PROTOCOL DPS-WEB-2026 · REV 4.2
Researchers: L. Vogt M. Keller
Home / Safety & Compliance Protocol
Document DPS-BIO-SAFE-2026 · Rev. 3.1

Bioethics & safety protocol

Formal terms, data-handling procedures, and compliance signatures for DevPulseSystems, 10435 Choriner Str. 44 Berlin, Germany. Support: [email protected].

Effective: 01 September 2026

Review cycle: Semi-annual

Custodian: A. Roth

ID

Controller identification

Entity: DevPulseSystems

Registered address: 10435 Choriner Str. 44, Berlin, Germany

Support email: [email protected]

Phone: +49 152 83019284

Activity: Web development & software engineering services

Supervisory reference: Berliner Beauftragte für Datenschutz und Informationsfreiheit

P

Section 1 · GDPR

Privacy Policy

DevPulseSystems (“we”, “us”), controller for the processing described below, is committed to protecting personal data in accordance with Regulation (EU) 2016/679 (GDPR) and, where applicable, the California Consumer Privacy Act as amended by the CPRA (“CCPA”).

1.1 Categories of data we process

  • Identity & contact data — name, business email, phone number, organization, postal address you submit via our contact requisition form or by email.
  • Project data — technical requirements, budget band, timelines, and files you choose to share for scoping.
  • Contract & billing data — company details, invoice history, and payment status required for accounting under German commercial and tax law.
  • Technical data — IP address, browser type, device identifiers, and pages viewed, collected through essential server logs and, only with consent, analytics cookies.

1.2 Purposes and legal bases (GDPR Art. 6)

  • Art. 6(1)(b) — contract: responding to inquiries, preparing quotations, delivering contracted development work, and supporting deliverables.
  • Art. 6(1)(c) — legal obligation: retaining invoices and accounting records for the periods required by German §147 AO and §257 HGB (typically 6–10 years).
  • Art. 6(1)(f) — legitimate interests: securing our services, preventing abuse, improving site reliability, and managing B2B client relationships — balanced against your rights.
  • Art. 6(1)(a) — consent: non-essential cookies and optional marketing communications; withdrawable at any time without affecting prior processing.

1.3 Recipients and processors

Data is shared only with vetted processors under GDPR Art. 28 data-processing agreements: our EU-hosted infrastructure provider, transactional email delivery service, Stripe Payments Europe, Ltd. for payment processing, and professional advisers (tax, legal) bound by confidentiality. We do not sell personal information and do not engage in automated decision-making or profiling that produces legal effects.

1.4 International transfers

Primary storage is within the European Economic Area. Where a tool involves a transfer to a third country, we rely on EU Standard Contractual Clauses and supplementary technical measures, or on an adequacy decision where one exists.

1.5 Retention

  • Inquiry records: up to 24 months after the last meaningful contact.
  • Contracts and invoices: statutory retention (generally 6–10 years).
  • Server logs: routinely rotated within 90 days unless needed for security investigation.

1.6 Your rights

You may request access, rectification, erasure, restriction, and portability of your data; object to processing based on legitimate interests; and withdraw consent at any time. You may lodge a complaint with a supervisory authority — in Berlin: the Berlin Commissioner for Data Protection and Freedom of Information. To exercise any right, email [email protected]. We respond within one month as required by GDPR Art. 12(3).

1.7 CCPA / CPRA notice (California residents)

If you are a California resident, you have the right to know which personal information we collect, the categories and specific pieces of information, the business purposes for collection, and the categories of third parties with whom it is shared; to request deletion; to correct inaccurate information; and to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising your rights. Requests may be submitted to [email protected] and will be verified before processing.

T

Section 2 · Formal terms

Terms of Service

These Terms govern services provided by DevPulseSystems, 10435 Choriner Str. 44 Berlin, Germany, to its clients. Where a signed Statement of Work (SOW) or master agreement exists, that document prevails in case of conflict. Governing law is the law of the Federal Republic of Germany; the place of jurisdiction for merchants is Berlin, subject to mandatory consumer protections.

2.1 Scope and formation

A contract is formed when we accept a written order confirmation or when performance begins after your written approval of a quotation. Public website content (including service pricing shown on our pages) is an invitation to inquire, not a binding offer; final scope, price, and schedule are confirmed in the order confirmation.

2.2 Services, cooperation, and delivery

  • We deliver web application development, data pipeline, integration, performance, and related engineering services with professional care per the agreed SOW.
  • You will provide timely access, content, credentials, and decision feedback. Delays on your side may shift milestones proportionally.
  • Unless stated otherwise, prices are in USD (or EUR where noted), exclusive of VAT where applicable, and payable 50% on kickoff and 50% on acceptance, or as otherwise agreed.
  • Payment is due within 14 days of invoice without set-off unless mandatory law provides otherwise. Late payments may accrue statutory default interest.

2.3 Acceptance and change control

Deliverables are deemed accepted upon written confirmation or, if you do not raise material non-conformity within 10 business days of handover. Change requests outside the agreed scope are estimated separately and proceed only after written approval.

2.4 Intellectual property

Upon full payment, all intellectual property rights in client-specific deliverables (custom code, designs, documentation created for you) transfer to you. We retain rights in pre-existing tools, frameworks, libraries, know-how, and generic components, which are perpetually licensed to you as necessary to use the deliverables. Third-party open-source components remain under their respective licenses.

