Data processing agreement

Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28(3) of the General Data Protection Regulation (GDPR) between the Customer as controller (“Customer”) and EX-IT GmbH & Co. KG, Bahnhofstraße 17, 63571 Gelnhausen, Germany, as processor (“we”). This agreement is an annex to the Terms of use (clause 11.2).

1. Subject matter, scope and term

1.1 This agreement governs the processing of personal data that we carry out on behalf of the Customer when providing modsi. It specifies the data protection obligations of the parties under the main contract, the Terms of use.

1.2 This agreement applies from the first processing on behalf of the Customer, i.e. from the creation of the Customer’s company in modsi, including any free trial. It runs for the term of the main contract and ends only once we have deleted all data processed on the Customer’s behalf in accordance with clause 10.

1.3 In the event of any conflict between this agreement and the Terms of use, this agreement takes precedence in matters of data protection.

1.4 Where we process personal data for our own purposes, we are a controller ourselves; our privacy policy applies to such processing. This concerns in particular the user account and sign-in (name, email address, password hash, two-factor authentication, passkeys, sessions, security log), contract and billing data, contact enquiries, reports of illegal content and the server logs.

2. Nature and purpose of the processing

2.1 We provide modsi to the Customer as a service via the internet. In doing so, we process personal data on behalf of the Customer exclusively in order to

• store media uploaded and content designed by the Customer (videos, images, slides, overlays, price lists, fonts and logos), process them technically (conversion into a uniform format, thumbnails) and play them out to the paired players;
• manage the Customer’s team (members, invitations, roles and location permissions, approval workflow) and make actions within the company traceable in the audit log;
• operate and remotely control the Customer’s screens (status, errors, storage level, preview and screenshot in “Now playing”);
• compile the Customer’s playback statistics and, on request, send them as a report;
• count accesses to the Customer’s QR codes and short links for the Customer’s scan statistics and redirect them to the destination specified by the Customer;
• inform team members by email, in-app notification (bell) and push notification about outages, approvals and reports.

2.2 There is no analysis of the content of the media, no processing for our own purposes and no disclosure to third parties, except in accordance with clause 4.3. Processing takes place in a data centre in Frankfurt am Main; sub-processors and their places of processing are listed in Annex 1.

3. Type of data and categories of data subjects

3.1 The data subjects are:

• the Customer’s team members (employees and other persons invited by the Customer);
• persons depicted or named in the Customer’s media and content;
• recipients of the reports set up by the Customer;
• persons who scan one of the Customer’s QR codes or open one of its short links.

3.2 The following types of data are processed:

• Team data: membership of the company (name and email address of the members as displayed within the company), role, location permissions, invitations, notification settings, approval requests and decisions, entries in the company’s audit log (who published, assigned or changed what and when – with IP address), in-app notifications as well as the content of notifications (for example the name of the screen, location, company and time; for approvals, the name of the content and of the requesting or deciding person);
• Content data: personal data contained in videos, images, texts and screenshots (for example the image and voice of persons depicted, names); special categories of personal data (Art. 9 GDPR) only if the Customer uploads them itself;
• Player device data: device model, app version, IP address, connection status, the publication currently playing, errors and storage level;
• Playback statistics: which media were played on which screen and when;
• QR scans: time, screen, device type and a day-specific one-way hash (check value) generated from the IP address, browser identifier, date and a secret key; the IP address itself is not stored, but only used briefly in memory to generate the check value and to limit the number of accesses;
• Report recipients: email addresses of the recipients.

3.3 The players do not collect any data about persons in front of the screen (no camera, no microphone, no counting of viewers).

3.4 The Customer is responsible for ensuring that the processing of the data it brings into modsi is lawful, in particular that it has the necessary consents or other legal bases for persons depicted and that it informs its team members about the processing.

3.5 This Agreement does not cover the users’ account and sign-in data (name, email address, password, two-factor authentication, passkeys, sessions, security log, push tokens) or the Customer’s contract and billing data; we process these as an independent controller in accordance with our privacy policy.

4. Instructions

4.1 We process the data only on documented instructions from the Customer. Documented instructions are this agreement, the Terms of use and the settings and actions that the Customer and its authorised team members make in the application (for example uploading, publishing, deleting, inviting, granting permissions).

4.2 Further instructions are given by the owners of the company in text form, for example by email to info@ex-it.eu. We treat instructions that go beyond the agreed scope of services as a request to change the services.

4.3 Without instructions, we process the data only where we are required to do so by Union or Member State law (for example in the case of reports of illegal content under Regulation (EU) 2022/2065); in such a case, we inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR). This also applies to a transfer to a third country.

