Data processing agreement

This is a non-binding courtesy translation. Pursuant to the final clause of the German version, the German text is drafted in German and is solely legally binding; any translation serves information purposes only.

This Data Processing Agreement applies between oneAI GmbH, Eisenbahnstraße 50, 72072 Tübingen, Germany (hereinafter "Processor") and the respective Customer who accepts oneAI GmbH's Terms of Use (EULA) and General Terms and Conditions (GTC) (hereinafter "Controller"). Controller and Processor are hereinafter individually also referred to as a "Party" and jointly as the "Parties". This Agreement automatically becomes part of the contractual relationship between oneAI GmbH and each Customer upon acceptance of the Terms of Use, without the need for separate signature.

Preamble

To specify the rights and obligations arising from the data processing relationship under the statutory requirements of Art. 28 GDPR, the Parties conclude the following Agreement. This Agreement supplements the Terms of Use (EULA) and General Terms and Conditions (GTC) of oneAI GmbH existing between the Parties, which together form the contractual basis for the use of the oneAI SaaS platform (hereinafter jointly the "Main Agreement").

1 Subject Matter and Duration of the Engagement

1.1 Subject Matter of the Engagement

The subject matter of the engagement is the performance of the following tasks:

The Processor provides the Controller with the provisioning and operation of the OneAI SaaS platform (hub.oneai.eu) on the basis of the Main Agreement. This includes in particular AI-assisted text and chat processing, RAG-based document search, management of Spaces and uploaded content, and audit logging. For the individual services, reference is made to the service description of the Main Agreement.

The processing of personal data is carried out in accordance with the model operation mode selected by the Controller:

• Standard models (self-hosted) and Private Models – processing exclusively within the infrastructure of the Processor or the Controller;
• “EU Models” (EU-flag models) – processing via Google Vertex AI Model Garden in the EU region;
• Public Models – external model providers to be actively selected by the Controller; the guarantees set out in Annex 1 additionally apply in this respect.

At the Controller's express request, or where expressly agreed in the Main Agreement or the relevant individual order – in particular where installation is not carried out by an implementation partner engaged by the Controller – the Processor additionally provides the following optional service: the Controller provides the Processor with a ready-to-use, isolated virtual machine within its own network. The Processor connects to this VM solely for the purpose of installing and configuring a Relay Docker container, which enables the Controller's local SMB shares to be connected to the oneAI cloud platform. The Processor does not create or operate the virtual machine itself; provisioning, operation and security of the VM are the Controller's responsibility. In the course of this activity, the Processor has no access to the SMB share itself, as it does not hold the credentials required for this; access is limited to the network level of the provided VM for the purpose of container installation and configuration. No third-country transfer is involved. Following successful installation and configuration, the access granted to the Processor to the virtual machine is terminated; any renewed access (e.g. for updates or maintenance) shall only take place following renewed authorisation by the Controller.

1.2 Duration of the Engagement

The duration of this engagement corresponds to the term of the underlying Main Agreement. The Controller may terminate this Agreement at any time without notice if the Processor commits a serious breach of this Agreement or applicable data protection provisions, fails to carry out an instruction of the Controller, refuses to provide required information, or denies the Controller access in the context of audits. Following termination, the Processor may no longer process the Controller's personal data.

1.3 Remuneration

All services of the Processor in connection with the fulfilment of its obligations under this Agreement are covered by the remuneration under the underlying Main Agreement.

2 Details of the Subject Matter of the Engagement

2.1 Nature, Purpose and Permissibility of the Processing

The nature and purpose of the processing of personal data by the Processor arise from the Main Agreement and the associated service description. The Controller alone is responsible for assessing the permissibility of the processing.

2.2 Categories of Personal Data

The subject matter of the processing is all personal data that the Controller or its authorised users enter, upload or otherwise have processed in the course of using the Platform. Depending on use, this may in particular include: name and contact data, communication content, document content, IT access and authorisation management data, IT usage metadata, and other content entered by the Controller or its users. The determination of the categories of data actually processed is the sole responsibility of the Controller as controller, in the context of its own usage decisions. Note: When using Public Models, the Controller is obliged not to submit special categories of personal data under Art. 9 GDPR (e.g. health data) in prompts without an appropriate legal basis (cf. Main Agreement/Terms of Use). Where the Controller provides the Processor with access credentials to its own third-party systems in connection with certain connectors (e.g. SMB network shares), the special provisions in Annex 2, Clause 1.6 apply in addition.

