Welcoma

Data Processing Agreement (DPA)

Pursuant to Article 28 of the General Data Protection Regulation (GDPR)

Last updated: September 2026

This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions, subscription agreement, order, or other agreement (“Agreement”) between the customer using Welcoma.app (“Customer”) and:

webAufstieg GmbH
Anton-Huber-Straße 20
73430 Aalen
Germany
Commercial Register: Amtsgericht Ulm, HRB 732541
VAT ID: DE294961679
Email: info@welcoma.app

(“Welcoma”, “we”, “us”, or “Processor”).

This DPA applies where Welcoma processes Personal Data on behalf of the Customer in connection with the Welcoma services.

1. Scope and Purpose

Welcoma provides website accessibility-related software and services, including accessibility tools, website scanning and analysis, reporting, configuration, integrations, translation and AI-supported functionality.

Where the use of these services involves the processing of Personal Data on behalf of the Customer, the Customer acts as the Controller and webAufstieg GmbH acts as the Processor within the meaning of the GDPR.

This DPA governs such processing.

Welcoma may separately act as an independent Controller for Personal Data that it processes for its own legitimate business purposes, such as customer account administration, invoicing, payment records, fraud prevention, security, legal compliance, and direct communication with the Customer. Such processing is governed by the Welcoma Privacy Policy and is outside the scope of this DPA.

2. Subject Matter and Duration of Processing

The subject matter of the processing is the provision, operation, maintenance, support, security, and improvement of the Welcoma services purchased or activated by the Customer.

Processing will continue for the duration of the Customer’s use of the relevant Welcoma services and, where necessary, for a limited period thereafter in accordance with this DPA, applicable law, and legitimate retention requirements.

3. Nature and Purpose of Processing

Depending on the Welcoma functionality used by the Customer, processing may include:

  • receiving and transmitting data;
  • storing data;
  • organizing and structuring data;
  • retrieving and accessing data;
  • analyzing website pages and content;
  • performing accessibility scans;
  • generating accessibility-related reports and findings;
  • providing accessibility widget functionality;
  • processing website URLs and technical information;
  • providing AI-assisted or translation functionality;
  • providing technical support;
  • detecting errors and security incidents;
  • maintaining service logs; and
  • deleting or otherwise restricting data when required.

Welcoma will process Personal Data only as necessary to provide the services and in accordance with the Customer’s documented instructions.

4. Categories of Personal Data

Depending on how the Customer configures and uses Welcoma, Personal Data processed on behalf of the Customer may include:

  • names and contact information contained within submitted or scanned website content;
  • website URLs and page content;
  • information contained in publicly accessible website pages;
  • technical identifiers;
  • IP addresses, where technically necessary and processed by the relevant functionality;
  • browser and device information;
  • server and technical log information;
  • accessibility configuration or preference information;
  • information submitted through integrations;
  • scan-related data and metadata;
  • support information submitted by the Customer; and
  • other Personal Data contained in information intentionally submitted to the service by the Customer.

The exact categories of Personal Data depend on the Customer’s website, configuration, integrations, and use of Welcoma.

5. Categories of Data Subjects

Data Subjects may include, depending on the Customer’s use of the services:

  • Customer employees and authorized users;
  • website administrators;
  • Customer representatives;
  • website visitors;
  • customers or prospective customers of the Customer;
  • users of websites operated by the Customer; and
  • individuals whose Personal Data appears within content processed through Welcoma.

6. Special Categories of Personal Data

Welcoma is not designed specifically for the processing of special categories of Personal Data under Article 9 GDPR or Personal Data relating to criminal convictions and offences under Article 10 GDPR.

The Customer should not intentionally submit such information to Welcoma unless the processing is necessary for the Customer’s use of the services and the Customer has established an appropriate legal basis and safeguards under applicable data protection law.

7. Customer Instructions

Welcoma will process Personal Data only on documented instructions from the Customer unless processing is required by applicable European Union or Member State law.