4.4 If, in our opinion, an instruction infringes data protection law, we inform the Customer without undue delay (Art. 28(3), third sentence, GDPR). We may suspend the execution of the instruction until the Customer confirms or changes it. We have not appointed a data protection officer; the contact for data protection matters is EX-IT GmbH & Co. KG at info@ex-it.eu.

5. Confidentiality

5.1 We only use persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR) and who have been familiarised with the data protection provisions relevant to them. This obligation continues after their work has ended.

5.2 These persons process the data only on instructions from the Customer, unless they are required to do so by Union or Member State law.

6. Security of processing

6.1 We take the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures are described in Annex 2.

6.2 The measures are subject to technical progress. We may replace them with equivalent or better measures; the level of protection must not fall below the previous level. We document material changes in Annex 2.

7. Sub-processors

7.1 The Customer grants us general authorisation to engage other processors (sub-processors). The sub-processors engaged at the start of the agreement are listed in Annex 1; they are deemed approved.

7.2 We notify the Customer of any intended changes (addition or replacement of a sub-processor) at least four weeks before they take effect by email to the owners of the company. The Customer may object to the change in text form for an important reason relating to data protection until it takes effect. If we are unable to remedy the objection, the Customer may terminate the main contract for cause with effect from the date on which the change takes effect.

7.3 We contractually impose on each sub-processor the same data protection obligations as set out in this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures (Art. 28(4) GDPR). We remain responsible to the Customer for the sub-processor’s compliance with its obligations.

7.4 Data is only transferred to a country outside the European Union or the European Economic Area if the conditions of Art. 44 to 49 GDPR are met, for example on the basis of an adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses of the EU Commission.

7.5 Ancillary services that we obtain from third parties without them gaining access to the data processed on the Customer’s behalf, such as telecommunications services, do not constitute sub-processing within the meaning of this clause.

8. Assistance to the Customer

8.1 We assist the Customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, data portability, objection). The Customer can fulfil many of these requests itself in the application, for example by changing or deleting media, removing team members or downloading media.

8.2 If data subjects contact us with a matter relating to the processing on behalf of the Customer, we forward the matter to the Customer without undue delay. We do not respond to such requests ourselves unless the Customer instructs us to do so.

8.3 Taking into account the nature of the processing and the information available to us, we assist the Customer in complying with its obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of breaches, data protection impact assessment, prior consultation of the supervisory authority), insofar as the Customer cannot reasonably do so itself.

8.4 For assistance that goes beyond the functions of the application and is not due to a breach on our part, we may charge a reasonable fee if we announce this in advance.

9. Notification of personal data breaches

9.1 If we become aware of a personal data breach affecting data processed on behalf of the Customer, we notify the Customer without undue delay after becoming aware of it, if possible within 24 hours and at the latest within 48 hours, by email to the owners of the company.

9.2 The notification contains, insofar as available, the information pursuant to Art. 33(3) GDPR: the nature of the breach including the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed. We provide any information not yet available without undue delay.

9.3 We take the necessary measures without undue delay to secure the data and to mitigate possible adverse effects for the data subjects, and coordinate these with the Customer. The Customer makes notifications to the supervisory authority and communications to data subjects; we assist the Customer in accordance with clause 8.3.

10. Deletion and return after the end of the contract

10.1 During the term, the Customer deletes data itself in the application; we remove deleted media from the object storage immediately; we retain older versions of deleted or replaced files for up to 30 days to protect against accidental deletion (Annex 2 section 3). If the Customer deletes its company, we immediately delete all of the company’s data including the media. In addition, the periods stated in the privacy policy apply, for example for raw playback statistics data (90 days), QR scans (13 months) and in-app notifications (90 days).

10.2 For the purpose of return, the Customer can download its media in the application during the term and for up to 30 days after the end of the contract (“Download” function in the “Media” section) and use the exports offered in the application, for example the playback statistics as a CSV file.

10.3 After these 30 days have expired, we automatically and permanently delete all of the company’s data including the media. Companies whose trial has expired without a plan having been booked are deleted 90 days after the end of the trial. Before such automatic deletion, the owners of the company receive a reminder by email 14 days and 3 days in advance.

10.4 Deleted data disappears from the encrypted database backups and from older file versions in the object storage (Annex 2 section 3) at the latest 30 days after its deletion; until then, we only use it to restore the service after a disruption or an accidental deletion.

