Data Processing Agreement (DPA)

(1) This data processing agreement forms part of the Kalender Sync terms of service between you (“Customer”) and PPJ Venture Labs UG (haftungsbeschränkt), Hohenzollernstraße 30, 80801 Munich, Germany, registered at Amtsgericht München under HRB 308771, represented by its managing director Paul Koch (“PPJ”). It governs all processing of personal data that PPJ carries out on your behalf when you use Kalender Sync, and takes effect when you accept the terms of service. It applies on every plan, including the Free plan and the trial; no separate signature is required. For contracts concluded before 17 October 2026, this agreement applies once you accept it by a declaration in text form or once it is incorporated as part of a change to the terms of service; until then, PPJ provides it on request.

(2) You act as controller, or as a processor authorised by your own controller to appoint PPJ.

(3) This agreement applies where you use Kalender Sync as a business (Unternehmer) within the meaning of section 14 of the German Civil Code (BGB), that is, in the course of a trade, business or self-employed profession, including as a sole trader or freelancer. If you use Kalender Sync as a consumer (section 13 BGB), there is no processing on your behalf; PPJ then processes your data as controller, as described in the privacy policy.

(4) For personal data processed on your behalf, this agreement takes precedence over conflicting provisions of the terms of service. It applies for the term of the service contract and beyond, until return or deletion under section 12 is complete.

(1) The subject matter is the provision and operation of Kalender Sync: reading event data from the connected source calendars and creating, updating and deleting blocker or copy events in the connected target calendars, each at the visibility level you choose (“Busy only”, “Title + time”, “All details”); the account and sign-in management this requires; transactional and service email; support and troubleshooting. Additionally, only with your express per-calendar approval: providing calendar data to an AI assistant you connect, at its request.

(2) Types of data: account data (email address, optional name, language setting, plan, timestamps of approvals given within the service); credentials for calendar services (OAuth tokens, app passwords, feed URLs), stored encrypted; calendar metadata (name, colour, write permissions); event data (title, times, location, description) during synchronisation; usage and log data (sessions with browser, IP address and last activity; technical logs; logs of AI assistant actions without event content).

(3) Event content is processed only in transit and is not stored permanently. What is stored permanently is event identifiers, checksums for change detection and the start time of the source event. Attendee lists, guest email addresses and attachments are neither stored nor copied into target calendars; where they are contained in responses from the calendar interfaces, they are discarded immediately.

(4) Data subjects are your users (such as owners, management, staff) and persons whose data is contained in the event content of the synchronised calendars (such as customers, business partners, contacts).

(5) Special categories of personal data (Art. 9 GDPR) are not intended for this processing. Depending on your entries, event content may nonetheless contain them. PPJ does not analyse event content.

(6) This agreement does not cover processing that PPJ carries out as controller: administering and billing the contractual relationship including payment processing, statutory retention duties, security and abuse monitoring of its own infrastructure, advertising and newsletters based on the recipients’ own consent, and communication with you as a contracting party. The privacy policy describes this processing.

(1) PPJ processes personal data only on your documented instructions. These consist of this agreement, the terms of service and the configuration you set in the application, in particular setting up, changing and deleting syncs, visibility levels and approvals. Additional individual instructions must be given in text form.

(2) PPJ does not use data processed on your behalf for its own advertising, for profiling or to train AI models.

(3) Where law requires PPJ to process otherwise, PPJ informs you beforehand unless that law forbids it. If PPJ considers an instruction to infringe data protection law, PPJ informs you without undue delay and may suspend its execution until it is confirmed or changed.

(1) You are responsible for the lawfulness of the processing and for safeguarding the rights of data subjects, in particular for the information duties under Articles 13 and 14 GDPR towards your users.

(2) You ensure that the persons who connect calendar accounts are entitled to do so and that synchronising the calendars concerned is compatible with the legal and professional duties that apply to you (such as confidentiality obligations). You are responsible for transfers to recipients under section 8 that you or your users initiate.

(3) You protect your credentials and inform PPJ without undue delay if you notice errors or irregularities in the processing.

(1) PPJ binds every person authorised to access personal data to confidentiality before access is granted, unless they are under a statutory duty of confidentiality; the obligation continues after their work ends. Access is limited to what the task requires.

(2) The contact point for data protection questions is support@kalender-sync.de. No data protection officer is appointed, as there is no obligation to appoint one; if that changes, PPJ will notify you of the contact details. PPJ keeps a record of processing activities under Article 30(2) GDPR.

(1) PPJ implements appropriate technical and organisational measures under Article 32 GDPR. They comprise: hosting in ISO 27001-certified data centres of Hetzner Online GmbH in Germany (application and database in Nuremberg, backups in Falkenstein) with the operator’s physical access control; server access exclusively by key-based SSH sign-in; user sign-in by one-time codes sent by email or through Google or Microsoft, passwords only as Argon2 hashes, sessions visible to users and individually revocable; administrative access limited to a narrow group of people, token-based and with logging of administrative operations; logical tenant separation and strictly separate staging and production environments; transport encryption on all connections (TLS, HSTS with preload); credentials for calendar services stored with authenticated encryption (ChaCha20-Poly1305); daily database backups with an additional encrypted backup on physically separate storage and tested restoration; system monitoring and logging on our own infrastructure; minimisation of personal data in technical logs; “Busy only” as the default visibility level and a limited synchronisation window; regular internal security reviews.

