Data Processing Agreement.

Data processing agreement for the use of "Noirdoc" between the Customer as controller (hereinafter "Controller") and Nextaim GmbH, Steinerstraße 15, Haus A, 81369 München, as processor (hereinafter "Processor").

Preamble

The Controller uses the LLM gateway "Noirdoc" provided by the Processor. The performance of the contract includes the processing of personal data. Art. 28 GDPR in particular sets out specific requirements for such processing on behalf of a controller. To meet these requirements, the parties conclude the following data processing agreement ("DPA").

The Controller may be a professional bound by secrecy within the meaning of § 203 StGB (German Criminal Code) (in particular a lawyer, tax advisor, auditor, notary or physician). Insofar as the Processor or the persons it engages come into contact with Protected Information of such Controllers in the course of providing the services, they act as other contributing persons within the meaning of § 203(3) sentence 2 StGB.

This DPA is concluded between the Controller and the Processor upon conclusion of the Main Contract. A separate signature is not required; the contract is concluded by registration on or use of the platform or by separate acceptance in text form.

1. Definitions

1.1 Controller, pursuant to Art. 4(7) GDPR, means the body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.2 Processor, pursuant to Art. 4(8) GDPR, means a body which processes personal data on behalf of the controller.

1.3 Personal data, pursuant to Art. 4(1) GDPR, means any information relating to an identified or identifiable natural person ("data subject").

1.4 Personal data requiring special protection means data pursuant to Art. 9 GDPR (including health data, data on racial/ethnic origin, political, religious or philosophical beliefs, trade union membership, genetic and biometric data, data concerning sex life) and data pursuant to Art. 10 GDPR relating to criminal convictions and offences.

1.5 Processing, pursuant to Art. 4(2) GDPR, means any operation performed on personal data, whether or not by automated means (including collection, storage, use, disclosure by transmission, erasure).

1.6 Supervisory authority, pursuant to Art. 4(21) GDPR, means an independent public authority established by a Member State pursuant to Art. 51 GDPR.

1.7 Protected Information means all information, data, documents and other content, including personal data and metadata, irrespective of form, storage medium or technical representation, that is subject to the Controller's statutory or professional duties of confidentiality, in particular secrets within the meaning of §§ 203, 204 StGB.

2. Competent supervisory authority

2.1 The competent supervisory authority for the Processor is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

2.2 The Controller and the Processor cooperate, on request, with the supervisory authority in the performance of its tasks.

3. Subject matter of the contract

3.1 The Processor provides the Controller with the LLM gateway "Noirdoc" on the basis of the Terms and Conditions or the individual usage contract ("Main Contract"). The Processor processes the inputs transmitted by the Controller (prompts, file attachments where applicable) exclusively to generate an inference via the managed models ("Managed Models") and to return the result. In doing so, the Processor may obtain access to personal data and processes such data exclusively on behalf of and on the instructions of the Controller. The assessment of the lawfulness of the data processing is the responsibility of the Controller.

3.2 The parties conclude this agreement to specify their mutual rights and obligations under data protection law. In case of doubt, the provisions of this agreement take precedence over the provisions of the Main Contract.

3.3 The provisions of this contract apply to all activities connected with the Main Contract in the course of which the Processor, its employees or persons engaged by it come into contact with personal data originating from the Controller or collected on its behalf.

3.4 The term of this contract corresponds to the term of the Main Contract, unless the following provisions give rise to obligations or termination rights extending beyond it.

3.5 No use for training. The Processor does not use the inputs or the generated outputs for training, fine-tuning or otherwise improving AI models. The Processor contractually ensures that the subprocessors engaged (Annex 4) do not use the content for such purposes either.

3.6 Purpose limitation (inference only). Processing takes place exclusively to execute the respective request and, in the cases set out in Annex 6, for the purposes stated there. No analysis, profiling or other secondary use of the content takes place. The plaintext of the request is processed by the Processor transiently in working memory and is not stored permanently; only the technical metadata pursuant to Annex 1 are processed permanently. The exceptions under Annex 6 remain unaffected.

