Data Processing Agreement (DPA)

This agreement on commissioned data processing (Vereinbarung zur Auftragsverarbeitung, AVV) under Art. 28 GDPR applies to all features of Datenmassiv AI. Annex 2 lists the subprocessors with the purpose and location of processing, Annex 3 the technical and organizational measures.

The agreement is concluded in the platform, and only in its German version: the owner of an organization accepts it on behalf of the organization under Settings → Data processing (Einstellungen → Auftragsverarbeitung) and receives a copy of the contract with the contracting parties and proof of acceptance as a PDF. This page offers no acceptance.

Download the German version as a PDF

Version 2026-10-v4 of 20 October 2026

1. Subject matter and term

1. DATENMASSIV GmbH, Zeitblomstraße 31/2, 89073 Ulm (hereinafter the "Provider", Anbieter), processes personal data on behalf of the customer (hereinafter the "Customer", Kunde) when providing the Datenmassiv AI platform. This agreement governs the rights and obligations of the parties under Art. 28 of the General Data Protection Regulation (GDPR, German: Datenschutz-Grundverordnung, DSGVO) for all features of the platform. It supplements the Provider's General Terms and Conditions (Allgemeine Geschäftsbedingungen) (hereinafter the "Main Agreement", Hauptvertrag).
2. This agreement applies for the term of the Main Agreement and beyond for as long as the Provider processes Customer data, in particular until deletion under Section 12 has been completed. This agreement cannot be terminated separately.

2. Nature, purpose and scope of processing

The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. The Provider processes Customer data solely to provide the agreed services. It does not use Customer data to train AI models or for its own purposes. Under their terms for the use of their interfaces, the AI model providers used do not use inputs to train their models.

3. Instructions

1. The Provider processes Customer data only on documented instructions from the Customer, including with regard to transfers to third countries, unless it is required to do so by Union or Member State law. In that case, it informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).
2. The instructions are laid down in this agreement. Settings that the Customer or its users make in the platform, such as the choice of AI models, the retention period, web search or connecting Microsoft 365, are deemed documented instructions. Individual instructions going beyond this, such as enabling models outside the EU, require text form (Textform).
3. If the Provider considers an instruction to be unlawful, it informs the Customer without undue delay. It may suspend execution until the Customer confirms or changes the instruction.

4. Obligations of the Customer

The Customer is responsible for the lawfulness of the processing and of its instructions, in particular for a legal basis, for informing the data subjects and, for the embed chatbot, for the privacy notice on its website. It enters special categories of personal data under Art. 9 GDPR only to the extent this is permitted and it has assessed the risks. It informs the Provider without undue delay if it detects errors or irregularities in the processing.

5. Confidentiality

The Provider ensures that all persons authorized to process Customer data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). They receive access to Customer data only to the extent necessary for providing the services, for support or for resolving faults. This obligation continues after the end of the agreement.

6. Security of processing

The Provider takes the technical and organizational measures required under Art. 32 GDPR (Art. 28(3)(c) GDPR). The measures in effect when the agreement is concluded are set out in Annex 3. The Provider may adapt them to the state of the art, provided the level of protection laid down there is not reduced.

7. Subprocessors

1. The Customer grants general authorization to engage other processors (Art. 28(2) GDPR). The subprocessors (Unterauftragsverarbeiter) engaged when the agreement is concluded are listed in Annex 2.
2. The Provider informs the owner of the organization in text form at least four weeks before adding or replacing a subprocessor. Within 14 days of receiving this information, the Customer may object in text form for an important reason relating to data protection law. If the parties do not reach an agreement, either party may terminate the Main Agreement with effect from the time of the planned engagement.
3. The Provider contractually imposes on each subprocessor the same data protection obligations as are laid down in this agreement (Art. 28(4) GDPR) and is liable to the Customer for their compliance.

8. Transfers to third countries

Customer data is generally processed in the European Union or the European Economic Area. Processing in a third country takes place only to the extent Annex 2 states it or the Customer instructs it, for example by enabling AI models outside the EU. Transfers to third countries take place only in accordance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision, including the EU-U.S. Data Privacy Framework, or of EU standard contractual clauses. Models outside the EU are switched off. The Provider enables them only on the Customer's instructions.

9. Rights of data subjects

The Provider assists the Customer by appropriate technical and organizational measures in responding to requests from data subjects under Chapter III GDPR (Art. 28(3)(e) GDPR). For this purpose, it provides features in the platform for export, rectification and erasure. If a data subject contacts the Provider directly, the Provider forwards the request to the Customer without undue delay and does not answer it itself unless the Customer instructs it to.

10. Notification of personal data breaches

The Provider notifies the Customer of a breach of the security of Customer data without undue delay, and no later than 48 hours after becoming aware of it (Art. 33(2) GDPR). The notification is based on the information available to the Provider; it provides further information as soon as it becomes available.

