Usage & Privacy

Privacy Policy
We (“we”, “us”, “our”) take the protection of the data of our users (“you”) very seriously. This privacy policy describes which information we collect via our website, how we use it, and which rights you have. Please read this policy carefully in order to understand our practices.

Information that we collect
We collect the following categories of data:

Non-personal data
Technical information such as browser type, operating system, or anonymized usage statistics.
This data does not allow any conclusion to be drawn about a specific person.

Personal data
Information that you voluntarily provide to us via contact forms or our chat (e.g. name, email address, telephone number).
IP addresses and other data that may be collected for technical reasons when visiting the website.

Automatically collected data
IP address and other technical data that is automatically collected during the use of our website.
Information that is collected through cookies in order to improve your user experience (see section Cookies).

Use of collected information
The data collected by us is primarily used to provide you with our services and to process your inquiries efficiently. For example, if you fill out a contact form, book an appointment, or share information in our chat, we use the information you provide in order to get in touch with you and fulfill the corresponding service.

In addition, anonymized usage data helps us to improve our website and our services. We use this information to identify technical problems, increase user-friendliness, and further develop our offerings in a targeted manner. We also use the data to ensure that our website remains secure and is protected against unauthorized access.

In doing so, we strictly comply with the applicable data protection laws and use your data exclusively for the stated purposes. Use for other purposes only takes place with your express consent.

Disclosure of information
Your data is only disclosed to third parties in justified cases. This includes trusted service providers who support us in the operation and provision of our website.

In cases in which we are legally obliged to do so, we may disclose your data to authorities or other legal bodies. Your personal data will not be disclosed for advertising purposes or without your consent.

Storage and security
Your data is stored on secure servers that are located in encrypted cloud environments and are protected by modern security measures. We use technical and organizational measures to protect your data against unauthorized access, loss, or misuse.

Despite these measures, no absolute protection can be guaranteed. Therefore, please only share sensitive information with caution. If you suspect that your data is at risk, please contact us immediately.

User rights
You have the right to information about the personal data stored by us. In addition, you may request the correction of incorrect data, the deletion of your data, the restriction of processing, or object to the processing.

To exercise your rights, please contact us using the contact details given below.

Updating the privacy policy
We reserve the right to update this privacy policy regularly in order to adapt it to new legal requirements or technical developments. The current version is available on our website.

Third-party services
Our application uses APIs from Google (e.g. Gmail, Google Calendar) and Microsoft (e.g. Outlook Mail, Outlook Calendar) for the provision of calendar, email, and further API functions. Access takes place exclusively on the basis of your consent via OAuth 2.0.

We only access data that is required for the respective function (e.g. appointment overview, appointment scheduling, email sending). No use for advertising purposes, profiling, or disclosure to third parties takes place.

Our application complies with the requirements of the Google API Services User Data Policy (including Limited Use) as well as the Microsoft Graph API terms of use.

You can revoke the connection to your Google or Microsoft account at any time.

Contact
If you have questions about the processing of your data or about this privacy policy, please contact us:

Logicx AI GmbH
Email: office@logicx-ai.com

GENERAL TERMS OF USE of Logicx AI GmbH

Logicx AI GmbH
Czerningasse 10/1
1020 Vienna, Austria
Email: office@logicx-ai.com
Managing Director: Julian Lumetsberger
VAT No.: ATU81498345
FN: 643624g
Version: 17.03.2026

1. Scope of application and fundamentals

1.1 These Terms of Use govern the use of the AI solution provided by LOGICX AI (hereinafter “LOGICX AI” or “Provider”), in particular the “Artificial Experts”, including the underlying software, AI functions, interfaces (APIs), updates and other associated services (hereinafter “Solution”).

1.2 These Terms of Use apply to companies or organizations that use the Solution, in particular to authorized partners of LOGICX AI as well as to end customers who receive access to the Solution through such a partner (hereinafter jointly “Customers”).

The use of the Solution by employees or other persons takes place exclusively in the name of and under the responsibility of the respective Customer.

1.3 The use of the Solution requires that the Customer accepts these Terms of Use.

The Terms of Use shall be deemed agreed as soon as the Customer or a user authorized by it accesses or uses the Solution, provided that they were made known to the Customer beforehand in an appropriate manner.

