Data Processing Agreement (DPA)

The subject matter is the processing of personal data of the Controller’s end customers by the Processor in the course of providing the "Sondercase" service. The duration matches the term of the main contract.

Processed are inbound customer inquiries (email/messenger) and associated order and contact data for the purpose of automated or draft-based responses to support requests.

From the messages already processed in the course of providing the service, the Processor computes aggregate quality metrics — in particular the extent to which AI-suggested responses are adopted unchanged, edited or discarded (e.g. share of words changed). No message content is made visible to staff and no additional copies of content are stored; only aggregate metrics for improving and assuring the quality of the service arise. This processing occurs within the documented instructions of the Controller (Art. 28 GDPR).

• Data types: contact data, communication content, order/transaction data.
• Data subjects: the Controller’s end customers.

• Processing solely on the Controller’s documented instructions.
• Confidentiality obligation of the persons involved.
• Technical and organisational measures (TOMs) per Art. 32 GDPR (see annex).
• Support with data-subject rights and notification duties (Art. 33/34 GDPR).
• Deletion or return of data after the contract ends, at the Controller’s choice.
• Evidence of compliance and enabling audits.

The Controller approves the use of the sub-processors named in the Privacy Policy. The Processor will give timely notice of changes; a right to object for good cause exists.

• Encryption of credentials and secrets (encryption of sensitive data at rest).
• Access control (row-level security, role-based access), tenant isolation per organisation.
• Transport encryption (TLS), authentication via JWT.
• Logging, rate limiting and bot protection.
• Regular backups and recoverability.
• Internal analytics run solely via read-only, logged database access to aggregate metrics; message content is not made visible to staff.

Any transfer to third countries occurs only in compliance with Art. 44 et seq. GDPR (e.g. EU Standard Contractual Clauses).

The provisions of the main contract apply in addition. In case of conflict, this DPA prevails on data-protection matters.