2.3 Categories of Data Subjects

The circle of data subjects is determined by the Controller's own use of the Platform and may in particular include: employees of the Controller, customers and business partners of the Controller, applicants, and other natural persons whose personal data the Controller or its authorised users enter in the course of using the Platform. The determination of the categories of data subjects actually affected is the sole responsibility of the Controller as controller.

3 Technical and Organisational Measures

3.1 The Processor takes appropriate technical and organisational measures for the adequate protection of personal data, as required by Art. 28(3) sentence 2(c) GDPR in conjunction with Art. 32(1) GDPR, in order to ensure the security of the processing. To this end, the Processor ensures:

• the ongoing confidentiality, integrity, availability and resilience of the systems and services in connection with the processing;
• the ability to rapidly restore the availability of and access to personal data in the event of a physical or technical incident.

3.2 The Parties agree on the measures set out in detail in Annex 2 (“Technical and Organisational Measures”) to this Agreement. These apply to the entire operation of the OneAI platform; insofar as parts of the infrastructure are provided by a sub-processor (see Annex 1), its measures are included in the protection level described.

3.3 The measures are subject to technical progress. The Processor is permitted to implement alternative, adequate measures in line with the state of the art, provided the security level of the defined measures is not undercut. Material changes must be documented and communicated to the Controller in text form.

4 Third-Country Transfer

4.1 When using self-hosted standard models, “EU Models” (EU-flag models) (Google Vertex AI Model Garden, EU region) and Private Models, processing takes place exclusively within the European Union or a contracting state of the EEA Agreement; no third-country transfer occurs in this respect.

4.2 A transfer to a third country is only permitted under the following conditions:

• an adequacy decision under Art. 45 GDPR exists for the country concerned;
• the Processor provides appropriate safeguards under Art. 46 or 47 GDPR (in particular EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914);
• the transfer is necessary for the establishment, exercise or defence of legal claims in connection with specific administrative, judicial or regulatory proceedings; or
• the transfer is necessary to protect the vital interests of the data subject or another natural person.

4.3 A transfer to a Public Model located outside the EU/EEA (e.g. OpenAI, USA) occurs exclusively as a result of the deliberate selection of a Public Model not marked as “EU” (EU flag) by the Controller or its users. Standard models (self-hosted), “EU” (EU flag) models and Private Models do not trigger any third-country transfer. By selecting such a Public Model, the Controller gives the Processor the documented instruction under Art. 28(3) sentence 2(a) GDPR to transfer the relevant data to the selected provider; the Controller, as controller, alone decides whether and where the transfer takes place. If no such selection is made, no third-country transfer occurs. The Controller may further use the Platform's administration functions to technically control which models are available to its users, and in particular may deactivate (technically exclude) Public Models not marked as “EU” (EU flag) and Private Models organisation-wide. If the Controller makes use of this, a third-country transfer via model selection is technically excluded.

4.4 The transfer associated with such a selection is based on the guarantees set out in Annex 1 (EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914 in conjunction with the respective providers' Data Processing Addenda). Every transfer must comply with all contractual obligations under this Agreement, in particular the purpose limitation. The assessment of the permissibility of the transfer in the specific individual case – in particular with regard to the content entered – is the responsibility of the Controller as controller, where applicable in the context of its data protection impact assessment (Art. 35 GDPR).

5 Rectification, Erasure and Restriction of Data

5.1 The Processor may only rectify, erase or restrict the processing of data processed under the engagement in accordance with the Controller's instructions (Art. 28(3) sentence 2(a) GDPR).

5.2 If a data subject approaches the Processor directly with a request for immediate rectification or erasure of their personal data, the Processor shall forward the request to the Controller without undue delay.

5.3 Insofar as covered by the scope of services, the Processor shall ensure, in accordance with the Controller's documented instructions, the rights to erasure, to be forgotten, to rectification, to data portability and to information without undue delay.

