Data Processing Agreement

1. Parties, roles, and scope

1.1 This Data Processing Agreement ("DPA") under Art. 28 GDPR applies between the client ("Controller") and Studio 073X e.K., Rienzistr. 12, 70597 Stuttgart, Germany, trading as AETOP. ("Processor"), whenever the Processor processes personal data on behalf of the Controller under a contract governed by our Terms and Conditions ("Main Contract"). It becomes part of the Main Contract on its conclusion.

1.2 If the parties have signed an individual processing agreement, that agreement prevails over this DPA.

1.3 This DPA does not cover data the Processor processes as its own controller, in particular for contract administration, invoicing, account management, and security logs. Our Privacy Policy applies to that processing.

1.4 Third-party accounts that the Controller connects to the services (e.g., Google, Microsoft, an email mailbox) are providers of the Controller under its own contracts. They are not sub-processors of the Processor.

2. Subject matter, duration, nature, and purpose

2.1 Subject matter and purpose. Processing of personal data to provide the services under the Main Contract: for Platform Services, in particular reading, summarizing, and drafting content and preparing actions that are executed only after the Controller's approval; for Agency Services, the processing described in the Order.

2.2 Nature of processing. Collection, storage, ingestion of documents, computation and storage of embeddings for search, transmission of text to AI models, generation of drafts and documents, logging, export, and deletion.

2.3 Duration. For the term of the Main Contract, plus the period until deletion under section 9.

3. Categories of data and data subjects

3.1 Categories of data, depending on what the Controller submits and connects:

• master and contact data (name, address, email address, phone number);
• content data (correspondence, documents, notes, appointments);
• financial and contract data contained in the content;
• special categories of personal data (Art. 9 GDPR) and data relating to criminal offences (Art. 10 GDPR), only to the extent they occur in the content;
• access credentials for connected accounts;
• audit logs of read access and tool calls, and model inputs and outputs stored for debugging.

3.2 Data subjects: the Controller's users, employees, clients, customers, prospects, and correspondents, and other third parties mentioned in the content.

3.3 The Controller only submits data it is entitled to process. Data subject to professional secrecy (§ 203 StGB, § 43e BRAO, § 62a StBerG) may only be submitted after a separate confidentiality agreement has been signed.

4. Instructions

4.1 The Processor processes personal data only on documented instructions of the Controller (Art. 28(3)(a) GDPR). Instructions are the Main Contract, this DPA, the connection of an account, any request entered in the services, any approval or rejection of a proposed action, and instructions in text form.

4.2 If the Processor considers an instruction to infringe data protection law, it informs the Controller without undue delay and may suspend its execution (Art. 28(3) sentence 3 GDPR).

4.3 If the Processor is required by Union or Member State law to process data, it informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.4 The Processor does not use the data for its own purposes, in particular not to train or improve AI models and not for product analytics.

5. Confidentiality

The Processor ensures that persons authorized to process the data have committed themselves to confidentiality (Art. 28(3)(b) GDPR). Access is limited to the owner and persons bound to confidentiality, and only to the extent required to provide the services, to remedy a specific disruption, or on the Controller's instruction. The obligation continues after the end of the contract.

6. Technical and organizational measures (Art. 32 GDPR)

For the Platform Services, the Processor implements at least the following measures. For Agency Services, the measures of the sub-processors listed in section 7 apply, supplemented by access control and encrypted devices on the Processor's side.

The Processor may adapt the measures to technical progress, provided the level of protection is not reduced.

7. Sub-processors

7.1 The Controller authorizes the following sub-processors ("direct sub-processors"). For each direct sub-processor, the tables link its data processing agreement and its own list of sub-processors.

Platform Services: core (always used)

Only if agreed in the Order

Agency Services

7.2 The Processor uses AI providers only under business or API terms under which they do not use the data to train their models.

7.3 The Processor informs the Controller in text form at least four weeks before adding or replacing a direct sub-processor listed in section 7.1. The Controller may object in text form for good cause within this period. If the Processor cannot reasonably provide the services without the change, either party may terminate the affected services with effect from the date of the change; prepaid fees are refunded pro rata.

7.4 Direct sub-processors engage further sub-processors of their own. The Controller's authorization under section 7.1 extends to the further sub-processors named in each direct sub-processor's own sub-processor list linked in the tables above, as that list is amended under the respective provider's data processing agreement. For changes to further sub-processors, the Processor relies on each provider's own sub-processor list and notification mechanism; the notice periods and objection procedures for such changes are those set by the respective provider's data processing agreement, and the four-week period in section 7.3 does not apply to them. The Processor passes on such changes to the Controller in text form as far as the Processor receives notice of them. If the Controller objects to such a change in text form for good cause, the Processor raises the objection with the provider as far as the provider's agreement allows; section 7.3 sentence 3 applies accordingly.

7.5 The Processor imposes on each sub-processor substantially the same data protection obligations as in this DPA (Art. 28(4) GDPR).

7.6 Transfers to third countries take place only to the sub-processors marked accordingly above and only on the basis of an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Data subject rights and assistance

8.1 The Controller remains responsible for responding to data subject requests. The Processor forwards requests it receives to the Controller without undue delay and does not respond itself.

8.2 The Processor assists the Controller, as far as reasonable and necessary, with access, export, rectification, erasure, restriction, and objection, and with compliance with Art. 32 to 36 GDPR.

8.3 The Processor maintains a record of processing activities under Art. 30(2) GDPR.

9. Return and deletion

9.1 After the end of the Main Contract, the Processor returns the Controller's data in a common machine-readable format or deletes it, at the Controller's choice (Art. 28(3)(g) GDPR). The Controller communicates its choice in text form within 14 days after the end of the contract. After a return, the Processor deletes remaining copies without undue delay, unless Union or Member State law requires storage.

9.2 If the Controller makes no choice, the Processor deletes the data after this period, including at its sub-processors, unless there is a statutory retention obligation, and confirms the deletion in text form.

9.3 Data in backups is deleted when the backup retention period expires. The Processor states this period in the deletion confirmation.

10. Personal data breaches

10.1 The Processor notifies the Controller of any personal data breach without undue delay, and for incidents in its own sphere at the latest within 24 hours after becoming aware of it.

10.2 The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person.

10.3 The notification does not replace the Controller's own notification under Art. 33 GDPR.

11. Audits

11.1 The Controller may verify compliance with this DPA once per calendar year and additionally on concrete occasion (e.g., an incident or a request by a supervisory authority).

11.2 Verification takes place primarily through documentation, a questionnaire, or a remote review; an on-site audit requires at least 15 working days' notice. Auditors must be bound to confidentiality; the Processor may reject a competitor as auditor. The audit must not give access to other clients' data.

12. Liability and final provisions

12.1 Liability follows Art. 82 GDPR and the liability provisions of the Main Contract.

12.2 This DPA is concluded in electronic format (Art. 28(9) GDPR). Amendments require text form. A countersigned copy is available on request at project@aetop.co.

12.3 In case of conflict between this DPA and the Main Contract regarding the processing of personal data, this DPA prevails.