Data Processing Agreement

under Art. 28 GDPR between the customer as controller and Georg Flossmann, trading as “leanframe”, Ickelsamerstraße 35, 81825 Munich, Germany, as processor. Version of 1 November 2026.

This English version is provided for information only. The German version is legally binding.

The customer concludes this agreement electronically by accepting the terms, on registration or on first signing in to the portal. It applies to all businesses the customer manages in leanframe.

1. Subject matter and duration

1. The subject matter is the processing of personal data by leanframe on behalf of the customer when providing the leanframe software under the terms.
2. The agreement applies as long as leanframe processes the customer’s data, i.e. until the deletion periods under section 10 have expired.

2. Nature and purpose of processing

leanframe stores and processes data in order to

• answer booking requests in the chat and in the portal and to book, reschedule and cancel appointments,
• send confirmations, reminders and notices by email,
• read, sort and answer new emails in the mailboxes connected by the customer (of the business and of individual staff members) and mark answered or completed emails there as read (can be switched off),
• at the customer’s request (can be switched off), learn from the customer’s edits to reply drafts: earlier drafts and sent replies from the same mailbox are given to the AI model as style examples; not used to train the model,
• maintain waitlists, customer lists, tasks and statistics for the customer, including messages end customers leave for the customer in the chat,
• at the customer’s instigation, send questions about a task to end customers by email, remind them once and summarise the reply in the connected mailbox,
• if the customer switches on aftercare (from the Standard plan): ask end customers once after a booking for their consent, store the consent with evidence and only email end customers who consented after the appointment to ask for a review and remind them of a follow-up appointment; apply unsubscribes immediately,
• if the customer creates questionnaires (Plus plan): ask end customers the customer's questions before the appointment (on the booking page, via a link from the confirmation and reminder, non-confidential questions also in the chat), store the answers, show them to the customer in the portal and send one reminder for an open questionnaire,
• mention offers and discounts entered by the customer in the chat and by email, check their conditions when booking and note the offer used on the appointment,
• on the customer’s instructions, transfer appointment data to addresses specified by the customer (webhooks) and provide data as a file (export); the customer is responsible for these recipients,
• sync appointments with a calendar connected by the customer (Google, Microsoft, iCloud),
• if the customer switches on “Customers in your address book” (from the Standard plan): on the customer’s instructions, write the name, phone number and email address of end customers with an appointment and a short note (“Customer of …”) to a group “leanframe” in the address book connected by the customer (Google, Microsoft, Apple iCloud), keep them up to date in one direction only and delete them there as soon as the end customer is deleted or merged in leanframe, the customer switches the feature off with “Remove contacts” or the business is closed; leanframe does not read or change the customer’s other contacts. The customer is responsible for the address book and the contract with its provider,
• resolve faults and provide support.

3. Types of data and data subjects

End customers who answer a questionnaire: their answers to the customer's questions.

Special categories of personal data (Art. 9 GDPR). For businesses in the health professions, a booking in itself may show that a treatment takes place; this information is covered by this agreement. Beyond that, leanframe processes health data only in questions that the customer explicitly marks as confidential in a questionnaire (feature available only once enabled by leanframe). For these:

1. The legal basis is the explicit consent of the end customer (Art. 9(2)(a) GDPR), which leanframe obtains on the customer's behalf: a separate box that is not pre-ticked, with a text stating which questions, the purpose (preparing the appointment with the customer), the deletion period and withdrawal. The appointment never depends on it (confidential questions cannot be required). leanframe stores the evidence (time, channel, version and wording, questionnaire version, appointment) and implements a withdrawal immediately: the answers are deleted unless the customer has marked a legal retention duty for that end customer (with a reason, admins only, logged). In that case they are no longer shown or used from the withdrawal on and are only kept, locked, until the period ends (Art. 17(3)(b), Art. 18 GDPR); the end customer is told so in the link. Whether such a duty exists is the customer's decision and responsibility.
2. The answers are stored encrypted (AES-256-GCM, separate key, bound to the customer and the answer). They are not passed to any AI model (neither the chat nor the portal assistant), not included in emails to the customer or end customer, webhooks or appointment exports. In the portal only the customer's admins and staff members granted the right by an admin can see them; every view and export is logged. Via the link the end customer does not see their confidential answers again (only that they are stored).
3. leanframe deletes them after the period set by the customer (1 month to 10 years after the end customer's last appointment with the customer, default 3 years), on withdrawal as in point 1 and immediately when the end customer is deleted.
4. The customer remains responsible for lawfulness: they only ask what they need to prepare the appointment, update their privacy policy, check whether a data protection impact assessment is required (Art. 35 GDPR) and set the deletion period according to their retention duties (e.g. the documentation duty under § 630f BGB); they keep the records themselves in their own files.

