Pulse
Data Processing Agreement (DPA)
pursuant to Art. 28 General Data Protection Regulation (GDPR) · Last updated: 23 October 2026 · Version 2026-10-23
The German version (/avv) is authoritative. This English version is provided for convenience.
This agreement governs the processing of personal data by the operator of Pulse on behalf of its customers. It applies to every user of Pulse who uses Pulse to manage their business and enters personal data of their own clients, business partners or staff — and supplements the Terms of Service.
The user of Pulse whose details (company or name, address, accepting person) are captured in Pulse when this agreement is accepted and recorded in the acceptance log.
Sebastian Kistner (Pulse)
Schaafweide 1, 76467 Bietigheim, Germany
Email: support@pulse-business.app
1. Subject matter, duration and precedence
(1) The Provider makes the web application Pulse available to the Customer as a cloud service (hosting, storage and processing of the data entered by the Customer). The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
(2) Processing lasts for as long as the Customer uses a Pulse account. The agreement ends when the user relationship ends (termination or deletion of the account) and once the obligations under section 12 have been fulfilled.
(3) In the event of a conflict between this agreement and the Terms of Service, this agreement prevails as far as the processing of personal data is concerned.
2. Instructions
(1) The Provider processes personal data only on the Customer's documented instructions — including with regard to transfers to a third country — unless required to do otherwise by Union or Member State law. In that case, the Provider informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) This agreement and the settings made and functions triggered by the Customer in Pulse count as instructions. This includes in particular the organisation's AI mode (“Off”, “Only on demand”, “Automatic”): the Provider sends data to the AI provider named in Annex 3 only within the selected mode. The Customer gives individual instructions in text form (email to support@pulse-business.app).
(3) The Provider will inform the Customer without undue delay if it believes that an instruction infringes data protection law. It may suspend carrying out the instruction until the Customer confirms or amends it.
3. Customer's obligations and responsibility
(1) The Customer is the controller within the meaning of the GDPR. The Customer is responsible for ensuring that the processing of the data it enters is lawful (in particular that a legal basis exists) and that it meets its information obligations towards data subjects.
(2) Pulse is not designed for the processing of special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). The Customer does not enter such data unless the Provider has agreed in advance in text form.
(3) The Customer chooses its organisation's AI mode on its own responsibility and checks whether sending the data concerned to the AI is compatible with its obligations towards its own clients.
(4) On request, the Customer names a contact person for data protection matters.
4. Confidentiality
The Provider undertakes, and obliges all persons authorised to process data on its behalf, to maintain confidentiality unless they are already subject to an appropriate statutory duty of confidentiality. This obligation continues after this agreement ends.
5. Technical and organisational measures
(1) The Provider implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).
(2) The measures are adapted to the state of the art. Alternative measures are permitted if they do not fall below the level of protection. The Provider documents material changes and makes them available to the Customer on request.
6. Sub-processors
(1) The Customer gives the Provider general authorisation to use the sub-processors named in Annex 3.
(2) The Provider informs the Customer in text form at least 30 days in advance of any intended changes (adding or replacing sub-processors) — by email to the address stored in the account and/or a notice in Pulse. The Customer may object within 14 days on an important data protection ground. Without an objection the change is deemed approved. If the parties cannot agree after a justified objection, the Customer may terminate the user relationship extraordinarily with effect from the date the change takes effect.
(3) The Provider concludes a contract with each sub-processor that imposes essentially the same data protection obligations as this agreement, and remains liable to the Customer for their compliance.
7. Transfers to third countries
(1) Processing outside the European Union or the European Economic Area takes place only if the special requirements of Art. 44 et seq. GDPR are met — in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards (Art. 46 GDPR), such as the EU Standard Contractual Clauses.
(2) The third-country connections named in Annex 3 and the safeguards used for each are deemed approved by the Customer.
8. Assistance with data subject rights
(1) The Provider assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Customer can view, correct, delete and export the data stored in Pulse itself.
(2) If a data subject contacts the Provider directly, the Provider forwards the request to the Customer without undue delay and does not respond itself unless legally required to.
9. Further assistance
Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in complying with Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessment, prior consultation with the supervisory authority).
10. Notification of personal data breaches
(1) If the Provider becomes aware of a personal data breach in connection with the processing for the Customer, it notifies the Customer without undue delay and at the latest within 48 hours after becoming aware, at the email address stored in the account.
(2) The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken and proposed. The Provider supplies missing information without undue delay.
11. Audit rights and evidence
(1) The Provider makes available to the Customer the information necessary to demonstrate compliance with this agreement. This includes in particular this agreement with its annexes and the documentation of backup and restore tests, which the Provider provides on request.
