Data Processing Agreement

This Data Processing Agreement is entered into by and between the Customer (hereinafter referred to as the "Controller") and Timesheet - Mobile Time Tracking OG, Untere Weißgerberstrasse 43 1/2, 1030 Vienna, Austria, operating the FirstReply service (hereinafter referred to as the "Processor"), together the "Parties".

"Customer" in this context means, on the one hand, independent individual users of our Services, such as freelancers or other persons who register for use independently of an employer or other organization ("Individual Customer"). In the case of companies, organizations, institutions, groups of persons or the like that use our Services to manage the customer support of their business and have acquired licenses for the employees or other persons assigned to their FirstReply organization for this purpose ("Enterprise Customers"), the respective company, organization, institution, group of persons or the like shall be deemed to be the Customer and thus the Controller.

1. General

  1. This Data Processing Agreement (hereinafter also referred to as the "DPA"), in addition to the Privacy Policy, governs the processing of personal data (hereinafter also referred to as the "Data") by the Processor within the scope of the contract concluded between the Parties for the use of the FirstReply app and services. FirstReply is an AI-powered customer support platform. It is available as a web app accessible via the browser, connects the Controller's support channels (such as email inboxes, WhatsApp, Facebook Messenger, Instagram, LinkedIn and Google Play reviews), and enables the automated processing of customer support conversations through artificial intelligence, including classification, AI-drafted and automated replies, translation, contact management, a knowledge base, and analytics and reporting (the "Services" or the "App").

  2. The provision of the commercial and legal conditions and a precise technical or professional description of the Services are not the subject of this DPA. This DPA shall ensure that the processing of Data in the context of the use of the Services complies with all applicable legal requirements, in particular in accordance with the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act (Datenschutzgesetz, "DSG"). All terms used in this DPA shall have the meaning defined in the Privacy Policy, the Terms of Service or, subsidiarily, in the GDPR or, further subsidiarily, in other applicable legal provisions.

2. Term

This DPA is entered into for the duration of the use of the Services or for the duration of the contract concluded between the Parties on the use of the Services.

3. Subject of the Data Processing

3.1 Purpose of the processing

Receiving, storing, organizing, classifying, translating and answering the Controller's customer support conversations across connected channels, including AI-based classification, reply drafting and automated replies, as well as the related contact management, knowledge management, analytics and reporting. The purpose is to assist the Controller in operating its customer support. This agreement is to be understood as a supplement to the contract concluded for the use of the Services.

3.2 Data categories

3.2.1 User data

a) Enterprise Customers only: name, profile picture (if provided) and language of license users (team members).

b) All content that is entered, uploaded, provided, collected, or otherwise processed via the Services and its functions, such as, in particular, support conversations and messages including attachments, contact data of the Controller's customers (such as names, email addresses, phone numbers and messaging identifiers), inboxes, templates, prompts, classifications, knowledge entries and connected knowledge sources, and other uploads, provided that and only to the extent that this data is provided. This also includes all data and information made available based on individually connectable channels and integrations.

c) The content of support conversations and knowledge sources that is processed by artificial intelligence for the purpose of classification, reply drafting, translation and assistant features, which may contain personal data of the Controller and of third parties (such as the Controller's customers).

d) Information transmitted by user-activated and connected or integrated third-party applications, such as messaging platforms, review platforms and knowledge-source integrations.

e) Personal data of individual persons that the Controller's customers provide in the context of support conversations, for example within message content or attachments.

4. Processor's Duties

  1. The Processor is obliged to process the Data exclusively within the scope of the above-mentioned purposes and in accordance with the terms of this DPA and the documented instructions of the Controller. If the Processor receives an official order to release data of the Controller, the Processor shall, to the extent permitted by law, immediately inform the Controller thereof and refer the authority to the Controller. Likewise, the processing of Data for the Processor's own purposes shall require a written mandate. The description of the data processing and the Services in the Terms of Service, the Privacy Policy and this DPA conclusively contain the instructions of the Controller with regard to the processing.

  2. The Processor declares that it has committed all persons entrusted with the data processing to maintain confidentiality prior to commencing their activities or that they are subject to an appropriate statutory confidentiality obligation. In particular, the confidentiality obligation of the persons entrusted with the data processing shall remain in force even after the termination of their activities and their departure from the Processor.