4. Instructions

1. leanframe processes the data only on documented instructions from the customer, unless required to do so by law. In that case leanframe informs the customer beforehand, unless the law prohibits this.
2. Instructions are this agreement, the terms and the settings the customer makes in the portal. The customer gives further instructions in text form.
3. If leanframe considers an instruction to be unlawful, leanframe informs the customer without delay.

5. Confidentiality

1. All persons at leanframe with access to the data are bound to confidentiality or are under a statutory obligation of confidentiality.
2. If the customer is bound by professional secrecy (e.g. a health profession under Section 203(1) of the German Criminal Code, StGB, such as physiotherapy), leanframe acts as another person involved under Section 203(3) sentence 2 StGB. leanframe hereby undertakes to keep secret all third-party secrets it learns in doing so and has been informed that unauthorised disclosure is a criminal offence under Section 203(4) StGB. leanframe only takes note of such secrets as far as necessary for the service, obliges its staff and subprocessors in text form in the same way and only uses subprocessors as far as necessary for the service.

6. Security of processing

leanframe takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. leanframe may develop them further as long as the level of protection does not decrease.

7. Sub-processors

1. The customer approves the sub-processors listed in Annex 2.
2. leanframe announces new or changed sub-processors by email at least four weeks in advance. The customer may object for an important data protection reason. If the parties cannot agree, the customer may terminate as of the date of the change.
3. leanframe contractually binds every sub-processor to the obligations of this agreement.
4. Transfers to countries outside the EEA only take place in accordance with Art. 44 et seq. GDPR, for example on the basis of an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

8. Assistance to the customer

1. leanframe assists the customer with requests from data subjects. In the portal the customer can export (access request) and delete a person’s data. If a request reaches leanframe directly, leanframe forwards it to the customer.
2. leanframe assists the customer with the obligations under Art. 32 to 36 GDPR as far as processing in leanframe is concerned.

9. Notification of breaches

leanframe notifies the customer of a personal data breach without undue delay, if possible within 48 hours of becoming aware of it. The notification contains the information under Art. 33(3) GDPR as far as known.

10. Deletion and return

1. During the term the following periods apply:
   • Chat transcripts: adjustable from 1 to 36 months after the last message, 12 months by default. After that the texts are deleted and contacts without appointments are anonymised.
   • Completed and discarded tasks: the same period after completion. Open tasks remain until completed; deleting a customer also deletes their tasks and questions. Questions are deleted together with their task.
   • Sent emails: 30 days after sending. For permanently undeliverable ones, address, type and date are kept for the sending block as long as it is set (default 90 days, 1 to 365); the content is deleted after 30 days. For customer emails about an appointment, subject, time and a checksum of the text (SHA-256) stay with the appointment until the end customer is deleted. Log of webhook deliveries: 30 days.
   • Emails from connected mailboxes with their replies and stored drafts: as for chat transcripts. The customer can delete stored drafts at any time with “Delete what it learned”. leanframe deletes a mailbox’s credentials as soon as the customer disconnects it.
   • Aftercare: evidence of a consent while it applies and for 3 years after it is withdrawn or the end customer is deleted (duty to prove consent, limitation period of possible claims); log of aftercare emails 3 years; unsubscribe links 2 years.
   • Questionnaires: confidential answers adjustable from 1 month to 10 years after the end customer's last appointment (default 3 years), other answers 1 to 120 months after the last appointment (default 24); both immediately with the end customer. Evidence of consent and the viewing log 3 years (duty of proof, limitation period).
   • Contacts from abandoned bookings without an appointment, conversation, consent or other use: anonymised after 7 days.
   • Customers and appointments: until the customer deletes them in the portal or the contract ends.
   • Contacts in the connected address book (group “leanframe”): with the end customer, when the feature is switched off with “Remove contacts” and when the business is closed (before it is deleted). If the customer chooses “Keep in address book” when switching off, they remain there under the customer’s responsibility; leanframe deletes credentials and mappings immediately.
   • These periods also apply while a business is paused or, after closing, not yet deleted.
2. After the contract ends, leanframe deletes all data according to the periods in section 7 of the terms. On request, leanframe provides the data in a common format beforehand.
3. Backups are encrypted and overwritten no later than 35 days after they are created.

11. Evidence and audits

1. leanframe provides the customer with the information necessary to demonstrate compliance.
2. The customer, or an auditor appointed by the customer and bound to confidentiality, may audit compliance after giving four weeks’ notice, during normal business hours and without disrupting operations. An on-site audit is only necessary if written information is insufficient.

12. Liability

Liability is governed by Art. 82 GDPR. Otherwise the rules of the terms apply.

13. Final provisions

1. In the event of conflict, this agreement takes precedence over the terms as far as the protection of personal data is concerned.
2. Changes must be made in text form.
3. This English version is for information only; the German version prevails.

Annexes: 1. Technical and organisational measures · 2. Sub-processors