6 Audits and Other Obligations of the Processor

In addition to the obligations under this Agreement, the Processor shall comply with the statutory obligations under Art. 28 to 33 GDPR; in particular:

a) For data protection enquiries, the Processor can be reached at: privacy@oneai.eu. Should the Processor become legally required to appoint a data protection officer, the Controller will be notified without undue delay in text form.

b) The Processor and any person subordinate to it who has access to the Controller's personal data may only process such data in accordance with the Controller's instructions under Clause 10 of this Agreement, unless they are obliged to process it under Union or Member State law (Art. 28(3) sentence 2(a), Art. 29 GDPR).

c) The Processor shall only deploy persons who are bound to confidentiality and have been made familiar with the relevant data protection provisions (Art. 28(3) sentence 2(b) GDPR). This obligation continues to apply after termination of this Agreement and/or the Main Agreement.

d) The Processor shall cooperate with the supervisory authority in the performance of its tasks.

e) The Processor shall inform the Controller without undue delay of any audit actions and measures of the supervisory authority insofar as they relate to this engagement.

f) The Processor shall support the Controller to the best of its ability in connection with supervisory authority audits, administrative or criminal proceedings, claims for damages by data subjects or third parties, and other claims in connection with the processing.

g) The Processor shall regularly review its internal processes and the technical and organisational measures to ensure that processing within its area of responsibility complies with applicable data protection law and that the rights of data subjects are safeguarded.

h) The Processor shall demonstrate the technical and organisational measures taken to the Controller within the scope of its audit rights under Clause 8.

7 Sub-Processing Relationships

7.1 Sub-processing relationships within the meaning of this Agreement are services directly related to the performance of the principal service. This does not include ancillary services used by the Processor, e.g. telecommunications, postal/transport or disposal services. However, the Processor remains obliged to ensure data protection and data security for the Controller's data by appropriate and lawful contractual arrangements and control measures, even for such ancillary services.

7.2 The Processor is entitled to engage the sub-processors named in Annex 1 to process the Controller's personal data. The engagement of further or other sub-processors shall be communicated to the Controller in text form. If the Controller does not object in text form within 30 days of receipt of this notification, the change is deemed approved. An objection is only valid and relevant if the Controller demonstrates, in text form within this period, objectively and comprehensibly, that and for which specific reasons the engagement of the new or changed sub-processor reduces the level of protection or security owed under this Agreement, the GDPR, or Regulation (EU) 2024/1689 (EU AI Act), or violates mandatory requirements of these provisions. Unsubstantiated objections, as well as objections based exclusively on economic, competitive, strategic or other considerations not grounded in data protection or security law, are invalid. If, following a valid objection, no amicable solution is reached within a further period of 14 days, the Controller shall have a right of extraordinary termination with respect to the part of the service affected by the sub-engagement.

7.3 If the Processor performs the agreed service with the involvement of sub-processors outside the EU/EEA, it shall ensure that the data protection permissibility is guaranteed – in particular through the guarantees under Clause 4. The sub-processor shall be subject to the same data protection obligations as set out in this Agreement, with sufficient guarantees of appropriate technical and organisational measures (Art. 28(4) sentence 1 GDPR).

8 Controller's Audit Rights

8.1 The Controller has the right, in consultation with the Processor, to carry out audits or have them carried out by an auditor bound to confidentiality. The Controller has the right to satisfy itself of compliance with the technical and organisational measures by means of random checks, generally once a year or on a specific occasion (Art. 28(3) sentence 2(h) GDPR).

8.2 The Processor shall ensure that the Controller can satisfy itself of compliance with the obligations. It is obliged, upon request, to provide the Controller with the necessary information and in particular to demonstrate the implementation of the technical and organisational measures (Art. 28(3) sentence 2(h) GDPR).

8.3 Evidence of such measures may be provided by current certificates, reports or report extracts from independent bodies (e.g. auditors, data protection auditors, quality auditors), suitable certification (e.g. IT security or data protection audit), or other suitable measures.