1.4 These Terms of Use form the basis for all offers, deliveries and services of LOGICX AI. They are directed primarily at entrepreneurs within the meaning of Section 1 UGB.

1.5 Deviating, conflicting or supplementary conditions shall only become part of the contract if LOGICX AI has expressly agreed to their validity in writing.

1.6 Supplementary or deviating provisions regarding the scope of services, the rights of use, prices, terms or other conditions may arise from individual agreements, in particular from partner agreements, end customer agreements, offers, order forms or service descriptions (jointly “Individual Agreements”).

In the event of contradictions between these Terms of Use and such an Individual Agreement, the provisions of the Individual Agreement shall take precedence.

2. Subject matter of the contract and provision of services

2.1 The specific scope of the functions and services of the Solution available in each case results from the respective Individual Agreements, service descriptions or order documents.

LOGICX AI provides its services in accordance with the current state of the art and recognized industry standards. Specific service level agreements (SLAs) may be agreed in individual contracts.

2.2 LOGICX AI is entitled to use subcontractors for the provision of services. LOGICX AI remains responsible for the services of the subcontractors used as for its own actions and will inform the Customer upon request about material subcontractors used that have direct access to Customer data or provide critical parts of the service. A requirement for the Customer's consent to the use of specific subcontractors may be agreed in the individual contract.

2.3 LOGICX AI is entitled to further develop, change or adapt the Solution and its functions, in particular in order to adapt it to the state of the art, to changed legal or regulatory requirements or to security-relevant developments.

Such changes may not unreasonably impair the essential purpose of the use of the Solution. LOGICX AI will inform the Customers in an appropriate manner about material changes to the Solution.

2.4 Usage limits: Each package includes a fixed usage quota within the meaning of a fair use policy (e.g. token volume, API calls or computing power).

The exact scope of this included quota results from the service description or price sheet valid at the time of conclusion of the contract. After reaching this quota, the Provider is entitled to temporarily throttle the service or to charge separately for additional consumption beyond this in accordance with the currently applicable tariffs. A transfer of unused quotas to the following month is excluded.

2.5 A transfer or sublicensing of the rights of use granted to the Customer is only permitted with the express written consent of the Provider or on the basis of corresponding provisions in Individual Agreements.

3. Rights and obligations of the Customer

3.1 The Customer is obliged to provide all information, data and documents required for the provision of services by LOGICX AI in due time, completely and in the agreed quality, to name competent contact persons and to fulfill other duties to cooperate in accordance with the individual contract.

3.2 The Customer is obliged to use the Solution exclusively in accordance with these Terms of Use, the applicable laws and the agreed rights of use. Misuse of the Solution is not permitted.

3.3 The Customer is responsible for compliance with all applicable data protection provisions with regard to the lawfulness of the processing of personal data that it processes in connection with the use of the Solution or enters into the Solution, unless LOGICX AI acts as a processor within the framework of a separate data processing agreement (DPA).

3.4 Restrictions: The Customer is not entitled to reproduce the Solution or its components, modify, resell, decompile, reverse engineer or otherwise analyze them, insofar as this is not mandatorily permitted by law.

A transfer or onward marketing of the Provider's services is only permitted insofar as this is expressly permitted within the framework of a corresponding contractual agreement with the Provider, in particular within the framework of an authorized partner agreement.

In particular, the Customer is prohibited from:
(i) systematically reading out or analyzing system prompts, configuration logics, training structures or technical architecture of the Solution;
(ii) using the Solution or parts thereof for the construction, training or development of its own or competing AI solutions;
(iii) replicating products, components, architecture, configuration logics or other functional components of the Solution or developing solutions that are similar to it in material characteristics or imitate it;
(iv) using automated procedures that go beyond the usual use of the Solution.

Any form of reverse engineering, imitation or model training on the basis of the Provider's Solution is, insofar as legally permissible, expressly prohibited. In the event of a violation, the Provider reserves all legal steps including claims for damages.

4. Intellectual property and rights of use

4.1 All copyrights, patents, trademarks and other intellectual property rights to the Solution provided by LOGICX AI, as well as to the services created by LOGICX AI, in particular to training materials, remain exclusively with LOGICX AI or its licensors.