2.5 Warranties and liability

We warrant that services are performed with the skill of a competent web development professional. For commercial clients, statutory warranty claims under §§ 634 ff. BGB apply with the agreed defect notification window; we are entitled to cure by repair or replacement. To the fullest extent permitted by law: we are not liable for indirect or consequential damages; total liability is limited to the fees paid for the affected engagement in the prior 12 months; nothing limits liability for intent, gross negligence, injury to life/body, fraud, or mandatory statutory liability (e.g. under the Product Liability Act).

2.6 Confidentiality and data security

Each party shall keep the other’s confidential information secret for the term and 3 years after, except where disclosure is required by law. We apply industry-standard security controls — encryption in transit, least-privilege access, and encrypted backups — consistent with the measures described in our Privacy Policy.

2.7 Termination

Either party may terminate for material breach with 14 days’ written cure period. Retainers may be cancelled with 30 days’ notice at the end of a billing month. On termination you pay for work performed up to the effective date; we provide paid-at-handover work product as per § 2.4.

2.8 Service levels

Active maintenance retainers include a 99.9% monthly uptime target for monitored production systems under our management and a best-effort 2-business-hour response window for standard tickets, 24/7 escalation for critical incidents as defined in the SOW. Credits, if any, are as stated in the SOW.

C

Section 3 · Storage register

Cookie Policy

This site uses cookies and similar local storage technologies. Under the German Telecommunications-Telemedia Data Protection Act (TTDSG) § 25 and the ePrivacy framework, we require consent for non-essential technologies; essential technologies needed to deliver the page you request are exempt.

3.1 Technologies we use

Name Type Purpose Duration
cookie_accepted Local storage (essential) Remembers that you dismissed the cookie notice on this device. Until cleared
session_* / _csrf First-party cookie (essential) Maintains secure sessions and protects form submissions against cross-site request forgery. Session
_ga / analytics IDs Third-party cookie (optional) Aggregate traffic statistics — only set after you opt in via the consent notice. Up to 13 months

3.2 Managing your preferences

You can block or delete cookies through your browser settings at any time. Blocking essential storage may prevent the site from remembering your preferences. Withdrawing consent for optional cookies can be done by clearing site data for devpulsesystems.com and reloading the page — the consent notice will reappear.

3.3 Embedded content

Our contact page embeds a Google Maps frame (maps.google.com). Loading that frame may cause Google to receive technical data such as your IP address under Google’s own privacy rules. You can still use all other site features without interacting with the map.

R

Section 4 · Settlement

Refund Policy

DevPulseSystems sells custom engineering services and, occasionally, prepaid maintenance retainers. The following terms apply to payments made through our invoicing system or the secure Stripe payment link, and supplement any mandatory consumer withdrawal rights.

4.1 Custom development projects

  • Kickoff deposit (up to 50%): non-refundable once work has begun, as it reserves engineering capacity and covers scoping already performed.
  • Milestone payments: refundable only to the extent that the related milestone has not yet been performed.
  • Cancellation by you: you pay for all work completed through the cancellation date; unused prepaid fees for unperformed future milestones are returned within 14 business days to the original payment method.
  • Cancellation by us: if we terminate without cause or for reasons not attributable to you, all unused prepaid amounts are refunded in full.

4.2 Fixed-price packages

If you cancel before any work has started, you receive a full refund minus any non-recoverable third-party costs already incurred (e.g. domain or license fees purchased for your project).

4.3 Maintenance retainers

Monthly retainers may be cancelled with 30 days’ written notice effective at the end of the current billing month. The current month is non-refundable once the service window has opened. Annual prepay is refundable on a pro-rata basis for whole unused months if you cancel within the first 30 days.

4.4 Statutory right of withdrawal (EU consumers)

Where you act as a consumer and the contract was concluded at a distance, you have a 14-day right of withdrawal under §§ 312g, 355 BGB. For services, if you request performance to begin within the withdrawal period, you owe a proportionate amount for services already rendered. The withdrawal right does not apply to fully performed services begun with your express prior consent and acknowledgment of waiver, or to sealed audio/video/software where the seal has been broken.

4.5 Defective deliverables

If a deliverable is materially non-conforming, we will cure within a reasonable period under § 2.3 of our Terms. If cure fails, statutory warranty remedies apply; a corresponding refund or price reduction may be claimed in accordance with §§ 634 ff. BGB. Report defects promptly to [email protected] with reproduction steps.

4.6 How to request a refund

Email [email protected] with your invoice number, sample/contract reference, and a short description. Approved refunds are issued to the original payment method within 14 business days. Chargebacks filed without contacting us first may delay resolution while we investigate.

✓

Control checklist

Ethics & safety compliance — verified

  • ✓ Lawful purpose only — no surveillance products, spam systems, or deceptive interfaces.
  • ✓ Data minimization enforced at every intake form and API surface.
  • ✓ Accessibility target WCAG 2.1 AA on delivered public interfaces.
  • ✓ Secure SDLC: dependency scanning, secret hygiene, and code review gates.
  • ✓ Incident response path documented; client notified within 24 h of a confirmed breach affecting their data.
  • ✓ Subprocessor list reviewed semi-annually under Art. 28 GDPR.
ISO

Compliance sign-off

ISO-aligned control signatures

ISO 27001 CONTROLS MAPPED GDPR ART. 32 TTDSG § 25

Prepared by · Engineering

Dr. Lena Vogt

Lead Systems Engineer · ISO 27001 lead auditor (internal)

Signed: 01 Sep 2026

Reviewed by · Compliance

Markus Keller

Quality & Compliance Officer · CIPP/E

Signed: 01 Sep 2026

Authorized by · Management

Anja Roth

Managing Director · DevPulseSystems

Signed: 01 Sep 2026

Doc checksum: DPS-SAFE-2026-09-A7F3 · Page 1 of 1