This is a convenience translation. Only the German version is legally binding.

Pursuant to Art. 32 GDPR | Last updated: May 2026 | Version: 2.0
Processor: Tapcoat GmbH, Hanauer Landstraße 204, 60314 Frankfurt am Main

Scope: This Annex describes the technical and organizational measures within the meaning of Art. 32 GDPR implemented at the time of signing. Tapcoat undertakes to notify the controller in writing of any material changes at least 30 days in advance.

A. Physical access control

The Tapcoat platform is operated as a cloud service on DigitalOcean (data center FRA1, Frankfurt am Main) and Hetzner (data centers in Falkenstein/Nuremberg), all located in Germany. Physical access control to the server premises is the responsibility of DigitalOcean and is documented in the DigitalOcean DPA and the SOC 2 reports. Tapcoat does not operate any server hardware of its own.

Server hardware exclusively in certified data centers of the hosting providers in Germany (DigitalOcean FRA1, Frankfurt am Main; Hetzner, Falkenstein/Nuremberg; each ISO 27001)
Tapcoat employees neither require nor have physical access to servers
Server infrastructure accessed exclusively logically via VPN and bastion host (see Section D)

B. System access control

Measures to prevent the unauthorized use of data processing systems.

B.1 Authentication methods

Login with email address and password (standard)
Magic link: passwordless login via a cryptographically signed, time-limited email link
QR login: authentication by scanning a one-time code with an already authenticated device
Two-factor authentication (2FA) for internal admin access to production systems: mandatory

B.2 Password security

Minimum password length: 8 characters
Required characters: uppercase letter, lowercase letter, number, special character (all four classes required)
Password hashing: bcrypt (adaptive, collision-resistant hash algorithm; no plaintext password stored)

B.3 Session management

Sessions are fully invalidated on the server side when the password is changed
Brute-force protection: automatic rate limiting per IP address

B.4 Transport encryption

All connections exclusively via HTTPS (TLS 1.2 enforced as a minimum, TLS 1.3 prioritized)
Wallet pass endpoints and API endpoints: identical TLS requirements

C. Data access control and authorization management

Measures to ensure that authorized persons can access only the data assigned to them.

C.1 Persons with production access

A maximum of 3–5 persons have technical access to the production database
Authorized persons: management of Tapcoat GmbH and developers at formwandler interactive / Molchkragen Media GmbH
No production access for external freelancers, IT administrators, or other third parties

C.2 Role concept and least privilege

Clearly separated roles: Dev, Admin, Support, each with different authorization levels
Principle of least privilege: each person receives only the rights required for their work
Access rights are systematically reviewed quarterly; access that is no longer required is deactivated without undue delay

C.3 Audit logging

The following access actions are logged:

Admin logins (time, identifier)
Configuration changes to system parameters
Direct database access via psql / SSH
Manual data corrections in the production database

D. Transfer control

Measures to ensure that personal data cannot be read, copied, altered, or deleted without authorization during electronic transmission.

D.1 Encryption in transit

All data transfers between client and server exclusively via TLS 1.2 / TLS 1.3 (HTTPS)
API communication between Tapcoat backend services is also encrypted
Wallet pass signing: cryptographic signature of all Apple Wallet and Google Wallet passes with Tapcoat’s own certificate

D.2 Access to certificates and credentials

Wallet pass signing certificates stored in a password-protected password manager (LastPass)
Access to production credentials restricted to a maximum of 3–5 persons
SSH access to production systems exclusively via VPN and bastion host; key-based authentication (no password authentication)

D.3 DDoS protection and network security

Cloudflare as upstream DDoS protection, CDN, and DNS provider for all Tapcoat endpoints
Rate limiting configured via Cloudflare

E. Input control

Measures to ensure that it can subsequently be determined whether and by whom data has been entered, altered, or removed.

Admin logins, configuration changes, direct database access, and manual data corrections are logged (see C.3)
Protection against SQL injection: use of parameterized queries and ORM without exception
Protection against cross-site scripting (XSS): server-side output encoding at all output points
Protection against cross-site request forgery (CSRF): CSRF token active in all form-related endpoints
Input validation at all API endpoints (server-side)

F. Job control

Measures to ensure that personal data is processed exclusively in accordance with the instructions of the controller.

Contractual commitment pursuant to Art. 28 GDPR: Tapcoat processes data exclusively within the scope of the Data Processing Agreement
Technical Client separation: no cross-Client data processing possible (see Section H)
Sub-processors: listed in full in Annex 2 of the DPA and authorized by the controller
Tapcoat employees are bound in writing to data confidentiality; the obligation to follow instructions is set out in the employment contract

G. Availability control

Measures to ensure that personal data is protected against accidental destruction or loss.

G.1 Hosting infrastructure

DigitalOcean, LLC + Hetzner Online GmbH: Backend / database — compute, managed database, object storage — FRA1 Frankfurt am Main (DigitalOcean) + Falkenstein/Nuremberg (Hetzner)
Mittwald CM Service GmbH & Co. KG: Marketing website tapcoat.com — web hosting — Espelkamp, Germany
Cloudflare, Inc.: CDN / DDoS protection — DNS, CDN, WAF, rate limiting — Frankfurt PoP (EU routing)

G.2 High availability

Application services: high-availability cluster with automatic failover in the event of failure of individual instances

G.3 Data backup

Data backup is performed via the DigitalOcean Managed Database service (automated by the provider)
Backups remain exclusively within the infrastructure of the respective hosting providers (DigitalOcean, Hetzner); no export to uncontrolled third-party systems
Encryption of data at rest: AES-256 (standard for DigitalOcean Managed Database and Hetzner)

G.4 Emergency management

A disaster recovery plan documented in writing is in place
The plan is tested in practice at least once a year

G.5 Monitoring and operations

Sentry: application performance monitoring and real-time error tracking (app + backend)
Better Stack: log management, uptime monitoring, and status pages
Oh Dear (Immutable VOF): external, independent availability monitoring of all Tapcoat endpoints
Automatic alerts in the event of server/API outages and increased error rates

H. Separation requirement (Client separation)

Measures to ensure that data collected for different purposes is processed separately.

