Data Processing Agreement (DPA)
Data Processing Agreement (DPA)
Data Processing Agreement on Behalf of a Controller Pursuant to Art. 28 GDPR
Concluded between
HydroMapper GmbH
Veritaskai 6
21079 Hamburg, Germany
– as Processor (hereinafter "Contractor") –
and the Controller (hereinafter "Client").
The Client and the Contractor are hereinafter referred to individually as a "Party" and collectively as the "Parties".
Preamble
The Contractor provides services to the Client in the area of utilizing the "InfraCloud" platform as well as providing storage space in accordance with the Cloud Services Agreement (hereinafter also referred to as "SaaS Agreement" or "Main Contract"). Insofar as personal data within the meaning of the General Data Protection Regulation ("GDPR") is processed in the course of executing the SaaS Agreement, the Parties conclude the following Data Processing Agreement to fulfill the requirements of the GDPR. Separate remuneration for the performance of this agreement is not provided, unless expressly agreed otherwise. The respective Client is specified individually in the associated Main Contract or offer.
1 Subject/Scope of Commissioning
1.1 The collaboration between the Parties under the Main Contract may result in the Contractor receiving access to personal data of the Client (hereinafter "Client Data") and processing it exclusively on behalf and in accordance with the instructions of the Client within the meaning of Art. 4 No. 8 and Art. 28 GDPR. This Data Processing Agreement shall apply to this processing.
1.2 The processing of Client Data by the Contractor shall occur exclusively in the manner specified in the Cloud Services Agreement and, if applicable, additionally in Annex 1, as well as to the scope and for the purpose specified therein. The group of data subjects affected by the data processing is also detailed in the Main Contract and, if applicable, additionally in Annex 1. The duration of the processing corresponds to the term of the Main Contract.
1.3 The Contractor is prohibited from processing Client Data in any way deviating from or exceeding the specifications in the Main Contract and Annex 1. This also applies to the use of anonymized data.
1.4 The processing of Client Data shall take place exclusively within the territory of the Federal Republic of Germany, in a member state of the European Union, or in another contracting state to the Agreement on the European Economic Area. Any relocation to a third country requires the prior written consent of the Client and may only take place if the special requirements of Art. 44 to 49 GDPR are met.
1.5 The provisions of this Agreement shall apply to all activities related to the Main Contract where the Contractor, its employees, or agents commissioned by the Contractor come into contact with personal data originating from the Client or collected for the Client.
2 Authority of the Client to Issue Instructions
2.1 The Contractor shall process Client Data only within the scope of the assignment and exclusively on behalf and in accordance with the instructions of the Client within the meaning of Art. 28 GDPR (Data Processing). This applies in particular to the transfer of personal data to a third country or to an international organization. The Client has the sole right to issue instructions regarding the type, scope, and method of processing activities (hereinafter also "Right to Issue Instructions"). If the Contractor is required to carry out further processing by the law of the European Union or the member states to which it is subject, it shall notify the Client of these legal requirements prior to processing.
2.2 Instructions shall generally be issued by the Client in writing; instructions given orally must be confirmed by the Contractor in writing. The persons authorized to issue and receive instructions are defined in the individual agreement between the Contractor and the Client (e.g., offer and order). In the event of a change or long-term unavailability of the persons designated in the individual agreement, the other Party must be notified of the successor or representative in text form without delay. The Parties shall announce any change of the person authorized to issue or receive instructions in a timely manner. Until such notification is received by the Client or Contractor, the designated persons shall continue to be deemed authorized to issue or receive instructions.
2.3 If the Contractor is of the opinion that an instruction from the Client breaches data protection regulations, it must inform the Client immediately. The Contractor is entitled to suspend the execution of the respective instruction until it is confirmed or modified by the Client.
3 Protection Measures of the Contractor
3.1 The Contractor is obligated to comply with data protection regulations and not to disclose information obtained from the Client's area to third parties or permit their access. Documents and data must be secured against access by unauthorized persons, taking into account the state of the art.
3.2 Furthermore, the Contractor shall obligate all persons entrusted with the processing and fulfillment of this Agreement (hereinafter referred to as "Employees") to confidentiality in writing (obligation to confidentiality, Art. 28 (3) lit. b GDPR) and ensure compliance with this obligation with due diligence. At the Client's request, the Contractor shall provide the Client with proof of the Employees' obligation in written or electronic form.
3.3 The Contractor will design its internal organization in such a way that it meets the specific requirements of data protection. It undertakes to implement all appropriate technical and organizational measures (TOM) for the adequate protection of Client Data in accordance with Art. 32 GDPR and to maintain them for the duration of the processing of Client Data. A description of the Contractor's technical and organizational measures will be provided to the Client upon request.
3.4 The Contractor reserves the right to modify the technical and organizational measures implemented, while ensuring that the contractually agreed level of protection is not compromised.
4 Information and Support Obligations of the Contractor
4.1 In the event of disruptions, suspected data breaches or violations of the Contractor's contractual obligations, suspected security-relevant incidents, or other irregularities in the processing of Client Data by the Contractor, persons employed under the contract, or third parties, the Contractor will inform the Client immediately. The same applies to audits of the Contractor by the data protection supervisory authority. The notifications pursuant to Sec. 4 Para. 1 Sentence 1 shall contain at least the information specified in Art. 33 (3) GDPR.