The Customer’s documented instructions include:

  • the Agreement;
  • this DPA;
  • configuration of the Welcoma services;
  • features enabled by the Customer;
  • data submitted through the service;
  • documented requests submitted through Welcoma support; and
  • other written instructions agreed between the parties.

If Welcoma reasonably believes that an instruction infringes applicable data protection law, Welcoma will inform the Customer unless prohibited by law.

8. Obligations of the Customer

The Customer is responsible for ensuring that:

  1. Personal Data is collected and processed lawfully;
  2. the Customer has an appropriate legal basis for the processing;
  3. Data Subjects receive all notices required by applicable law;
  4. instructions given to Welcoma comply with applicable data protection laws;
  5. the Customer does not instruct Welcoma to process Personal Data unlawfully;
  6. the Customer appropriately configures its website and Welcoma services; and
  7. only Personal Data necessary for the intended purpose is submitted to Welcoma.

The Customer remains responsible for determining the purposes and means of processing as Controller.

9. Confidentiality

Welcoma ensures that persons authorized to process Personal Data:

  • are subject to appropriate confidentiality obligations;
  • access Personal Data only where necessary for their duties; and
  • receive appropriate instructions regarding data protection and information security.

Access to Personal Data is limited according to the principle of least privilege.

10. Technical and Organizational Measures

Welcoma maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, or other unlawful processing.

Measures may include, as appropriate to the relevant service and risk:

  • access controls and authorization management;
  • role-based or need-to-know access;
  • secure authentication mechanisms;
  • encryption of data during transmission using appropriate transport encryption;
  • secure infrastructure and hosting configurations;
  • regular software and security updates;
  • vulnerability and security management;
  • protection against unauthorized system access;
  • logging and monitoring of relevant system activities;
  • backup and recovery measures;
  • procedures for handling security incidents;
  • employee confidentiality requirements;
  • data minimization;
  • procedures for deleting Personal Data;
  • separation of production and development access where appropriate; and
  • regular review of security measures.

Welcoma may update its technical and organizational measures to reflect technological developments, provided that the overall level of protection is not materially reduced. Additional information is provided in Annex II – Technical and Organizational Measures below.

11. Subprocessors

The Customer grants Welcoma general authorization to engage subprocessors where necessary to provide the services.

Welcoma will ensure that subprocessors processing Personal Data on behalf of the Customer are subject to contractual data protection obligations providing a level of protection consistent with this DPA and applicable data protection law.

Welcoma remains responsible for the performance of its subprocessors in accordance with Article 28 GDPR.

Subprocessors may be used for services such as:

  • infrastructure and hosting;
  • email delivery;
  • artificial intelligence processing;
  • translation functionality;
  • security;
  • technical monitoring;
  • customer support; and
  • other technical infrastructure required to operate Welcoma.

Timme Hosting GmbH & Co. KG

Hosting, server infrastructure and/or email/SMTP infrastructure.

OpenAI

AI-powered functionality where such functionality is used within Welcoma.

Google / Gemini

AI-powered and/or translation functionality where such functionality is used within Welcoma.

Welcoma may add or replace subprocessors where necessary. Where required by Article 28 GDPR, Welcoma will provide the Customer with reasonable advance notice of material changes to subprocessors, allowing the Customer to object on reasonable data protection grounds. If the parties cannot reasonably resolve a valid objection, the Customer may discontinue the affected functionality or terminate the affected service in accordance with the Agreement.

12. International Data Transfers

Welcoma will ensure that Personal Data transferred outside the European Economic Area (“EEA”) is transferred only where an appropriate legal mechanism under applicable data protection law is available.

Depending on the relevant recipient and processing location, such safeguards may include:

  • an adequacy decision adopted by the European Commission;
  • the European Commission’s Standard Contractual Clauses;
  • another legally recognized transfer mechanism; or
  • another appropriate safeguard permitted under Chapter V of the GDPR.