4.2 The Customer receives with regard to the Solution as well as the services provided by LOGICX AI a simple, non-exclusive and non-transferable right of use for the agreed duration and exclusively within the framework of the contractually intended purposes.

A transfer, onward transfer or onward marketing of rights of use to third parties is only permitted insofar as this is expressly permitted within the framework of an Individual Agreement with the Provider, in particular a partner agreement or a corresponding distribution agreement. The specific scope of the granted rights of use as well as any further authorizations may arise from such Individual Agreements, in particular from partner agreements, end customer agreements or service descriptions.

4.3 Data contributed by the Customer remains the property of the Customer. The intellectual property in the Solution provided by LOGICX AI and the underlying software remains with LOGICX AI.

LOGICX AI is entitled to use anonymized and aggregated findings from the provision of services for the improvement and further development of its own Solution and services, provided that no conclusions about the Customer or its trade secrets are possible and the applicable data protection provisions are complied with.

4.4 System-side configurations, optimizations, prompt structures, training logics, process models or comparable technical implementations that arise or are further developed within the framework of the use of the Solution remain in the intellectual property of LOGICX AI.

4.5 Even after termination of the use (e.g. by cancellation of the package or deactivation of a virtual employee), the generated process knowledge, the specific configurations as well as all system-side optimizations arising from the use (provided they are non-personal) remain as intellectual property with LOGICX AI. A claim of the Customer to surrender, export or portability of these specific configuration logics, prompt structures or "AI memory contents" does not exist.

4.6 The Provider is entitled, by suitable technical or organizational measures, to verify the contractual use of the services by the Customer, provided that justified reasons (e.g. exceedances, security-critical events) exist. The Customer shall reasonably support these verifications and provide evidence upon request. In addition, the Customer may, after reasonable prior notice and while maintaining confidentiality as well as the Provider's trade secrets, verify compliance with material contractual obligations by LOGICX AI, in particular regarding data protection and information security, to a reasonable extent or have this verified by a third party obliged to confidentiality. Details, in particular regarding the frequency and allocation of costs, shall be determined in the individual case or in the individual contract.

4.7 Copyright and protection notices may not be removed or changed.

5. Warranty and liability

5.1 Due to the functioning of AI systems, generated content may be incomplete, faulty or incorrect. The Customer is therefore obliged to appropriately review AI-generated results before their business use or publication.

LOGICX AI is not liable for damages that arise from the fact that AI-generated content is adopted or used without corresponding review.

5.2 The Customer is itself responsible for the use of the AI functions of the Solution as well as for the compliance with the applicable legal requirements, in particular the EU AI Regulation (AI Act). LOGICX AI is not liable for damages that arise from the fact that the Customer uses AI functions improperly, does not comply with legal requirements or uses AI-generated results without appropriate review.

5.3 Insofar as the Customer, through its own adaptations, configurations or integrations of the Solution, becomes the operator or provider of an AI system within the meaning of the EU AI Regulation (AI Act), it is itself responsible for compliance with the resulting legal requirements. LOGICX AI is not liable for legal or regulatory consequences that arise from the fact that the Customer does not comply with such requirements.

5.4 LOGICX AI is liable towards entrepreneurs for damages caused by it – regardless of the legal ground – only in cases of intent or gross negligence. Liability for slight negligence is, insofar as legally permissible, excluded.

This limitation of liability does not apply to personal injury, to damages under the Product Liability Act or in the event of a breach of material contractual obligations, the fulfillment of which makes the proper execution of the contract possible in the first place and on the compliance with which the Customer may regularly rely.

5.5 Liability for indirect damages, consequential damages, loss of profit, loss of data or business interruptions is, insofar as legally permissible, excluded.

5.6 The Customer is itself responsible for the regular backup of its data. This also applies to data that the Customer contributes to the systems of LOGICX AI or processes with them, unless an explicit backup service by LOGICX AI for these specific data of the Customer is agreed in the individual contract.

5.7 The Customer shall indemnify LOGICX AI against all claims of third parties – including any fines and costs of legal defense – arising from a breach of its obligations under the AI Regulation in connection with the actions referred to in clause 9.2 and 9.3.

