Data Processing Agreement | Pitch

·Data Processing Agreement

·Last Updated: November 11, 2025 (Version 1.0.10) Sign the Data Processing Agreement here Pitch Software GmbH

• 1In the course of the fulfillment of the contract between Pitch Software GmbH, Joachimstraße 7, 10119 Berlin (the "Processor") and the customer (the "Customer", together with the Processor the "Parties") regarding the provision of the Processor's software to the Customer (the "Contract"), it is possible that the Processor deals with personal data pursuant to Art. 4 no. 1 General Data Protection Regulation ("GDPR"), i.e. any information relating to an identified or identifiable natural person (e.g. names, addresses or phone numbers of persons who are the Customer's customers), with regard to which the Customer acts as a controller pursuant to data protection law (the "Customer Data‟). This agreement (the "Agreement") specifies the data protection obligations and rights of the Parties in connection with the Processor's use of Customer Data to render the services under the Contract.

·Subject of the Agreement

·Scope of the Processing

• 2.1The Processor shall process the Customer Data on behalf and in accordance with the instructions of the Customer within the meaning of Art. 28 GDPR. The Customer remains the controller pursuant to Art. 28 GDPR.
• 2.2The processing of Customer Data by the Processor occurs in the manner and the scope and for the purpose determined in Annex 2.2 to this Agreement; the processing relates to the types of personal data and categories of data subjects specified therein. The duration of processing corresponds to the term of the Contract.
• 2.3The Processor reserves the right to anonymize or aggregate the Customer Data in such a way that it is no longer possible to identify individual data subjects, and to use them in this form for the purpose of needs-based designing, machine-learning, developing and optimizing as well as rendering of the services agreed as per the Contract. The Parties agree that anonymized and according to the above requirement aggregated Customer Data are not considered Customer Data for the purposes of this Agreement.
• 2.4The Processor may process and use the Customer Data for the Processor ́s own purposes as controller to the extent legally permitted by data protection law. This Agreement does not apply to such data processing.
• 2.5The processing of Customer Data by the Processor shall in principle take place inside the European Union or another contracting state of the European Economic Area (EEA). The Processor is nevertheless permitted to process Customer Data in accordance with the provisions of this Agreement outside the EEA if the Processor informs the Customer in advance (e.g. in the privacy policy) about the place of data processing and if the requirements of Art. 44 to 48 GDPR are fulfilled or if an exception according to Art. 49 GDPR applies.

·Right of the Customer to Issue Instructions

• 3.1The Processor processes the Customer Data in accordance with the instructions of the Customer, unless the Processor is legally required to do otherwise. In the latter case, the Processor shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
• 3.2The instructions of the Customer are in principle conclusively stipulated and documented in the provisions of this Agreement. Individual instructions which deviate from the stipulations of this Agreement or which impose additional requirements shall require the Processor's consent.
• 3.3The Processor shall ensure that the Customer Data is processed in accordance with the instructions given by the Customer. If the Processor is of the opinion that an instruction given by the Customer infringes this Agreement or applicable data protection law, the Processor is after correspondingly informing the Customer entitled to suspend the execution of the instruction until the Customer confirms the instruction. The Parties agree that the sole responsibility for the processing of the Customer Data in accordance with the instructions lies with the Customer.

·Legal Responsibility of the Customer

• 4.1The Customer is solely responsible for the permissibility of the processing of the Customer Data and for safeguarding the rights of data subjects in the relationship between the Parties. Should third parties assert claims against the Processor based on the processing of Customer Data in accordance with this Agreement, the Customer shall indemnify the Processor from all such claims upon first request.
• 4.2The Customer is responsible to provide the Processor with the Customer Data in time for the rendering of services according to the Contract and the Customer is responsible for the quality of the Customer Data. The Customer shall inform the Processor immediately and completely if during the examination of the Processor's results the Customer finds errors or irregularities with regard to data protection provisions or instructions of the Customer.
• 4.3Upon request, the Customer shall provide the Processor with the information specified in Art. 30 para. 2 GDPR, insofar as it is not already available to the Processor.
• 4.4If the Processor is required to provide information to a governmental body or person on the processing of Customer Data or to cooperate with these bodies in any other way, the Customer is obliged to assist the Processor at first request in providing such information and in fulfilling other appropriate cooperation obligations.
• 5The Processor shall commit all persons engaged in processing Customer Data to confidentiality with respect to the processing of Customer Data.