4.2 In the event of Sec. 4 Para. 1, the Contractor shall assist the Client within reasonable limits in fulfilling its clarification, remedial, and information measures in this regard. In particular, the Contractor shall immediately implement the necessary measures to secure the data and mitigate potential adverse consequences for the data subjects, inform the Client of this, and request further instructions.
4.3 The Contractor undertakes to provide the Client, upon oral or written request, with all information and evidence necessary to carry out a control pursuant to Sec. 7 Para. 1 of this Agreement within a reasonable period of time.
5 Other Obligations of the Contractor
5.1 The Contractor is required to maintain a record of all categories of processing activities carried out on behalf of the Client in accordance with Art. 30 (2) GDPR. The types, purposes, and categories of processing documented in Annex 1 shall form the baseline for this record. The record shall be made available to the Client upon request.
5.2 The Contractor is obligated to assist the Client in conducting data protection impact assessments pursuant to Art. 35 GDPR and any prior consultation with the supervisory authority pursuant to Art. 36 GDPR.
5.3 The Contractor confirms that it has appointed a Data Protection Officer—insofar as there is a statutory obligation to do so—and will inform the Client of their contact details without delay. Any change in the person of the corporate Data Protection Officer/contact person for data protection must be communicated to the Client in writing without delay.
5.4 Should the Client Data at the Contractor's site be endangered by attachment or seizure, by insolvency or composition proceedings, or by other events or measures of third parties, the Contractor must inform the Client immediately, unless prohibited from doing so by a court or administrative order. In this context, the Contractor shall immediately inform all competent authorities that the decision-making authority over the data lies exclusively with the Client as the "Controller" within the meaning of the GDPR.
6 Subcontracting Relationships
6.1 The contractually agreed services or the partial services described below shall be carried out with the involvement of the subcontractors named in Annex 2. Within the scope of its contractual obligations, the Contractor is authorized to establish additional subcontracting relationships with subcontractors ("Subcontracting Relationship"). Before establishing further subcontracting relationships, the Contractor shall inform the Client in text form with a notice period of four weeks. The Client may object to the change only for good cause. The objection must be made within 14 calendar days and must explicitly state all important reasons. An important reason on the part of the Contractor exists in particular if the subcontractor does not have its registered office in a country that is a member of the EU/EEA or for which the Commission has issued an adequacy decision pursuant to Art. 45 GDPR.
6.2 A subcontracting relationship within the meaning of these provisions does not exist if the Contractor commissions third parties with services that are to be regarded as purely ancillary services. These include, for example, postal, transport, and shipping services, cleaning services, guarding services, telecommunications services without concrete connection to services provided by the Contractor for the Client, as well as other measures to ensure the confidentiality, availability, integrity, and resilience of the hardware and software of data processing systems. The Contractor's obligation to ensure compliance with data protection and data security in these cases remains unaffected.
7 Audit Rights
7.1 The Client is entitled to regularly verify compliance with the regulations of this Agreement, in particular the implementation and compliance with the technical and organizational measures pursuant to Sec. 3 Para. 3 of this Agreement. For this purpose, the Client may, for example, obtain information from the Contractor, request the presentation of existing expert opinions, certifications, or internal audits, or inspect the Contractor's technical and organizational measures in person or through a qualified third party during normal business hours, provided that the third party is not in a competitive relationship with the Contractor.
7.2 The Client shall carry out audits only to the extent necessary and shall show reasonable consideration for the Contractor's business operations. The Parties shall agree on the timing and type of inspection in good time.
7.3 The Client shall document the audit result and communicate it to the Contractor. In the event of errors or irregularities that the Client discovers, particularly when auditing processing results, it must inform the Contractor immediately. If facts are determined during the audit whose future avoidance requires changes to the ordered workflow, the Client shall notify the Contractor of the necessary changes in workflow without delay.
8 Rights of Data Subjects
8.1 The Contractor shall support the Client as far as possible with appropriate technical and organizational measures in fulfilling its obligations under Art. 12 to 22 and Art. 32 to 36 GDPR. It shall immediately provide the Client with the requested information about Client Data, unless the Contractor does not have the corresponding information itself.
8.2 If the data subject asserts their rights pursuant to Art. 16 to 18 GDPR, the Contractor is obligated to immediately correct, delete, or restrict the Client Data upon instruction from the Client. The Contractor shall provide the Client with written proof of the deletion, correction, or restriction of the data upon request.
8.3 If a data subject asserts rights, such as to information, correction, or deletion regarding their data, directly against the Contractor, the Contractor shall forward this request to the Client without delay and await its instructions. The Contractor will not contact the data subject without a corresponding specific instruction.
8.4 The Client shall compensate the Contractor for the effort incurred for the support services.
9 Term and Termination
9.1 The term of this Agreement corresponds to the term of the Main Contract. If the Main Contract can be terminated with ordinary notice, the regulations regarding ordinary termination apply accordingly. In case of doubt, termination of the Main Contract shall also be deemed termination of this Agreement, and termination of this Agreement shall be deemed termination of the Main Contract.