11. Assistance with the obligations under Art. 32 to 36 GDPR

Taking into account the nature of the processing and the information available to it, the Provider assists the Customer with the security of processing, with notifications to the supervisory authority and communications to data subjects, with data protection impact assessments and with prior consultations of the supervisory authority (Art. 28(3)(f) GDPR).

12. Deletion and return after the end of the agreement

1. When a subscription ends, the Customer data is retained until the Customer deletes it itself or requests the deletion of its organization in text form (Section 14 of the Main Agreement). Until then, the Customer can retrieve it via the organization export and the features of the platform; this constitutes the return within the meaning of Art. 28(3)(g) GDPR.
2. If the Customer requests the deletion of its organization, the Provider deletes the Customer data, including stored files, within 30 days, unless Union or Member State law requires storage. On request, it confirms the deletion in text form.
3. During the term, the platform automatically deletes chat histories and agent tasks after the retention period set by the Customer.
4. The Provider may retain documentation that serves as evidence of proper processing in accordance with statutory retention periods even after the end of the agreement.

13. Evidence and audits

The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for audits, including inspections, by the Customer or an auditor mandated by the Customer who is bound to confidentiality and is not a competitor of the Provider (Art. 28(3)(h) GDPR). Inspections must be announced with reasonable notice, as a rule two weeks, and take place during normal business hours without disrupting operations disproportionately. The Customer bears the costs of an inspection unless it establishes a breach of this agreement by the Provider. The Provider may restrict access to information to the extent data of other customers or security concerns are affected.

14. Liability

Section 13 of the Main Agreement governs the liability of the parties to each other. Liability towards data subjects under Art. 82 GDPR remains unaffected.

15. Final provisions

1. In the event of conflicts, this agreement takes precedence over the Main Agreement in all matters of data protection. In all other respects, the provisions of the Main Agreement apply, in particular those on applicable law and place of jurisdiction.
2. A new version of this agreement takes effect when the Customer accepts it in the platform. Until then, the most recently accepted version applies.
3. Should any provision be invalid, the remaining provisions remain valid.

Annex 1: Nature and purpose of processing, types of data, data subjects

The subject matter of the processing is the provision of the platform with the following features. Data is processed in each case only to the extent the Customer uses the feature.

Types of personal data

• User master data: name, email address, role, organization membership
• Content data: inputs, uploaded and imported documents, AI responses, generated files and results of agents and workflows
• Audio recordings, transcripts and summaries of conversations
• Configuration data: templates, agent, workflow and chatbot settings, to the extent they contain personal data
• Integration data: files and content from Microsoft 365 and appointments from a connected calendar
• Data of website visitors: chat messages, pseudonymous session identifier, timestamps, language and voluntarily provided contact details
• Usage and log data: timestamps, consumption, IP address in security logs, technical error contexts

Categories of data subjects

• Employees and other users of the Customer who are given access to the platform
• Contacts and other third parties whose data the Customer brings in through inputs, documents, workflows or integrations, such as customers, prospects, suppliers, business partners and applicants
• Participants in transcribed conversations
• Website visitors of the Customer who use an embed chatbot

Annex 2: Subprocessors

Always engaged:

Engaged only if the Customer uses or enables the respective feature:

The platform retrieves data on the Customer's behalf from providers that the Customer connects itself, such as its Microsoft 365 tenant. These providers are contractual partners of the Customer and not subprocessors of the Provider. Also not covered is processing for which the Provider itself is the controller, such as billing via Stripe and audience measurement of the public website.

Annex 3: Technical and organizational measures

Confidentiality

• Tenant separation in the database through row-based access rules (Row Level Security); each organization sees only its own data.
• Tiered role and permission concept per organization with server-side checking of every request.
• Sign-in via personal, time-limited sign-in links.
• Credentials for integrations are stored encrypted with AES-256-GCM under a separate key per organization.
• Embed chatbots only on approved domains; visitors are handled under pseudonymous session identifiers.
• Data analysis by agents in isolated, short-lived environments without network access.

Integrity

• Encrypted transmission of all connections via TLS.
• Logging of security-relevant events such as role changes and contract acceptances in a security log.
• Rate limiting of requests against abuse and automated attacks.

Availability and resilience

• Operation with infrastructure providers under Annex 2 with encryption of data at rest.
• Longer-running processes via durable orchestration that resumes after disruptions.
• Error monitoring that does not capture personal data by default.

Data protection by default

• AI models outside the EU are switched off; the Provider enables them only on the Customer's instructions.
• No training of AI models with Customer data.
• Configurable retention period with automatic deletion; deletion of an organization including all stored files.
• Self-service export of the organization data as a JSON file (Art. 20 GDPR).

Organization

• Commitment of all employees to confidentiality.
• Access to Customer data only to the extent necessary for operation and support.
• Selection and contractual commitment of subprocessors under Art. 28(4) GDPR.