This is a convenience translation. Only the German version is legally binding.

pursuant to Art. 28 GDPR

between the Client as controller and Tapcoat GmbH as processor

Tapcoat GmbH
Hanauer Landstraße 204
60314 Frankfurt am Main
HRB 141281, Local Court (Amtsgericht) of Frankfurt am Main
Represented by: Tim Hoh, Lutz Bischoff (Managing Directors)
Last updated: May 2026

This DPA takes effect upon acceptance in the dashboard by a person authorized to represent the controller. Annexes 1 (TOMs) and 2 (Recipients of personal data) form an integral part of this agreement.

Preamble

Tapcoat provides the controller with cloud-based cloakroom software on the basis of the General Terms and Conditions (GTC) applicable between the parties (available at tapcoat.com/en/terms-and-conditions) (the “Main Agreement”). In the course of such use, Tapcoat processes personal data on behalf of the controller. This DPA specifies the data protection obligations pursuant to Art. 28 GDPR.

§ 1 Subject matter, term and termination

(1) Subject matter of the processing is the provision of the Tapcoat platform for the digital management of cloakroom processes, including all related features (check-in, wallet pass, payment features, reporting, push notifications, branding, etc.).

(2) Term: This DPA applies for the term of the Main Agreement and ends automatically upon its termination.

(3) After termination, the provisions on data obligations set out in § 11 apply.

§ 2 Nature and purpose of the processing

(1) Nature: Collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, use, disclosure, provision, transmission, combination, restriction, erasure and destruction of personal data — in each case exclusively on the instructions of the controller.

(2) Purpose: Provision and operation of the cloakroom software, in particular:

Registering items and assigning them to a hanger location
Issuing digital cloakroom passes (Apple Wallet, Google Wallet)
Identifying guests via QR codes, NFC identifiers, external tickets or a name list
Processing payment transactions (optional, via Frisbii)
Sending push notifications and remarketing messages (optional)
Reporting and analyses for the controller

§ 3 Categories of personal data

(1) Data of the controller’s staff (managers, users):

Name, email address, phone number (optional)
Account data (password as bcrypt hash, login times, IP address, device data)
Role, permissions, assigned events
Activity logs (audit log)

(2) Data of end customers (the controller’s guests):

Identifiers (wallet pass ID, QR code, NFC tag, external ticket ID)
Optional: name, seat, email address, phone number (if collected by the controller)
Item data (hanger location, check-in time, pickup time, item type, optional photo)
For paid cloakrooms: encrypted payment tokens (via Frisbii), transaction status, amount, timestamp
Push notification tokens (if enabled)
Device and browser data from the end-customer landing page (IP address, user agent)

(3) Special categories of personal data (Art. 9 GDPR) are not intended to be processed. If the controller wishes to introduce such data, this requires a separate written agreement.

§ 4 Categories of data subjects

Staff of the controller (managers, users, cloakroom staff)
End customers (guests who use cloakroom services at the controller’s locations)
Where applicable, third-party contact persons (e.g. for lost & found)

§ 5 Obligations of the processor (Tapcoat)

(1) Bound by instructions: Tapcoat processes personal data exclusively on documented instructions from the controller. Instructions arise from this DPA, the Main Agreement and the use of the software (configuration instructions). Additional instructions must be given in text form (email is sufficient).

(2) Notice of unlawful instructions: If Tapcoat considers an instruction from the controller to be unlawful, Tapcoat will inform the controller without undue delay and may suspend its execution until the matter has been clarified.

(3) Confidentiality: Tapcoat ensures that all persons authorized to process the data have committed themselves to confidentiality or are subject to a statutory obligation of confidentiality.

(4) Security (Art. 32 GDPR): Tapcoat implements appropriate technical and organizational measures in accordance with Annex 1 (TOMs).

(5) Sub-processors: Tapcoat may engage sub-processors in accordance with § 7 and Annex 2.

(6) Assistance: Tapcoat assists the controller with requests from data subjects (Art. 12–22 GDPR), data security (Art. 32), personal data breaches (Art. 33–34) and data protection impact assessments (Art. 35–36). Services beyond the contractually agreed scope of functions may be subject to separate remuneration.