3.7 Abuse monitoring. Where a managed provider carries out abuse monitoring, including any human review of flagged content, this is disclosed in Annex 4. For the Managed Models, the Processor relies on deployments within the EU (e.g. EU Data Zone or German region) and, where available, seeks restricted abuse monitoring without content storage and without human review.

3.8 Own provider keys (BYOK). Where the Controller uses its own keys for external providers, it engages the respective model provider directly itself. To that extent, this provider is not a subprocessor of the Processor; in this case, the Processor processes only the forwarding (routing) and the associated metadata.

3.9 The Processor, its employees and subprocessors may obtain knowledge of Protected Information only to the extent necessary for the performance of the contractually agreed services.

4. Right to issue instructions

4.1 The Processor may process data only within the scope of the Main Contract and in accordance with the instructions of the Controller; this applies in particular with regard to transfers to a third country. If the Processor is required by Union or Member State law to carry out further processing, it informs the Controller of these requirements before the processing.

4.2 The instructions are initially laid down by this contract and the Terms and Conditions (initial instruction: processing exclusively for inference, clause 3) and may subsequently be changed in text or written form by individual instructions. The persons authorised to issue instructions are set out in Annex 5.

4.3 All instructions must be documented by both parties. Instructions that go beyond the service agreed in the Main Contract are treated as a request for a change of service.

4.4 If the Processor considers that an instruction infringes data protection provisions, it informs the Controller thereof without undue delay. It may suspend execution until the instruction is confirmed or changed and may refuse an obviously unlawful instruction.

4.5 The Processor informs the Controller without undue delay of any doubts as to the content and scope of the duty of confidentiality under § 203 StGB and follows the Controller's instructions in this respect.

4.6 Settings that the Controller makes in the customer account, and parameters with which it requests a function in an individual request, are deemed individual instructions in text form within the meaning of clause 4.2; they are attributable to the Controller irrespective of Annex 5. Documentation pursuant to clause 4.3 takes place for settings in the customer account; individual request parameters are not documented separately.

5. Type of data, categories of data subjects

5.1 The content of the inputs is determined solely by the Controller. The data processed in the course of execution may therefore contain any category of personal data, including special categories under Art. 9 GDPR and data under Art. 10 GDPR, insofar as the Controller transmits such data. The Controller is responsible for the lawfulness and necessity of this transmission. The types of data are described in more detail in Annex 1.

5.2 The categories of data subjects are set out in Annex 2.

6. Protective measures of the Processor

6.1 The Processor complies with the statutory data protection provisions and, taking into account the state of the art, secures documents and data against access by unauthorised persons.

6.2 The Processor takes all necessary technical and organisational measures (TOMs) for the appropriate protection of the data pursuant to Art. 32 GDPR, at least the measures listed in Annex 3; this includes in particular that the plaintext of the request is not stored permanently unless Annex 6 provides otherwise (clause 3.6). The Processor reserves the right to change the measures, provided that the protection does not fall below the agreed level.

6.3 Mr Denis Amedov is appointed as the Processor's contact person for data protection.

6.4 The Processor obliges all persons entrusted with the processing to maintain confidentiality (Art. 28(3)(b) GDPR) and ensures compliance with due care; the obligation continues to apply after the end of the contract. Proof is provided on request.

6.5 The Processor obliges all persons who may come into contact with Protected Information in the course of providing the services in text form to maintain confidentiality. The obligation is imposed before they take up their activity. The Processor provides the Controller with proof of the obligation on request. In addition, the parties may conclude a separate confidentiality agreement on professional secrets; this applies cumulatively with the foregoing provisions.

6.6 The Processor is aware that a breach of the duty of confidentiality by the persons working for it may be punished under § 203(4) sentence 1 StGB with imprisonment of up to one year or a fine. The Processor is further aware that it is itself liable to punishment under § 203(4) sentence 2 no. 2 StGB if it makes use of further contributing persons and has not ensured that they have been bound to secrecy. Under § 203(6) StGB, the penalty increases to imprisonment of up to two years or a fine if the offender acts with the intent to enrich or to harm.

