# Data Processing Agreement for Brixovo

**Version 0.1 · 24 September 2026 · DRAFT – not ready for use without completed annexes**

## Parties and Allocation of Roles

**Customer:** [TENANT: full name/company name, legal form, address, representation, data protection contact]

**Contractor:** Martin Tomczak, Holstenstraße 3d, 25560 Schenefeld, Germany, trading as Brixovo. Data protection contact: [APPROVAL: contact address].

**Main Contract:** [CONTRACT ID, date and scope of services].

**Customer's role, to be determined for each processing activity:** [Controller / processor acting on behalf of named controllers].

> This contract template has been prepared for the SaaS service operated by Brixovo, not for a self-hosted kit licence. Annexes A–D form part of the contract and must reflect the actual operational circumstances. The older files in the parent directory are not implicitly incorporated.

## § 1 Subject Matter, Purpose and Duration

1. The Contractor processes personal data exclusively to provide the platform services agreed in the Main Contract and specified in Annex A. Processing operations may include, in particular, collection, storage, organisation, extraction, indexing, retrieval, transmission to approved model and infrastructure partners, generation, display, export, restriction and deletion.

2. The engagement covers only the functions actually booked: where applicable, knowledge processing and chat, widgets, websites and contact enquiries, approved integrations and automations, and associated administration and technical support. No blanket authorisation for any further purposes is granted.

3. The contract begins before processing on behalf of the Customer starts and applies throughout its duration, including agreed return, switching and deletion phases. It ends only when no data to be processed on behalf of the Customer remains with the Contractor or its subprocessors, except where a statutory retention obligation precludes this.

4. The Contractor's own processing for contract billing, its own statutory obligations and other self-determined purposes is permissible only on its own valid legal basis and must be made transparent separately. Classification as “security” or “metadata” does not automatically remove data from the scope of data protection law.

## § 2 Roles in the Processing Chain

1. If the Customer is a controller, it determines the purposes and essential means of processing within the statutory framework. If it is itself a processor for an end customer, it engages Brixovo as a subprocessor only on the basis of the relevant authorisation and permissible instructions from its own customer.

2. The Customer documents the controllers and permissible instruction channels in Annex A. It passes the applicable obligations along the chain. Brixovo supports the necessary rights to evidence and audit of the ultimate controller without opening up unauthorised direct access to other customers.

3. Consumers who purchase services for private purposes are not, for that reason alone, controllers of data processing carried out by the Tenant for its own contractual purposes. Roles are determined for each processing activity, not solely on the basis of the account name.

## § 3 Instructions

1. The Contractor processes data only on documented instructions, including with regard to transfers to third countries. Where a statutory processing obligation exists, it informs the Customer of that obligation before processing, unless the law prohibits this on important grounds of public interest.

2. Initial instructions arise from the Main Contract, this contract and the completed annexes. Further instructions may be issued in text form or through an agreed documented administration process. Permissible configurations constitute instructions only within the agreed purpose; the mere technical availability of a setting does not extend the engagement.

3. If the Contractor considers an instruction unlawful, it informs the Customer without undue delay and suspends the affected operation until the matter has been lawfully resolved. Mere confirmation of an instruction that remains unlawful does not create an obligation to execute it.

4. Persons authorised to issue instructions and contact persons are named in Annex D. Special measures such as exports, deletions, support access and approval of external recipients require an appropriate permissions check.

## § 4 Confidentiality and Security

1. Before taking up their duties, persons authorised to process data are committed to confidentiality or are subject to an appropriate statutory duty of confidentiality. Access is granted on a need-to-know basis. The obligation continues after the end of the contract.

2. The Contractor implements the technical and organisational measures specifically described in Annex B. Taking into account the state of the art, costs, and the nature, scope, context and purposes of processing, the measures ensure an appropriate level of protection. The mere existence of a software function is not evidence of its secure operation.

3. Changes to the measures are permitted provided that the agreed level of protection is not reduced. Material changes are documented and communicated where necessary. The Contractor regularly reviews effectiveness, recoverability and necessary adaptations.

4. Pseudonymised identifiers, hash values and event metadata may still be personal data. Automatic PII detection is not complete anonymisation; its limits and the processing paths covered must be stated accurately in Annex B.

5. Processing Tenant content to train generally usable models or for the Contractor's own advertising is not part of this engagement. The Contractor binds the partners it uses accordingly and checks the actual contractual and configuration situation. No different optional processing may be deemed authorised by this clause.

