Data Processing Agreement

> For whom is this relevant? > This DPA is for organisations (e.g. nurseries, schools, companies) that use Bedtime Stories for third parties and are therefore data controllers under GDPR. Private individuals acting for their own family do not need a DPA.

1. Subject Matter and Duration

Richtfest Tech UG (haftungsbeschränkt) ("Processor") processes personal data on behalf of the customer ("Controller") for the purpose of providing the Bedtime Stories service in accordance with the concluded Service Agreement (AGB). The duration of this DPA corresponds to the duration of the Service Agreement.

2. Nature, Purpose and Scope of Processing

| Criterion | Details | |---|---| | Nature | Storage, retrieval, processing, transmission, deletion of personal data | | Purpose | Provision of AI-generated bedtime stories, text-to-speech, library, community functions | | Data types | E-mail addresses, first names, child profiles (first name, age, preferences), generated stories, audio files | | Data subjects | Users (adults), children (profiles managed by adults) |

3. Obligations of the Processor

Richtfest Tech UG undertakes to:

• Process personal data exclusively on the documented instructions of the Controller
• Ensure that authorised persons are bound to confidentiality
• Implement and maintain the technical and organisational measures in Annex 1
• Notify the Controller within 72 hours of becoming aware of a personal data breach
• Support the Controller in responding to data subject requests
• Delete or return all personal data at the end of the contract, at the Controller's choice

4. Sub-Processors

The Controller grants general authorisation for the use of the following sub-processors. We will notify the Controller of any intended changes (addition or replacement) allowing an opportunity to object.

| Sub-Processor | Location | Purpose | Transfer mechanism | |---|---|---|---| | HostEurope GmbH | Germany | Hosting | EU | | OpenAI, Inc. | USA | AI generation | SCCs | | ElevenLabs, Inc. | USA | TTS | SCCs | | Inworld AI, Inc. | USA | TTS | SCCs | | Stripe, Inc. | Ireland (EU) | Payment | EU |

Annex 1 — Technical and Organisational Measures (TOMs)

Access control

Server infrastructure at HostEurope with ISO-27001-certified data centres. No direct physical access by Richtfest Tech UG employees.

Access control (logical)

All data in transit encrypted with TLS 1.2+. Passwords stored using bcrypt. Sanctum token-based API authentication.

Availability / backups

Regular automated backups through HostEurope. Monitoring of service availability.

Data minimisation

Only the minimum data required is collected. No tracking, no advertising profiling.