9.2 The Client is entitled to terminate this Agreement for good cause at any time without notice. Good cause exists if the Contractor does not comply with its obligations under this Agreement, intentionally or grossly negligently violates provisions of the GDPR, or cannot or does not want to execute an instruction from the Client. In the event of minor—i.e., neither intentional nor grossly negligent—violations, the Client shall first set a reasonable deadline for the Contractor within which the Contractor can remedy the violation. If this deadline expires fruitlessly, the Client shall then have the right to extraordinary termination.
10 Deletion and Return After End of Contract
Upon termination of the Main Contract or at any time upon its request, the Contractor shall return to the Client all documents, data, and data carriers provided to it or, at the choice of the Client, delete them completely and irrevocably, unless there is a statutory retention requirement. This also applies to duplications of Client Data at the Contractor's site, such as backups, but not to documentation serving as proof of the orderly and correct processing of Client Data. Such documentation must be retained by the Contractor for an appropriate period and handed over to the Client upon request.
11 Liability
11.1 The liability of the Parties is governed by Art. 82 GDPR. Any liability of the Contractor towards the Client for breach of obligations under this Agreement or the Main Contract remains unaffected.
11.2 The Parties shall each release themselves from liability if a Party proves that it is not responsible in any respect for the circumstance through which the damage occurred to a data subject. Sec. 11 Para. 2 Sentence 1 shall apply accordingly in the case of a fine imposed on a Party, with the release taking place to the extent that the respective other Party shares responsibility for the breach sanctioned by the fine.
12 Final Provisions
12.1 The Parties agree that the plea of right of retention by the Contractor within the meaning of Sec. 273 BGB regarding the data to be processed and the associated data carriers is excluded.
12.2 Amendments and supplements to this Agreement must be in writing. This also applies to waiving this written form requirement.
12.3 In case of doubt, the regulations of this Agreement shall take precedence over the regulations of the Main Contract. Should individual provisions of this Agreement prove to be completely or partially invalid or unenforceable, or become invalid or unenforceable as a result of changes in legislation after the conclusion of the contract, the validity of the remaining provisions shall not be affected thereby. The invalid or unenforceable provision shall be replaced by the valid and enforceable provision that comes closest to the meaning and purpose of the void provision.
12.4 This Agreement is subject to German law. The exclusive venue is Hamburg.
Annex 1 – Data Processing Specification Pursuant to Art. 28 (3) GDPR
Subject Matter and Purpose of Processing
The processing of personal data takes place within the scope of providing and using the "InfraCloud" software platform. The purpose of the processing is to enable use by authorized users, manage user access and project data, and provide technical provisioning and maintenance of the platform.
2. Categories of Data Subjects
Personal data of the following groups of data subjects are processed:
• Users of the InfraCloud platform, particularly those invited or authorized by the Client to use the platform (e.g., employees, project participants, clients, subcontractors)
• Persons identifiable in content uploaded by the Client (e.g., photos, plans, documents)
• Other data subjects according to individual use by the Client
3. Categories of Personal Data
Depending on the use by the Client, the following personal data, among others, are processed:
• Communication data (e.g., email address, optional phone number)
• Contract master data (e.g., name, company, user role)
• Usage data (e.g., login times, access rights, change histories)
• Project-related personalized data (e.g., annotations with creator details, timestamps)
• Uploaded content with potential personal reference (e.g., photos, PDF documents, plans with comments)
4. Type of Processing
Depending on the use-case scenario, processing includes the following activities:
• Collection, recording, organization, structuring
• Storage, adaptation, alteration
• Retrieval, consultation, use
• Transmission, alignment, combination
• Restriction, erasure
Further data types (only upon individual agreement): The Client may instruct the processing of additional personal data. These must be communicated in writing in advance and will be documented by the Contractor in a separate list.
5. Purpose of Processing
Processing takes place exclusively for the purpose of providing and using the InfraCloud platform, in particular:
• for project and document management,
• for assigning, tracking, and commenting on tasks,
• for communication between project participants,
• for storing and processing project-related content.
The platform serves the customer to digitize and structure project-related workflows, including the optional integration of user-specific content.
6. Duration of Processing
The duration of the processing is aligned with the term of the SaaS Agreement concluded between the Parties. Following the end of the contract, data will be deleted or anonymized in accordance with the contractually agreed deletion periods.
7. Subprocessors
Storage and technical processing of data are handled by subcontractors within the framework of subcontracting relationships in accordance with Annex 2.
8. Supplemental Processing
If types of personal data beyond the categories specified above are processed by the Client on the platform, the Contractor must be informed in writing. The supplementary data categories must be documented separately.
Annex 2 – Directory of Subprocessors Pursuant to Sec. 6 DPA
Within the meaning of Sec. 6 of the Data Processing Agreement, all subprocessors delivering privacy-relevant activities on behalf of the Contractor are listed below. All subprocessors are carefully selected and contractually bound to comply with the specifications of Art. 28 GDPR.
Currently Employed Subprocessors:
Company: Amazon Web Services EMEA SARL
Registered Office: Luxembourg
Activity under contract: The subprocessor is used to store data in the cloud. The server location is in Frankfurt (AWS Region Europe (Frankfurt), eu-central 1). All data storage occurs within the European Union.
Company: sedevo GmbH
Registered Office: Germany
Activity under contract: Operation and maintenance of the InfraCloud platform
Status: 2025-07-14
Future revisions of this Data Processing Agreement will be stored here going forward.