## § 5 Subprocessors and Recipients

1. General authorisation is granted for the subprocessors fully named in Annex C at contract formation. New or replacement subprocessors must be notified before their use begins. **Contract proposal:** Notification is generally given at least 30 calendar days before the intended use; the Customer is given an opportunity to raise a reasoned objection on data protection grounds before use begins.

2. The parties examine an objection and seek a suitable alternative. A new service provider that has been objected to is not used for the affected processing until the objection has been lawfully resolved. If continuation without that provider is not possible, a separate agreement or orderly termination of the affected service is required. Advance payments for services no longer provided thereafter must be accounted for and refunded.

3. The Contractor imposes at least the same applicable data protection obligations on the subprocessor and remains responsible to the Customer for their fulfilment. It verifies sufficient guarantees and provides necessary evidence.

4. Transfers outside the EEA require fulfilment of the requirements of Chapter V GDPR. Recipients, countries, transfer basis, any supplementary measures and the transfer assessment are documented in Annex C. An EU storage region alone does not prove that all access from third countries is excluded.

5. Integration destinations independently selected by the Customer must be classified according to their actual function as subprocessors, independent controllers or other recipients. The Contractor must not execute instructions for a recognisably unlawful transfer without review. Maintenance or support is not categorically excluded from the concept of subprocessing.

## § 6 Data Subject Rights, Incidents and Assistance

1. The Contractor assists the Customer through appropriate technical and organisational measures with access, rectification, erasure, restriction, data portability and other data subject rights. Requests received directly are forwarded to the responsible Customer without undue delay, unless the Contractor has its own statutory obligation.

2. Identity and authority are checked appropriately. Data of other data subjects, Tenants or customers must not be disclosed without authorisation. Statutory deadlines are not extended by internal ticket or payment processes.

3. The Contractor notifies the Customer of every personal data breach of which it becomes aware **without undue delay**. An investigation of the facts that is still incomplete must not delay the initial notification. Missing details are provided in stages. The parties may agree an additional specific response-time target; no unverified operational commitment of 24 or 48 hours is deemed to be given here.

4. To the extent available, the notification contains the nature and extent of the incident, affected data and groups of persons, likely consequences, measures taken and proposed, and a contact for queries. The Contractor secures necessary evidence in accordance with data minimisation and assists with the controller's reports and notifications.

5. In accordance with the information available to it and its processing, the Contractor assists with compliance with obligations relating to security, data protection impact assessments and, where applicable, prior consultation. The Contractor's own statutory obligations remain in place.

6. Assistance owed by law is not made dependent on an advance special payment. Separate additional services beyond what is owed require a transparent offer; no additional fees are agreed for consequences of the Contractor's own breaches of duty.

## § 7 Evidence and Audits

1. The Contractor provides all information necessary to demonstrate compliance with its obligations and allows audits, including inspections, by the Customer or a suitable auditor commissioned by it. Certificates of infrastructure partners do not replace evidence of the Contractor's own organisational measures.

2. As a rule, audits are coordinated with reasonable advance notice, subject to confidentiality and with the least possible disruption to operations. This neither restricts urgent audits prompted by specific circumstances, statutory rights or authorities' powers, nor limits them to once a year.

3. Data and trade secrets of other customers, as well as security and confidentiality, must be protected. Alternative evidence may be agreed to the extent that it actually enables the required audit. No general waiver of audit rights is agreed.

4. The Contractor maintains the records and documentation required by law and appoints a data protection officer where required. The obligation to appoint one and an actual appointment are not asserted without verification.

## § 8 Return, Deletion and Retention

1. After completion of the processing services, at the Customer's choice, the Contractor returns the data and deletes existing copies or deletes the data, unless a statutory storage obligation precludes this. Provider switching and retrieval periods are coordinated with the permissible instruction; the DPA continues to apply during this time.

2. Annex B contains specific deletion periods and mechanisms for original files, search indexes and embeddings, chats, leads, automation data, logs, caches and backups. Mere logical deletion does not constitute complete destruction. External recipients must be included in accordance with the permissible engagement.

3. Legally necessary evidence is stored separately, with restricted access and only for as long as necessary. A hash chain or the label “compliance” does not create a blanket retention exception for personal data. The Contractor documents deletion or legally necessary residual retention and provides evidence on request.

