Data processing agreement

Version 2026-10-09.2. Agreement under Art. 28 of the General Data Protection Regulation (GDPR).

between the company that holds a sumwerk account (the Customer, controller)

and Kitchn Venture GmbH, Französische Straße 12, 10117 Berlin, Germany, operator of sumwerk (the Processor).

The Customer accepts this agreement electronically, at sign-up or under Account → General. sumwerk records who accepted which version, when and from which address. An electronic form is sufficient (Art. 28 (9) GDPR). Whoever accepts confirms that they may do so for the Customer.

1. Subject and duration

1. The Processor provides the service sumwerk to the Customer: subscription metrics from the Customer’s Stripe account and the customer records, notes, tasks, emails and automations around them. In doing so it processes personal data on behalf of the Customer. Annex 1 describes that processing.
2. This agreement runs as long as the Customer’s account exists and ends with it. Clauses on deletion and confidentiality apply beyond the end as far as they must.
3. For data of the Customer’s own users that the Processor needs to run the account (login, server logs, the API log), the Processor is itself a controller; the privacy notice at sumwerk.com/privacy applies to it, not this agreement.

2. Instructions

1. The Processor processes the data only on documented instructions of the Customer. The instructions are: this agreement, the settings the Customer makes in sumwerk, the calls the Customer’s systems make through the API, and what the Customer’s users do in the application. Further instructions are given in text form to hello@sumwerk.com.
2. If the Processor believes an instruction infringes data protection law, it tells the Customer without delay and may suspend carrying it out until the Customer confirms or changes it.
3. If the Processor is required by Union or Member State law to process the data otherwise, it informs the Customer beforehand, unless that law prohibits it.

3. Duties of the Customer

1. The Customer is responsible for the lawfulness of the processing and of its instructions, including a legal basis for the data it sends to sumwerk and for emails it sends from sumwerk.
2. The Customer connects Stripe by installing the sumwerk app in its Stripe account, which shows the app’s permissions before the install, and keeps the logins and API tokens of its users and systems safe. sumwerk only reads the Stripe account until the Customer switches on billing management; from then on it changes billing in Stripe only as the Customer’s users instruct it in sumwerk.
3. The Customer does not store special categories of personal data (Art. 9 GDPR) or data on criminal convictions (Art. 10 GDPR) in sumwerk. The service is not made for them.
4. Services the Customer connects (Stripe, Google, Plain, ChartMogul, its own systems, webhook receivers, AI assistants over MCP) are the Customer’s own providers, not sub-processors of the Processor.

4. Confidentiality

Persons the Processor authorises to process the data are bound to confidentiality, by contract or by law, also after their work ends. They process the data only on the Processor’s instructions and only as far as their task requires.

5. Security of processing

The Processor takes the technical and organisational measures of Annex 2 (Art. 32 GDPR). It may develop them further as long as the level of protection does not fall below what is described there.

6. Sub-processors

1. The Customer gives a general authorisation to engage sub-processors. The ones engaged at the time of acceptance are listed in Annex 3.
2. The Processor announces a new or replaced sub-processor at least 30 days beforehand: on sumwerk.com/privacy, in the changelog, and by email to the owners of the account. The Customer may object within that time for a reason related to data protection. If no solution is found, the Customer may end the account with effect from the change; nothing further is owed.
3. The Processor binds every sub-processor by contract to data protection duties that match this agreement, and remains liable to the Customer for them.
4. Where a sub-processor processes data outside the European Economic Area, the transfer rests on an adequacy decision or on the standard contractual clauses of the European Commission (Annex 3).

7. Rights of data subjects

The Processor helps the Customer, as far as it can, to answer requests of data subjects (access, rectification, erasure, restriction, portability, objection). The Customer can see, correct, export and delete customer records itself in the application and through the API. If a data subject writes to the Processor about the Customer’s data, the Processor passes the request on and does not answer it itself.

8. Personal data breaches

The Processor informs the Customer without undue delay, and no later than 48 hours after becoming aware, of a personal data breach that concerns the Customer’s data: what happened, which data and roughly how many persons are concerned, what the likely consequences are and what has been done. It supports the Customer in its duties under Art. 33 and 34 GDPR.

9. Further assistance

The Processor supports the Customer, on request and taking into account the information available to it, with data protection impact assessments and prior consultations (Art. 35, 36 GDPR).

10. Deletion and return

1. The Customer can export its data at any time as CSV and through the API.
2. Disconnecting Stripe or uninstalling the sumwerk app in Stripe ends sumwerk’s access to the Stripe account at once. When the account ends, the Processor deletes the Customer’s data within 30 days; backups that still contain it expire by themselves within a further 30 days and are not restored for any other purpose until then.
3. The Processor keeps data longer only where Union or Member State law requires it, and then only for that purpose.