10.5 Statutory retention obligations remain unaffected; they concern our own invoice and accounting data, which we process as controller, not the data processed on the Customer’s behalf. On request, we confirm the deletion to the Customer in text form.

11. Evidence and audits

11.1 We make available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. Such evidence is primarily provided by self-disclosure and documentation, in particular by this agreement and its annexes and, on request, by additional explanations in text form.

11.2 If this is not sufficient in an individual case, the Customer may conduct audits, including inspections, itself or through an auditor appointed by it who is bound to confidentiality and is not a competitor of ours. On-site audits must be announced in text form at least 30 days in advance, take place during our normal business hours, must not disrupt operations, are limited to the necessary extent and, without specific cause, take place no more than once per calendar year. Each party bears its own costs.

11.3 Our servers and data are located in data centres of our sub-processor to which we do not have physical access ourselves. For these data centres, evidence is provided by the certificates and audit reports that the sub-processor publishes or makes available to us.

11.4 We inform the Customer without undue delay of inspections and measures by the supervisory authority insofar as they relate to the processing on behalf of the Customer.

12. Liability

12.1 Art. 82 GDPR applies in relation to the data subject to compensation for damage suffered by a data subject as a result of an infringement of the GDPR.

12.2 As between the parties, the liability provisions of the Terms of use (clause 12) apply, unless Art. 82 GDPR mandatorily provides otherwise.

13. Final provisions

13.1 Amendments and additions to this agreement require text form; Art. 28(9) GDPR remains unaffected. Changes made by us are subject to the procedure under clause 13 of the Terms of use; changes of sub-processors are subject to clause 7.2 of this agreement.

13.2 The annexes form part of this agreement. In the event of conflict, this agreement takes precedence over the Terms of use in matters of data protection.

13.3 Should individual provisions be invalid, the remainder of the agreement shall remain valid. The invalid provision shall be replaced by the statutory provision, in particular Art. 28 GDPR.

13.4 Applicable law and place of jurisdiction are governed by the main contract (clause 15 of the Terms of use). The contractual language is German. Last updated: 20 October 2026.

Annex 1: Sub-processors

Stripe Payments Europe, Ltd., Dublin, Ireland, is not a sub-processor: Stripe processes payment data as an independent controller and does not receive any data processed on behalf of the Customer. Apple Inc. and Google LLC are likewise independent controllers insofar as they distribute the apps via the App Store and Google Play.

Without AI, the “Slide from keywords” function works exclusively according to fixed rules on our servers. Before we switch on the AI wording assistant, which transmits the keywords entered to an AI provider, we add that provider to this list in accordance with the procedure under clause 7.2.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

This annex describes the measures implemented in modsi and on our servers.

1. Confidentiality

Physical access control: We do not operate our own server rooms. Servers, database and object storage run in DigitalOcean’s data centre in Frankfurt am Main (region FRA1); physical security (access protection, surveillance, power supply, fire protection) is the responsibility of the operator. According to DigitalOcean, it holds SOC 2 Type II and SOC 3 reports from an independent auditor (Schellman & Company); the FRA1 data centre is certified to ISO/IEC 27001, among others, and holds SOC 2 Type II reports (DigitalOcean Trust Center, retrieved on 13 October 2026).

System access control (servers):

• The server firewall only permits SSH, HTTP and HTTPS; the database (PostgreSQL), Redis, the real-time service and the website server are only reachable locally on the server.
• The application runs under its own system user without administrator rights; this user may only restart the modsi services. The source code is obtained with a read-only key.
• Error messages with technical details are not delivered to users in production.
• Server access: sign-in to the server only with SSH keys (password sign-in disabled), blocking of addresses after repeated failed attempts (fail2ban), a firewall that only allows SSH and the web ports; the database is only reachable on the server itself. Operating system security updates are installed automatically every day; if a restart is required, the server restarts automatically at night. Only employees of EX-IT GmbH & Co. KG entrusted with operating modsi have access to the server and the database. Access is granted via SSH keys and revoked as soon as it is no longer needed.

