Data Processing Agreement (DPA) pursuant to Article 28 of the General Data Protection Regulation (GDPR) Version dated: 29 August 2026 between 1. Controller / Client [Name / company of the customer] [Address] [Postcode City] [Email address] – hereinafter the “Client” or the “Controller” – and 2. Processor JDu Apps Sole proprietor: Julian Dubbert Eilenau 11 22087 Hamburg Germany support@copy-for-trello.com copy-for-trello.com – hereinafter the “Processor” – together the “Parties”. 1. Subject matter and scope 1.1 This Agreement governs the processing of personal data by the Processor on behalf of the Controller in connection with the use of the migration service provided by JDu Apps. 1.2 The Processor provides a technical service for the automated migration of data from supported project management and collaboration platforms into target accounts or target platforms designated by the Controller. The current focus of the service is the migration of Trello® boards. 1.3 The Processor processes personal data only to the extent necessary to perform the migration commissioned by the Controller, or where the Controller issues a corresponding instruction. 1.4 This DPA applies only to processing activities in which the Processor processes personal data on behalf of the Controller. Other processing activities in which the Processor itself is a controller within the meaning of the GDPR are not subject to this DPA. 2. Nature and purpose of the processing 2.1 The purpose of the processing is exclusively the performance of the data migration commissioned by the Controller. 2.2 The processing may in particular include the following operations: • reading data from the source system, • transferring data via technical interfaces, • temporary processing and interim storage, • technical transformation and structuring, • mapping of users and objects, • transferring data into the target system, • creation or restoration of attachments, • repair or establishment of links, • technical error handling, • technical logging, • retry of failed processing steps, • subsequent deletion of data that is no longer required. 2.3 Processing takes place solely for the purpose of technically performing the migration selected by the Controller. The content processed in the course of the migration shall not be used for advertising, profiling, or any other purposes of the Processor’s own. 3. Categories of personal data In the course of a migration — depending on the platform selected by the Controller and the data contained therein — the following categories of personal data may in particular be processed: • names and other master data relating to individuals, • usernames and user identifiers, • email addresses and other communications data, • user assignments and mentions, • card, task and project titles, • descriptions and other free-text content, • comments and activities, • checklists, • labels and tags, • due dates and status information, • attachments, files and images, • links and references, • technical identification data, • other content contained in the data selected by the Controller for migration. Where the data made available by the Controller for migration contain special categories of personal data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR, such data may also be processed to the extent technically required for the migration. 4. Categories of data subjects The processing may in particular concern: • employees and staff of the Controller, • customers and prospects of the Controller, • suppliers and business partners of the Controller, • users of the platforms used by the Controller, • contact persons and other points of contact, • other natural persons whose personal data are contained in the data to be migrated. 5. Duration of the commissioned processing 5.1 The commissioned processing begins when the respective migration starts. 5.2 Processing generally ends upon completion or cancellation of the respective migration and the subsequent deletion of personal data that are no longer required. 5.3 This DPA applies for the duration of the business relationship between the Parties. It ends upon termination of the business relationship and cessation of the processing of personal data by the Processor. Statutory retention obligations remain unaffected. 6. Processing on documented instructions 6.1 The Processor processes personal data solely on documented instructions from the Controller, unless processing is required by law. 6.2 Commissioning a specific migration, selecting the data to be migrated, and designating the target system constitute instructions of the Controller. 6.3 The Controller is responsible for the lawfulness of the processing and, in particular, for ensuring that it is entitled to transfer and process the data. 6.4 The Processor is entitled to refuse to carry out an instruction if, in its view, the instruction violates mandatory data protection provisions. The Controller shall be informed of this without undue delay. 6.5 Where the Processor is required to process personal data by Union or Member State law, it shall inform the Controller of that legal requirement before processing, unless the law prohibits such information. 7. Confidentiality 7.1 The Processor shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 7.2 Personal data may be made accessible only to persons who need those data to perform their respective tasks. 7.3 Access rights are granted on a least-privilege basis and are revoked when the relevant need ceases. 8. Data minimisation and nature of the technical processing 8.1 In designing and operating the service, the Processor takes into account the principle of data minimisation. 8.2 Complete contents of the systems to be migrated — in particular card descriptions, comments, custom fields and comparable content — are generally processed only during the technical performance of the migration and are not stored permanently in the regular application database. 