9 Support of the Controller, Notification of Breaches by the Processor

The Processor shall support the Controller in complying with the obligations set out in Art. 32 to 36 GDPR regarding the security of personal data, breach notification obligations, data protection impact assessments and prior consultations. This includes in particular:

a) ensuring an appropriate level of protection through technical and organisational measures that take into account the circumstances and purposes of the processing and the likelihood and severity of potential infringements, and that enable the immediate detection of relevant breach events;

b) the obligation to document and notify the Controller without undue delay of breaches of the protection of personal data (Art. 33(2) GDPR), and to take appropriate measures, in coordination with the Controller, to secure the data and mitigate possible adverse effects;

c) supporting the Controller (Art. 28(3) sentence 2(e) GDPR) with its notification obligation to the supervisory authority or the data subject;

d) supporting the Controller with its information obligation towards the data subject and providing all relevant information upon request.

10 Controller's Right to Issue Instructions, Instruction-Bound Processing

10.1 The Controller has a comprehensive right to issue instructions to the Processor regarding the nature, scope and method of data processing.

10.2 Data may only be processed within the scope of this Agreement and in accordance with the Controller's instructions. The Processor is prohibited from using the data for other purposes or disclosing it to third parties without the Controller's knowledge. Copies or duplicates are not made without the Controller's knowledge; excluded from this are backup copies insofar as they are necessary to ensure proper processing.

10.3 Instructions from the Controller shall be documented by the Processor. Verbal instructions shall be confirmed without undue delay in text or written form.

10.4 Changes to the subject matter and procedure of the processing shall be agreed jointly and documented. Processed personal data shall only be forwarded to third parties or the data subject with the Controller's prior consent in text form.

10.5 If the Processor is of the opinion that an instruction violates data protection provisions, it shall notify the Controller without undue delay. The Processor is entitled to suspend implementation of the instruction concerned until it is confirmed or amended by the Controller (Art. 28(3) sentence 3 GDPR).

10.6 No training on customer data. The Processor never uses the Controller's personal data to train its own or third-party AI models. For self-hosted standard models this is technically enforced; for Public Models this is contractually secured via the respective providers' Data Processing Addenda (no-training clauses, and for Mistral additionally through an activated training opt-out).

11 Liability

11.1 The liability of the Parties is governed by statutory provisions, in particular Art. 82 GDPR. The Processor is only liable for damage caused by the processing if it has failed to comply with the obligations under the GDPR specifically addressed to processors, or has acted outside of or contrary to the Controller's lawful instructions (Art. 82(2) sentence 2 GDPR).

11.2 In their internal relationship, the Parties bear the damage in proportion to their respective share of responsibility and fault (Art. 82(5) GDPR). Insofar as the Controller, as controller, issues instructions, enters content into the Platform, or selects models or Public Model providers, it bears the resulting data protection responsibility.

11.3 A Party is released from liability if it proves that it is not in any way responsible for the event giving rise to the damage (Art. 82(3) GDPR).

11.4 Any limitations and caps on liability under the Main Agreement also apply to claims arising from or in connection with this Agreement, insofar as legally permissible. They do not apply in cases of intent and gross negligence, injury to life, body or health, direct statutory claims of data subjects, or sanctions under Art. 83 GDPR.

12 Deletion of Data and Return of Data Carriers

12.1 Copies or duplicates of the data are not made without the Controller's knowledge. Excepted are necessary backup copies to ensure proper data processing and data required to comply with statutory retention obligations.

12.2 Upon completion of the contractually agreed work or at the Controller's request – at the latest upon termination of the Main Agreement – the Processor shall, at the Controller's choice, return or delete all documents in its possession and all processing or usage results created in connection with the engagement (Art. 28(3) sentence 2(g) GDPR). This also applies to test data and discarded material. The deletion log shall be presented upon request.

12.3 Documentation serving as evidence of proper, contract-compliant data processing shall be retained by the Processor beyond the end of the contract in accordance with the applicable retention periods. It may hand these over to the Controller at the end of the contract for its own exoneration.

13 Miscellaneous, Amendment of this Agreement

13.1 Should individual provisions of this Agreement be or become invalid or unenforceable, this shall not affect the validity of the remaining provisions. The invalid or unenforceable provision shall be replaced by the valid and enforceable provision that comes closest to the economic purpose of the original provision. The same applies to any gaps in the Agreement.

13.2 This Agreement is governed by German law. The exclusive place of jurisdiction for disputes arising from or in connection with this Agreement is, to the extent legally permissible, Tübingen.