6. Data protection

6.1 LOGICX AI processes personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act. LOGICX AI takes appropriate technical and organizational measures (TOMs) to protect the processed data in accordance with Art. 32 GDPR.

6.2 Insofar as LOGICX AI processes personal data on behalf of the Customer, the data processing agreement in accordance with Art. 28 GDPR in its respectively applicable version shall be deemed agreed upon conclusion of the respective Individual Agreement and shall become part of the contractual relationship.

6.3 Unless otherwise regulated in the individual contract or DPA, core data processing systems that LOGICX AI uses for the provision of the contractual services for the Customer and on which personal data of the Customer is processed shall be operated within the European Union (EU) or the European Economic Area (EEA).

6.4 LOGICX AI may use third-party services for the provision of the services in connection with the Solution.

Insofar as processing or storage of data takes place in this context, this shall occur exclusively within the framework of the applicable data protection regulations and only insofar as this is necessary for the fulfillment of the contractually agreed services.

7. Contract duration and termination

7.1 The term and termination modalities for the use of the Solution result from the respective Individual Agreements, in particular from partner agreements, end customer agreements or other individual agreements.

7.2 After expiration of the authorization to use the Solution, LOGICX AI may, at the request of the Customer, hand over or securely delete the Customer's specific data in accordance with the provisions of the individual contract or a DPA, provided that no mandatory statutory retention obligations oppose this. Any modalities and costs for extensive data migration or conversion shall be regulated in the individual contract.

8. Use of third-party software

8.1 The Provider uses services and interfaces (APIs) of third parties for certain functions of its Solution, in particular cloud, infrastructure or platform services as well as AI models and AI systems of external providers (e.g. providers of large language models), such as Google, Microsoft, OpenAI or other comparable providers (hereinafter “Third-Party Services”).

8.2 The Customer acknowledges and agrees that for the use of these Third-Party Services the respective terms and conditions of these third-party providers (“Third Party Terms”) shall apply. These third-party terms are not part of these general Terms of Use between the Customer and LOGICX AI, but shall apply additionally to the use of the respective Third-Party Services. LOGICX AI may make an up-to-date list of the material Third-Party Services used for the provision of its core services as well as, where possible, links to their terms in an appropriate form accessible. The Customer is obliged to inform itself about these terms and to comply with them when using the Third-Party Services.

8.3 LOGICX AI selects the Third-Party Services used by it with due care. Nevertheless, the Provider assumes, insofar as legally permissible, no warranty or liability for the functionality, uninterrupted availability or for any changes made by the third-party provider to its services (e.g. to APIs). The Provider is not responsible for data loss, malfunctions or performance restrictions that are directly and exclusively attributable to disruptions or changes within the sphere of the third-party provider and which LOGICX AI could not avert despite applying the required care.

LOGICX AI is therefore not liable for failures, delays or restrictions of the Solution insofar as these are attributable to disruptions or changes in third-party services.

8.4 The Customer undertakes, when using the Provider's services, insofar as these involve Third-Party Services, to comply with all applicable Third Party Terms, in particular with regard to data processing, security requirements and usage restrictions.

8.5 Integrations and changes made by the Customer:

(a) Insofar as the Customer on its own initiative connects integrations via provided interfaces (APIs), its own software or third-party services with the services of the Provider or makes extensions within the intended configuration possibilities (“Customer-initiated adjustments”), this shall take place under the Customer's own responsibility and at the Customer's own risk.

(b) The Customer acknowledges that Customer-initiated adjustments may impair the functionality, stability and security of the Provider's services. The Provider assumes no warranty or liability for disruptions, damages or data loss resulting from such Customer-initiated adjustments.

(c) The Customer shall indemnify LOGICX AI against all claims of third parties, including reasonable costs of legal defense, arising from the fact that adjustments, integrations or other changes to the Solution made by the Customer infringe rights of third parties or violate statutory provisions.

(d) The Provider is entitled to review Customer-initiated adjustments. If the Provider determines, or if there is a justified suspicion, that Customer- initiated adjustments endanger or violate the stability, security or integrity of the Provider's services, the rights of third parties or statutory provisions, the Provider may take appropriate measures at its own discretion.