Where Standard Contractual Clauses are required, the applicable clauses may be incorporated into the contractual relationship between the parties or between Welcoma and the relevant subprocessor. Welcoma will take additional safeguards where reasonably necessary to maintain an appropriate level of protection.

13. Data Subject Requests

Taking into account the nature of the processing, Welcoma will provide reasonable assistance to the Customer through appropriate technical and organizational measures to enable the Customer to respond to requests from Data Subjects exercising their rights under the GDPR.

These rights may include:

  • access;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability;
  • objection; and
  • other rights available under applicable data protection law.

If Welcoma receives a request directly from a Data Subject relating to Personal Data processed solely on behalf of the Customer, Welcoma may direct the Data Subject to the Customer unless otherwise required by law.

14. Assistance with GDPR Compliance

Taking into account the nature of the processing and the information available to Welcoma, Welcoma will provide reasonable assistance to the Customer regarding its obligations under Articles 32 to 36 GDPR, including where applicable:

  • security of processing;
  • Personal Data Breach assessment and notification;
  • data protection impact assessments; and
  • consultations with supervisory authorities.

15. Personal Data Breaches

If Welcoma becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer, Welcoma will notify the Customer without undue delay.

The notification will, to the extent information is reasonably available, include relevant information regarding:

  • the nature of the incident;
  • the categories of affected Personal Data;
  • the categories of affected Data Subjects;
  • the likely consequences of the incident; and
  • measures taken or proposed to address and mitigate the incident.

Providing such notification does not constitute an admission of fault or liability by Welcoma. The Customer is responsible for determining whether notification to a supervisory authority or affected Data Subjects is legally required.

16. Deletion and Return of Personal Data

Upon termination of the relevant services or deletion of the Customer account, Welcoma will delete or return Personal Data processed on behalf of the Customer, at the Customer’s choice where technically and legally applicable, unless applicable law requires continued storage.

Welcoma’s operational records, scan registrations, and associated account-related processing data are deleted in accordance with Welcoma’s applicable deletion procedures when the Customer account is deleted, subject to information that must be retained for legal, accounting, security, or compliance purposes.

Personal Data contained in temporary backups or technically necessary backup systems may remain for a limited period until overwritten or deleted through normal backup lifecycle procedures, during which time it will remain protected and will not be used for other purposes.

17. Audit and Compliance Information

Welcoma will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

Where reasonably necessary, the Customer may conduct an audit itself or through an independent auditor subject to:

  • reasonable prior written notice;
  • appropriate confidentiality obligations;
  • avoidance of unreasonable disruption to Welcoma’s operations;
  • compliance with Welcoma’s security requirements; and
  • reasonable limitations necessary to protect information relating to other customers.

Where available, Welcoma may satisfy audit requests by providing relevant security documentation, certifications, audit reports, questionnaires, or other appropriate evidence before permitting an on-site inspection. Audits must be proportionate to the nature and risk of the processing.

18. Cooperation with Supervisory Authorities

Welcoma will cooperate with competent data protection supervisory authorities where required by applicable law and will provide reasonable assistance to the Customer in relation to regulatory inquiries concerning processing carried out by Welcoma on the Customer’s behalf.

19. Changes to Processing

Welcoma may modify its services, infrastructure, technical measures, or subprocessors over time. Any modification affecting processing under this DPA will continue to comply with applicable data protection law and will not materially reduce the overall level of protection afforded to Personal Data.

20. Order of Precedence

If there is a conflict between this DPA and another provision of the Agreement concerning the processing of Personal Data, this DPA will prevail to the extent of that conflict with respect to data protection matters. The remainder of the Agreement remains unaffected.

21. Liability

Liability arising under this DPA is subject to the liability provisions of the Agreement between the Customer and Welcoma, to the extent permitted by applicable law. Nothing in this DPA limits rights or liabilities that cannot legally be limited under the GDPR or other applicable law.