Cloud Services Agreement (SaaS)
Preamble
HydroMapper GmbH, Veritaskai 8, 21079 Hamburg, Germany – hereinafter referred to as "HydroMapper" or "Provider" – develops, distributes, and manages a cloud platform (hereinafter "InfraCloud" or "Software") for the digital asset management of structures. This Cloud Services Agreement governs the rights and obligations between HydroMapper and the customers of HydroMapper's SaaS services. HydroMapper provides its SaaS services exclusively on the basis of this Cloud Services Agreement.
1 Subject of the Agreement
1.1 The subject of this agreement is the provision of the InfraCloud platform for use in the customer's business via the Internet against payment and limited to the duration of the agreement, as well as the provision of storage space on the provider's servers. For this purpose, the customer receives the right to use the software for viewing and managing the visualizations of their structures as described below.
1.2 Inside InfraCloud, underwater and above-water structures can be viewed clearly and threedimensionally with information on their condition and damage. For this purpose, the status of the structures can be displayed in the form of a full-scale model (a so-called "Digital Twin") based on specific models (such as 3D models, digital orthophotos, digital landscape models) and used in particular for damage visualization and as a basis for maintenance planning. This display and use of the models utilizing InfraCloud is the subject of this contract. First, point clouds of the structures must be generated, for example, using laser scanning, 360° imaging, or photogrammetry. These can then be combined with further information such as drawings or other images. From this, a model of the structures is calculated, which can be displayed in InfraCloud. This upstream surveying and creation of point clouds are not covered by this agreement and are the subject of separate agreements.
1.3 The Provider may also grant the Customer the option to upload self-created surveys of structures that comply with InfraCloud into InfraCloud in order to process them there with the software. This requires a corresponding survey by the Customer using the quality parameters provided by HydroMapper after appropriate training. These surveys are also the subject of separate agreements.
1.4 Depending on the functionality level, various features may be available within InfraCloud. Details can be found in the current version of the InfraCloud price table (hereinafter "Price Table"). In addition, separate AI tools for InfraCloud, which are compensated based on usage, can be booked if described in the Price Table.
2 Provider's Services; Software and Storage Space
2.1 The Provider grants the Customer the use of the latest version of the software for the agreed number of authorized users via the Internet by means of access through a browser.
2.2 The Provider guarantees the functionality and availability of the software during the term of the contractual relationship and will maintain it in a condition suitable for contractual use. The range of functions of the software that can be used by the customer results from the selected tariff from the price list valid at the time the contract is concluded or from the individual agreement between HydroMapper and the customer.
2.3 The aim of InfraCloud is to provide the best possible impression of the state of preservation of the respective structure. The accuracy and quality depend significantly on the data obtained from the survey. Neither the data acquisition itself nor the technical post-processing of survey data (e.g., "post-processing" or meshing) is the subject of this contract.
2.4 The Customer may increase or reduce the number of authorized users of the software as required in accordance with the conditions specified in the price table. After completion of the contract, the Provider will immediately send access data for the corresponding number of authorized users in electronic form, or the Customer can authorize these users for the respective project themselves. If the Customer grants users access to the software to the extent permitted in Annex 1, he must also obligate them to comply with the obligations existing under this agreement and is liable to the Provider for violations by the users.
2.5 Following the conclusion of the contract, the Provider will send the Customer a user manual in electronic form. The user manual can also be viewed at any time while using the software and can be downloaded in a common format.
2.6 The Provider may, without being obliged to do so, update or further develop the software at any time and adapt it in particular due to a change in the legal situation, technical developments, or to improve IT security. In doing so, the Provider will appropriately take into account the legitimate interests of the Customer and inform the Customer in good time about necessary updates. In the event of a significant impairment of the Customer's legitimate interests, the Customer has a special right of termination.
2.7 The provider does not owe an adaptation to the individual needs or the IT environment of the customer.
2.8 The Provider will inform the Customer in good time about any restrictions associated with maintenance. Maintenance is regularly performed outside of standard business hours, unless maintenance must be carried out at another time due to compelling reasons.
2.9 The Provider shall provide the Customer with storage space on its servers in accordance with the price list or an individual offer for the purpose of storing data and using the software. The Provider will ensure that the data can be retrieved as part of the use of the software. The Customer may expand or reduce the storage space volume as required in accordance with the conditions specified in the price table or in an individual offer.
2.10 The Provider will take state-of-the-art measures to protect the data. However, the Provider has no custodial or safekeeping obligations with regard to the data. The Customer is responsible for ensuring sufficient backup of the data.
3 Scope of Use and Rights of Use
3.1 A physical transfer of the software to the customer does not take place.
3.2 The Customer receives simple, i.e., non-sublicensable and non-transferable, rights, limited in time to the duration of the contract, to use the Software in its currently valid version for viewing and managing the representation of its structures for the contractually agreed number of users, by accessing it via a browser in accordance with the terms of this contract.
3.3 The Customer may only use the software within the scope of its own business activities using its own personnel. Any further use of the software by the Customer is not permitted.
3.4 Fair Use: Excessive or abusive use of InfraCloud is not permitted. The Provider reserves the right to warn the Customer in the event of excessive or abusive use. In the event of continued excessive or abusive use, HydroMapper reserves the right to charge the Customer for the costs incurred by HydroMapper and to exclude the Customer from using InfraCloud.