H.1 Data separation model

Hybrid model: Enterprise Clients receive dedicated, logically isolated database instances
Standard Clients: shared database infrastructure with row-level security (RLS) applied throughout at database level — every query is automatically restricted to the Client’s own Client ID
Consistent Client ID verification in all API endpoints (enforced on the server side)
Manual code reviews with an explicit focus on correct Client ID separation for security-relevant code changes

H.2 Wallet pass uniqueness

Wallet pass IDs are based on UUIDs (generated cryptographically at random, cannot be guessed)
Unauthorized access to other Clients’ wallet passes is technically impossible due to UUID length and random distribution

I.1 Privacy by design and privacy by default

Data minimization: for new features, it is systematically reviewed whether processing the planned volume of data is necessary
Pseudonymization: used where technically reasonable and possible
Privacy by default: privacy-friendly default settings are standard; Clients do not have to actively configure any privacy settings

I.2 Deletion concept

At the Client’s request: complete anonymization or deletion of the account within 30 days; 30-day export period beforehand
Statutory retention obligations under the HGB and AO are taken into account in the system logic and do not override any deletion obligations

J. Application security

Parameterized database queries (prepared statements) are used without exception — no dynamic SQL concatenation
ORM as an additional layer of protection against direct SQL manipulation
Automated security updates for dependencies: Renovate / Dependabot / Snyk active in the CI/CD process
Additional manual review of dependency updates before deployment to the production environment
External port scan performed at the time of the soft launch (May 20, 2026)
Automated vulnerability scans for libraries and dependencies (Snyk) integrated into the development process

K. Personnel, training, and confidentiality obligation

K.1 Commitment to data confidentiality

All Tapcoat employees with data access: bound in writing to data confidentiality pursuant to Art. 28(3)(b) GDPR
All employees of formwandler interactive / Molchkragen Media GmbH with access to Tapcoat data: bound in writing
Employees of Symplion GmbH (IT administration) with administrative access to the internal IT infrastructure (email, devices), no access to production systems: bound in writing
External freelancers with data access: bound in writing

K.2 Training

Data protection training during the onboarding of every new person with data access
Event-driven training after security incidents, material platform changes, or changes in legislation

K.3 Offboarding

Documented offboarding process: all access is centrally deactivated on the last working day
Obligation to return all means of access (keys, devices, certificates) upon leaving

L. Incident response

An incident response plan documented in writing is in place (separate document)
Responsibilities during an incident (incident lead, technical lead, data protection contact) are assigned by name
Escalation paths up to the management of Tapcoat GmbH are defined
A template for notification to the competent supervisory authority pursuant to Art. 33 GDPR is available
A template for notification of data subjects pursuant to Art. 34 GDPR is available
No known personal data breach in the last 12 months (as of May 2026)

Supervision: Competent supervisory authority: Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden. Notifiable incidents are reported within 72 hours of becoming aware of them (Art. 33(1) GDPR). Where processing is carried out on behalf of a Client: the affected Client is notified without undue delay after Tapcoat becomes aware of the incident.

M. Certifications and external audits

Port scan / security audit: Performed — port scan at soft launch, May 20, 2026
Automated vulnerability scans: Active (ongoing) — Snyk / Dependabot integrated into the CI/CD process
ISO 27001: Not in place
BSI C5 / SOC 2: Not in place
Hosting providers (infrastructure): DigitalOcean: SOC 2 Type II + ISO 27001; Hetzner: ISO 27001

Tapcoat currently does not hold its own information security certification. The cloud infrastructures used are certified: DigitalOcean according to SOC 2 Type II and ISO 27001, Hetzner according to ISO 27001. These certificates can be provided as a reference upon request.

N. Summary of implemented measures

A Physical access control: Fully provided by cloud providers (DigitalOcean, Hetzner; each ISO 27001)
B System access control: Implemented: bcrypt, TLS 1.2+, internal MFA, rate limiting
C Data access control: Implemented: least privilege, quarterly review, audit log
D Transfer control: Implemented: TLS, VPN/bastion host, Cloudflare
E Input control: Implemented: logging, prepared statements, XSS/CSRF/input validation
F Job control: Implemented: DPA commitment, data confidentiality, Client separation
G Availability control: Implemented: HA cluster, backup (DigitalOcean), DR plan, monitoring
H Separation requirement: Implemented: RLS, UUID IDs, hybrid model, code reviews
I Privacy by design / default: Implemented: data minimization, pseudonymization, deletion process
J Application security: Implemented: ORM, prepared statements, dependency scans
K Personnel and training: Implemented: commitments, onboarding, offboarding
L Incident response: Implemented: plan, templates, responsibilities, escalation
M Certifications: Infrastructure certificates in place (DigitalOcean); own certification not in place

O. Effectiveness and updates

This TOMs description forms part of the Data Processing Agreement and takes effect upon its signing. Tapcoat updates this Annex in the event of material changes to the security measures. The controller will be informed in writing; a new version will be provided. The date of the current version is noted in the document header.

Version 1.0 — May 2026 — Initial version
Version 2.0 — May 2026 — Planning notes removed; implemented measures only; classic Art. 32 structure A–M

Annex 1 to the DPA — Technical and Organizational Measures (TOMs)