These include in particular:
(i) requesting the Customer to change or remove the relevant adjustment without undue delay;
(ii) temporarily or permanently restricting or preventing access to the affected parts of the services or the entire service;
(iii) deactivating, removing or modifying the relevant adjustment itself if the Customer does not comply with a request under (i) within a reasonable period or if there is imminent danger. The Provider will inform the Customer of this in advance where possible and give it the opportunity to comment, insofar as this is possible and reasonable taking into account the circumstances.

9. Obligations of the Customer with regard to the EU Regulation on Artificial Intelligence (AI Act / Regulation (EU) 2024/1689)

9.1 LOGICX AI takes all necessary precautions to comply with the Regulation on Artificial Intelligence (“AI Regulation”) for the Solution provided by LOGICX AI with regard to its original intended purpose.

9.2 The Customer assumes sole responsibility for compliance with all obligations incumbent upon it under the AI Regulation, in particular in the following cases: (a) if it materially modifies an AI system provided by LOGICX AI or changes its original intended purpose; (b) if it integrates the AI system into its own products or services and thereby itself becomes a provider within the meaning of the AI Regulation; (c) if it uses or operates the AI system in such a way that it is classified as a high-risk AI system within the meaning of the AI Regulation or its risk classification is materially changed; (d) if it uses a high-risk AI system as a deployer within the meaning of the AI Regulation.

9.3 In the cases referred to under clause 9.2, the Customer is obliged to fulfill all obligations incumbent upon it due to its specific role and the respective risk category of the AI system under the AI Regulation independently, in due time and in full. This includes in particular the independent review of applicability as well as the implementation of all relevant governance, risk, documentation, transparency and due diligence obligations under the AI Regulation.

9.4 The Customer shall inform LOGICX AI in writing about any planned use, modification or integration in accordance with clause 9.2 that could materially change the regulatory classification of the AI system or the allocation of responsibilities under the AI Regulation.

9.5 Labeling obligation: The Customer undertakes to label generated content originating from AI services as such in accordance with the statutory requirements.

10. Final provisions

10.1 Amendments and additions to these general Terms of Use require written form in order to be effective, unless a stricter form is prescribed by law. This also applies to any waiver of this written form requirement.

10.2 LOGICX AI is entitled to amend these General Terms of Use for objectively justified reasons, in particular in the event of changes to the legal framework, technical developments or adjustments to the scope of services of the Solution.

LOGICX AI will inform the Customer of changes at least 30 days before they take effect by sending the amended Terms of Use to the email address last provided by the Customer.

The changes shall be deemed accepted if the Customer does not object to them in writing by email within 30 days from receipt.

10.3 Austrian law shall apply exclusively, to the exclusion of its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

10.4 The exclusive place of jurisdiction for all disputes is the court in Austria having subject-matter and local jurisdiction, provided that the Customer is an entrepreneur.

10.5 Should individual provisions of these General Terms of Use or an Individual Contract be or become wholly or partially invalid or unenforceable, this shall not affect the validity of the remaining provisions.

In place of the invalid or unenforceable provision, a valid and enforceable provision shall be deemed agreed that comes economically closest to the meaning and purpose of the original provision.

Data Processing Agreement (DPA)
pursuant to Art. 28 General Data Protection Regulation (GDPR)

between
the respective customer using the services of Logicx AI GmbH, in particular the “Artificial Experts” solution, on the basis of an offer, main agreement or individual agreement
(hereinafter referred to as the “Controller”)
and
Logicx AI GmbH
Czerningasse 10/1
1020 Vienna, Austria
E-mail: office@logicx-ai.com
Managing Director: Julian Lumetsberger
VAT ID No.: ATU81498345
Company Register No.: FN 643624g
(hereinafter referred to as the “Processor”)
Controller and Processor jointly the “Parties”, individually also a “Party”.
Version: 17 March 2026

Preamble

This Data Processing Agreement (“DPA”) specifies the data protection rights and obligations of the Parties in connection with the processing of personal data by the Processor on behalf of the Controller pursuant to Art. 28 GDPR.
This DPA supplements the main agreement existing between the Parties concerning the use of the services and solutions of Logicx AI GmbH, in particular the “Artificial Experts” solution, including any individual agreements, order documents, service descriptions and the respective applicable General Terms of Use of Logicx AI GmbH (jointly the “Main Agreement”). The Main Agreement already provides that the DPA is deemed agreed upon conclusion of the respective individual agreement.
Where provisions of this DPA concern the protection of personal data and conflict with the Main Agreement, the provisions of this DPA shall prevail.

