Terms of Use

Annex 1 — Data Processing Agreement (Art. 28 GDPR)

This annex forms part of these Terms and is concluded upon their acceptance between the Customer (hereinafter the “controller”) and Smartwebchat (hereinafter the “processor”). No separate conclusion is required; on request, Smartwebchat provides a signed copy in text form. Item 13 of the contract template (Annexes 2 to 4) is not brought into force in this version; the numbering of the remaining items is left unchanged so that it matches the template.

1. Subject matter, duration, nature and purpose of the processing. The subject matter is the operation of the Smartwebchat platform for the controller, in particular the operation of the chat assistant embedded by the controller, the storage of the controller's knowledge base and the generation of responses by means of AI language models. The sole purpose is the provision of the services described in Sections 2 and 4 of these Terms. Processing is automated and lasts for the term of the usage agreement, including the transition period under Section 11.

2. Types of data and categories of data subjects. The data processed comprises in particular chat inputs and conversation histories, contact details voluntarily provided (name, email address, telephone number), appointment and booking data, technical connection data and the knowledge base content uploaded by the controller. Data subjects are the controller's website visitors, prospects and customers, as well as the controller's employees insofar as they operate the platform. Special categories of personal data under Art. 9 GDPR are not the subject of the engagement. They may nevertheless occur because data subjects enter them into the chat unprompted; clause 8 applies in that case.

3. Instructions. The processor processes personal data exclusively on documented instructions from the controller. Instructions are given through the controller's configuration in the dashboard and, in addition, in text form to privacy@smartwebchat.eu. If the processor considers an instruction to be unlawful under data protection law, it shall inform the controller without delay and may suspend its execution. Processing for the processor's own purposes, in particular for training AI models, does not take place. For the sub-processors engaged under clause 6, the processor has opted out of the processing of the transmitted data for those providers' own training purposes, in so far as the respective provider offers such a choice; for Mistral AI SAS the opt-out has applied since 28 August 2026.

4. Confidentiality. The processor uses only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR). The processor maintains measures appropriate to the risk, in particular: transport encryption (TLS) for all connections; storage of credentials exclusively as a cryptographic hash; tenant-separated data storage with server-side verification of tenancy on every access; role-based access control with personal credentials; operation of the application, database and file storage in data centres within the Federal Republic of Germany, whereby backups may be replicated within the hosting provider's EU network zone; an automated deletion procedure for expired retention periods; and regular, encrypted backups with a documented restore test. The automated deletion procedure deletes conversation data — chat transcripts, ratings, conversation categories and triggered proactive triggers — 30 days after it arises, as it does the conversation extract, together with the stated handover reason, contained in a handover to a member of the controller's staff. Enquiries, appointment requests and handovers are deleted no later than the period the controller sets for each assistant in the dashboard; the default is 365 days. A handover in which, once the conversation extract has been cleared, neither a name nor an email address nor a processing note remains is deleted after 30 days. Security logs are deleted 30 days after they arise, and review-request dispatches together with the recipient address 90 days after their scheduled dispatch time, provided the dispatch has completed or failed. Processing by sub-processors is governed by item 6. The measures are subject to technical development; the processor may change them provided the level of protection is not reduced.

6. Sub-processors. The controller grants general authorisation for the use of the following sub-processors (Art. 28(2) GDPR):

• Hetzner Online GmbH, Gunzenhausen, Germany — hosting and data centre operations, processing in Germany; dispatch of emails from the processor's own mailbox (including notifications about enquiries and handovers).
• Mistral AI SAS, Paris, France — generation of chat responses and text embeddings; the default setting; processing within the EU.
• OpenAI Ireland Ltd., Dublin, Ireland — only where a premium OpenAI model has expressly been selected for the assistant concerned; the transfer to it takes place within the European Economic Area; clause 7 governs any onward transfer.
• Brevo GmbH, Berlin, Germany — dispatch of the request for a review to the controller's customers; processing within the EU.

The processor informs the controller in text form of intended changes to this list, giving four weeks' notice (Art. 28(2) sentence 2 GDPR). Within that period, the controller may object on important data protection grounds; if no agreement is reached, either party may terminate the usage agreement with effect from the date of the change. Every sub-processor is bound to a level of protection equivalent to that of this annex. Digistore24 GmbH is not a sub-processor; it acts as an independent controller within the scope of the purchase agreement.

6.1 The controller's own access keys. If the controller stores its own access key of the respective provider for a messaging channel (clause 6.4) or for a destination it has configured (clause 9), the contractual relationship with that provider exists between the controller and the provider. To that extent the provider is not a sub-processor of the processor, and the list in clause 6 does not apply to it. The controller concludes the contract required under Art. 28 GDPR itself and names the provider in its own privacy policy. This option does not exist for language models; responses are generated exclusively via the providers listed in clause 6.

6.2 Services expressly not covered. Under the data flow currently implemented, the following are not sub-processors: Digistore24 GmbH, Hanover — it acts as an independent controller within the purchase contract (Art. 6(1)(b) GDPR), as do its own service providers; Calendly, Inc. and Cal.com, Inc. — where the assistant offers appointment booking, it outputs a booking link which the data subject opens itself, and no data of the data subject is transmitted to those providers by the processor; and the providers of availability monitoring, source code management and deployment, because they have no access to personal data of data subjects. The classification follows the actual data flow rather than this list; if the possibility of access or the data transmitted changes, the processor reassesses it before the change and adjusts clause 6 where necessary.

