FAQ: Update of the Data Processing Agreement (DPA)

Why did I receive an email about updating my DPA?

We have updated our Data Processing Agreement (Auftragsverarbeitungsvertrag / DPA) to reflect changes in our sub-processor landscape and to ensure continued GDPR compliance. The DPA is the legal foundation for processing personal data within ContractHero on your behalf. To keep your compliance documentation up to date, we ask you to review and sign the updated DPA via our Self-Service portal.

What has changed in the new DPA?

The core contract terms (§1–§12) and the technical and organizational measures (Anlage 3 / TOM) remain unchanged. The update primarily concerns Anlage 4 – Sub-processors:

New sub-processors added:

• Modal Labs Inc. – Scalable compute & AI infrastructure (Server location: EU)
• Qdrant Solutions GmbH – Vector database platform (Server location: EU)

Server location updates:

• Amazon Web Services (AWS): Clarified from "Frankfurt am Main, Germany" to "EU"
• Twilio Inc.: Updated from "USA" to "EU"
• Crisp IM: Updated from "FR" to "EU"

All other sub-processors remain the same.

Why was this update necessary?

As our platform evolves, we occasionally add or change the third-party services (sub-processors) we work with. Under GDPR (Art. 28), we are required to keep you informed about which sub-processors handle personal data on your behalf and to update the DPA accordingly. This ensures your compliance documentation stays current for internal or external audits (e.g., data protection, ISO 27001).

Are these new changes, or the same ones from a few months ago?

This is the latest version of our DPA as of February 2026. If you signed a previous version recently, please review the updated sub-processor list above to see if any changes are relevant for your records. We recommend signing the current version to ensure your documentation is fully up to date.

Can I get a version with tracked changes (redline)?

A formal redlined document is not available through the Self-Service portal. However, the summary above covers all material changes. The contract clauses (§1–§12) and the technical and organizational measures (Anlage 3) are identical to the previous version — only the sub-processor list (Anlage 4) has been updated.

Our company requires multiple signatures (joint representation). Is that possible?

Yes. The Self-Service portal includes a second, optional signature block. If your company requires two signatures due to joint representation rules (e.g., two managing directors must sign jointly), the second authorized signatory can sign the DPA via the same link using the additional signature field. The second field is optional — if only one signature is required, it can simply be left blank.

Can the DPA notification emails be sent to a different address (e.g., our legal department)?

The notification was sent to the email address associated with your ContractHero account. If you would like future communications to be directed to a different address (e.g., legal@yourcompany.com), please let our support team know at support@contracthero.com and we will update your contact preferences.

What do I need to do now?

1. Click the link in the email you received (or log in to your ContractHero account)
2. Review the updated DPA in the Self-Service portal
3. Have an authorized person sign the DPA electronically
4. Done — your compliance documentation is now up to date

Where is my data hosted?

ContractHero's primary infrastructure runs on Amazon Web Services (AWS) within the EU (Frankfurt am Main). All sub-processors processing personal data operate within the EU are bound by appropriate safeguards (Standard Contractual Clauses) in accordance with GDPR requirements.

Can I download the DPA as a PDF?

Yes, there are two ways to download the DPA from PandaDoc:

Before signing: When you open the DPA in PandaDoc, you will first be asked to fill in a short form with your email address, first name, and last name. After completing these fields, click "Weitere Aktionen" (Further actions) and then select "Herunterladen" (Download) to save a copy of the DPA as a PDF.

After signing: Once you have completed the form fields and clicked "Abschließen" (Complete), PandaDoc will display a confirmation message: "Streichen Sie es von Ihrer Liste, indem Sie jetzt ein signiertes PDF herunterladen." Simply click on the green text to download your signed PDF copy of the DPA.

Who can I contact if I have further questions?

Please reach out to our support team at support@contracthero.com or via the chat on our website. We are happy to help.

Updated on: 03/11/2026