4 Support
The Provider will set up a support service for Customer inquiries regarding the functions of the software. The contact details can be found in the individual customer offer. Inquiries are processed in the chronological order of their receipt.
5 Service Levels; Troubleshooting
5.1 The Provider guarantees a total availability of the platform services during its regular working hours of at least 97.5%. The minimum availability refers to the working hours from Monday to Friday from 9:00 to 17:00 CET (excluding nationwide public holidays) and is calculated on a calendar week basis. Up to four deviations from this regulation per calendar year are deemed permissible, provided that each individual downtime does not exceed two working days. Such deviations do not constitute a breach of this agreement. The assurance of total availability does not apply to the alpha and beta phases of InfraCloud.
5.2 Within the meaning of this agreement, the platform is considered available if there is an uninterrupted connection between the servers on which the software is hosted and the transfer point to the Internet, and the Client can successfully log in and access the software. Failures of the AWS infrastructure or of AWS services are not taken into account when calculating the minimum availability. The measuring instruments used by the Provider in the data center are authoritative for proving availability.
5.3 The Customer must report faults immediately to the contact details specified in the individual customer offer. Fault reports can be sent by email at any time. Telephone reports are only possible during service times – Monday to Friday from 9:00 to 17:00 CET (except for nationwide public holidays). The Provider will resolve any faults that occur as quickly as possible. Due to the different types and possible causes of faults, no flat-rate or guaranteed fault clearance times can be promised. In the event of a fault, the Provider will regularly inform the Client about the progress of the fault clearance measures. Processing of a correctly received fault report begins at the latest within four hours during service times.
6 Obligations of the Customer
6.1 The Customer must protect and store the access details transmitted to him in accordance with the state of the art against access by third parties. The Customer will ensure that use only takes place to the contractually agreed extent. Unauthorized access must be reported to the Provider immediately.
6.2 The Customer is obliged not to store any data on the provided storage space whose use violates applicable law, official orders, third-party rights, or agreements with third parties.
6.3 Before storing or using data in the software, the Customer will check it for viruses or other harmful components and use state-of-the-art measures (e.g., antivirus software) for this purpose.
6.4 The Customer is responsible for performing regular and adequate data backups.
7 Warranty
7.1 With regard to granting the use of the software and providing storage space, the warranty provisions of German tenancy law (§§ 535 et seq. BGB) apply.
7.2 The Customer must notify the Provider of any defects without delay.
7.3 The warranty for minor reductions in the suitability of the service is excluded. Strict liability (strict liability without fault) pursuant to Section 536a paragraph 1 of the German Civil Code (BGB) for defects already existing at the time of the conclusion of the contract is excluded.
8 Liability
8.1 The parties are liable without limitation in cases of intent, gross negligence, as well as for culpable injury to life, limb, or health.
8.2 Without prejudice to the cases of unlimited liability pursuant to Section 8 (1), in the event of a slightly negligent breach of duty, the Provider is only liable in the event of a breach of material contractual obligations—meaning obligations whose fulfillment enables the proper execution of the contract in the first place, or whose breach endangers the achievement of the contract purpose and on whose compliance the other party may regularly rely. However, this is limited to the predictable, contract-typical damage at the time the contract was concluded.
8.3 Compensation for consequential damages—in particular lost profits, loss of earnings, unrealized savings, or damages resulting from project delays—is excluded. Furthermore, the Provider is not liable for damages arising from third-party claims against the Customer.
8.4 The foregoing limitations of liability do not apply to liability under the German Product Liability Act (Produkthaftungsgesetz) or under warranties expressively assumed in writing by a party.
8.5 Section 8 applies accordingly for the benefit of employees, legal representatives, and vicarious agents of the parties.
9 Legal Defects; Indemnification
9.1 The Provider warrants that the software does not violate any third-party rights. The Provider will indemnify the Customer against all third-party claims arising from intellectual property right infringements for which it is responsible in connection with the contractual use of the software, and will reimburse the costs of reasonable legal enforcement. The Customer will immediately inform the Provider of any third-party claims asserted against him due to the contractual use of the software, and will grant him all necessary powers of attorney and authority to defend the claims.
9.2 The Customer warrants that the content and data stored on the Provider's servers, as well as their use and provision by the Provider, do not violate applicable law, official orders, third-party rights, or agreements with third parties. The Customer will indemnify the Provider upon first request against claims asserted by third parties due to a violation of this section. The Customer is solely responsible for the data uploaded to InfraCloud.
10 Payment and Terms of Payment
10.1 The Customer pays a usage-based fee to the Provider. The amount is based on the individually agreed offer or the price list. The first billing period begins with the agreed start of use.
10.2 The fee to be paid will be adjusted in the event of changes in the number of users or storage space volume in accordance with the conditions in the current price list.
10.3 Invoicing takes place monthly or annually, depending on the individually agreed offer. The invoice is due for payment within 14 business days.
11 Contract Duration and Termination
11.1 The contract enters into force upon explicit acceptance of the order by the Provider. The minimum contract term is specified in the respective individual agreement with the Customer. Unless a fixed term is agreed in the individual offer, the contract is automatically extended by a further contract year unless it is terminated in writing by one of the parties with a notice period of three (3) months before the end of the respective term. Deviating notice periods agreed elsewhere shall take precedence.
