Clauses

For third-country transfers, the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 of the European Commission of 4 June 2021, Module 3 (Processor to Processor) shall apply.

The SCCs are hereby incorporated by reference into this DPA. The party-specific details (Appendices I–III of the SCCs) are derived from this DPA and its Annexes:

Appendix I.A (Parties): Data exporter (Processor) = Genz IT Solutions GmbH. Data importer (Sub-processor) = as listed in Annex 3
Appendix I.B (Description of processing): As set out in Annex 1 of this DPA
Appendix I.C (Supervisory Authority): Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Appendix II (TOMs): As set out in Annex 2 of this DPA
Appendix III (Sub-processors): As set out in Annex 3 of this DPA

Supplementary addenda for transfers under the UK International Data Transfer Addendum (IDTA) and the Swiss revFADP shall be added as further annexes when there is an actual need.