  3. The Processor declares that it has taken all necessary measures to ensure the security of the processing pursuant to Art. 32 GDPR. These measures are available upon request at any time and may be changed in the future but must not fall below the current level of protection. The Controller declares that these measures within the meaning of Art. 32 GDPR ensure an adequate level of protection.

  4. The Processor shall take the technical and organizational measures to enable the Controller to fulfill the rights of data subjects under Chapter III of the GDPR (information, access, rectification and erasure, data portability, objection, as well as automated decision-making in individual cases) at any time within the statutory time limits and shall provide the Controller with all information necessary for this purpose. If a corresponding request is addressed to the Processor and the request indicates that the applicant mistakenly believes that the Processor is responsible for the data processing carried out by it, the Processor shall immediately forward the request to the Controller and inform the applicant accordingly.

  5. The Processor shall assist the Controller in complying with the obligations set out in Articles 32 to 36 of the GDPR (data security measures, notifications of personal data breaches to the supervisory authority, notification of the data subject of a personal data breach, data protection impact assessment, prior consultation).

  6. The Processor undertakes to provide the Controller with the information necessary to monitor compliance with the obligations set out in this DPA. Primarily, the proof of compliance shall be provided by handing over certificates, confirmations or other documentation. Should reasonable doubt nevertheless arise as to compliance, the Controller shall be granted the right to inspect and control the data processing facilities with regard to the processing of the data provided by it, including through third parties appointed by the Controller. The costs for this shall in any case be borne by the Controller.

  7. Upon termination of this DPA, the Processor shall, at the Controller's discretion, either delete or release to the Controller in a commonly used format all processing results and records containing personal data of the Controller.

  8. The Processor shall inform the Controller without undue delay if it considers that an instruction given by the Controller violates Union or Member State data protection law.

5. Place of Processing

  1. The Customer acknowledges that the provision of the contractual services may require the transfer or processing of personal data in/to countries outside the EEA. The provisions of this DPA shall also be the Customer's instructions with respect to transfers to third countries.

  2. The Processor undertakes to comply with the standard contractual clauses as amended by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries in accordance with Regulation (EU) 2016/679 in the case of transfers of personal data to processors established in third countries that do not ensure an adequate level of data protection.

6. Sub-Processors

  1. The Processor is entitled to engage additional processors ("Sub-Processors"). The Processor currently uses the Sub-Processors listed at firstreply.ai/sub-processors.

  2. The Processor is entitled to engage further Sub-Processors.

  3. The Processor shall notify the Controller of the intended additions or changes to the Sub-Processors in good time so that the Controller can prohibit them if necessary. The Processor shall conclude the necessary agreements within the meaning of Article 28 (4) GDPR with all Sub-Processors.

7. Controller's Duties

  1. The Controller warrants that all personal data made available to the Processor shall be collected and made available in accordance with the applicable data protection laws and that it shall comply with all obligations in this respect, in particular with regard to informing the data subjects, obtaining the relevant consents, if any, as well as documentation and transparency.

  2. The Controller shall further ensure that all instructions given to the Processor in relation to the processing of personal data shall be in accordance with the applicable laws.

  3. The Controller shall indemnify and hold harmless the Processor in the event of any breach of these obligations.

8. Final Provisions

  1. This DPA shall be governed by Austrian law to the exclusion of international private law and the UN Convention on Contracts for the International Sale of Goods. The place of jurisdiction shall be the locally and materially competent court at the registered office of the Processor.

  2. If any provision of this DPA is or becomes invalid or unenforceable, this shall not affect the validity of the remaining provisions. The Parties undertake to agree on a new, effective provision in place of the ineffective provision which comes as close as possible to the meaning and purpose of the ineffective provision. The same shall apply to gaps in this agreement.

  3. The liability of the Processor shall be limited to damage caused by processing that did not comply with the obligations of the Processor under the GDPR and this Agreement or where the Processor acted outside or contrary to the lawful instructions of the Controller. Liability is also limited to gross negligence and intent and to three times the annual fee of the concluded contract.

Version: 16 July 2026