13.3 Changes to this Agreement will be announced to the Controller by e-mail or via the Platform at least six (6) weeks before the intended effective date. The Controller's consent is deemed given if it does not object in writing before the intended date; the Controller will be separately notified of this legal consequence in the change notification. A material change to the subject matter of the contract (principal obligations) by way of unilateral amendment is excluded. This does not affect the Parties' obligation to adapt this Agreement insofar as this becomes necessary due to a change in applicable data protection laws or binding requirements of the European Commission or the competent supervisory authorities. The engagement or replacement of sub-processors is governed exclusively by the provision in Clause 7.2; the preceding paragraphs of this Clause 13.3 do not apply to this.

Annex 1 – List of Sub-Processors

List of sub-processors engaged by the Processor with the Controller's consent (with verified business addresses). The list is set out below; changes will be communicated in accordance with Clause 7.2.

Note: Providers and data transfers not used to provide the core service to the Controller – in particular payment and e-mail service providers, as well as connector target systems connected by the Controller itself (e.g. Microsoft, Google, GitHub, ClickUp, weclapp) – are not the subject of this engagement. Connector target systems fall within the Controller's area of responsibility and are connected solely at its instigation and on the basis of its own contractual relationships.

Annex 2 – Technical and Organisational Measures

The following technical and organisational measures implemented and guaranteed by oneAI GmbH pursuant to Art. 32 GDPR are set out below. The OneAI platform is operated on servers in the ISO 27001-certified data centre of Hetzner Online GmbH (Germany), supplemented by an additional, likewise ISO 27001-certified secondary/backup capacity with Scaleway S.A.S. (France, see Annex 1); the non-GPU-intensive infrastructure is provided by the infrastructure sub-processor relyon AG (see Annex 1). The measures set out below apply to the entire operation of the OneAI platform.

CONFIDENTIALITY

1.1 Physical Access Control

oneAI GmbH employees are trained in handling and maintaining the confidentiality of sensitive data.

oneAI GmbH's office and operational premises are secured with an electronic locking system; electronic keys are issued only to authorised persons, and issuance is logged.

Business premises are locked and may only be entered by authorised persons with a key.

The OneAI platform's servers are located in the ISO 27001-certified data centre of Hetzner Online GmbH (Germany). The data centre premises are staffed around the clock by the data centre operator's personnel and are alarm- and video-monitored.

Visitors to data centre premises are collected at the entrance and entered in a visitor list; access is only possible with valid identification documents.

Important documents are stored in lockable cabinets; only authorised persons receive keys.

1.2 Access Control (Authentication)

Passwordless-first: authentication via WebAuthn/passkeys (FIDO2); no standard password-based login.

Single sign-on via Microsoft Entra ID (OAuth 2.0) and Google Sign-In; administrative access is role-based, additionally protected by conditional access policies and mandatory multi-factor authentication (MFA).

All employees receive a personalised user account; passwords are not shared. Where passwords are used, a complexity policy applies requiring at least 15 characters (upper/lower case, numbers, special characters).

Automated user provisioning and deprovisioning via Enterprise SCIM 2.0.

The network is protected by a rule-based, regularly reviewed firewall; spam filters and anti-virus/malware protection with signatures updated several times daily.

Mobile devices contain no unencrypted personal data; a Mobile Device Management (MDM) system is in use.

Session management: 24-hour expiry, session tokens SHA-256-hashed; API keys with an optional expiry date, stored encrypted.

External service providers are only engaged with a concluded data processing agreement; their access is limited to the required extent.

1.3 Access Control (Authorisation)

A role-based permission concept (RBAC) exists for all systems and storage at organisation and space level (read/write/admin).

Strict tenant separation at database level; every operation is authenticated and assigned to its tenant.

User accounts of departed employees are blocked immediately upon termination of employment and deleted after a transitional period.

Access to applications containing personal data is logged; logs are retained for 14 days.

Data carriers no longer required or intended for reuse are manually destroyed or securely erased by repeated overwriting.

Access to virtual machines provided by the Controller in connection with the optional remote access service (cf. Clause 1.1) is restricted to authorised personnel only. Shared credentials are not used for this purpose; each accessing person authenticates using a personal SSH key or an individual user account.

1.4 Separation

Data of different tenants is separated logically and at the network level via VLANs defined in the security architecture; network segments are separated by a firewall.