§ 1 Subject Matter and Term

1.1 Subject matter of the processing

The Processor processes personal data on behalf of the Controller in connection with the provision, operation, support, maintenance and technical enablement of the services described in the Main Agreement.
The details are specified in Annex 1 to this DPA.

1.2 Nature, purpose, scope and categories

The nature, purpose and scope of the processing as well as the categories of personal data and data subjects are set out in Annex 1 to this DPA.

1.3 Term

This DPA enters into force upon conclusion of the Main Agreement and applies for the entire term of the Main Agreement, insofar as the Processor processes personal data on behalf of the Controller.

1.4 Termination

Upon termination of the Main Agreement, this DPA shall also terminate, unless individual obligations under this DPA by their nature continue beyond termination, in particular confidentiality, documentation, deletion and data protection obligations.

§ 2 Processing Subject to Instructions

2.1
The Processor processes personal data exclusively on documented instructions from the Controller, unless there is a statutory obligation to process the data.

2.2
The provisions of this DPA, the Main Agreement and the configurations, settings, approvals and usage actions performed by the Controller in the course of using the solution, insofar as they concern the processing of personal data, shall initially be deemed documented instructions.

2.3
The Controller may issue individual instructions in documented form, in particular in writing or by e-mail. Oral instructions must be confirmed without undue delay in text form.

2.4
If the Processor believes that an instruction infringes the GDPR or other applicable data protection provisions, it shall notify the Controller without undue delay. The Processor is entitled to suspend implementation of an obviously unlawful instruction until it is confirmed or amended.

§ 3 Obligations of the Processor

3.1 Confidentiality

The Processor ensures that all persons involved in the processing of personal data have been committed to confidentiality or are subject to an appropriate statutory duty of confidentiality.

3.2 Security of processing

The Processor implements all technical and organizational measures (TOMs) required pursuant to Art. 32 GDPR to protect the personal data. The agreed measures are set out in Annex 2 to this DPA.

3.3 Assistance with data subject rights

Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible and reasonable, so that the Controller can comply with its obligations to respond to requests from data subjects.
If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay, provided that it is possible to assign the request to the Controller.
Costs incurred by the Processor as a result of such assistance shall be borne by the Controller, unless the assistance is required due to misconduct by the Processor.

3.4 Assistance with statutory obligations

Taking into account the nature of the processing and the information available to the Processor, the Processor shall assist the Controller in complying with the obligations pursuant to Art. 32 to 36 GDPR, in particular in connection with:
security of processing,
notification of personal data breaches,
communication to data subjects,
data protection impact assessments,
prior consultation with supervisory authorities.

3.5 Documentation and information

Upon request, the Processor shall make available to the Controller the information necessary to demonstrate compliance with the obligations set out in this DPA and in Art. 28 GDPR.

3.6 Deletion and return

After completion of the contractual services, the Processor shall delete or return personal data at the Controller’s choice, unless there is a statutory obligation to continue storing the data. Further details are set out in § 10 of this DPA.

3.7 No processing for own purposes

The Processor does not process personal data attributable to the Controller for its own purposes. The use of anonymized or aggregated information to improve and further develop the solution remains permissible only insofar as no conclusions can be drawn about the Controller, individual data subjects or confidential content, and the applicable data protection provisions are complied with.

§ 4 Obligations of the Controller

4.1
The Controller is responsible for the lawfulness of the processing of personal data, in particular for the existence of a legal basis pursuant to Art. 6 GDPR, and for safeguarding the rights of data subjects.

4.2
The Controller is obliged to provide personal data and instructions to the Processor only to the extent permitted under data protection law.

4.3
The Controller shall inform the Processor in good time if special categories of personal data pursuant to Art. 9 GDPR or personal data with increased risk are to be processed in the course of using the services, unless this is already apparent to the Processor from the use of the services.