7. Information obligations of the Processor

7.2 The Processor takes the necessary measures to secure the data and to mitigate adverse consequences without undue delay, informs the Controller and requests further instructions.

7.3 The Processor provides the Controller with information at any time insofar as the Controller's data are affected by a breach.

7.4 If the Controller's data are endangered by attachment, seizure, insolvency proceedings or measures of third parties, the Processor informs the Controller without undue delay, unless prohibited from doing so by a court or official order, and notifies the competent bodies that the sole authority to decide on the data rests with the Controller.

7.5 The Processor informs the Controller without undue delay of material changes to the security measures (clause 6.2).

7.6 A change of the contact person for data protection is notified without undue delay.

7.7 The Processor maintains a record of the processing activities carried out on behalf of the Controller pursuant to Art. 30(2) GDPR and makes it available on request; it assists to an appropriate extent in drawing up the Controller's record.

7.8 The Processor is aware that Protected Information in its custody may be subject to the prohibition of seizure under § 97(2) StPO (German Code of Criminal Procedure). Protected Information may not be handed over without the Controller's consent. In the event of a seizure, the Processor objects to the measure and informs the Controller without undue delay.

7.9 The Processor is aware that Protected Information may be subject to the Controller's right to refuse to testify under § 53a StPO and that the professional bound by secrecy decides on the exercise of this right. In the event of an official examination, the Processor objects with reference to § 53a StPO and informs the Controller without undue delay so that the Controller can decide on the exercise of the right to refuse to testify.

8. Audit rights of the Controller

8.1 The Controller satisfies itself of the technical and organisational measures before the start of processing and regularly thereafter. Proof is provided primarily by information, certificates or attestations (e.g. ISO 27001, SOC 2, BSI C5) or internal audits; in addition, the Controller may, after timely coordination and during normal business hours, carry out audits itself or through a competent third party who is not a competitor, without disproportionately disrupting operations.

8.2 On request, the Processor provides, within a reasonable period, all information and evidence necessary to audit the measures.

8.3 The Controller documents the audit result, communicates it to the Processor and points out any errors identified or necessary changes to procedures without undue delay.

8.4 On request, the Processor provides a current data protection and security concept.

9. Engagement of subprocessors and transfers

9.1 The subprocessors named in Annex 4 are approved. The Processor is authorised to engage further subprocessors; it selects subprocessors carefully according to suitability and reliability, imposes on them the data protection obligations under Art. 28(4) GDPR and ensures that the Controller can also exercise its rights (in particular audit and inspection rights) vis-à-vis the subprocessors. If the engagement takes place in a third country, the Processor ensures an adequate level of data protection (e.g. EU standard contractual clauses).

9.2 Insofar as subprocessors may come into contact with Protected Information in the course of providing the services, the Processor obliges them in text form to maintain confidentiality before engaging them.

9.3 Change of subprocessors. If the Processor intends to add or replace a subprocessor, it notifies the Controller thereof actively and at least 14 days in advance in text form (e.g. by email notification). The Controller may object to the change within 14 days on legitimate grounds relating to data protection. If no mutually agreed solution can be found, the Controller has the right to suspend or terminate the service concerned.

9.4 A subprocessing relationship requiring approval does not exist in the case of purely ancillary services (e.g. telecommunications, postal or cleaning services without a specific connection to the services provided for the Controller).

9.5 Place of processing. The Managed Models are processed exclusively within the EU or the EEA; to that extent, no transfer to a third country takes place. Where the Controller uses its own provider keys (BYOK, clause 3.8), the Controller itself instructs the transfer to its provider and is responsible for compliance with Chapter V GDPR.

9.6 Insofar as the Processor engages subprocessors established outside Germany, it ensures that the protection of Protected Information there is comparable to the domestic level of protection (§ 43e(4) Federal Lawyers' Act (BRAO), § 62a(4) Tax Advisory Act (StBerG)). For subprocessors established in a Member State of the European Union or of the European Economic Area, comparability of the level of protection is presumed.

