Data Processing Agreement (Product Demo)

Preamble

The Client tests the software "dAi Pro" in a free, time-limited demo environment. For this purpose, the Client designates up to three addresses of its own website; the Contractor reads out the content linked there, makes it queryable via an AI assistant, and provides the Client with a test interface. Since the content read out and the test inputs may contain personal data, the Contractor processes this data on behalf of the Client. This agreement governs the processing pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR).

§ 1 Contracting Parties

Client (Controller): the person or company that requests the demo via the order form (hereinafter "Client"). The data provided in the form (name, company, email address) shall be decisive.

Contractor (Processor): Joachim Dreistein, Medienentwicklung, Bolkerstraße 14, 40213 Düsseldorf, Germany, email: info@dreistein.de (hereinafter "Contractor").

§ 2 Subject Matter and Duration of Processing

1. The subject matter is the operation of a demo environment of the software "dAi Pro": reading out the websites and PDF documents designated by the Client (text only, up to 50 pages, link depth 1), conversion into a searchable knowledge base (full-text and vector index), answering of test questions by an AI language model (text and voice), as well as logging of the test conversations for functionality control.
2. The agreement begins with acceptance in the order form and ends automatically with the complete deletion of the demo environment – no later than seven days after setup. The Client may request deletion at any time beforehand (an email to info@dreistein.de is sufficient).
3. After deletion, the Client will receive an unsolicited confirmation of deletion at the email address provided.

§ 3 Type of Data and Categories of Data Subjects

1. Types of data: content of the websites and PDF documents designated by the Client, insofar as they contain personal data (e.g. names and contact details of employees, authors, reference customers); test inputs in the demo chat (text) including the responses generated therefrom; when using voice input: voice recordings of test users for the duration of the conversion into text (transcription); technical log data of the test conversations (timestamp, question, answer, pseudonymized IP address).
2. Data subjects: persons whose data is published on the designated websites, as well as the test users of the demo determined by the Client.
3. Exclusion: the Client warrants that the designated content does not contain any special categories of personal data pursuant to Art. 9 GDPR. The demo is not intended for such data.

§ 4 Obligations of the Contractor

1. The Contractor processes the data exclusively for the purposes set out in § 2 and only on documented instructions from the Client (Art. 28(3)(a) GDPR). The configuration of the demo via the order form and the demo interface shall be deemed an instruction. If the Contractor becomes aware that an instruction violates data protection law, it shall inform the Client without undue delay.
2. Processing takes place exclusively on servers within the European Union; for exceptions regarding voice input, see § 6 and Annex C.
3. Persons authorized to carry out processing are bound to confidentiality (Art. 28(3)(b) GDPR). At the Contractor's premises, only the owner has access to the systems.
4. The Contractor implements the technical and organizational measures set out in Annex B (Art. 32 GDPR) and adapts them to the state of the art without falling below the level of protection.
5. The Contractor supports the Client, to the extent reasonable, in responding to data subject requests (Art. 12–23 GDPR) as well as with the obligations under Art. 32–36 GDPR. Given the seven-day term, this support will as a rule be fulfilled by the immediate deletion of the data concerned.
6. The Contractor shall report personal data breaches connected with the demo to the Client without undue delay at the email address provided in the form.
7. Upon the end of processing (§ 2(2)), the Contractor completely deletes all order data: knowledge base, files, conversation logs, access data, and the demo itself. No return of data takes place – the Client itself has the source content. The evidence of the conclusion of this agreement is retained without any personal reference (anonymized).
8. Statutory retention obligations remain unaffected; such data is blocked and deleted after the retention period expires.

§ 5 Evidence and Audits

1. The Contractor makes available to the Client the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular this agreement including its annexes as well as, upon request, a description of the measures implemented.
2. On-site audits are, given the free, seven-day test operation, limited to cases in which there are concrete indications of violations; they must be announced with reasonable notice and limited to what is necessary.

§ 6 Sub-processors

1. The Client generally authorizes the engagement of the sub-processors named in Annex C (Art. 28(2) GDPR).
2. The Contractor provides information about intended changes to Annex C on the demo order page. For ongoing demos, the following applies: if the Client objects to a change, the demo will be deleted immediately at its request – no further claim exists given the free-of-charge nature.
3. With each sub-processor there is a contract pursuant to Art. 28 GDPR that corresponds to the level of protection of this agreement.
4. Third-country notice on voice input: the conversion of spoken questions into text is carried out by Gladia SAS (France). Pursuant to their data processing terms, sub-processors in third countries (in particular the USA) may be used in the process; transfers are based on an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. Voice input is optional; the data of anyone who does not use it does not reach Gladia.

§ 7 Liability

The statutory provisions apply, in particular Art. 82 GDPR. In the internal relationship, the parties are liable in accordance with their respective share of responsibility.

§ 8 Final Provisions

1. This agreement is concluded electronically: the Client accepts it by checking the declaration in the order form; the timestamp and text version are logged (Art. 28(9) GDPR – electronic format).
2. In the event of conflicts with other arrangements regarding the demo, this agreement shall take precedence on data protection matters.
3. German law applies. Should a provision be invalid, the agreement shall otherwise remain valid.

Annex A – Processing in Detail

Annex B – Technical and Organizational Measures (Art. 32 GDPR)

1. Encryption: transmission exclusively via TLS (HTTPS/WSS).
2. Tenant separation: each demo receives its own, isolated database schema; access to the knowledge base only with a 64-character, randomly generated access key.
3. Access control: individual access credentials (user/password, bcrypt-hashed) per demo; backend in read-only mode (write protection at the application level); administration access only by the owner.
4. Pseudonymization: IP addresses are stored exclusively as a SHA-256 hash (abuse protection, proof of order).
5. Data minimization: only text is extracted; no image extraction, no file download option, no transfer into training data.
6. EU processing: hosting in Germany (IONOS); AI processing for demos technically enforced only via EU providers (Mistral AI, France) – demos without an EU-capable configuration are refused.
7. Deletion concept: automatic hourly deletion run; deletion covers schema, files, logs, usage data and access credentials; deletion confirmation to the client; repeatability in the event of partial failures; control tool for orphaned datasets.
8. Abuse protection: bot check in the order form, rate limiting per IP hash and domain, honeypot.
9. Availability/integrity: self-test of each demo after setup; logging of administrative runs.

Annex C – Sub-Processors

Cloudflare, Inc. (Turnstile bot protection in the order form) processes the orderer's data prior to the conclusion of the contract and is therefore listed in the privacy policy, not as a sub-processor under this agreement.