8.3 Attachments and files may be stored temporarily on the file system or comparable temporary storage for the technical performance of the migration. Such temporary files are deleted after their processing has been completed. 8.4 Certain technical metadata may be stored temporarily for technical operation. This may in particular include: • technical IDs, • board, card and object mappings, • short links and references, • truncated card titles, • usernames or user identifiers for a mapping configured by the Controller, • technical status information, • technical log information. 9. Technical and organisational measures 9.1 The Processor shall implement appropriate technical and organisational measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk. 9.2 The measures contemplated at the time of conclusion of this Agreement are described in Annex 2 – Technical and Organisational Measures (TOM). 9.3 The Processor is entitled to further develop technical and organisational measures or to replace them with equivalent measures, provided that the existing level of protection is not materially reduced. 10. Assistance with data subject rights 10.1 Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in fulfilling its obligations towards data subjects under Articles 15 to 22 GDPR. 10.2 This may in particular include: • providing available information, • assisting with the identification of stored data, • assisting with erasure, • assisting with the restriction of processing, • forwarding requests received directly by the Processor. 10.3 Decisions on the merits of a data subject request and the fulfilment of statutory obligations towards the data subject remain with the Controller. 11. Assistance with security incidents and other obligations 11.1 Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in fulfilling its obligations under Articles 32 to 36 GDPR. 11.2 This includes in particular informing the Controller without undue delay of a personal data breach of which the Processor becomes aware, insofar as it concerns data processed on behalf of the Controller. 11.3 Where available at the relevant time, the information shall in particular include: • the nature of the security incident, • the categories of data concerned, • the groups of data subjects concerned, • known or suspected effects, • measures already taken or planned. 12. Sub-processors 12.1 The Processor may engage further processors to perform its services. These may in particular include providers in the areas of • hosting and cloud infrastructure, • email delivery, • monitoring and security, • data processing, • other technical infrastructure, insofar as they are in fact engaged as sub-processors within the meaning of Article 28 GDPR. 12.2 The sub-processors engaged at the time of conclusion of this Agreement are listed in Annex 3 – List of Sub-processors. 12.3 The Controller grants the Processor a general authorisation to engage further sub-processors. 12.4 Before engaging a new sub-processor or replacing an existing one, the Processor shall inform the Controller of the intended change and give the Controller the opportunity to object on important data-protection grounds. 12.5 The Processor shall ensure that each sub-processor is contractually bound to data protection obligations that appropriately correspond to the obligations provided for in this DPA. 12.6 The Processor shall bind the sub-processors it engages, by means of appropriate contractual arrangements, to comply with the data protection requirements applicable to the respective processing. Before engaging them, the Processor shall adequately assess whether the respective sub-processors provide suitable guarantees for processing in compliance with data protection law, in particular by reviewing suitable data protection agreements, technical and organisational measures, and other available evidence. The Processor’s responsibility for sub-processors is limited to the selection, oversight and contractual duties incumbent upon it under Article 28 GDPR. No guarantee is given for every actual act of a sub-processor outside the Processor’s sphere of influence and control. 13. Transfers to third countries 13.1 A transfer of personal data to a third country or an international organisation shall take place only where the statutory requirements of Articles 44 et seq. GDPR are met. 13.2 Where a sub-processor processes personal data outside the European Economic Area, this shall be indicated accordingly in the list of sub-processors or in the information provided in that regard. 14. Deletion and return 14.1 Personal data are generally processed only for the period required to perform the respective migration. 14.2 After completion or cancellation of a migration, temporarily stored personal data are generally deleted within 14 days, unless a longer retention period is required by law. 14.3 Data may temporarily be contained in technical backups. Deletion from backups takes place as part of the regular technical deletion cycles. 14.4 A separate return of the complete migration data is generally not required, because the data are transferred into the target system designated by the Controller as part of the commissioned migration. 14.5 Statutory retention obligations remain unaffected. Data that must be retained for a longer period due to a legal obligation shall be deleted after expiry of the applicable period and, during the statutory retention period, shall be processed only to the extent required by law. 14.6 The Processor shall ensure that sub-processors generally delete or return the Controller’s personal data after completion of their respective services in accordance with the contractual and statutory deletion obligations applicable to them. However, the Processor is not obliged to monitor deletion at a sub-processor beyond the control measures that are contractually and technically available to it. 15. Demonstration and audit rights 15.1 The Processor shall make available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR. 15.2 The Processor shall support reasonable reviews and audits by the Controller insofar as these are necessary to fulfil statutory obligations. 