10. Obligations of the Controller as a professional bound by secrecy

10.1 The Controller is responsible for the lawfulness of the transmission of Protected Information and for compliance with the statutory and professional requirements applicable to it. It ensures that suitable technical and organisational protective measures have been implemented before processing by the Processor. These include in particular, insofar as technically and legally appropriate for the respective operating model, pseudonymisation, encryption, tokenisation or functionally equivalent measures.

10.2 The Processor is not obliged to check the lawfulness of individual data transmissions or compliance with authorisations to disclose under professional law, and may rely on the fulfilment of the foregoing obligations unless it is aware of specific indications of non-compliance.

10.3 The Controller warrants that it has provided truthful information on its professional status during registration. It bears sole responsibility for the consequences of incorrect information.

10.4 The Controller indemnifies the Processor against all claims by third parties and against reasonable costs of legal defence insofar as these are based on a breach of the obligations under clause 10.1 or on the Controller having transmitted Protected Information without the required legal basis. This does not apply insofar as the claim is based on a breach of duty for which the Processor is responsible.

11. Requests and rights of data subjects

11.1 The Processor assists the Controller, where possible, with appropriate technical and organisational measures in fulfilling the Controller's obligations under Art. 12 to 22 and 32 and 36 GDPR.

11.2 If a data subject asserts rights directly against the Processor, the Processor refers the data subject to the Controller without undue delay and awaits the Controller's instructions.

12. Liability

12.1 The liability of the parties towards data subjects is governed by Art. 82 GDPR. In the internal relationship, each party is liable for the part of the damage that results from a breach of duty attributable to it. A party is exempt from liability in the internal relationship if it proves that it is not in any way responsible for the event giving rise to the damage (Art. 82(3) GDPR).

12.2 Insofar as the damage results from the Controller having transmitted inadmissible or incorrect data or having breached its obligations as controller (in particular under clause 10), the Controller indemnifies the Processor against claims by data subjects or third parties, including reasonable costs of legal defence.

12.3 The Processor's liability for contractual breaches of duty under this DPA is limited to intent and gross negligence, unless mandatory law (in particular Art. 82 GDPR) provides for more extensive liability. The limitations of liability and liability caps of the Main Contract (Terms and Conditions) apply in addition, insofar as they do not conflict with Art. 82 GDPR.

13. Right of extraordinary termination

13.1 The Controller may terminate the Main Contract in whole or in part without notice if the Processor fails to comply with its obligations under this contract, intentionally or grossly negligently infringes provisions of the GDPR, or cannot or will not carry out an instruction.

13.2 In the case of simple breaches, the Controller sets a reasonable period for remedy.

14. Termination of the Main Contract

14.1 After termination of the Main Contract or on request, the Processor, at the Controller's option, returns or erases all documents and data provided, unless there is a statutory obligation to retain them; this also applies to any backups. Insofar as immediate erasure from backups is not technically possible, it takes place when they are routinely overwritten; until then, the data remain blocked. As content data are stored beyond the individual request only in the cases set out in Annex 6 (clause 3.6), this otherwise concerns account data and metadata. The Processor provides proof of proper erasure on request.

14.2 The Controller has the right to verify, in a suitable manner, the complete return or erasure in accordance with the contract.

14.3 The Processor treats the data that have come to its knowledge in connection with the Main Contract as confidential even after its end. This agreement remains valid for as long as the Processor holds personal data of the Controller.

14.4 The duty of confidentiality regarding Protected Information within the meaning of clause 1.7 applies without time limit, i.e. also after termination of the Main Contract and irrespective of the reason for termination.

15. Final provisions

15.1 Amendments and supplements to this agreement require text form; the precedence of individual contractual agreements remains unaffected. The Processor announces amendments to this DPA, in particular to adapt it to a change in the legal situation, to the Controller in text form at least 30 days before they take effect. The Controller may object within 30 days on legitimate grounds relating to data protection; if no mutually agreed solution is reached, it may suspend the service concerned or terminate it extraordinarily (in accordance with clause 9.3).