(7) Notification of data breaches: Tapcoat informs the controller without undue delay, and no later than 24 hours after becoming aware of it, of any personal data breach and provides all information the controller requires for its notification obligation under Art. 33 GDPR.

(8) Data obligations: After the end of the agreement, Tapcoat acts in accordance with § 11.

(9) Proof of compliance: Tapcoat makes available all information necessary to demonstrate compliance with Art. 28 GDPR and permits audits in accordance with § 9.

(10) Data protection officer: Tapcoat has not currently appointed a data protection officer, insofar as this is not required by law. Data protection inquiries should be sent to datenschutz@tapcoat.com.

§ 6 Obligations of the controller

(1) The controller is responsible for the lawfulness of the data processing, in particular for the legal basis, the information obligations toward guests and staff, and for obtaining any required consent.

(2) The controller ensures that uploaded data has been lawfully collected and that data subjects have been duly informed.

(3) The controller designates a data protection contact person and enters their contact details in the dashboard.

(4) The controller reviews the TOMs (Annex 1) for adequacy before concluding the agreement and is obliged to regularly monitor the processing.

§ 7 Sub-processors

(1) General authorization: The controller grants Tapcoat general authorization to engage the sub-processors listed in Annex 2 and to engage future sub-processors in accordance with the following provisions.

(2) Notice: Tapcoat informs the controller in text form at least 30 days before engaging or replacing a sub-processor.

(3) Right to object: The controller may object to the engagement of a new sub-processor for good cause within 30 days of notification.

(4) Consequences of an objection: If the parties do not reach an agreement within 30 days, either party may terminate the Main Agreement for cause with 30 days’ notice.

(5) Liability: Tapcoat concludes an equivalent DPA with each sub-processor and is liable for the sub-processor’s compliance as for its own conduct.

§ 8 Transfers to third countries

(1) As a rule, all processing takes place within the European Union. Hosting of the platform takes place in data centers in Germany (DigitalOcean FRA1, Frankfurt am Main; Hetzner, Falkenstein/Nuremberg). Sub-processors with a third-country connection are listed in Annex 2.

(2) Transfers to third countries take place only where indicated in Annex 2 and are based on appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular EU Standard Contractual Clauses, adequacy decisions, EU-US Data Privacy Framework).

§ 9 Inspection rights and audits

(1) The controller has the right to verify compliance with this DPA. Verification is primarily carried out on the basis of documents provided: the TOM annex, the list of sub-processors, certificates and written self-disclosures.

(2) Written inquiries are answered by Tapcoat within 30 business days. The controller limits inquiries to a maximum of one per calendar year, unless a specific occasion requires an additional one.

(3) On-site inspections are permitted by way of exception if there is a specific, documented reason, with at least 30 business days’ advance notice, during normal business hours and at the controller’s expense.

(4) External auditors must be bound to confidentiality in writing and must demonstrably not be competitors of Tapcoat.

§ 10 Personal data breaches

(1) Tapcoat informs the controller of any personal data breach without undue delay, and no later than 24 hours after becoming aware of it.

(2) The notification includes: a description of the breach, its likely consequences, the countermeasures taken and the contact details of the contact person at Tapcoat.

§ 11 Termination, return and deletion

(1) After termination of the Main Agreement, Tapcoat makes the data available for export in a machine-readable format for 30 days (data portability under the EU Data Act).

(2) After the 30 days have expired, Tapcoat deletes all personal data, including backup copies, unless statutory retention obligations prevent this.

(3) Statutory retention: Payment and booking data is retained for up to 10 years in accordance with § 257 HGB and § 147 AO. During this period, it is blocked and used exclusively to fulfill statutory obligations.

(4) Tapcoat confirms the deletion in text form upon request.

§ 12 Liability

(1) The liability provisions of the Main Agreement (GTC) apply accordingly.

(2) In relation to data subjects, Tapcoat and the controller are jointly and severally liable pursuant to Art. 82 GDPR. Internally, liability is determined by the respective share of fault.

§ 13 Final provisions

(1) This DPA takes effect upon acceptance in the dashboard by a person authorized to represent the controller. In the event of any conflict, this DPA takes precedence over the Main Agreement with regard to data processing on behalf of the controller.

(2) Amendments must be made in text form.

(3) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Place of jurisdiction: Frankfurt am Main.

(4) Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.

Annexes:

Data Processing Agreement (DPA)