·Requirements for Personnel and Systems

·Security of Processing

• 6.1The Processor takes necessary appropriate technical and organizational measures according to Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the Customer Data, as well as the different likelihood and severity of the risk to the rights and freedoms of the data subjects, in order to ensure a level of protection of Customer Data appropriate to the risk. The implemented technical and organizational measures include the measures as listed in Annex 6.1.
• 6.2The Processor shall have the right to modify technical and organizational measures during the term of this Agreement, as long as they continue to comply with the statutory requirements.

·Engagement of Further Processors

• 7.1The Customer grants the Processor the general authorization to engage further processors with regard to the processing of Customer Data. Further processors engaged at the time of conclusion of this Agreement are listed in Annex 7.2. In general, no authorization is required for contractual relationships with service providers that are concerned with the examination or maintenance of data processing procedures or systems by third parties or that involve other additional services, even if access to Customer Data cannot be excluded, as long as the Processor takes reasonable steps to protect the confidentiality of the Customer Data. In order to receive notifications with respect to adding or replacing existing subprocessors Customer may subscribe to a mailing list using to following link: tally.so/r/mVZPby. Subprocessor notifications will occur no later than 14 days prior to any changes, in order to allow for Customer to object. An objection may only be raised by the Customer for important reasons which have to be substantiated vis-à-vis the Processor. Insofar as the Customer does not object within 14 days after receipt of the notification, the Customer ́s right to object to the corresponding engagement lapses. If the Customer objects, the Processor is entitled to terminate the Contract and this Agreement with a notice period of three months until the end of a month.
• 7.2The agreement between the Processor and the further processor must impose the same obligations on the further processor as those incumbent upon the Processor under this Agreement. The Parties agree that this requirement is fulfilled if the contract has a level of protection corresponding to this Agreement.
• 7.3Subject to compliance with the requirements of Sec. 2.5 of this Agreement, the provisions of this Sec. 7 shall also apply if a further processor in a third country is involved. The Customer hereby authorises the Processor to conclude an agreement with another processor on behalf of the Customer based on the standard contractual clauses for the transfer of personal data to processors in third countries pursuant to the decision of the European Commission of June 5th 2021. The Customer declares its willingness to cooperate in fulfilling the requirements of Art. 49 GDPR to the extent necessary.

·Data Subjects' Rights

• 8.1The Processor shall support the Customer within reason by virtue of technical and organisational measures in fulfilling the Customer's obligation to respond to requests for exercising data subjects' rights.
• 8.2As far as a data subject submits a request for the exercise of its rights directly to the Processor, the Processor will forward this request to the Customer in a timely manner.
• 8.3The Processor shall inform the Customer of any information relating to the stored Customer Data, about the recipients of Customer Data to which the Processor may disclose it in accordance with the instructions and about the purpose of storage, as far as the Customer does not have this information at its disposal and as far as the Customer is not able to collect it itself.
• 8.4The Processor shall, within the bounds of what is reasonable and necessary, enable the Customer to correct, delete or restrict the further processing of Customer Data, or at the instruction of the Customer correct, block or restrict further processing itself, if and to the extent that this is impossible for the Customer. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.
• 8.5Insofar as the data subject has a right of data portability vis-à-vis the Customer in respect of the Customer Data pursuant to Art. 20 GDPR, the Processor shall support the Customer within the bounds of what is reasonable and necessary in handing over the Customer Data in a structured, commonly used and machine-readable format, if the Customer is unable to obtain the data elsewhere. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

·Notification and Support Obligations of the Processor

• 9.1Insofar as the Customer is subject to a statutory notification obligation due to a breach of the security regarding the Customer Data (in particular pursuant to Art. 33, 34 GDPR), the Processor shall inform the Customer in a timely manner of any reportable events in the Processor ́s area of responsibility. The Processor shall assist the Customer in fulfilling the notification obligations at the Processor's request to the extent reasonable and necessary. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.
• 9.2The Processor shall assist the Customer to the extent reasonable and necessary with data protection impact assessments to be carried out by the Customer and, if necessary, subsequent consultations with the supervisory authority pursuant to Art. 35, 36 GDPR. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

·Deletion and Return of Customer Data

• 10.1Upon termination of this Agreement, the Processor shall, in the discretion of the Customer, a. either delete or return the Customer Data; and b. delete existing copies thereof unless the Processor is obligated by law to further store the Customer Data.
• 10.2The Processor may keep documentations which serve as evidence of the orderly and accurate processing of Customer Data, also after the termination of this Agreement.