(2) The Customer may verify compliance with this agreement through audits — including inspections — or have them carried out by an auditor bound to confidentiality. They must be announced with reasonable notice (as a rule 14 days), take place during normal business hours, must not disrupt operations disproportionately and are in principle limited to once a year, except for a specific reason (e.g. a data breach).
(3) Audits of sub-processors are carried out on the basis of their certifications, audit reports and contractual commitments; there is no access to the sub-processors' data centres.
12. Deletion and return after the end of the agreement
(1) After the user relationship ends, the Provider deletes the personal data processed for the Customer unless a statutory duty to retain it exists. Before the end of the agreement the Customer can export its data in Pulse (return).
(2) If the Customer deletes its account in Pulse, the business data and the backup copies created by Pulse are deleted immediately. Backups of the sub-processors expire automatically after their retention period; until then they are not used for other purposes.
(3) The Customer's statutory retention obligations (e.g. for invoices) remain unaffected; fulfilling them — for example by exporting data before deletion — is the Customer's responsibility.
13. Liability
Liability is governed by Art. 82 GDPR and the liability provisions of the Provider's Terms of Service.
14. Final provisions, acceptance and changes
(1) This agreement is concluded when an owner or administrator of the Customer accepts it in Pulse under “Settings → Data processing agreement (DPA)”. Electronic acceptance satisfies the text form requirement. As evidence, the Provider stores the time, account or organisation, the name of the accepting person, the Customer's company and address, the language, and the version and checksum of the accepted agreement text.
(2) The Provider may adapt this agreement where necessary because of a change in the law, changes to sub-processors (section 6) or changes to the technical and organisational measures and where this does not unreasonably disadvantage the Customer. It informs the Customer with reasonable notice; for material changes it asks for renewed acceptance in Pulse.
(3) The law of the Federal Republic of Germany applies. If individual provisions are invalid, the validity of the remaining provisions is not affected.
Annex 1 — Subject matter of the processing
Nature and purpose of the processing
Provision, operation and protection of the Pulse application for the Customer: storing and retrieving the data entered, calculating and presenting it (e.g. invoices, quotes, financial overviews), creating and restoring backup copies, authentication and permission management of users, and sending account emails (confirmation, password reset, invitations).
On the Customer's instruction (AI mode, section 2(2)): AI-assisted processing of the data needed for the respective function by the AI provider named in Annex 3.
On the Customer's instruction (Opportunity Radar): evaluation and temporary storage of the enquiries, tenders and job ads that the Customer pastes in or sends to their personal forwarding address (text only, no attachments; unprocessed messages for 30 days at most) and – where the Customer triggers it – their AI-assisted assessment and reply preparation by the AI provider named in Annex 3.
Categories of data subjects
- Clients, prospects and business partners of the Customer and their contact persons
- Persons named in the Customer's projects, invoices, quotes, contracts, appointments, documents or notes
- Employees, team members and persons commissioned by the Customer (user accounts)
- Persons named in enquiries, tenders and job ads that the Customer pastes in or forwards (e.g. contact persons of prospective clients)
Types of personal data
- Master data: name, company, address, email address, phone number, tax or VAT identification number
- Contract, invoice and payment data: contents of quotes, invoices, contracts and reminders, amounts, payment status, and the Customer's bank details on invoices
- Project, time and appointment details, notes, documents and project files including their contents, as entered by the Customer
- User accounts: name, email address, role, sign-in and technical usage data (e.g. IP address in server logs), audit log entries
- Opportunity Radar: the Customer's search profile (skills, minimum rate, regions, languages, availability), saved opportunities with notes and drafts and – pasted in or sent to the forwarding address – sender, subject and text of enquiries and emails (no attachments)
Special categories
Not intended (see section 3(2)).
Duration
See section 1(2) and section 12.
Annex 2 — Technical and organisational measures (Art. 32 GDPR)
1. Confidentiality
- Physical access control: the Provider does not operate its own data centres. The application runs with the sub-processors named in Annex 3; physical access control is the responsibility of those providers.
- Access control (systems): sign-in with email and password or via Google, Apple or Microsoft (Supabase Auth); sessions use signed tokens; the Provider accesses the production systems only through the providers' management consoles and only the Provider itself does so.
- Access control (data): only members of an organisation can access that organisation's data — enforced by database rules (row-level security), not just in the interface. Within an organisation, role-based permissions apply (owner, administrator, accountant, employee, viewer; adjustable permission matrix). Team management, backups and acceptance of this agreement are restricted server-side to owners and administrators; plan and billing fields are protected against manipulation by a database trigger.
- Separation: the data of different customers is held logically separated in the same database (tenant separation per organisation).
- Encryption: transmission only encrypted (TLS, HSTS, strict security headers); according to Supabase, all customer data is encrypted at rest with AES-256. Secret keys (e.g. the AI access and the database service key) are kept exclusively server-side and never in the browser.