15.2 Should individual provisions be invalid or unenforceable, the validity of the remaining provisions remains unaffected.

15.3 This agreement is governed by German law. The exclusive place of jurisdiction is Munich.

15.4 The Processor expressly acknowledges all rights and obligations arising from its status as another contributing person within the meaning of § 203(3) sentence 2 StGB.

Annexes

Annex 1: Description of the data concerned / categories of data

• Content dataInputs (prompts, file attachments where applicable), generated outputs and the mappings of placeholders to original values created during masking (Annex 6 No. 1). These may contain any category of personal data entered by the Controller, including special categories (Art. 9 GDPR) and data under Art. 10 GDPR. Content data may at the same time be Protected Information within the meaning of clause 1.7. Content data are processed transiently and stored beyond the individual request only in the cases set out in Annex 6 (clause 3.6).
• Account and authentication dataName, business email address, roles, session information.
• Usage data and metadataTimestamp, tenant and key identifier, requested model, token consumption, audit logs.

Annex 2: Description of the data subjects / categories of data subjects

• employees of the Controller;
• customers, clients, patients or other business contacts of the Controller;
• end users of the Controller's applications;
• all other natural persons named in the inputs.

Annex 3: Technical and organisational measures of the Processor

The Processor takes at least the following measures:

• Confidentiality
  • Operation in German data centres (T-Systems International GmbH, T Cloud Public, ISO 27001)
  • Role-based access control following the principle of least privilege
  • Multi-factor authentication for all administrative access
  • Obligation of employees to maintain confidentiality, including the confidentiality undertaking under clause 6.5
  • Masking (pseudonymisation) of personal data, where the Controller enables it (Annex 6 No. 1)
• Integrity
  • Encryption in transit (TLS 1.2+)
  • Audit logging of security-relevant access
  • No permanent storage of the plaintext of the request outside the cases set out in Annex 6 (clause 3.6)
• Availability and resilience
  • Measures to protect against failure and unauthorised access
  • Operational monitoring (monitoring, alerting)
• Recoverability
  • Procedures for restoring availability after an incident
• Procedures for regular review
  • Regular assessment of the effectiveness of the measures
  • Regular vulnerability analyses (vulnerability scans)

Annex 4: Approved subprocessors within the meaning of clause 9

Section A: Subprocessors bound to confidentiality

Subprocessor	Address	Service	Processing
T-Systems International GmbH	AddressFriedrich-Ebert-Allee 140, 53113 Bonn, Germany	ServiceOperation of the gateway and the website (T Cloud Public)	ProcessingProcessing in Germany.
Microsoft Ireland Operations Limited	AddressOne Microsoft Place, South County Business Park, Dublin 18, Ireland	ServiceProvision of managed frontier models (Azure OpenAI, EU Data Zone)	ProcessingProcessing in the EU.
NoteIn standard operation, abuse monitoring with storage of flagged content and human review (by reviewers in the EEA) may take place; the Processor seeks restricted abuse monitoring without content storage (clause 3.7).
AKI.IO GmbH	AddressMarienburger Str. 1, 10405 Berlin, Germany	ServiceProvision of managed open-weight models	ProcessingProcessing in Germany.
IONOS Cloud GmbH	AddressElgendorfer Str. 57, 56410 Montabaur, Germany	ServiceProvision of managed open-weight models	ProcessingProcessing in German data centres.
Google Cloud EMEA Limited	AddressVelasco, Clanwilliam Place, Dublin 2, Ireland	ServiceProvision of managed frontier models (Google Vertex, EU Data Zone)	ProcessingProcessing in the EU.
NoteIn standard operation, abuse monitoring with storage of flagged content and human review (by reviewers in the EEA) may take place; the Processor seeks restricted abuse monitoring without content storage (clause 3.7).
weber.digital GmbH	AddressZollernstraße 49, 72336 Balingen, Germany	ServiceProvision of managed open-weight models	ProcessingProcessing in German data centres.
TensorX Ltd.	AddressUnit 25, Classon House, Dundrum Business Park, Dublin 14, Ireland	ServiceProvision of managed open-weight models	ProcessingProcessing in the EU/Ireland/Finland.

