Data processing agreement
Version 1.0 of 29 October 2026 · Annex 1 to the terms and conditions of the ifm.lu platform
This data processing agreement (“DPA”) forms part of the terms and conditions (“Terms”) of concilio et labore GmbH, Amselweg 4, 54306 Kordel, Germany (“Processor”), and applies to every contract concluded under them with a customer (“Controller”). It is concluded in electronic form (Art. 28(9) GDPR) when the contract is concluded. Terms defined in the Terms have the same meaning here. In case of conflict between this DPA and the Terms on the processing of personal data, this DPA prevails.
1. Subject matter and duration
1.1 The Processor processes personal data on behalf of the Controller in order to provide the ifm.lu platform and the related services under the contract (“Services”). Details are set out in Appendix A.
1.2 This DPA applies for the term of the contract and beyond it for as long as the Processor processes personal data of the Controller, in particular during a transition period and until the deletion under clause 9.
2. Instructions
2.1 The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case it informs the Controller of that legal requirement before processing, unless the law prohibits this. The contract, this DPA and the settings and functions the Controller uses on the Platform are the Controller’s documented instructions. Further instructions are given in text form.
2.2 The Processor informs the Controller without delay if it considers that an instruction infringes data protection law. It may suspend the instruction until the Controller confirms or changes it.
3. Obligations of the Controller
The Controller is responsible for the lawfulness of the processing, for informing the data subjects and for answering their requests. It informs the Processor without delay of errors or irregularities it finds in the processing.
4. Confidentiality
The Processor ensures that the persons authorised to process the personal data have committed themselves in writing to confidentiality and, where applicable, to the professional secrecy described in clause 8.3 of the Terms, or are under an appropriate statutory obligation of confidentiality, and that they process the data only on the Controller’s instructions.
5. Security of processing
5.1 The Processor takes the technical and organisational measures described in Appendix B to ensure a level of security appropriate to the risk (Art. 32 GDPR). It reviews them regularly and may adapt them to technical progress, provided that the level of security is not reduced.
5.2 The Processor informs the Controller of material changes to the measures in advance through the Platform.
6. Sub-processors
6.1 The Controller gives a general authorisation for the sub-processors listed in Appendix C. The Processor informs the Controller at least 30 days in advance of any intended addition or replacement of a sub-processor. The Controller may object in text form within this period on reasonable grounds relating to data protection. If the parties find no solution, the Controller may terminate the affected Services with effect from the change; clause 17 of the Terms applies.
6.2 The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. It remains fully liable to the Controller for the performance of the sub-processor’s obligations.
7. Support of the Controller
7.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests of data subjects (Chapter III GDPR). The Platform provides functions for this (search, export, correction, restriction and deletion within the limits of the record-keeping duties of the Controller). The Processor forwards to the Controller without delay any request it receives directly from a data subject and does not answer it itself.
7.2 The Processor assists the Controller in ensuring compliance with Arts. 32 to 36 GDPR, in particular with information for data protection impact assessments and prior consultations. The Platform provides standard inputs for the data protection impact assessments of its own processing.
7.3 Assistance that goes beyond the functions of the Platform and the standard inputs is charged at the rates of the Order Form, unless it is required because of a breach by the Processor.
8. Personal data breaches
8.1 The Processor notifies the Controller without undue delay, and in any case within 24 hours of becoming aware of it, of a personal data breach concerning the Controller’s personal data. The notification contains, as far as available, the information required by Art. 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available is provided in phases without undue further delay.
8.2 The Processor takes the measures needed to secure the data and to mitigate possible adverse consequences, and assists the Controller in its notification to the supervisory authority and in its communication to the data subjects.
9. Return and deletion
At the end of the Services, the Processor, at the choice of the Controller, returns all personal data and deletes the existing copies, unless Union or Member State law requires their storage. Clause 17 of the Terms (export, transition period, deletion after 90 days, written confirmation) applies. Documentation that proves the proper processing may be kept by the Processor beyond the end of the contract in line with the applicable retention periods.
10. Audits and information
10.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by it. Clause 11 of the Terms applies; the rights of the supervisory authorities remain unaffected.
10.2 The Processor may demonstrate compliance also by current certifications, audit reports of independent auditors or the reports of its sub-processors (for example those of the cloud provider), where they cover the processing concerned.
11. Transfers to third countries
11.1 The personal data are stored and processed in the European Union, in the cloud region Europe (Frankfurt). A transfer to a third country, including remote access from it, takes place only where the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision (for example the EU–U.S. Data Privacy Framework for certified recipients) or of the standard contractual clauses adopted by the European Commission.
