Data Processing Agreement (DPA)
Convenience translation. Only the German version is legally binding: German version.
Agreement on the processing of personal data on behalf of the controller pursuant to Art. 28 GDPR for the use of Tasktopus AI. Last updated: July 2026.
Note: If Tasktopus AI processes personal data on your behalf (e.g. of your employees or customers), we will conclude an individual, signed DPA based on this document on request. Request it at hallo@tasktopus-ai.de. In case of doubt, the signed version takes precedence over this online version.
1. Contracting Parties
Processor (Provider):
JJO-Labs
Jan Jonas
Pemöllers Weg 20
22941 Delingsdorf
Germany
hallo@tasktopus-ai.de
Controller (Customer): the person or company that uses Tasktopus AI under the main contract (Terms).
2. Subject Matter and Duration
(1) The subject matter of the processing on behalf of the controller is the processing of personal data that the Controller enters into the Platform or has processed in the course of using Tasktopus AI (SaaS).
(2) The duration corresponds to the term of the main contract (Terms). The DPA ends automatically upon its termination.
3. Nature and Purpose of the Processing
The purpose is the provision of the contractually agreed SaaS services: storage, organization and display of project, task, time and user data as well as – where activated by the Customer – AI-supported features (e.g. prioritization, summaries). Processing takes place exclusively on instruction and for the provision of these services.
4. Categories of Data Subjects
- employees and team members of the Customer,
- contact persons and contacts of the Customer,
- where applicable, other persons whose data the Customer records in the Platform.
5. Categories of Personal Data
- master data (name, role, team),
- contact data (email address),
- usage and activity data (tasks, comments, time tracking),
- content voluntarily entered by the Customer.
Special categories of personal data (Art. 9 GDPR) are not subject to the processing, unless expressly agreed otherwise.
6. Obligations of the Processor
(1) The Processor processes personal data exclusively on documented instructions from the Controller, unless it is required to process the data by law.
(2) The Processor ensures that the persons authorized to process the data have committed themselves to confidentiality.
(3) The Processor takes the necessary technical and organizational measures pursuant to Art. 32 GDPR (see section 8).
(4) The Processor supports the Controller, as far as possible, in fulfilling data subject rights and in meeting notification obligations under Art. 33/34 GDPR.
(5) The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes data protection law.
7. Sub-processors
(1) Sub-processors may only be engaged with the general or specific authorization of the Controller. By concluding this DPA, the Controller grants its general authorization for the engagement of the sub-processors listed below.
(2) The Processor contractually binds sub-processors to an equivalent level of data protection. The following sub-processors are currently engaged:
| Sub-processor | Purpose | Location / server location | Safeguard for third-country transfers |
|---|---|---|---|
| ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany | Hosting of the website and platform, email delivery | Germany | – (no third-country transfer) |
| OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA | AI-supported features (language model API): prioritization, summaries, risk detection, chat assistant | USA | Standard contractual clauses (Art. 46(2)(c) GDPR), Data Processing Addendum |
(3) The Processor informs the Controller in advance of any intended changes concerning the addition or replacement of sub-processors. The Controller may object to such changes within 14 days of notification. If the Controller raises a justified objection, the parties will seek an amicable solution; if no agreement is reached, the Controller has a special right of termination.
8. Technical and Organizational Measures (TOM)
- encrypted data transmission (HTTPS/TLS),
- access and authorization concepts (role-based),
- access protection for servers and mailboxes,
- regular data backups,
- measures against unauthorized access, loss and misuse.
The specific TOM are provided to the Controller as an annex to the signed DPA.
9. Support and Data Subject Rights
The Processor supports the Controller in responding to requests from data subjects (access, rectification, erasure, restriction, data portability, objection) and forwards requests addressed to it to the Controller without undue delay.
10. Deletion and Return
After completion of the processing services, the Processor deletes the personal data or returns it, at the choice of the Controller, unless there is a legal obligation to store the data. After the end of the contract, the Customer generally has 30 days to export its data (see Terms, § 8(5)).
11. Evidence and Audits
The Processor makes available to the Controller all information necessary to demonstrate compliance and allows for reasonable audits (e.g. by providing information or recognized certificates/reports).
12. Final Provisions
(1) In the event of conflicts between this DPA and the main contract, the provisions of this DPA take precedence with regard to data protection.
(2) The law of the Federal Republic of Germany applies. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.
← Back to the home page