4.4
The Controller remains responsible for using the solution in accordance with the applicable data protection provisions. This also corresponds to the allocation of responsibilities provided for in the Terms of Use.

4.5
The Controller shall inform the Processor without undue delay if it becomes aware of errors, irregularities or infringements in connection with the processing of personal data within the scope of the services.

4.6
The Controller is obliged to review in advance the personal data it provides in the course of using the services for permissibility under data protection law and bears responsibility for the lawfulness of the processing.

§ 5 Subprocessors

5.1 General authorization

The Controller hereby grants the Processor general authorization to engage further processors (“Subprocessors”).

5.2 List of Subprocessors

The Subprocessors engaged at the time of conclusion of the agreement are listed in Annex 3.

5.3 Changes

The Processor shall inform the Controller in an appropriate manner of intended changes concerning the engagement or replacement of Subprocessors. The Controller may object to such change for an important data protection reason within 14 calendar days of receipt of the information.

5.4 Consequences of an objection

If the Controller raises a justified objection and reasonable alternative service provision without the affected Subprocessor is not possible, the Parties are entitled to extraordinarily terminate the affected services or, if necessary, the Main Agreement with regard to the service components affected thereby.

5.5 Obligations of Subprocessors

The Processor shall enter into a contract or another suitable legal instrument within the meaning of Art. 28(4) GDPR with each Subprocessor, imposing on such Subprocessor substantially the same data protection obligations as those set out in this DPA, in particular with regard to confidentiality, security, assistance obligations and deletion.

5.6 Liability

The Processor is liable to the Controller for compliance with the data protection obligations of its Subprocessors in accordance with the statutory provisions and the provisions of this DPA.

§ 6 Third-Country Transfers

6.1
Processing of personal data in a third country or by a Subprocessor in a third country shall take place only if the requirements of Art. 44 et seq. GDPR are met.

6.2
Where third-country transfers are required or cannot be fully excluded for individual services, the Processor shall ensure that a permissible transfer mechanism exists. This may in particular be done by means of an adequacy decision, by Standard Contractual Clauses of the European Commission pursuant to Art. 46 GDPR or by other legally recognized safeguards.

6.3
Where the Processor engages Subprocessors in relation to which third-country transfers take place or cannot be fully excluded, the respective applicable transfer mechanisms shall be indicated in the list of Subprocessors.

6.4
Upon request, the Processor shall inform the Controller about the relevant safeguards, insofar as this is legally and contractually permissible.

§ 7 Technical and Organizational Measures (TOMs)

7.1
The technical and organizational measures described in Annex 2 are agreed as a binding component of this DPA.

7.2
The Processor is entitled to further develop and adapt the TOMs, taking into account the state of the art, provided that the agreed level of protection is not reduced.

7.3
The Processor shall inform the Controller in an appropriate manner of material changes that significantly affect the level of data protection.

§ 8 Notification of Personal Data Breaches

8.1
The Processor shall inform the Controller without undue delay after becoming aware of a personal data breach affecting personal data of the Controller.

8.2
Where possible, this notification shall contain at least:
a description of the nature of the breach,
the categories of data and groups of persons affected,
the known or likely consequences,
the countermeasures already taken or proposed.

8.3
The Processor shall assist the Controller to a reasonable extent in fulfilling any notification and communication obligations.

§ 9 Control Rights and Audits

9.1
The Controller is entitled to verify the Processor’s compliance with data protection obligations to a reasonable extent.

9.2
Compliance shall primarily be demonstrated by suitable documents and information of the Processor, in particular by:
descriptions of the TOMs,
internal policies and processes,
contractual assurances,
evidence regarding Subprocessors,
certificates, audit reports or comparable evidence, where available.

9.3
On-site inspections are permissible only if:
there is an important reason,
less intrusive means of evidence are insufficient,
the inspection takes place during regular business hours,
it has been announced in writing with reasonable notice,
and legitimate confidentiality and security interests of the Processor are safeguarded.

9.4
The Processor may require that the auditing third party does not compete with the Processor and signs an appropriate confidentiality undertaking.

9.5
Unless the audit is due to substantial misconduct attributable to the Processor, the Controller shall bear its own costs as well as appropriate remuneration of the Processor for extraordinary audit efforts.