15.3 The Controller shall generally exercise its audit rights in the first instance by means of appropriate documentation, evidence, information and — where available — certifications or audit reports. 15.4 Where a more extensive review is required, the Controller may, after reasonable prior notice, conduct an audit or have one conducted by a suitable independent auditor. 15.5 Audits shall be conducted in such a way that the Processor’s business operations, the security of systems and the rights of the Processor’s other customers are impaired as little as possible. 15.6 The details of an audit shall be appropriately coordinated between the Parties. 16. Data Protection Officer and data protection contact The Processor has appointed a Data Protection Officer where such appointment is legally required. Data-protection-related enquiries may be directed to the following contact address: privacy@copy-for-trello.com Where the Controller has appointed a Data Protection Officer, the Parties may exchange the respective contact details. 17. Amendments to the Agreement 17.1 Amendments and supplements to this DPA require written form, where legally permissible. 17.2 The Processor may amend this DPA where this is necessary due to statutory or regulatory changes, changes to the technical or organisational framework, or further development of the service. Where an amendment materially affects the rights or obligations of the Controller, the Controller shall be informed appropriately. 18. Electronic conclusion of the Agreement 18.1 This DPA may be concluded in electronic form. 18.2 Where the DPA is concluded as part of an electronic ordering or registration process, the Controller’s documented electronic consent shall constitute conclusion of the DPA. 18.3 In doing so, the Processor shall in particular document the applicable version of the DPA as well as the time and attribution of the consent. Article 28(9) GDPR expressly provides that the contract may also be concluded in electronic form. 19. Relationship to the main agreement 19.1 This DPA supplements the main agreement between the Parties concerning the use of the migration service. 19.2 In the event of conflict between this DPA and the main agreement, the provisions of this DPA shall prevail with respect to the processing of personal data. 19.3 In all other respects, the provisions of the main agreement remain unaffected. 20. Governing law German law shall apply, unless mandatory statutory provisions provide otherwise. The statutory places of jurisdiction remain unaffected. 21. Severability Should any provision of this DPA be or become invalid or unenforceable, the remaining provisions shall remain unaffected. Where legally permissible, the invalid or unenforceable provision shall be replaced by a valid provision that most closely approximates the commercial and data-protection purpose of the original provision. Annex 1 – Description of the processing 1. Subject matter Automated migration of data from supported project management and collaboration platforms into target accounts or target platforms designated by the Controller. The current focus is the migration of Trello® boards. 2. Purpose Performance of the data migration commissioned by the Controller. 3. Processing operations • reading • transferring • processing • structuring • mapping / assigning • temporary storage • technical transformation • recreation in the target system • transfer of attachments • technical error handling • deletion 4. Categories of personal data • names and master data relating to individuals • usernames and user identifiers • communications data • email addresses • user assignments and mentions • card and task titles • descriptions • comments • checklists • labels and tags • due dates • status information • attachments and files • images • technical IDs and references • other personal data contained in the migrated content 5. Categories of data subjects • employees and staff • customers and prospects • suppliers and business partners • users of the source and target platforms • other persons whose personal data are contained in the migrated content 6. Duration Processing takes place during the respective migration. Temporarily stored data are generally deleted within 14 days after completion or cancellation of the migration. Annex 2 – Technical and Organisational Measures (TOM) 1. Principle JDu Apps implements technical and organisational measures that ensure a level of security appropriate to the risk. The measures take particular account of the specific nature of the migration service, namely that complete contents of the systems to be migrated are generally not stored permanently in the regular application database. 2. Physical access control The production application is operated on the server infrastructure of a professional hosting provider. Physical access to data centre and server areas is controlled by the respective hosting provider. JDu Apps itself has no physical access to the server hardware. 3. System access control Administrative access to the production infrastructure is protected by appropriate authentication and access-protection measures. These include in particular, where used for the respective infrastructure: • individual user accounts, • secure authentication, • restricted administrative access, • SSH access via suitable authentication methods, • firewall rules, • disabling of unused network services, • regular security updates. 4. Data access control Access rights to systems and data are granted on a least-privilege basis. Access to customer data is limited to persons and processes that require it for operation, maintenance, troubleshooting or support. Permissions that are no longer required are revoked. 