22. Term and Termination

This DPA becomes effective when the Customer enters into an Agreement with Welcoma that incorporates or refers to this DPA and remains effective for as long as Welcoma processes Personal Data on behalf of the Customer. Data protection obligations that by their nature must continue after termination will remain effective for as long as Welcoma retains Personal Data covered by this DPA.

23. Contact

Questions relating to this DPA or the processing of Personal Data may be directed to:

webAufstieg GmbH
Anton-Huber-Straße 20
73430 Aalen
Germany
Email: info@welcoma.app
Website: welcoma.app

Annex I – Details of Processing

Controller

The Welcoma customer identified in the applicable account, order, subscription, or Agreement.

Processor

webAufstieg GmbH, Anton-Huber-Straße 20, 73430 Aalen, Germany.

Subject Matter

Processing of Personal Data necessary to provide Welcoma’s accessibility, scanning, reporting, widget, AI, translation, support, and related services.

Duration

For the duration of the Customer’s use of the relevant services and any limited retention period required for deletion, backup, security, or legal compliance.

Nature of Processing

Collection, receipt, transmission, organization, storage, retrieval, consultation, analysis, scanning, automated processing, generation of accessibility-related results, support, restriction, and deletion.

Purpose

Provision, operation, security, maintenance, support, and improvement of the Welcoma services requested by the Customer.

Data Subjects

  • Customer personnel;
  • Customer administrators;
  • Customer representatives;
  • website users and visitors;
  • Customer customers and prospective customers; and
  • individuals whose Personal Data appears within content processed by the service.

Personal Data

  • contact information;
  • website content;
  • URLs;
  • technical identifiers;
  • IP addresses where applicable;
  • browser/device information;
  • log information;
  • accessibility-related settings;
  • scan metadata;
  • support information; and
  • other Personal Data submitted through the service.

Annex II – Technical and Organizational Measures

Access Control

Access to Personal Data is restricted to authorized personnel who require access for legitimate operational purposes.

Authentication and Authorization

Administrative and technical access is protected through appropriate authentication and authorization controls.

Confidentiality

Personnel with access to Personal Data are subject to confidentiality obligations.

Transmission Security

Appropriate encryption protocols are used to protect Personal Data during transmission over public networks.

System Security

Systems and applications are maintained through appropriate security updates, configuration management, access restrictions, and security practices.

Data Minimization

Processing is limited to Personal Data reasonably necessary to provide the requested services.

Logging and Monitoring

Relevant technical and administrative activities may be logged and monitored for security, diagnostics, fraud prevention, and service reliability.

Incident Management

Welcoma maintains procedures for identifying, assessing, responding to, and documenting security incidents.

Availability and Recovery

Appropriate infrastructure, recovery, and backup measures are used where necessary to maintain the availability and resilience of the services.

Data Deletion

Procedures are maintained for deleting Personal Data when it is no longer required or when deletion is required following termination of the Customer’s account.

Vendor Management

Third-party processors are selected with consideration for appropriate data protection and security measures and are contractually bound to applicable data protection obligations.

Annex III – Subprocessors

Timme Hosting GmbH & Co. KG

Service: Hosting, technical infrastructure and/or email/SMTP services.

OpenAI

Service: Artificial intelligence processing used for applicable AI-powered functionality.

Google / Gemini

Service: Artificial intelligence and/or translation processing used for applicable functionality.

Additional infrastructure, security, communications, or technical service providers may be used where necessary. All subprocessors processing Personal Data on behalf of Welcoma are subject to appropriate contractual data protection requirements.

Electronic Acceptance

This DPA may be concluded electronically and does not require a handwritten signature where the Customer has accepted an Agreement, subscription, order, or Welcoma terms that incorporate this DPA.

Customers requiring a separately executed copy of the DPA may contact: info@welcoma.app