11.2 The right to extraordinary termination for cause remains unaffected. In all cases, termination must be made in writing.
11.3 During the contract term, the platform provides the Customer with features to download and export the data processed by them. The Customer is solely responsible for backing up their data. There is no obligation on the Provider's part to assist with the transfer back or safeguarding of the data.
11.4 The Provider will irretrievably delete all of the Customer's data remaining on its servers 30 days after the end of the contractual relationship, unless there is an explicit agreement to the contrary between the parties. The Provider has no right of retention or lien on the data.
12 Data Protection; Confidentiality
12.1 The parties will comply with the respective applicable data protection regulations.
12.2 As the user of the software, the Customer is the controller under data protection law, while HydroMapper acts solely as a processor. For this purpose, a separate Data Processing Agreement (DPA) is also concluded with this contract. The Provider will process the corresponding personal data solely in accordance with the provisions specified therein and the Customer's instructions.
12.3 The parties undertake to maintain strict confidentiality regarding all confidential information (including trade secrets) that they learn in connection with this contract and its execution, and not to disclose, pass on, or use it in any other way in relation to third parties. Confidential information refers to information that is marked as confidential or whose confidentiality arises from the circumstances, regardless of whether it has been communicated in written, electronic, embodied, or oral form. The confidentiality obligation does not apply if the disclosing party is obliged to disclose the confidential information due to a statutory obligation or a binding administrative or court order. The parties undertake to agree on a regulation identical in content to the preceding paragraph with all employees and subcontractors.
13 Final Provisions
13.1 If individual provisions of this contract are or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected. The parties will replace such provisions with valid and enforceable provisions that come as close as possible to the meaning, economic purpose, and intent of the parties when the contract was concluded. The same applies in the event of a loophole in the contract.
13.2 There are no verbal or written collateral agreements to this contract. Modifications to this contract and its annexes must be made in writing.
13.3 German law applies, excluding its conflict of laws provisions and the United Nations Convention on Contracts for the International Sale of Goods of April 11, 1980 (CISG).
13.4 The exclusive place of jurisdiction for all disputes arising from or in connection with this contract is Hamburg.
As of: 2025-07-23
Future versions of this SaaS agreement will be filed here starting now.
Cloud Services Agreement (SaaS)
Preamble
HydroMapper GmbH, Veritaskai 8, 21079 Hamburg, Germany – hereinafter referred to as "HydroMapper" or "Provider" – develops, distributes, and manages a cloud platform (hereinafter "InfraCloud" or "Software") for the digital asset management of structures. This Cloud Services Agreement governs the rights and obligations between HydroMapper and the customers of HydroMapper's SaaS services. HydroMapper provides its SaaS services exclusively on the basis of this Cloud Services Agreement.
1 Subject of the Agreement
1.1 The subject of this agreement is the provision of the InfraCloud platform for use in the customer's business via the Internet against payment and limited to the duration of the agreement, as well as the provision of storage space on the provider's servers. For this purpose, the customer receives the right to use the software for viewing and managing the visualizations of their structures as described below.
1.2 Inside InfraCloud, underwater and above-water structures can be viewed clearly and threedimensionally with information on their condition and damage. For this purpose, the status of the structures can be displayed in the form of a full-scale model (a so-called "Digital Twin") based on specific models (such as 3D models, digital orthophotos, digital landscape models) and used in particular for damage visualization and as a basis for maintenance planning. This display and use of the models utilizing InfraCloud is the subject of this contract. First, point clouds of the structures must be generated, for example, using laser scanning, 360° imaging, or photogrammetry. These can then be combined with further information such as drawings or other images. From this, a model of the structures is calculated, which can be displayed in InfraCloud. This upstream surveying and creation of point clouds are not covered by this agreement and are the subject of separate agreements.
1.3 The Provider may also grant the Customer the option to upload self-created surveys of structures that comply with InfraCloud into InfraCloud in order to process them there with the software. This requires a corresponding survey by the Customer using the quality parameters provided by HydroMapper after appropriate training. These surveys are also the subject of separate agreements.
1.4 Depending on the functionality level, various features may be available within InfraCloud. Details can be found in the current version of the InfraCloud price table (hereinafter "Price Table"). In addition, separate AI tools for InfraCloud, which are compensated based on usage, can be booked if described in the Price Table.
2 Provider's Services; Software and Storage Space
2.1 The Provider grants the Customer the use of the latest version of the software for the agreed number of authorized users via the Internet by means of access through a browser.
2.2 The Provider guarantees the functionality and availability of the software during the term of the contractual relationship and will maintain it in a condition suitable for contractual use. The range of functions of the software that can be used by the customer results from the selected tariff from the price list valid at the time the contract is concluded or from the individual agreement between HydroMapper and the customer.
2.3 The aim of InfraCloud is to provide the best possible impression of the state of preservation of the respective structure. The accuracy and quality depend significantly on the data obtained from the survey. Neither the data acquisition itself nor the technical post-processing of survey data (e.g., "post-processing" or meshing) is the subject of this contract.
