Data processing agreement (DPA)

Version 1.0 (22.09.2026)

between

the Customer (entrepreneur within the meaning of Section 14 BGB), who concludes the agreement online in the settings

— hereinafter "Controller" —

and

moewe communication group GmbH, Pfeuferstr. 49, 81373 München, Deutschland, represented by the managing directors Marc Falke, Maximilian Kern

— hereinafter "Processor" —

§ 1 Subject Matter and Duration

1. The Processor operates moewe AI studio (https://chat.moewe-studio.de), an AI studio which the Controller uses on the basis of the General Terms and Conditions (Main Agreement). Insofar as the Controller processes personal data for which it is the controller, the Processor processes such data on behalf of the Controller. This Agreement specifies the data protection obligations of the parties.
2. The term of this Agreement corresponds to the term of the Main Agreement. It terminates upon termination of the usage relationship.

§ 2 Nature, Purpose and Scope of Processing

1. Nature and purpose: Storage, transmission to AI providers for the generation of responses, images and documents, processing in automations, research and scraping functions, provision to the Controller's sub-users, backup.
2. Categories of data: All data which the Controller or its sub-users enter into, upload to or make available via connected services in the Studio (e.g. texts, documents, images, contact details, research results), as well as account data of sub-users (name, email address).
3. Data subjects: Employees, customers, prospects, suppliers and other persons whose data the Controller processes in the Studio, as well as the Controller's sub-users.
4. The Controller remains the controller; it determines inputs, models used, connections to third-party services and scraping sources. It ensures that there is a legal basis for the processing.

§ 3 Instructions

1. The Processor processes data only on documented instructions from the Controller. Instructions arise from the Main Agreement and from the use of the functions (each request, setting and release in the Studio constitutes an instruction).
2. The Processor shall inform the Controller immediately if it considers that an instruction infringes data protection law.
3. If the Processor is required by Union or Member State law to carry out processing, it shall inform the Controller of that legal requirement before processing, unless that law prohibits such information.

§ 4 Obligations of the Processor

1. The Processor shall implement the technical and organisational measures described in Annex 1 and develop them in accordance with the state of the art; the security level must not be reduced in the process.
2. Persons authorised to process data are subject to confidentiality obligations and are informed of the requirements of data protection law.
3. The Processor shall assist the Controller by appropriate measures in fulfilling the rights of data subjects (access, rectification, erasure, restriction, data portability) and in complying with the obligations under Articles 32–36 GDPR. Requests from data subjects received directly by the Processor shall be forwarded to the Controller without undue delay.
4. The Processor shall report personal data breaches to the Controller without undue delay, at the latest within 48 hours of becoming aware thereof, with the information required under Article 33(3) GDPR, insofar as available.
5. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and shall allow for audits (§ 7).

§ 5 Sub-processors

1. The Controller grants general authorisation for the engagement of the sub-processors listed in Annex 2. The Processor shall only engage sub-processors under a contract which imposes on them the same data protection obligations.
2. The Processor shall inform the Controller of any intended changes (addition or replacement of sub-processors) at least 14 days in advance by email or in the privacy policy. The Controller may object within that period on important data protection grounds; otherwise the change shall be deemed approved. In the event of a justified objection, both parties shall have an extraordinary right of termination.
3. Which AI providers actually receive data is controlled by the Controller through the choice of model and functions. The "EU Models Only" option can be used to restrict processing to providers with processing in the EU.
4. Connections to third-party services (Annex 2, last entry) are established by the Controller itself; such services act on the Controller's instructions and according to their own terms and conditions.

§ 6 Transfer to Third Countries

Processing outside the EU/EEA shall only take place if the requirements of Articles 44 et seq. GDPR are met (adequacy decision, EU-US Data Privacy Framework, EU Standard Contractual Clauses) — see Annex 2.

§ 7 Rights of Audit

The Controller may verify compliance with this Agreement by obtaining information, submission of evidence (e.g. data centre certificates, description of measures) and — following reasonable notice, during business hours and without disruption to operations — by its own audits or audits by appointed third parties. The Processor may charge reasonable compensation for audits that go beyond information and evidence.

§ 8 Deletion and Return

Following termination of the Main Agreement, the Processor shall delete all personal data of the Controller, unless there is a statutory retention obligation (e.g. billing data). Prior to this, the Controller may secure its content via the Studio's export functions. Backup copies shall be overwritten following the regular rotation (14 days).

§ 9 Liability

Article 82 GDPR and the liability provisions of the Main Agreement shall apply to liability.

§ 10 Final Provisions

1. Amendments and supplements must be made in text form. In the event of conflicts, this Agreement shall take precedence over the Main Agreement in data protection matters.
2. German law shall apply. Place of jurisdiction is Munich.
3. This Agreement is concluded electronically (Article 28(9) GDPR); the conclusion is documented by the Processor with date, agreement number and details of the Controller and made available to both parties as a PDF.

Annex 1 — Technical and Organisational Measures (Art. 32 GDPR)

Access Control (Physical, System and Data)

• Hosting in ISO 27001 certified data centres (Hetzner, Germany) with physical access control.
• Server access exclusively via SSH key; password login disabled; automatic blocking on failed attempts (fail2ban); firewall.
• User accounts with password (bcrypt/scrypt hash), optional two-factor authentication, rate limits against brute force.
• Role and rights concept: customers see only their own data and data released to them; admin functions are restricted to administrators.
• API keys and OAuth tokens are stored encrypted (AES-256-GCM).

Disclosure and Transmission Control

• Encrypted transmission (TLS 1.2+, HSTS) between browser, Studio and all providers.
• Files are delivered only via access-protected endpoints, not publicly.
• Offsite backups are encrypted before transmission (AES-256).

Input and Engagement Control

• Consumption and billing processes are logged; credit corrections by administrators are recorded with reason and timestamp.
• Sub-processors are only engaged with data processing agreements or Standard Contractual Clauses; content is not used for training models in accordance with the agreement.
• Software changes are version-controlled (Git) and subject to four-eyes principle for security-relevant changes.

Availability and Separation Control

• Daily backups (14 days), offsite copy, documented recovery.
• Uninterrupted updates (blue/green deployment), automatic security updates of the operating system.
• Client separation at database level (each row is assigned to a user/team), separate test and production systems.
• Incognito mode without storage; deletion of accounts and content on request.

Data Protection Management

• Data protection impact assessment conducted for age verification and AI processing; record of processing activities available.
• Reporting process for data protection incidents (information to the customer without undue delay, at the latest within 48 hours of becoming aware).
• Regular review of technical and organisational measures, security audits of source code.

Annex 2 — Approved Sub-processors

Version of list: 1.0 (22.09.2026). Current version: https://chat.moewe-studio.de/avv