Data Processing Agreement

This Data Processing Agreement ("DPA") is concluded between:

Skillties GmbH

Haydnstr. 1

12203 Berlin

Germany

("Processor")

and

[Customer Name]

[Customer Address]

("Controller")

Processor and Controller are hereinafter referred to individually as a "Party" and collectively as the "Parties".

1. Subject Matter and Scope

This DPA governs the processing of personal data by Skillties GmbH on behalf of the Customer in connection with the use of the Skillties platform ("Platform").

This DPA applies exclusively to claimed and paid workspaces operated by the Customer.

Processing of personal data that is publicly available on the Platform or processed by Skillties for its own purposes remains governed by the Privacy Policy and is not subject to this DPA.

2. Roles of the Parties

The Customer acts as controller within the meaning of Article 4(7) GDPR.

Skillties acts as processor within the meaning of Article 4(8) GDPR.

Skillties processes personal data solely on documented instructions of the Customer, unless required to do otherwise by applicable law.

3. Description of Processing

3.1 Nature and Purpose of Processing

Skillties processes personal data for the purpose of providing and operating the Platform, in particular to:

enable workspace-based collaboration,
process skill mappings and skill-related evaluations,
display workspace-internal visibility of skill data,
provide technical support and platform functionality.

3.2 Categories of Data Subjects

employees of the Customer,
contractors or other authorized users of the Customer,
workspace administrators.

3.3 Categories of Personal Data

Depending on the use of the Platform, the following categories of personal data may be processed:

identification data (name, email address, profile photo),
authentication data,
contact data (business telephone number),
organizational data (job title / position, department, office location, supervisor / manager, employee ID),
skill-related data (skill mappings, skill levels),
calculated data (match levels, averages),
usage and interaction data within the workspace.

Contact and organizational data are processed only where the Customer transfers them to the Platform, either manually, by file import or through a connected directory service (e.g. Microsoft Entra ID). The Customer determines which of these data fields are transferred. The Platform documents the Customer's current field selection in a data sheet that is available to the Customer's workspace administrators at any time; the field selection always remains within the categories listed above.

3.4 Processing Duration

Processing is carried out for the duration of the contractual relationship between the Parties, unless statutory retention obligations require longer storage.

4. Instructions of the Controller

Skillties shall process personal data only on documented instructions of the Customer.

Instructions are generally provided through:

this DPA,
the Master Service Agreement (MSA),
applicable order forms,
configuration and use of the Platform by authorized workspace administrators.

5. Obligations of the Processor

Skillties undertakes to:

process personal data exclusively in accordance with this DPA and applicable law,
ensure that persons authorized to process personal data are bound by confidentiality,
implement appropriate technical and organizational measures in accordance with Article 32 GDPR,
assist the Customer in fulfilling data subject rights,
notify the Customer without undue delay of any personal data breach.

6. Technical and Organizational Measures (TOMs)

Skillties implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including in particular:

access controls and role-based authorization,
encryption of data in transit and at rest,
regular backups,
logical separation of customer data,
monitoring and logging of system access.

The technical and organizational measures are described in detail in Annex 1: Technical and Organizational Measures, which forms an integral part of this DPA.

Skillties may adapt the measures to technical progress, provided the level of protection is not reduced. Changes are documented, and the current version of Annex 1 is always available below this DPA.

7. Subprocessors

The Customer grants a general authorization for Skillties to engage subprocessors.

Skillties may use subprocessors, in particular for:

hosting and infrastructure,
analytics and monitoring,
email delivery and platform operations.

Current subprocessors:

Google Cloud Platform (Google Cloud EMEA Limited) – hosting and infrastructure; data centres in Frankfurt am Main, Germany (region europe-west3).

Tools that Skillties operates itself on its own infrastructure in Germany, including product analytics, email delivery and workflow automation, are not subprocessors.

Microsoft Entra ID is the Customer's own directory service. Where the Customer connects it, Skillties accesses it with read permissions only; Microsoft does not act as a subprocessor of Skillties.

Skillties shall ensure that all subprocessors are contractually bound by data protection obligations equivalent to those set out in this DPA.

The Customer may object to the engagement of a new subprocessor on reasonable data protection grounds.

Additional Clarification on Tools Used for Skillties' Own Purposes

Tools and services used by Skillties exclusively for its own business purposes, including but not limited to customer relationship management (CRM), sales, marketing, product communication, and support operations (such as CRM systems), are not used for the processing of customer-controlled workspace data.

Such tools do not constitute subprocessors within the meaning of this Data Processing Agreement and are therefore not subject to Article 28 GDPR obligations in the context of this Agreement.

This includes HubSpot, which Skillties uses for marketing communication. Data of registered users in Business and Enterprise workspaces, including users who sign in via Microsoft Entra ID, is not processed in HubSpot.

8. International Data Transfers

Skillties processes personal data exclusively within the European Union; the platform is hosted in Frankfurt am Main, Germany.

No intentional transfers of personal data to third countries take place.

Where subprocessors are headquartered outside the EU, processing is contractually restricted to EU regions.

9. Assistance with Data Subject Rights

Skillties shall support the Customer, taking into account the nature of the processing, in fulfilling requests from data subjects pursuant to Articles 12–23 GDPR.

Where a data subject submits a request directly to Skillties, Skillties shall forward the request to the Customer without undue delay.