(2) PPJ may adapt the measures to the state of the art as long as the level of protection is not reduced. Material changes are documented.

(3) No security measure eliminates every risk; absolute security is not warranted.

(1) You give general written authorisation under Article 28(2) GDPR for the services listed on the sub-processor page (kalender-sync.de/en/subprocessors/); this list forms part of this agreement. Each service is authorised only for the purpose described there.

(2) Before processing begins, PPJ contractually binds each sub-processor to data protection obligations equivalent to those in this agreement (Article 28(4) GDPR) and remains liable to you for its performance. On request, PPJ provides the relevant provisions; commercial terms may be redacted.

(3) PPJ announces any intended addition or replacement of a sub-processor at least 30 calendar days before use, by email to the address of your account, and updates the list. It is your responsibility to keep that address current.

(4) You may object in text form within 30 days of receiving the notice on important data protection grounds. If you do not object, the change is deemed approved. If you object, PPJ may provide the service without the change objected to; if that is not possible or not reasonable, either party may terminate the service contract with effect from the date the change takes effect. PPJ refunds pro rata any fees already paid for the period after that date.

(5) Ancillary services from third parties without intended access to your personal data (such as telecommunications or maintenance without data access) are not sub-processing, and neither are the services you connect yourself under section 8.

(1) The calendar services that you or your users connect (such as Google, Microsoft, Apple iCloud, GMX, WEB.DE, mailbox.org, Infomaniak and other CalDAV or iCal services) are services of your choosing and not sub-processors of PPJ. PPJ accesses them only within the connections set up; calendar data flows only between your own accounts. Your contractual relationship with the respective provider governs.

(2) If you connect an AI assistant through the MCP interface, it receives calendar data only with your express per-calendar approval. Its provider is a recipient at your instruction and not a sub-processor of PPJ; its own terms govern the processing there.

(3) The application, database and backups are located in Germany. Sub-processors process data in third countries only where the requirements of Articles 44 et seq. GDPR are met; the sub-processor list states the processing location and the safeguard for each provider.

(1) PPJ forwards requests from data subjects that are evidently addressed to you without undue delay and responds substantively only on your instructions or where law requires it.

(2) Taking into account the nature of the processing and the information available, PPJ assists you with appropriate technical and organisational measures in responding to requests under Articles 12 to 23 GDPR and with your obligations under Articles 32 to 36 GDPR. The application provides account data export and complete account deletion as self-service for this purpose.

(3) Assistance to a reasonable extent is free of charge. Effort beyond that is provided only by prior arrangement and against reasonable remuneration.

(1) PPJ notifies you without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach affecting data processed on your behalf, by email to the address of your account.

(2) The notice contains the information under Article 33(3) GDPR as far as it is already available; missing details follow as soon as they are available. PPJ limits the effects and supports your notification duties under Articles 33 and 34 GDPR.

(1) PPJ makes available to you the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits. Compliance is demonstrated primarily through documentation: the technical and organisational measures under section 6, certificates of the data centres used and written answers.

(2) If that is not sufficient in a particular case, you may conduct an on-site inspection yourself or through an auditor bound to confidentiality. It must be arranged with at least 30 days’ notice, takes place no more than once per calendar year, during normal business hours and without disrupting operations; you bear the costs. Data of other customers and system security remain protected. The powers of supervisory authorities remain unaffected.

(1) When the provision of services ends, PPJ deletes or returns all personal data at your choice, unless a statutory retention duty applies. If you make no choice within 30 days of the end of the contract, the data is deleted. Deleting your account yourself in the application counts as an instruction to delete.

(2) Deletion in the production system takes place no later than 30 days after the end of the contract. Data in backups is deleted as part of the scheduled rotation, no later than twelve months after deletion in the production system. Backups are kept separate from the production system and encrypted, are blocked from ordinary processing and serve only for restoration after an incident; if a backup is restored, deletions are applied again.

(3) Statutory retention duties, such as for invoices and accounting records, remain unaffected; PPJ processes that data as controller.

(1) Article 82 GDPR governs the parties’ liability towards data subjects. Otherwise, the liability provisions of the terms of service apply.

(1) Each version of this agreement carries a version number and a date. Earlier versions are available on request.

(2) PPJ may change this agreement where there is a legitimate reason, in particular a change in law or in supervisory guidance, an adjustment to the technical measures, or a clarification that does not reduce your rights. PPJ announces such a change at least 30 calendar days before it takes effect, by email to the address of your account, and points out your right to object. If you object within that period, the previous version continues to apply to you; PPJ may then terminate the service contract at the end of that period. Otherwise the new version applies from the date stated.

(3) Changes that materially reduce your rights or PPJ’s obligations, or that extend the purposes of processing, require your express consent. PPJ obtains it before the new version applies to you.

(4) Changes to the sub-processor list follow section 7 and not this section.

(1) This agreement is concluded in electronic form and is valid without a signature (Article 28(9) GDPR). You can save and print it at any time using the print view on this page.

(2) If your organisation requires a signed copy naming both parties, write to support@kalender-sync.de. Its content is identical to this page in the version stated.

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods and subject to mandatory provisions. Jurisdiction follows the terms of service.

(2) This agreement is published in German and English. In case of discrepancy, the German version prevails.

(3) Should a provision be or become invalid, the remainder of this agreement stays in force; the statutory rules apply in its place.

The sub-processor list forms part of this agreement. The terms of service govern the service itself, and the privacy policy describes the processing we carry out as controller. Deutsche Fassung.