2.4 The Customer may increase or reduce the number of authorized users of the software as required in accordance with the conditions specified in the price table. After completion of the contract, the Provider will immediately send access data for the corresponding number of authorized users in electronic form, or the Customer can authorize these users for the respective project themselves. If the Customer grants users access to the software to the extent permitted in Annex 1, he must also obligate them to comply with the obligations existing under this agreement and is liable to the Provider for violations by the users.
2.5 Following the conclusion of the contract, the Provider will send the Customer a user manual in electronic form. The user manual can also be viewed at any time while using the software and can be downloaded in a common format.
2.6 The Provider may, without being obliged to do so, update or further develop the software at any time and adapt it in particular due to a change in the legal situation, technical developments, or to improve IT security. In doing so, the Provider will appropriately take into account the legitimate interests of the Customer and inform the Customer in good time about necessary updates. In the event of a significant impairment of the Customer's legitimate interests, the Customer has a special right of termination.
2.7 The provider does not owe an adaptation to the individual needs or the IT environment of the customer.
2.8 The Provider will inform the Customer in good time about any restrictions associated with maintenance. Maintenance is regularly performed outside of standard business hours, unless maintenance must be carried out at another time due to compelling reasons.
2.9 The Provider shall provide the Customer with storage space on its servers in accordance with the price list or an individual offer for the purpose of storing data and using the software. The Provider will ensure that the data can be retrieved as part of the use of the software. The Customer may expand or reduce the storage space volume as required in accordance with the conditions specified in the price table or in an individual offer.
2.10 The Provider will take state-of-the-art measures to protect the data. However, the Provider has no custodial or safekeeping obligations with regard to the data. The Customer is responsible for ensuring sufficient backup of the data.
3 Scope of Use and Rights of Use
3.1 A physical transfer of the software to the customer does not take place.
3.2 The Customer receives simple, i.e., non-sublicensable and non-transferable, rights, limited in time to the duration of the contract, to use the Software in its currently valid version for viewing and managing the representation of its structures for the contractually agreed number of users, by accessing it via a browser in accordance with the terms of this contract.
3.3 The Customer may only use the software within the scope of its own business activities using its own personnel. Any further use of the software by the Customer is not permitted.
3.4 Fair Use: Excessive or abusive use of InfraCloud is not permitted. The Provider reserves the right to warn the Customer in the event of excessive or abusive use. In the event of continued excessive or abusive use, HydroMapper reserves the right to charge the Customer for the costs incurred by HydroMapper and to exclude the Customer from using InfraCloud.
4 Support
The Provider will set up a support service for Customer inquiries regarding the functions of the software. The contact details can be found in the individual customer offer. Inquiries are processed in the chronological order of their receipt.
5 Service Levels; Troubleshooting
5.1 The Provider guarantees a total availability of the platform services during its regular working hours of at least 97.5%. The minimum availability refers to the working hours from Monday to Friday from 9:00 to 17:00 CET (excluding nationwide public holidays) and is calculated on a calendar week basis. Up to four deviations from this regulation per calendar year are deemed permissible, provided that each individual downtime does not exceed two working days. Such deviations do not constitute a breach of this agreement. The assurance of total availability does not apply to the alpha and beta phases of InfraCloud.
5.2 Within the meaning of this agreement, the platform is considered available if there is an uninterrupted connection between the servers on which the software is hosted and the transfer point to the Internet, and the Client can successfully log in and access the software. Failures of the AWS infrastructure or of AWS services are not taken into account when calculating the minimum availability. The measuring instruments used by the Provider in the data center are authoritative for proving availability.
5.3 The Customer must report faults immediately to the contact details specified in the individual customer offer. Fault reports can be sent by email at any time. Telephone reports are only possible during service times – Monday to Friday from 9:00 to 17:00 CET (except for nationwide public holidays). The Provider will resolve any faults that occur as quickly as possible. Due to the different types and possible causes of faults, no flat-rate or guaranteed fault clearance times can be promised. In the event of a fault, the Provider will regularly inform the Client about the progress of the fault clearance measures. Processing of a correctly received fault report begins at the latest within four hours during service times.
6 Obligations of the Customer
6.1 The Customer must protect and store the access details transmitted to him in accordance with the state of the art against access by third parties. The Customer will ensure that use only takes place to the contractually agreed extent. Unauthorized access must be reported to the Provider immediately.
6.2 The Customer is obliged not to store any data on the provided storage space whose use violates applicable law, official orders, third-party rights, or agreements with third parties.
6.3 Before storing or using data in the software, the Customer will check it for viruses or other harmful components and use state-of-the-art measures (e.g., antivirus software) for this purpose.
6.4 The Customer is responsible for performing regular and adequate data backups.
7 Warranty
7.1 With regard to granting the use of the software and providing storage space, the warranty provisions of German tenancy law (§§ 535 et seq. BGB) apply.
7.2 The Customer must notify the Provider of any defects without delay.
7.3 The warranty for minor reductions in the suitability of the service is excluded. Strict liability (strict liability without fault) pursuant to Section 536a paragraph 1 of the German Civil Code (BGB) for defects already existing at the time of the conclusion of the contract is excluded.
8 Liability
8.1 The parties are liable without limitation in cases of intent, gross negligence, as well as for culpable injury to life, limb, or health.