5. Tenant isolation Data and migrations of different customers are logically separated from one another. Access to migrations, user accounts and technical metadata is controlled on the basis of the respective permissions. For protected access operations, the application verifies the requesting user’s authorisation for the requested resource. 6. Data minimisation and temporary processing The application is designed so that complete contents of the systems to be migrated are generally not stored permanently in the regular database. In particular, card descriptions, comments, custom fields and comparable content may be processed exclusively in memory during technical processing. Attachments and files are, where required for the migration, stored temporarily and deleted after processing. 7. Encryption and transmission security The web application is provided via encrypted HTTPS/TLS connections. Communication with supported APIs takes place over encrypted connections where supported by the respective services. Credentials, tokens and other secrets are not stored in publicly accessible areas of the source code. 8. OAuth and access tokens Where supported by the respective platforms, OAuth-based authorisation procedures are used. Customer passwords for third-party platforms are generally not stored by JDu Apps. OAuth tokens and comparable credentials are used solely to perform the operations authorised by the customer and are protected against unauthorised access. Tokens that are no longer required are deleted or, where technically possible, invalidated. 9. Deletion concept The application uses automated or defined deletion processes. These include in particular: • deletion of temporary attachments after processing, • deletion of temporary migration data, • deletion of mappings that are no longer required, • deletion of tokens that are no longer required, • deletion of technical metadata after expiry of the applicable retention period. The regular retention period for persisted technical migration data is generally a maximum of 14 days. 10. Logging and input control Technical operations are logged to the extent required. Logging serves in particular: • error analysis, • security monitoring, • traceability of technical operations, • detection of misuse, • stability and operation of the application. Logs are limited to what is technically necessary. 11. Availability control The production application is operated on professional server infrastructure. To maintain availability, the following are used in particular, where provided for the respective infrastructure: • server monitoring, • technical logging, • regular security updates, • backup and recovery procedures, • procedures for handling technical incidents. 12. Recoverability Suitable backup and recovery procedures are used for relevant system components. In the event of a technical outage, recovery can be performed on the basis of the available backups and procedures. 13. Separation of development and production systems Development and production environments are generally operated separately. Production customer data are not used for development or testing purposes, unless this is required for a specific operational purpose and is permissible under data protection law. Where possible, test data or artificially generated data are used for development and testing. 14. Security updates and vulnerability management Operating systems, server components and software in use are updated regularly. Security-relevant updates are applied promptly depending on their criticality. Security-relevant vulnerabilities are assessed and addressed within the available technical means. 15. Security incidents Procedures exist for the detection, assessment, containment and remediation of security incidents. Known personal data breaches are assessed with regard to their impact on personal data and handled in accordance with statutory and contractual requirements. 16. Confidentiality Persons with access to production systems or personal data are bound to confidentiality in accordance with their tasks. Access rights are revoked when the respective tasks cease. 17. Review and further development The technical and organisational measures are reviewed regularly and adapted in the event of technical, organisational or legal changes. Changes must not result in a material reduction of the existing level of protection. 18. Review of sub-processors Before engaging sub-processors, JDu Apps adequately reviews their data-protection and technical frameworks. Where required, suitable data protection agreements or data processing agreements are concluded. In the selection process, JDu Apps particularly considers the technical and organisational measures offered and available evidence of their implementation. Changes to the sub-processors engaged are documented in accordance with the provisions of the DPA and, where required, communicated to the Controller. The sub-processors engaged are adequately reviewed on the basis of available information and evidence. Annex 3 – List of sub-processors At the time of conclusion of this Agreement, the following sub-processors are engaged insofar as required for the respective service: Company: Hetzner Online GmbH Purpose: Hosting, server infrastructure, and sending and receiving of emails Nature of processing: Processing of data arising on the server infrastructure as well as email addresses and communications data required for sending and receiving emails Location: Industriestr. 25, 91710 Gunzenhausen, Germany Company: Stripe Technology Company Limited (STC) Purpose: Payment processing and billing of booked services Nature of processing: Processing of customer, payment and transaction data for the performance and documentation of payments Location: One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland This list will be updated in the event of changes in accordance with the provisions of this DPA.