Production systems are separated from test and development environments.

1.5 Pseudonymisation & Encryption

All personal data is encrypted during transmission by appropriate measures (TLS 1.2+/HTTPS, VPN).

Provider API keys at rest are encrypted with XChaCha20-Poly1305 (Cure53-audited library); stored passwords and credentials are held encrypted in a password safe.

Backups are separately encrypted; central secrets management, no hard-coded credentials.

1.6 Access Credentials to the Controller's Third-Party Systems (e.g. SMB Network Shares)

Where the Controller provides the Processor with access credentials to its own third-party systems in connection with the use of certain connectors (e.g. to connect SMB network shares), the following applies in addition: the credentials are stored encrypted in the Processor's database. The keys required for decryption are held by the Processor's own infrastructure, since the agreed processing – including processing independent of the user being online (e.g. background indexing) – technically requires decryption by the Processor; an architecture in which only the Controller is able to decrypt is not compatible with this functionality.

Access to the Processor's own infrastructure and to the decryption keys is restricted to a narrowly defined, named group of authorised specialist personnel, who are bound by the standard confidentiality obligations contained in their employment agreements. As the Controller's third-party systems (e.g. the SMB server) lie outside the Processor's own infrastructure and are neither operated nor administered by the Processor, complete, tamper-resistant logging of actions taken there is consistently carried out at the level of that third-party system itself – where it can be implemented reliably. The Controller is recommended to implement corresponding, independent logging within its own infrastructure.

The Controller is advised to provide the Processor only with credentials limited to the minimum scope of permissions required for the intended purpose (e.g. read-only access, restricted to the necessary shares or directories) and to maintain logging of access to the share at the level of its own third-party system.

INTEGRITY

2.1 Input Control

Entered, modified or deleted data can be subsequently verified via journal/change logs and the Dual Audit Log (Provider and Deployer log, immutable hash chain).

Protection against SQL injection via parameterised queries; SSRF protection through a dedicated outbound proxy; schema validation on all API endpoints; webhook verification via HMAC-SHA256.

Access to virtual machines provided by the Controller in connection with the optional remote access service (cf. Clause 1.1) is restricted to a narrowly defined, named group of authorised specialist personnel, who are bound by the standard confidentiality obligations contained in their employment agreements. As the virtual machine lies outside the Processor's own infrastructure and is neither operated nor administered by the Processor, complete, tamper-resistant logging of all access to and actions performed on that machine is consistently carried out at the level of the Controller's own network or system environment – where it can be implemented reliably. The Controller is recommended to implement corresponding, independent logging within its own infrastructure.

2.2 Transfer Control

No data is disclosed to third parties without the Controller's instruction; no training takes place on customer data.

Access from mobile workplaces or home offices to internal systems is exclusively via encrypted connections (SSL/VPN).

Remote access to virtual machines provided by the Controller for the purpose of installing the Relay Docker container (cf. Clause 1.1) is carried out exclusively via encrypted standard protocols (SSH or RDP).

3. Availability, Resilience and Recoverability

Data centres are air-conditioned and equipped with a CO2 fire suppression system.

Server infrastructures are protected against power outages by an uninterruptible power supply (UPS).

Data storage is protected against failure by redundant RAID systems.

Relevant server systems are secured as virtual machines in a cluster against server hardware failure.

All systems are backed up at least daily (application servers as a whole system and additionally at the application level for granular restoration).

All backups are stored encrypted at two geographically separate locations.

All systems are protected by up-to-date virus/malware scanners; signatures are updated several times daily.

Code execution takes place in isolated sandboxes; monitoring is self-hosted, with no external telemetry.

A disaster recovery concept exists for business-critical IT infrastructure; regular recovery tests are carried out.

4. Procedure for Regular Review, Assessment and Evaluation

Record of processing activities maintained and kept up to date; data protection contact: privacy@oneai.eu; data protection management system established.

Incident response management in place; employees bound to confidentiality and trained in data protection law.

5. Sub-Processor Control

Selection of sub-processors with particular regard to data protection and data security.

No processing by sub-processors without conclusion of a DPA (cf. Annex 1).

Note on legal validity: This Agreement is drafted in German and is solely legally binding. Any translations serve information purposes only.