·Evidence and audits

• 11.1The Processor shall provide the Customer, at the Customer's request, with all information required and available to the Processor to prove compliance with its obligations under this Agreement.
• 11.2The Customer shall be entitled to audit (including inspections) the Processor with regard to compliance with the provisions of this Agreement, in particular the implementation of the technical and organisational measures.
• 11.3In order to carry out inspections in accordance with Sec. 11.2., the Customer is entitled to access the business premises of the Processor in which Customer Data is processed within the usual business hours (Mondays to Fridays from 10 am to 6 pm) after timely advance notification in accordance with Sec. 11.5 at its own expense, without disruption of the course of business and under strict secrecy of the Processor's business and trade secrets.
• 11.4The Processor is entitled, at its own discretion and taking into account the Customer's legal obligations, not to disclose information which is sensitive with regard to the Processor's business or if the Processor would be in breach of statutory or other contractual provisions as a result of its disclosure. The Customer is not entitled to get access to data or information about the Processor's other customers, cost information, quality control and contract management reports, or any other confidential data of the Processor that is not directly relevant for the agreed audit purposes.
• 11.5The Customer shall inform the Processor in good time (usually at least two weeks in advance) of all circumstances in relation to the performance of the audit. The Customer may carry out not more than one audit per calendar year.
• 11.6If the Customer commissions a third party to carry out the audit, the Customer shall obligate the third party in writing in the same way as the Customer is obliged vis-à-vis the Processor according to this Sec. 0. In addition, the Customer shall by way of written agreement obligate the third party to maintain secrecy and confidentiality unless the third party is subject to a professional obligation of secrecy. At the request of the Processor, the Customer shall immediately submit to the Processor the commitment and confidentiality agreements with the third party. The Customer may not commission any of the Processor's competitors to carry out the audit.
• 11.7At the discretion of the Processor, proof of compliance with the obligations under this Agreement may be provided, instead of an inspection, by submitting an appropriate current opinion or report from an independent authority (e.g. auditor, audit department, data protection officer, IT security department, data protection auditors or quality auditors) or a suitable certification by IT security or data protection audit (the "Audit Report"), if the Audit Report makes it possible for the Customer in an appropriate manner to convince itself of the Processor's compliance with the contractual obligations contained in this Agreement.
• 12The term and termination of this Agreement shall be governed by the term and termination provisions of the Contract. A termination of the Contract automatically results in a cancellation of this Agreement. An isolated termination of this contract is excluded.

·Contract term and termination

·Liability

• 13.1The Processor's liability under this Agreement shall be governed by the disclaimers and limitations of liability provided for in the Contract. As far as third parties assert claims against the Processor which are caused by the Customer's culpable breach of this Agreement or one of the Customer ́s obligations as the controller in terms of data protection law, the Customer shall upon first request indemnify and hold the Processor harmless from these claims.
• 13.2The Customer undertakes to indemnify the Processor upon first request against all possible fines imposed on the Processor corresponding to the Customer's part of responsibility for the infringement sanctioned by the fine.

·Final provisions

• 14.1In case individual provisions of this Agreement are ineffective or become ineffective or contain a gap, the remaining provisions shall remain unaffected. The Parties undertake to replace the ineffective provision by a legally permissible provision which comes closest to the purpose of the ineffective provision and that thereby satisfies the requirements of Art. 28 GDPR.
• 14.2In case of conflicts between this Agreement and other arrangements of the Parties, in particular the Contract, the provisions of this Agreement shall prevail.

Annex 2Annex 2.2

·Further Information on the Processing of Customer Data

Annex 6Annex 6.1

·Technical and Organizational Measures according to Art. 32 GDPR

·According to Art. 32 GDPR controller and processor of personal data must take technical and organizational measures (TOM) to ensure that the security and protection requirements of data protection are met. Technical measures are to be understood as all protection attempts that are physically implementable in the broadest sense, such as securing doors and windows or measures implemented in software and hardware, such as setting up a user account and password requirement. Organizational measures are to be understood as protection attempts that are implemented through instructions, procedures and procedures.

Annex 7Annex 7.2

·Further Processors

·Please contact us on privacy@pitch.com, should you have any questions. Version 1.0.10 (November 11, 2025)

·Version history of our Data Processing Agreement