System access control (application):

• Passwords of at least 10 characters, stored only as a hash (bcrypt).
• Optional two-factor authentication with an authenticator app (TOTP; secret stored encrypted, recovery codes only as a hash, protection against reuse of a code, at most 5 attempts per sign-in) and sign-in with passkeys (WebAuthn).
• Platform administrators can only access the administration area with two-factor authentication or a passkey set up and a session confirmed with the second factor; this is checked on every request.
• Sign-ins in the browser expire after 6 hours of inactivity. Access tokens are stored only as a hash; sessions can be ended individually in the application.
• Rate limits for sign-in, two-factor verification, passkeys, password reset and sensitive account actions (per email address, account or IP address).
• Permanent deletions (account, company) require the password to be entered again and, if two-factor authentication is active, additionally a code.
• Notification email in the event of security-relevant changes (password, two-factor authentication, passkeys); security log for each account.
• Players are paired using a one-time code valid for 10 minutes (limited number of failed attempts); their access keys are stored only as a hash and revoked when they are unpaired or the company is deleted.

Data access control:

• Fixed roles (owner, administrator, editor, store staff) with defined permissions; team members can be restricted to individual locations.
• Media are stored in a private object storage. Access only after an authorisation check via short-lived, signed addresses (upload 30 minutes, display 10 minutes, players 60 minutes).
• Real-time connections (channels per company, location, user and screen) are only opened after an authorisation check.
• Changes made by platform administrators to a company are recorded in the administrator’s security log and in the company’s audit log.

Separation control: Every database query for a company’s data is automatically restricted to the current company; if this context is missing, the application aborts instead of returning unfiltered data (tenant separation). In the object storage, each company’s files are stored under a separate path, which is emptied completely when the company is deleted. The production system is only deployed with a production configuration and without demo data.

Pseudonymisation and encryption: QR scans are counted without the IP address, using only a one-way hash that changes daily. Two-factor authentication secrets are stored encrypted. Backups are encrypted while still on the server (libsodium: XChaCha20-Poly1305 with authentication of each block, a random key per backup, sealed with an X25519 public key); the secret key required for decryption is not stored on the server. Media and backups are stored in DigitalOcean’s object storage, which according to the provider stores data encrypted at rest; the backups are additionally encrypted by us as described. The database on the server’s disk is not separately encrypted; passwords are stored there only as hashes, and two-factor authentication secrets are stored encrypted.

2. Integrity

Transfer control: All connections to the website, the application, the interface (API), the real-time connections and the web player are encrypted with TLS (certificates from Let’s Encrypt); unencrypted requests are redirected to HTTPS. In release versions, the apps do not permit unencrypted connections. The interface and the web player instruct the browser not to pass on referrer information. Media are only transferred via signed, short-lived addresses.

Input control: The company’s audit log records who published, assigned or changed what and when (with IP address); it can be viewed by owners and administrators. Security-relevant actions are recorded in the security log of the respective account. Uploaded files are checked on the basis of their actual content, not just their file extension.

3. Availability and resilience

• Background services (video processing, real-time service, website) are restarted automatically after a crash; emptying the object storage after a company has been deleted is retried with waiting periods in the event of errors.
• Rate limits protect pairing, the transmission of statistics by the players and short links against overload and misuse; the size of uploads and requests is limited.
• The players continue to play content that has already been loaded even without a connection to the server.
• Backups: the database is backed up automatically every day, encrypted (section 1) and transferred to an object storage separate from the server at DigitalOcean in the data centre in Frankfurt am Main; the completeness of the transfer is verified. Backups are retained for 30 days and then deleted automatically. Restoring onto a new server is documented step by step and was successfully tested on 13 October 2026 (restore into an empty database, comparison of the data).
• Media: the object storage retains older versions of deleted or replaced files for 30 days so that accidentally deleted media can be restored; after that, they are deleted automatically.
• Backup monitoring: if a backup fails or the last successful backup is older than 26 hours, the platform administrators are notified automatically by email.
• Operations monitoring: the availability of the application and the website is checked continuously from several locations; the server transmits metrics (load, memory, disk space) to DigitalOcean’s monitoring. In the event of an outage, sustained high load or a TLS certificate about to expire, we are notified automatically by email. The application’s services are restarted automatically after a crash.

4. Data minimisation and deletion

• Deletion periods are configured centrally and implemented automatically every day (including raw playback statistics data 90 days, QR scans 13 months, in-app notifications 90 days, push tokens 270 days without use, security log 12 months).
• Server logs are rotated daily and deleted after 14 days; in production, the application only logs warnings and errors and retains log files for 14 days.
• Deleting the company removes all data in the database and all files in the object storage; device access is revoked. The data disappears from backups and older file versions at the latest 30 days thereafter.

5. Procedure for regular review

The data protection-related periods and security settings are stored in the source code and in the server configuration and are versioned together with changes to the application. This annex is updated in the event of material changes. We review this annex and the measures described annually; this includes a restore test of the backups and updating the software used. All employees have undertaken in writing to maintain confidentiality.