All of the aforementioned subprocessors are bound in text form to maintain confidentiality regarding Protected Information (clause 9.2).

Section B: Subprocessors not bound to confidentiality

Subprocessor	Address	Service	Processing
Infercom SCS	Address29 Boulevard Grande-Duchesse Charlotte, 1331 Luxembourg	ServiceProvision of managed open-weight models	ProcessingProcessing in the EU/Germany.
Seeweb S.r.l. (Regolo.ai)	AddressVia Armando Vona, 66, 03100 Frosinone (FR), Italy	ServiceProvision of managed open-weight models	ProcessingProcessing in the EU/Italy.

These subprocessors are used exclusively for customers that are not professionals bound by secrecy within the meaning of § 203 StGB and therefore do not come into contact with Protected Information. A confidentiality obligation under clause 9.2 is not required to that extent.

Providers engaged when the Controller uses its own provider keys (BYOK) (e.g. OpenAI, Anthropic, OpenRouter) are not subprocessors of the Processor (clause 3.8). Changes to this list are notified in accordance with clause 9.3.

Annex 5: Persons authorised to issue instructions

Persons authorised to issue instructions on the part of the Controller:

Unless other persons are recorded in the customer account, the persons authorised to issue instructions on the part of the Controller are the person who concluded the Main Contract on behalf of the Controller and the persons designated by that person in text form. Where the Controller is a legal entity, the bodies authorised to represent it are additionally authorised to issue instructions, unless a different designation has been made in the customer account. The Controller may designate or change persons authorised to issue instructions at any time in text form or in the customer account.

Recipients of instructions at the Processor:

Person	Role	Email
Mr Denis Amedov	RoleManaging Director	Emailhello@noirdoc.de
Mr Antonio Maiolo	RoleManaging Director	Emailhello@noirdoc.de

Deputy arrangement: if the designated recipient of instructions is unavailable, their deputy is authorised to receive instructions. The Processor notifies the Controller of any change or deputy arrangement without undue delay in text form. Until such notification is received, the persons last designated are deemed authorised to receive instructions.

Data protection officer of the Processor (where different from the recipient of instructions): currently not separately appointed; the function is performed by the contact person for data protection (clause 6.3).

Annex 6: Retention of content data

(1) Content data within the meaning of Annex 1 are processed transiently and, after completion of the respective request, are stored neither by the Processor nor by the subprocessors. The only exceptions are the cases in Sections A and B of this Annex, in each case to the extent and for the duration stated there.

(2) The cases in Section A arise only if the Controller uses the respective function in the customer account or in the individual request. This constitutes an instruction within the meaning of clause 4.6.

Section A: Storage when certain functions are used

• No. 1 Masking mappings. If the Controller uses masking (via the setting in the customer account or in the individual request), the Processor stores the mapping of the placeholders to the original values in encrypted form. This ensures that subsequent requests in the same conversation receive the same placeholders and that responses can be translated back. The Controller selects the duration in the customer account; unless a different selection is made, it is 30 days. When the duration expires, the mappings are deleted automatically.
• No. 2 Stored responses. If the Controller enables storage with the provider in the customer account, the Processor forwards the storage parameters of requests that provide for storage with the provider to the subprocessor under Annex 4 used in each case. That subprocessor stores inputs and responses for a maximum of 30 days.
• No. 3 Uploaded files and skills. If the Controller uploads files or skills via the interfaces provided for this purpose, the subprocessor under Annex 4 used in each case stores them until the Controller deletes them, at the latest until termination of the Main Contract (clause 14.1).
• No. 4 Batch jobs. If the Controller submits several requests as a batch job, the Processor or the subprocessor under Annex 4 used in each case stores the inputs and results until the Controller deletes them, at the latest 30 days after submission of the batch job.

Section B: Storage without action by the Controller

• No. 5 Abuse monitoring. Individual subprocessors may store flagged content as part of their abuse monitoring and have it reviewed by humans. The subprocessor determines the scope and duration (clause 3.7).