6.3 Dormant integrations. The platform contains features that are not in operation, whose providers are therefore not sub-processors. Their activation by the processor requires a change to the list under clause 6 with four weeks' notice.

6.4 Channels using the controller's own provider key. The platform allows messaging channels to be connected — currently WhatsApp via a business solution provider established in the European Union. The controller enables the connection itself for each assistant and stores its own access key when doing so. clause 6.1 applies accordingly: the contractual relationship with the business solution provider and with the operator of the messaging service behind it exists between the controller and those companies. The controller concludes the required contracts itself and names both in its own privacy policy. For controllers under clause 8 the connection is blocked; for the controllers automatically classified there, the block is implemented technically.

7. Transfers to third countries. By default no transfer to a third country takes place; all processing under clause 6 occurs within the European Union. If the controller expressly selects a premium model for an assistant, the following applies: the recipient is OpenAI Ireland Ltd., established in Dublin; the transfer to it takes place within the European Economic Area. For any onward transfer to companies of the OpenAI group or to third parties outside the European Economic Area, OpenAI Ireland Ltd. has undertaken in the data processing agreement to rely on appropriate safeguards under Art. 46 GDPR or on an adequacy decision under Art. 45 GDPR; the processor discloses the basis applicable in the individual case on request and remains responsible for the selection of the sub-processor under Art. 28(4) GDPR. The selection constitutes an instruction of the controller within the meaning of clause 3; the controller assesses on its own responsibility whether it is permissible for the data it processes. Controllers under clause 8 are prohibited from making that selection; for the controllers automatically classified there, the block is implemented technically.

8. Special categories of personal data and professional secrecy. If the controller belongs to a healthcare profession or is subject to a duty of confidentiality under § 203 of the German Criminal Code, it is prohibited from selecting language models and messaging channels processing outside the European Union; for such a controller, processing remains limited to the providers named in clause 6 that process within the Union. The automatic classification based on the stored industry currently covers healthcare professions with a link to Art. 9 GDPR; for those, the restriction is enforced technically. It does not cover other professions bound by secrecy — in particular lawyers, notaries, tax advisers and auditors; they notify the processor of their duty of confidentiality in text form, whereupon the processor sets up the restriction for them as well. Until that notification is received, the restriction exists as a contractual prohibition without a technical block. Irrespective of this, the assistant is configured not to ask for health data and to remove such data before forwarding it to notifications. The controller works towards ensuring that data subjects do not transmit data under Art. 9 GDPR via the assistant. The controller's obligations under § 203(4) of the German Criminal Code and under its professional law remain unaffected.

9. Destinations configured by the controller. The controller may configure destinations to which the processor transmits data: a Slack address to which, upon handover to a human, the name, the contact details, the reason, a pseudonymous session identifier and the last messages of the conversation verbatim are sent; a webhook address for forwarding enquiries with the same details; an identifier for a web analytics service, to which only event signals are sent; and a messaging channel using the controller's own provider key, to which clause 6.1 applies accordingly. The configuration is an instruction within the meaning of clause 3. The controller selects the destination and bears responsibility for its permissibility, including any transfer to a third country; under the intended data flow the recipient is directly involved in the controller's processing and is not a sub-processor of the processor; the controller independently assesses the recipient's data protection role and, where necessary, concludes the contract required under Art. 28 GDPR itself. The controller names the recipient in its own privacy policy and has the required legal basis. The processor checks technically that the destination does not lie within an internal network range; no assessment of the destination's content or legality takes place. Only for the transmission to a web analytics service are exclusively pseudonymous identifiers, event names and event-related category details transmitted; message contents, names, email addresses and telephone numbers are not transmitted there. This does not apply to the other destinations under this clause — there the enquiry data is transmitted in full.

10. Assistance to the controller. The processor assists the controller, to the extent reasonable, in responding to requests from data subjects (Art. 12–23 GDPR), in ensuring the security of processing and in carrying out data protection impact assessments and prior consultations (Art. 35, 36 GDPR). If the processor becomes aware of a personal data breach, it shall inform the controller without undue delay, and no later than 48 hours after becoming aware of it, in text form, providing the information required under Art. 33(3) GDPR.

11. Deletion and return. After termination of the usage agreement and expiry of the transition period under Section 11, the processor deletes all personal data processed on behalf of the controller or returns it, at the controller's choice, unless a statutory retention obligation applies. The controller communicates its choice in text form before the transition period expires; without such notice, the data is deleted. Independently of this, the controller may export the data itself pursuant to Section 11 until the transition period expires. Deletion covers all copies; backups are overwritten as part of the regular backup cycle.

12. Evidence and audits. On request, the processor provides the controller with the information necessary to demonstrate compliance with this annex (Art. 28(3)(h) GDPR). On-site audits are permitted following reasonable prior notice, during normal business hours and without disrupting operations; the processor may substitute current evidence or certificates of its sub-processors where these suffice for the review.

14. Relationship to the Terms. In all other respects, these Terms apply. In the event of contradictions, this annex takes precedence in matters of data protection law. Liability is governed by Art. 82 GDPR and, in addition, by Section 9 of these Terms.