Data Processing Agreement

pursuant to Art. 28 DSGVO (GDPR) · Version of October 29, 2026

between you as a user of Bauhelfer.app (controller, hereinafter “Client”) and

Alwin Viereck
Erni-Singerl-Str. 6
81249 München

E-Mail: mail@bauhelfer.app

(processor, hereinafter “Contractor”). The agreement is concluded electronically (Art. 28 (9) DSGVO) when you consent to it in the app together with the Terms of Use.

1. Subject matter and duration

The Contractor processes personal data for which the Client is responsible exclusively for the purpose of operating Bauhelfer.app for the Client. The agreement applies for as long as the contract of use exists.

2. Nature and purpose of the processing

Storing and providing the data in the app; converting voice recordings into text and analysing them; reading receipt photos; creating quotes, invoices and PDF documents; providing the quote page (viewing, accepting, rejecting) to the Client’s customers and storing their decision; translating customer messages into the Client’s language; address suggestions; data export; error analysis.

3. Type of data

• Contact and address data (name, form of address, address, email, telephone)
• Order data (services, quantities, prices, quotes, invoices, payment status)
• Decisions on the quote page (time, IP address, name entered, voluntary note, request for early commencement)
• Working hours and hourly rates of employees and helpers
• Voice recordings and photos (may contain any of the data listed)

4. Data subjects

Customers and prospective customers of the Client, employees and helpers of the Client, contact persons of suppliers (on receipts).

5. Instructions

The Contractor processes the data only on documented instructions from the Client. Instructions are this agreement and the Client’s use of the app’s features. If the Contractor considers an instruction to be unlawful, it informs the Client. No processing for the Contractor’s own purposes (e.g. advertising, disclosure, training AI models with the Client’s data) takes place.

6. Confidentiality

Only persons who are bound to confidentiality and who need access to operate the Service have access to the data.

7. Technical and organisational measures (Art. 32 DSGVO)

• Processing on servers in the EU (hosting) and on a self-operated server in Germany (speech recognition, analysis)
• Encrypted transmission (TLS between app, website and server; encrypted private network between the Contractor’s own servers)
• Server access only for the Contractor with key-based login; passwordless login for users, sessions revocable
• Strict separation of data per business in all queries
• Secrets (login and acceptance codes) are masked in logs; error reports are pseudonymised before being passed on
• Quote page without cookies, tracking or third-party content; acceptance links not guessable (128 bit) and time-limited
• Deletion of all data of a business when the account is deleted; data export at any time

The Contractor may further develop the measures as long as the level of protection does not decrease.

8. Sub-processors

The Client approves the following sub-processors. The Contractor will inform the Client in advance of intended changes in the app or by email; the Client may object within two weeks and then terminate the agreement.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen — hosting (data centre in the EU)
• Tailscale Inc., USA — encrypted network between the servers; sees only connection data, no content
• OpenRouter, Inc., USA — only as a fallback if the Contractor’s own server fails: speech recognition, analysis, translation of customer messages
• komoot GmbH (Photon, Germany) and OpenPLZ API — address suggestions; only the search term entered is transmitted
• GitHub, Inc., USA — error reports, pseudonymised beforehand (names, addresses, contact details, bank details replaced)

Transfers to the USA are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, insofar as the provider is certified.

9. Support of the Client

The Contractor supports the Client with requests from data subjects (access, rectification, erasure, data portability) — above all through the app’s features (editing, deleting, export) — and with the Client’s obligations under Art. 32 to 36 DSGVO. If data subjects contact the Contractor directly, the Contractor forwards the request to the Client.

10. Notification of breaches

The Contractor notifies the Client of personal data breaches without undue delay, with the information known to it pursuant to Art. 33 (3) DSGVO.

11. Deletion and return

The Client can export its data at any time. If the Client deletes its account or the agreement ends, the Contractor deletes all data of the business, unless there is a statutory obligation to retain it; server logs are overwritten automatically.

12. Evidence and audits

On request, the Contractor provides the Client with the information necessary to demonstrate compliance with this agreement and allows audits after prior arrangement.

13. Liability, miscellaneous

Liability is governed by Art. 82 DSGVO. In all other respects, the Terms of Use apply. In the event of conflicts, this agreement takes precedence in matters of data protection.