## § 9 Liability and Final Provisions

1. The statutory rights of data subjects and liability under Art. 82 GDPR remain unaffected. The parties cannot exclude their statutory responsibility through a role designation. Mandatory obligations towards other parties involved remain in place.

2. For other contractual claims, the liability provisions of the Main Contract apply only to the extent that no mandatory law precludes this. This provision does not reduce the necessary protection, cooperation and evidence obligations.

3. This contract takes precedence in data protection matters. Individual agreements and mandatory standard contractual clauses retain precedence. The contract, including its annexes, may be concluded in a documented electronic format. In the event of invalidity, the statutory legal consequences apply.

---

## Annex A – Specific Processing Engagement

**Mandatory details, to be completed before use:**

| Field | Entry |
|---|---|
| Main Contract and enabled modules | [COMPLETE] |
| Controller or controllers for each processing activity | [COMPLETE; in a processing chain, document their authorisation] |
| Purpose of the respective processing activity | [COMPLETE; no blanket approval of all customer purposes] |
| Data subjects | [Selection: administrators/employees, end customers, visitors, contacts, persons referred to in documents] |
| Actual types of data | [Selection: master/contact data, document content, chat, leads, technical IDs, contract/billing references, action data] |
| Special categories/criminal data/professional secrets | Excluded as standard; special cases only with a specific agreement |
| Time frame | [Start, Main Contract duration, winding-up phase] |
| Permitted recipients and integration destinations | [COMPLETE] |
| Countries of processing and access | [COMPLETE; not just storage location] |

## Annex B – Technical and Organisational Measures and Deletion Directory: Completion and Evidence Matrix

**This table is an approval form, not yet a fully agreed description of technical and organisational measures. Enter specific measures and evidence for each row; close all gaps before use.**

| Area | To be specifically determined and evidenced |
|---|---|
| Physical operations | Data centres/contracting party, locations, physical access concept, verified certification references |
| Administrative access | Responsible persons, MFA rule, secure emergency access, employee departures |
| Tenant separation | Permission boundaries, tests, protection of downloads/exports/indexes and support access |
| Encryption | Transport, databases, object storage, backups, responsibility for keys and rotation |
| Integrations | Secret storage, minimum scopes, recipient approvals, revocation of permissions and safe retries |
| AI processing | Model/endpoint approvals, regions, partners' content retention, exclusion of training, PII limits |
| Logging | Actual event fields, access, purpose, storage location and deletion period; consider personal metadata |
| Availability and recovery | Backup scope/frequency, recovery targets, restoration tests, outage/emergency organisation |
| Vulnerabilities and changes | Updates, reviews, approvals, operational checks, protection of secrets |
| Data subject rights | Identity checks, responsibilities, export/deletion paths across all storage systems |
| Incidents | Monitored reporting channel, on-call/deputy arrangements, initial notification, escalation and follow-up |
| Content deletion | Documents, files, chunks, embeddings, chat, leads, templates, action content: specific period for each category |
| Backup deletion | Maximum period, protection against reuse in production, handling of restoration |
| Statutory retention | Specific data category, legal basis, duration and deletion after expiry |

## Annex C – Subprocessors and Transfers

**Enter only partners actually used. Candidates in the repository are not an approved live list.**

| Contracting party with address | Service/data type | Countries of storage and access | Data processing agreement/transfer basis | Measures/evidence |
|---|---|---|---|---|
| [Microsoft: specific contracting entity] | [Specific Azure services/model service] | [COMPLETE] | [Contract version, where applicable SCC/adequacy] | [COMPLETE] |
| [Email/support/monitoring partners, to the extent actually used] | [COMPLETE] | [COMPLETE] | [COMPLETE] | [COMPLETE] |
| [Other partners actually used] | [COMPLETE] | [COMPLETE] | [COMPLETE] | [COMPLETE] |

Stripe must be classified separately for each service and processing activity; a blanket classification of all payment, fraud-checking and statutory operations as subprocessing would not be supportable. Processing as an independent controller must be addressed in the appropriate privacy notices.

## Annex D – Contacts and Contract Conclusion

- Customer's authorised instruction-givers: [Name/function/contact].
- Contractor's instruction recipients: [Name/function/contact].
- Incident contact including deputy: [COMPLETE].
- Data protection officer, if appointed: [COMPLETE or correctly state not appointed].
- Version identifiers of all annexes: [COMPLETE].
- Documented electronic consent or signatures of both parties with date and authority to represent: [COMPLETE].