Annex: Agreement on the Confidentiality Obligations of Contributing Persons Pursuant to Section 203 StGB

1. Preamble

The purpose of these provisions is to enable the Customer to fulfil its obligation under section 203 (4) no. 1 StGB to require persons contributing to the processing to maintain confidentiality within the meaning of that provision.

2. OpenProject’s Duty of Confidentiality

(1) OpenProject undertakes towards the Customer to keep strictly confidential all information of which OpenProject becomes aware in the course of performing the contract and which, due to the Customer’s status as a professional secrecy holder, is subject to the special duty of confidentiality under section 203 StGB, i.e. not to disclose such information to any third party without the Customer’s express consent. OpenProject acknowledges that the unauthorised disclosure of such information is punishable under section 203 (4) sentence 1 StGB. When requiring its employees to maintain confidentiality, OpenProject has likewise informed them of the criminal consequences under section 203 (4) StGB.

(2) OpenProject shall ensure that information covered by the Customer’s professional secrecy is processed only to the extent necessary for the performance of the contract.

(3) OpenProject shall further ensure that such information is made available only to employees who require it for the performance of the contract and who have themselves been specifically required to maintain confidentiality.

(4) OpenProject shall also ensure that the obligations under these provisions are safeguarded by appropriate technical and organisational measures.

(5) At the Customer’s request, OpenProject shall provide evidence of the technical and organisational measures implemented, in particular the separate confidentiality obligations imposed on its employees.

3. Sub-processors

(1) Where OpenProject engages sub-processors in the provision of its services, the provisions of Clause 7.7 of the Data Processing Agreement concluded between the Parties shall apply accordingly with regard to the permissibility of engaging sub-processors.

(2) OpenProject shall disclose information to a sub-processor only after the sub-processor has been required to maintain confidentiality in the same manner as OpenProject itself. OpenProject shall provide evidence of such obligation upon request. OpenProject acknowledges that disclosure to sub-processors is also punishable under section 203 (4) no. 2 StGB unless an appropriate confidentiality obligation has been imposed in advance.

4. Duration of the Obligation

This confidentiality obligation shall apply for an unlimited period.