Contract information

General terms and conditions (draft)

1. Provider and scope

The provider of the “projectxy” software is ProjectXY, Leipziger str. 22, 04109 Leipzig. The offer is aimed exclusively at businesses within the meaning of § 14 BGB (German Civil Code).

2. Service

projectxy is a web-based application for creating quotes, invoices and credit notes, managing payments, reminders and receipts, and preparatory bookkeeping. The application does not replace tax advice and does not prepare tax returns. The customer remains responsible for the accuracy of their documents.

3. Access, packages and duration

Use requires activation of the company account by the operator. Until activation and after expiry or suspension of access, the account is in read-only mode (viewing and exporting remain possible). The operator defines the scope (package), extensions and any time limit at activation; a fee is charged only if separately agreed. There is no entitlement to activation. Access

4. Obligations of the customer

The customer keeps their credentials secret, uses the application only for lawful purposes and ensures that they are entitled to process the personal data they enter.

5. Availability and backup

The provider strives for high availability; maintenance windows are announced where possible. The provider creates regular backups. The customer is expected to additionally back up their data regularly via the export functions.

6. Liability

[PLACEHOLDER – Liability clause (after legal review)]

7. End of contract and data

After the end of the contract the customer can export their data for 90 Tage export; afterwards it is deleted unless statutory obligations prevent this.

8. Final provisions

German law applies. The place of jurisdiction is Leipzig.

Data processing agreement pursuant to Art. 28 GDPR (draft)

Between the customer (controller) and ProjectXY (processor).

1. Subject matter and duration

The processor processes personal data on behalf of the controller to provide the projectxy application for the duration of the usage agreement.

2. Nature and purpose of processing, data categories, data subjects

Storage, display, calculation, PDF generation and sending of documents. Categories: contact and business data of customers, suppliers and employees of the controller, invoice and payment data, uploaded receipts. Data subjects: customers, suppliers, contact persons and employees of the controller. If the controller uses rota and time tracking, additionally employee data: master data, rotas, working times with a correction log, leave and absences including sick days without diagnosis (special category under Art. 9 GDPR). The legal basis for processing by the controller is the employment relationship (§ 26 BDSG, Art. 88 GDPR); informing the employees is the controller's responsibility. If the controller uses personnel documents, additionally: employment contracts, written statements, certificates, warnings, dismissals and references generated from them as well as uploaded signed copies. Like all deleted data, deleted documents remain in the recycle bin for 90 days; the controller is responsible for observing retention periods for personnel records. If the controller uses route planning, additionally: addresses and coordinates of delivery locations, time windows, the times of the drivers' status reports (without location data – there is no continuous GPS tracking) as well as photos, signatures and names of recipients as proof of delivery.

3. Instructions

Processing takes place exclusively on the documented instructions of the controller; use of the application counts as an instruction.

4. Technical and organisational measures

Encrypted transmission, access control with roles and optional two-factor sign-in, logical separation of company accounts, logging, regular backups, server hardening. [PLACEHOLDER – Technical and organisational measures (annex or reference)]

5. Sub-processors

[PLACEHOLDER – Sub-processors (hosting, e-mail delivery, each with location)]. Additionally for route planning: MapTiler AG, Zurich (Switzerland; adequacy decision of the EU Commission) for map and address search, and HeiGIT gGmbH, Heidelberg (Germany) for driving times and distances (openrouteservice). For receipt recognition, if the controller switches it on: Anthropic PBC, San Francisco (USA; EU Commission standard contractual clauses, contracting party for the EEA Anthropic Ireland Limited, Dublin) for reading incoming invoices; storage there for at most 30 days, no training with the data. Changes are communicated to the controller, who may object.

6. Assistance, breach notification, deletion

The processor assists with data subject requests, reports personal data breaches without undue delay and deletes or returns the data after the end of the contract.

7. Audit rights

The controller may verify compliance with this agreement; the processor provides the information required for this.

By registering and using the application, this data processing agreement is concluded in the published version. Version 5 · As of 19/10/2026 (draft)