11.2 Appendix C states where a sub-processor may process data outside the European Economic Area and on which basis.
12. Liability and final provisions
12.1 Liability is governed by Art. 82 GDPR and, in the relation between the parties, by clause 15 of the Terms.
12.2 Changes of this DPA are made in accordance with clause 19 of the Terms; changes required by law or by a supervisory authority may be made with shorter notice. Clause 20 of the Terms applies.
Appendix A – Description of the processing
| Item | Description |
|---|---|
| Nature and purpose | Hosting, operation, maintenance and support of the Platform; storage, organisation, retrieval, use, transmission within the Platform, restriction and erasure of the Controller’s data as the Controller uses the functions; transcription of voice messages where the Controller has the setting switched on; sending of invitations, sign-in codes and notifications |
| Categories of data subjects | Users of the Controller (staff, conducting officers, board members, and auditors, delegates or advisers given access); persons whose data the Controller records on the Platform, in particular investors and their representatives and beneficial owners, staff of delegates and service providers, counterparties, applicants and other persons named in records, documents or messages |
| Categories of personal data | Account and sign-in data (e-mail address, name, role, organisation, second-factor data, sign-in times, devices for notifications); content entered by the Controller: records of the registers and workflows, documents and attachments, messages, voice messages and their transcripts, call events (participants, times; no call content); data on staff (positions, working time, absences without medical details, training, remuneration where the Controller uses these modules); data on investors and other persons as needed for due diligence, anti-money laundering, complaints and the other functions used; audit trail of actions on the Platform |
| Special categories and criminal data | Only where the Controller records them under its own legal basis, for example adverse media, sanctions and suspicion data in the anti-money laundering functions; the Platform asks for no health data |
| Duration | Term of the contract and the period of clause 1.2; within it, the retention periods set by the Controller on the Platform |
| Location | European Union, AWS region Europe (Frankfurt); see Appendix C for edge delivery |
Appendix B – Technical and organisational measures
| Area | Measures |
|---|---|
| Confidentiality: access to systems and data | Sign-in through a managed identity service with multi-factor authentication (authenticator app; passkey for staff of the Controller), automatic sign-out after 30 minutes without activity, accounts disabled after 90 days without use; roles and functions of the Controller decide what a User sees and may do; separate Tenant per Controller; staff of the Processor access the Controller’s environment only where needed for the Services, and such access is recorded |
| Confidentiality: encryption | TLS for all connections; encryption at rest of databases, files and backups; content of messages, attachments and transcripts with a key of the Controller’s Tenant in a key management service; secrets in a managed parameter store |
| Integrity | Every change of a record is kept in the record’s history and in an audit trail that Users cannot change or delete; earlier versions of messages and documents are kept; checks of input data and of uploads (types, sizes) |
| Availability and resilience | Managed cloud services in several availability zones of the region; point-in-time recovery of the database (35 days) and versioning of stored files; monitoring and alerts; business continuity and recovery plans tested at least yearly |
| Separation | Data of each Controller are kept and processed separately by Tenant identifier, and, where the Order Form so provides, in separate cloud accounts of the Controller |
| Development and change | Changes only through version control and automated tests; content security policy and other security headers on the Platform; dependencies kept current |
| Incident handling | Defined procedure for security incidents and personal data breaches with notification within 24 hours (clause 8) |
| Staff and organisation | Written confidentiality and secrecy undertakings; security awareness; need-to-know access; regular review of the measures |
| AI functions | No use of the Controller’s data to train models; the cloud provider’s use of content to improve its AI services is excluded for the Processor’s organisation; AI output shown as such and reviewed by Users |
Appendix C – Sub-processors
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (with Amazon Web Services, Inc., Seattle, USA, as its affiliate) | Cloud infrastructure: compute (AWS Lambda), database (Amazon DynamoDB), file storage (Amazon S3), key management (AWS KMS), identity (Amazon Cognito), e-mail (Amazon SES), API and WebSocket gateway (Amazon API Gateway), event routing (Amazon EventBridge), speech-to-text (Amazon Transcribe), relay for calls (Amazon Kinesis Video Streams) | Region Europe (Frankfurt), Germany | Data stored and processed in the EU; for possible access from the USA: EU–U.S. Data Privacy Framework and standard contractual clauses of the AWS data processing addendum |
| Amazon Web Services EMEA SARL (as above) | Content delivery and access check at the network edge (Amazon CloudFront, Lambda@Edge): requests to the Platform pass the nearest edge location, which may be outside the EEA when a User travels; portal content is not cached | Global edge network | As above |
Notifications to devices are delivered as empty messages through the push service of the User’s browser (for example Google, Mozilla, Microsoft or Apple), which receives only the device address chosen by the browser and the time; the content is fetched from the Platform by the User’s device. The Processor’s own website services (consent banner of the public pages) do not process personal data of the Controller.