2. Integrity
- Transfer control: data is transmitted only via TLS; AI requests go through a server-side proxy that only accepts requests from signed-in users; the AI mode “Off” is enforced server-side.
- Input control: audit log in the application (who performed which action and when, e.g. creating and deleting records, permission changes, changes to the AI mode, restoring a backup).
3. Availability and resilience
- Backup concept: Pulse automatically creates backup copies per organisation — once a day when there are changes and before larger deletions — and keeps them for up to 30 days. Each backup carries a checksum (SHA-256).
- Recoverability: owners and administrators can restore a backup themselves in the settings and verify the backups; before every restore the current state is backed up. The procedure is documented in an operations manual; the backup and restore function is covered by automated tests.
- Further measures of the sub-processors (infrastructure, database backups according to their respective scope of service) apply in addition.
- The application works offline: changes are cached locally and synchronised after a connection loss.
- Abuse and overload protection: server-side daily limit per user for AI requests.
4. Review, assessment and data protection by design
- Data protection by default: the AI sends data only on demand by default; the Customer can switch it off. Reach measurement is cookieless and anonymous; error and usage statistics contain no personal data or business data.
- Changes to the database, permissions and backups are checked with automated tests (including tests against a real PostgreSQL database).
- Control of processing: sub-processors are bound by contract (data processing agreements, EU Standard Contractual Clauses); instructions are documented in text form.
- Notification process for personal data breaches under section 10.
Annex 3 — Sub-processors
The following sub-processors are used at the time of this version:
| Sub-processor | Service | Data processed | Location / safeguard |
|---|---|---|---|
| Supabase (contracting entity: Supabase Pte. Ltd., Singapore) | Database, authentication, edge functions (including the AI proxy, team management, account deletion), sending of account emails | All data entered in Pulse under Annex 1, including backup copies; user accounts | Processing in the region chosen by the Provider with the vendor (details on request); further sub-processors of Supabase according to its current list; EU Standard Contractual Clauses in Supabase's data processing agreement |
| Vercel Inc., USA | Hosting and delivery of the web application; anonymous, cookieless reach measurement (Vercel Web Analytics) | Technical access data (IP address, browser, operating system, time, requested address); no data from the Pulse database | USA; data processing agreement with EU Standard Contractual Clauses (where applicable additionally the EU-U.S. Data Privacy Framework) |
| Anthropic (Claude API) | AI features — only if the Customer's AI mode is not “Off” and an AI feature is triggered (mode “Only on demand”) or called automatically (mode “Automatic”) | The data needed for the respective function: the user's input plus, for example, key figures, client and project names, amounts, contents of quotes, invoices and contracts; for the Opportunity Radar, the search terms, the text of an enquiry pasted in by the Customer (or the retrieved content of a link they name) and their short profile (profession, skills, minimum rate, region, languages) – no client or invoice data | USA and, where applicable, further locations of Anthropic and its service providers; Anthropic Data Processing Addendum with EU Standard Contractual Clauses. Retention according to Anthropic: automatic deletion of inputs and outputs after 30 days at the latest (as of July 2026); longer only for content flagged by safety systems (up to 2 years, classification scores up to 7 years) or under a legal obligation. No model training on API data (default). Pulse itself does not store AI requests or responses. |
| Mailgun (Mailgun Technologies, Inc., USA; Sinch group) — optional; used only after notice under section 6(2) | Email intake of the Opportunity Radar: receiving the emails that the Customer sends to their personal forwarding address and handing them over to the database | Sender, subject and text of the forwarded emails (attachments are discarded) and the recipient address | Processing in the provider's EU region where available; provider's data processing agreement with EU Standard Contractual Clauses. Until notice is given under section 6(2), the email intake is not operated. |
Not sub-processors within the meaning of this agreement
- Paddle (Merchant of Record) processes payments as an independent controller; no client or project data of the Customer (Annex 1) is transmitted to Paddle.
- GitHub (optional project file sync): the transfer takes place at the Customer's initiative directly between the Customer's browser and GitHub; the access token stays exclusively in the browser. Pulse servers receive neither the token nor these file contents.
- Google, Apple, Microsoft (optional sign-in): independent controllers for the sign-in; only basic profile data (name, email) is transmitted.
- Public sources of the Opportunity Radar (TED, We Work Remotely, Remotive and career pages on Greenhouse and Lever): Pulse retrieves these public listings server-side; only search terms and country codes are transmitted, no personal data of the Customer or its clients. freelance.de is not retrieved automatically.
Acceptance
By accepting in Pulse (Settings → Data processing agreement (DPA)), this agreement becomes effective between the Customer and the Provider. The time of acceptance, account, accepting person and the checksum of this text are stored as evidence.