11. Evidence and audits

1. The Processor gives the Customer the information needed to show that the duties of Art. 28 GDPR are met: this agreement with its annexes, answers to reasonable questions in text form, and the certificates and reports of its sub-processors as far as they are available.
2. If that is not enough, the Customer, or an auditor it names who is bound to confidentiality and is not a competitor of the Processor, may carry out an inspection: once a year, or when there is a concrete reason, with at least 30 days’ notice, during business hours, without disturbing operations and without access to the data of other customers. Each side bears its own costs; effort of the Processor beyond one working day a year is paid for at cost.

12. Liability

Art. 82 GDPR applies between the parties and towards data subjects. Beyond that, liability follows the terms of service.

13. Final provisions

1. In case of conflict, this agreement takes precedence over other arrangements between the parties as far as the protection of personal data is concerned.
2. The Processor may change this agreement when the law, the service or the sub-processors change. A new version is published with its date and has to be accepted again; until then the accepted version applies. Every acceptance stays on record.
3. If a provision is or becomes invalid, the rest remains in force.
4. German law applies. The English version governs; the German version is a translation for convenience.

Annex 1: The processing

Purpose	Providing sumwerk: computing subscription metrics from Stripe data; keeping customer records, people, notes, call logs, tasks and emails; running the Customer’s automations and at-risk rules; imports and exports; the API and the MCP server
Nature	Reading from Stripe (never writing), storing, computing, displaying, sending emails and webhooks on the Customer’s instruction, deleting
Data subjects	The Customer’s own customers and leads and the people who work there; recipients of emails the Customer sends from sumwerk
Kinds of data	Names, email addresses, postal and tax details as far as Stripe holds them, company, country, phone, title, LinkedIn address; subscriptions, prices, invoices, payment status (no card numbers: Stripe does not pass them on); the Customer’s own attributes, tags, notes, call logs, tasks; emails written in sumwerk; from Plain: title, status, labels and participants of support conversations (message text is read on demand and not stored)
Special categories	None intended (clause 3.3)
Place	Germany (Annex 3 for the exceptions)
Duration	As long as the account exists (clause 10)

Annex 2: Technical and organisational measures

Access to systems and data. The servers are reached by the operator only, over SSH; the administrator account accepts keys only, no passwords. The database listens on the server itself and is not reachable from the internet. In the application: passwords are stored as bcrypt hashes, at least ten characters; sign-in, sign-up and password reset are rate limited; sessions are signed cookies that are only sent over HTTPS requests to our own domain; API tokens are stored as SHA-256 hashes, have a read or a read-and-write scope and can be revoked one by one.

Separation. Every record belongs to an account, and every query of the application is scoped to the signed-in user’s or the token’s account; automated tests check that one account cannot reach another’s data. Sandboxes are separate accounts with their own data and tokens. The operator’s admin area shows states and counts of an account, not its customers or amounts.

Encryption. All connections use TLS. Keys and tokens of connected services (Google, Plain, import keys) are encrypted in the database at application level and are never displayed again or written to logs. Backups are encrypted (AES-256) before they leave the server.

Minimisation. Stripe is connected through the sumwerk app: no key of the Customer’s Stripe account is stored, and sumwerk writes to Stripe only while the Customer has billing management switched on. Support messages from Plain and call transcripts are not stored. The API log keeps the names of fields, never their values. Error reports keep no request data.

Integrity and traceability. Stripe events are kept as an append-only log. Closed months change only through a recorded restatement. What an operator changes on an account by hand is written to a log that cannot be edited. The API log shows every call made with the Customer’s tokens for 30 days.

Availability and resilience. A backup every night, checked after it is written, kept 14 days on the server and 30 days encrypted in separate storage; restoring has been tested. A monitor outside our own server checks the service every minute and alerts the operator; disk, memory, the database and the certificates are watched on the server; the status is public at status.sumwerk.com.

Development. Every change runs through automated tests, a static security analysis and a check of the dependencies for known vulnerabilities before it is deployed. Customers’ data is not copied out of production for development or testing; tests and the demo account use synthetic data. The one exception is the operator’s own affiliated company, whose data is used to verify the calculations, with its consent.

Organisation. Access to production is limited to the persons who need it to operate the service; they are bound to confidentiality. Incidents are handled by the operator, recorded, and reported under clause 8. Sub-processors are chosen for their security and bound by contract.

Annex 3: Sub-processors

Sub-processor	Task	Place, basis for a transfer
Hetzner Online GmbH, Gunzenhausen, Germany	Servers, database, storage for the encrypted backups	Germany (Nuremberg)
ActiveCampaign, LLC (Postmark), Chicago, USA	Sending emails: those of sumwerk to the Customer’s users, and those the Customer’s users write to their customers when they go out through sumwerk’s sender (recipient, sender, subject, text)	USA. Standard contractual clauses; the company states it is certified under the EU-U.S. Data Privacy Framework
Cloudflare, Inc., San Francisco, USA	Name servers for sumwerk.com; the status page and the monitor, which hold no customer data. The application’s traffic does not pass through Cloudflare	Worldwide. Standard contractual clauses; the company states it is certified under the EU-U.S. Data Privacy Framework