10. Personal Data Breaches

Skillties shall notify the Customer without undue delay after becoming aware of a personal data breach.

Such notification shall include, where available:

a description of the breach,
the categories and approximate number of affected data subjects,
the likely consequences,
measures taken or proposed to address the breach.

11. Audits and Inspections

The Customer may verify compliance with this DPA by means of audits.

Audits shall:

be conducted during normal business hours,
be limited to once per year unless justified by a specific incident,
not unreasonably disrupt Skillties' operations.

Skillties may satisfy audit requests by providing appropriate documentation or third-party audit reports.

12. Return or Deletion of Data

Upon termination of the contractual relationship, Skillties shall, at the Customer's choice:

delete personal data processed on behalf of the Customer, or
return such data to the Customer,

unless statutory retention obligations apply.

13. Confidentiality

Both Parties shall treat all information obtained in connection with this DPA as confidential.

This obligation survives termination of the DPA.

14. Liability

Liability under this DPA shall be governed by the liability provisions of the Master Service Agreement.

Mandatory statutory liability remains unaffected.

15. Term and Termination

This DPA enters into force together with the Master Service Agreement or the applicable order form.

It remains effective for the duration of the processing of personal data by Skillties on behalf of the Customer.

16. Governing Law and Jurisdiction

This DPA is governed by the laws of the Federal Republic of Germany.

The place of jurisdiction is Berlin, Germany, to the extent legally permissible.

17. Final Provisions

If any provision of this DPA is invalid or unenforceable, the remaining provisions shall remain unaffected.

This DPA forms an integral part of the contractual relationship between the Parties.

Annex 1

Technical and Organizational Measures

pursuant to Article 32 GDPR

Version 1.0 · As of 9 October 2026

This annex describes the measures Skillties GmbH takes to ensure the security of personal data processed on behalf of its customers. It forms part of the Data Processing Agreement (DPA) and is reviewed at least once a year.

1. Confidentiality

Art. 32(1)(b) GDPR

1.1 Physical access control

The platform is operated exclusively in Google Cloud data centres in Frankfurt am Main, Germany (region europe-west3).
Physical protection of the data centres (access systems, video surveillance, security staff) is provided by the data centre operator; Google Cloud is certified, among others, under ISO/IEC 27001.
Skillties does not operate its own server rooms for customer data.

1.2 System access control

Sign-in to the platform via a central identity service; customers can sign in via their own Microsoft Entra ID and thus apply their own policies, for example on multi-factor authentication.
Only a few named administrators have access to production systems; access is protected by multi-factor authentication.
Access rights are granted on a need-to-have basis and revoked when no longer needed.

1.3 Data access control

Role and permission concept per workspace with individual permissions and reach (direct reports, own area, everyone); the customer defines roles and permissions itself.
Nobody can pass on permissions they do not hold themselves.
Skillties staff access customer data only to the extent required for operation and support.

1.4 Separation control

Logical separation of data per workspace; private content of a workspace is not visible outside it.
Sandbox workspaces are separate from production workspaces.

2. Integrity

Art. 32(1)(a) and (b) GDPR

2.1 Transfer control

All connections to the platform are encrypted via TLS.
The connection to Microsoft Entra ID uses read permissions only; Skillties does not write any data to the customer’s directory.
Data is only passed on to the subprocessors named in the DPA.

2.2 Input control

Processes relevant to co-determination are logged – where configured by the customer – and can be viewed by authorised roles.
For assignments it is visible whether they come from the directory or were set by hand, including person and date.
Synchronisations with Microsoft Entra ID are logged per run.

3. Encryption

Art. 32(1)(a) GDPR

3.1 Transmission and storage

Transmission: transport encryption via TLS.
Storage: encryption at rest by the data centre operator, including backups.

4. Availability and resilience

Art. 32(1)(b) and (c) GDPR

4.1 Availability control

Daily backups at the data centre operator.
Container-based operation; systems can be restored from backups.
Software, dependencies and containers are updated regularly.

5. Regular review

Art. 32(1)(d) GDPR

5.1 Procedures

Regular updating and hardening of the software in use.
Penetration tests.
Automated tests of the role and permission concept.
Review and adjustment of these measures at least once a year.

6. Organisation and order control

Art. 28(3) and Art. 32(4) GDPR

6.1 Staff

All persons with potential access to customer data are bound to confidentiality in writing.
Regular data protection training.

6.2 Instructions and incidents

Processing solely on the documented instructions of the customer.
Notification of personal data breaches to the customer without undue delay, at the latest within 48 hours of becoming aware.

6.3 Logs

Technical logs are kept according to the data centre operator’s standard retention periods (standard logs 30 days, administrative audit logs 400 days) and then deleted automatically.

7. Deletion and return

Art. 28(3)(g) GDPR

7.1 Periods and export

The customer can export the data of its workspace at any time.
Data of members who have left is deleted after a period set by the customer (default 6 months, adjustable from 0 to 24 months).
People no longer provided by Microsoft Entra ID for 30 days leave the workspace; the deletion period for members who have left then applies to their data.
Deletion of an account or a workspace is carried out after a period of 14 days, during which it can be revoked.
Backups are overwritten as part of the backup cycle.

Data protection contact

Skillties GmbH, Management
Haydnstr. 1, 12203 Berlin, Germany
info@skillties.com