8.2 Without prejudice to the cases of unlimited liability pursuant to Section 8 (1), in the event of a slightly negligent breach of duty, the Provider is only liable in the event of a breach of material contractual obligations—meaning obligations whose fulfillment enables the proper execution of the contract in the first place, or whose breach endangers the achievement of the contract purpose and on whose compliance the other party may regularly rely. However, this is limited to the predictable, contract-typical damage at the time the contract was concluded.
8.3 Compensation for consequential damages—in particular lost profits, loss of earnings, unrealized savings, or damages resulting from project delays—is excluded. Furthermore, the Provider is not liable for damages arising from third-party claims against the Customer.
8.4 The foregoing limitations of liability do not apply to liability under the German Product Liability Act (Produkthaftungsgesetz) or under warranties expressively assumed in writing by a party.
8.5 Section 8 applies accordingly for the benefit of employees, legal representatives, and vicarious agents of the parties.
9 Legal Defects; Indemnification
9.1 The Provider warrants that the software does not violate any third-party rights. The Provider will indemnify the Customer against all third-party claims arising from intellectual property right infringements for which it is responsible in connection with the contractual use of the software, and will reimburse the costs of reasonable legal enforcement. The Customer will immediately inform the Provider of any third-party claims asserted against him due to the contractual use of the software, and will grant him all necessary powers of attorney and authority to defend the claims.
9.2 The Customer warrants that the content and data stored on the Provider's servers, as well as their use and provision by the Provider, do not violate applicable law, official orders, third-party rights, or agreements with third parties. The Customer will indemnify the Provider upon first request against claims asserted by third parties due to a violation of this section. The Customer is solely responsible for the data uploaded to InfraCloud.
10 Payment and Terms of Payment
10.1 The Customer pays a usage-based fee to the Provider. The amount is based on the individually agreed offer or the price list. The first billing period begins with the agreed start of use.
10.2 The fee to be paid will be adjusted in the event of changes in the number of users or storage space volume in accordance with the conditions in the current price list.
10.3 Invoicing takes place monthly or annually, depending on the individually agreed offer. The invoice is due for payment within 14 business days.
11 Contract Duration and Termination
11.1 The contract enters into force upon explicit acceptance of the order by the Provider. The minimum contract term is specified in the respective individual agreement with the Customer. Unless a fixed term is agreed in the individual offer, the contract is automatically extended by a further contract year unless it is terminated in writing by one of the parties with a notice period of three (3) months before the end of the respective term. Deviating notice periods agreed elsewhere shall take precedence.
11.2 The right to extraordinary termination for cause remains unaffected. In all cases, termination must be made in writing.
11.3 During the contract term, the platform provides the Customer with features to download and export the data processed by them. The Customer is solely responsible for backing up their data. There is no obligation on the Provider's part to assist with the transfer back or safeguarding of the data.
11.4 The Provider will irretrievably delete all of the Customer's data remaining on its servers 30 days after the end of the contractual relationship, unless there is an explicit agreement to the contrary between the parties. The Provider has no right of retention or lien on the data.
12 Data Protection; Confidentiality
12.1 The parties will comply with the respective applicable data protection regulations.
12.2 As the user of the software, the Customer is the controller under data protection law, while HydroMapper acts solely as a processor. For this purpose, a separate Data Processing Agreement (DPA) is also concluded with this contract. The Provider will process the corresponding personal data solely in accordance with the provisions specified therein and the Customer's instructions.
12.3 The parties undertake to maintain strict confidentiality regarding all confidential information (including trade secrets) that they learn in connection with this contract and its execution, and not to disclose, pass on, or use it in any other way in relation to third parties. Confidential information refers to information that is marked as confidential or whose confidentiality arises from the circumstances, regardless of whether it has been communicated in written, electronic, embodied, or oral form. The confidentiality obligation does not apply if the disclosing party is obliged to disclose the confidential information due to a statutory obligation or a binding administrative or court order. The parties undertake to agree on a regulation identical in content to the preceding paragraph with all employees and subcontractors.
13 Final Provisions
13.1 If individual provisions of this contract are or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected. The parties will replace such provisions with valid and enforceable provisions that come as close as possible to the meaning, economic purpose, and intent of the parties when the contract was concluded. The same applies in the event of a loophole in the contract.
13.2 There are no verbal or written collateral agreements to this contract. Modifications to this contract and its annexes must be made in writing.
13.3 German law applies, excluding its conflict of laws provisions and the United Nations Convention on Contracts for the International Sale of Goods of April 11, 1980 (CISG).
13.4 The exclusive place of jurisdiction for all disputes arising from or in connection with this contract is Hamburg.
As of: 2025-07-23
Future versions of this SaaS agreement will be filed here starting now.
Clone component
Copied to clipboard
+49 40 99 99 862-00
Veritaskai 6, 21079 Hamburg, Germany
Clone component
Copied to clipboard
info@hydromapper.de
Clone component
Copied to clipboard
+49 40 99 99 862-00
Veritaskai 6, 21079 Hamburg, Germany
Clone component
Copied to clipboard
info@hydromapper.de
Clone component
Copied to clipboard
+49 40 99 99 862-00
Veritaskai 6, 21079 Hamburg, Germany
Clone component
Copied to clipboard
info@hydromapper.de