Data Processing Agreement (DPA)

Completed version – Kibo AI GmbH as data processor

---

Parties to the Agreement

between

– hereinafter referred to as the „Controller“ –

and

Kibo AI GmbH
Laufertorgraben 2
90489 Nuremberg
– hereinafter referred to as the „Processor“ –

– jointly referred to as the „Parties“ – the following is agreed.

---

Appendix 1 – List of commissioned services and contact details

Subject Matter of Processing

Provision, operation, and maintenance (upkeep, updates, technical support) of the web-based SaaS platform Claritava for implementing the EU Pay Transparency Directive (2023/970) and the German Pay Transparency Act. The Client uses the platform to carry out pay equity analyses, job evaluations using the Hay method, and to fulfil its statutory and internal reporting obligations.

Nature and Purpose of Processing

Nature of processing:

• Collection through the transmission/upload of data sets (in particular salary and employee data) by the Client into the Contractor's platform
• Storing, organizing, structuring, and merging the data sets within the platform
• Evaluating and analyzing the data based on the requirements of the Pay Transparency Directive as well as any additional criteria specified by the Client (comparison of pay grades, departments, genders, hierarchy levels)
• Creation of evaluations, reports, dashboards, and key metrics (statistics, aggregations, comparative analyses)
• Anonymization in accordance with § 5 of this Agreement
• Access by employees of the Contractor solely to the extent necessary to provide the contractually owed services (support, error analysis, maintenance)

Purpose of processing:

• Review and assurance of compliance with EU Pay Transparency Directive 2023/970
• Conducting internal pay equity and pay structure analyses for the client
• Preparation of evidence and documentation for supervisory authorities or internal bodies (works council)
• Use of platform features for sustainable management and monitoring of compensation structures

Categories of personal data

Insofar as transmitted to the platform by the client:

• Master data: First name, last name, employee ID or internal identifiers, and where applicable year of birth, gender
• Employee data: Job title, function, department, organizational unit, start date, employment scope (full-time/part-time), hierarchy level (L1–L8, EX-1), location
• Compensation data: Base salary, variable compensation components (bonuses, commissions), allowances, benefits in kind, shares/equity, benefits, historical compensation data
• Contract and organizational data: Type of employment relationship, full-time/part-time status, and where applicable information on absences

Special categories of personal data within the meaning of Art. 9 GDPR are, as a rule, not to be transmitted by the client.

Categories of data subjects

• Active employees of the client
• Where applicable, former employees (retrospective analyses)
• Where applicable, interns, working students, apprentices, temporary workers

Duration of processing

For the duration of the main agreement between the parties (Claritava SaaS usage agreement). After termination of the agreement: deletion or return in accordance with § 10 of this agreement within 30 days.

Data Protection Officer

Controller (client side):
The controller has not appointed a data protection officer.

Processor (Kibo AI GmbH):
The processor has not appointed a data protection officer.
(Contact for data protection inquiries: datenschutz@kibo-ai.com – placeholder, please set up)

---

Appendix 2 – List of engaged subprocessors

Subprocessor	Address	Processing location	Description of processing
Google Cloud EMEA Limited	70 Sir John Rogerson's Quay, Dublin 2, Ireland	Google Cloud Region europe-west3, Frankfurt am Main, Germany	Cloud hosting (Cloud Run), database operation (Cloud SQL PostgreSQL), storage of all customer data, automatic encrypted backups
Anthropic, LLC	548 Market St, PMB 90375, San Francisco, CA 94104, USA	USA (processing on Anthropic servers)	AI-powered generation of job descriptions and compliance recommendations. Note: Only non-personal data is transmitted (job title, level, department name). No employee or compensation data. Legal basis: Art. 46 GDPR (Standard Contractual Clauses / DPA with Anthropic)
HR4You AG (planned, upon activation of the integration)	Stadttor 1, 40219 Düsseldorf, Germany	Germany	HR data sync: Transmission of employee master and compensation data for automatic data reconciliation. Certified under ISO/IEC 27001 + 27701. (3-week advance notice pursuant to § 7 will be provided separately)

Note on Anthropic / third country transfer: Kibo AI GmbH activates the „Zero Data Retention“ (ZDR) option with Anthropic, ensuring that no transmitted data is used for training purposes. The conclusion of Standard Contractual Clauses (SCCs) with Anthropic is documented.

---

Anhang 3 – Technische und organisatorische Maßnahmen (TOM)

A. Zutrittskontrolle – Serverräume

A1.0: Ja – personenbezogene Daten werden auf Servern gespeichert.

A1.1 Serverstandort: Google Cloud Platform, Region europe-west3, Rechenzentrumsstandort Frankfurt am Main, Deutschland.

A1.2 Mehrere Standorte: Ja – automatische Backups ebenfalls in Region europe-west3 (georedundant innerhalb Frankfurt).

A1.4 Einheitliche Maßnahmen: Ja – alle Standorte unter Google Cloud Infrastruktur mit einheitlichen Sicherheitsmaßnahmen.

Physische Zutrittskontrolle: Liegt vollständig bei Google Cloud (ISO 27001 zertifiziert, SOC 2 Type II). Google-Rechenzentren sind mit biometrischer Zugangskontrolle, 24/7-Videoüberwachung, Mehrfaktor-Authentifizierung und Sicherheitspersonal gesichert.

---

B. Zugangskontrolle (IT-Systeme)

Maßnahme	Umsetzung
Authentifizierung	JWT-Token (RS256), OAuth 2.0 (Google Login), Session-Timeout 24h
Passwort-Policy	Passwörter werden mit bcrypt (Cost Factor 12) gehasht gespeichert (Implementation through go-live)
Multi-Factor Authentication	Via Google OAuth (when the customer uses Google login); native MFA planned
Admin Access	Only 2 people (development team) have direct database access
Remote Access	Exclusively via encrypted connection (GCP IAP / VPN)

---

C. Access Control (Permissions)

Role	Data Access	Scope
ADMIN (Customer Side)	All data of the respective tenant	Read + Write + Configuration
HR	All employee data of the tenant	Read + Write
MANAGER	Own department	Read + limited write access (merit proposals)
USER	Own personnel data	Read only
Kibo AI Support	Only with documented customer authorization, logged	Technical Support

Tenant separation: Strict TenantId filtering at the database level for every query. Cross-tenant data access is technically impossible.

---

D. Disclosure Control / Transmission Security

Maßnahme	Umsetzung
Encryption in Transit	HTTPS / TLS 1.2+ (enforced via Cloud Run, HSTS)
Encryption at Rest	AES-256 (Google Cloud SQL Managed Encryption)
API File Export	CSV export available exclusively via authenticated API endpoints
Third-Country Transfers	Anthropic API (USA) only – exclusively non-personal data; SCCs in place

---

E. Availability Control

Maßnahme	Umsetzung
Uptime SLA	Google Cloud Run: 99.9%
Autoscaling	Cloud Run automatic scaling
Database Backups	Automatic daily backups (Cloud SQL, 7-day retention)
Recovery Time	RTO < 4h, RPO < 24h
Monitoring	GCP Cloud Monitoring + Alerting

---

F. Separation Control

• Strict logical tenant separation at the database level (TenantId on every table)
• Production, testing, and development environments are kept separate
• Anonymized benchmark data is stored in a separate table (no joins with personnel data)

---

G. Data Processing Control

• All employees with data access are bound by confidentiality obligations
• Subprocessors are documented in Appendix 2
• Data breaches are reported without delay (internally within 24 hours at the latest); the data controller is notified within 48 hours