§ 10 Deletion and Return of Data

10.1
After completion of the contractual services, the Processor shall delete or return personal data of the Controller at the Controller’s choice, unless there is a statutory retention obligation.

10.2
If the Controller does not communicate an express choice within a reasonable period after the end of the agreement, the Processor is entitled to securely delete the personal data after expiry of a reasonable transition period, unless statutory or legitimate technical retention requirements conflict with this.

10.3
Backup copies and backup repositories shall be deleted within customary backup and deletion cycles, provided that immediate individual removal is possible only with disproportionate effort and the data remain appropriately protected until deletion.

10.4
Upon request, the Processor shall confirm deletion or return to the Controller in an appropriate form.

§ 11 AI-Specific Processing / System Use

11.1
Where the Controller uses the “Artificial Experts” solution, the processing of personal data may in particular be triggered or influenced by inputs, uploads, interface connections, prompts, work instructions, system interactions, logging and generated results.

11.2
The Processor processes such data exclusively for the purpose of providing the contractually owed services, including provision of the functions, execution of system processes, error analysis, system security, support and maintenance.

11.3
Personal data of the Controller shall not be used to train the Processor’s own or third-party general models, unless expressly agreed separately.

11.4
Where the Controller itself determines or expands the area of use of the solution through configurations, integrations or its own use cases, the Controller remains responsible for the permissibility under data protection law and the regulatory classification of such use.

§ 12 Confidentiality

12.1
Both Parties undertake to treat all confidential information received in connection with this DPA as confidential for an unlimited period of time and to use it exclusively for the performance of the contractual relationship.
This obligation shall continue to apply after termination of the Main Agreement and this DPA.

§ 13 Liability

The liability of the Parties is governed by the statutory provisions, in particular Art. 82 GDPR, and additionally by the liability provisions of the Main Agreement, insofar as these do not conflict with mandatory data protection law.

§ 14 Final Provisions

14.1 Written form

Amendments and supplements to this DPA must be made in written or text form, unless a stricter form is prescribed by law.

14.2 Severability clause

Should any provision of this DPA be or become invalid or unenforceable in whole or in part, the validity of the remaining provisions shall remain unaffected.

14.3 Applicable law

Austrian law shall apply exclusively, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

14.4 Place of jurisdiction

The exclusive place of jurisdiction for all disputes shall be the court with subject-matter and local jurisdiction in Austria, provided that the contractual partner is an entrepreneur.

Annex 1

Description of Processing Activities

1. Subject matter of the processing

Provision, hosting, operation, support, maintenance and technical enablement of the “Artificial Experts” solution as well as related functions, interfaces, storage, communication and processing services pursuant to the Main Agreement.

2. Duration of the processing

For the duration of the Main Agreement and beyond only insofar as statutory retention obligations, legitimate documentation purposes or technically required deletion cycles require this.

3. Nature of the processing

Depending on the specifically commissioned and used service, the processing may in particular include:
collection by input, upload or connection of systems by the Controller,
storage on systems of the Processor (in case of cloud use) or on systems of the Controller (in case of on-premise use, where agreed),
organization, structuring and administration of data,
analysis and processing by software-based and AI-supported functions in accordance with the purposes defined by the Controller,
use for the creation of results, reports or other outputs,
provision, display and processing of data and results for the Controller,
transmission within the system architecture and to authorized Subprocessors,
deletion or restriction of data in accordance with the Controller’s instructions or after the end of the agreement.

4. Purpose of the processing

The processing of personal data takes place exclusively for the provision of the services agreed in the Main Agreement and on the instructions of the Controller, in particular for:
provision and operation of the solution,
automation and support of the Controller’s processes,
technical administration, maintenance, support and error analysis,
ensuring the functionality, security and stability of the solution.

5. Categories of personal data

Depending on the use, the following categories of data in particular may be processed:
master data,
contact data,
communication data,
content data,
usage data,
log and metadata,
organizational and role data,
document and system data provided by the Controller,
audio, image or video data, where the solution is used for this purpose.
Special categories of personal data pursuant to Art. 9 GDPR are processed only insofar as the Controller permissibly introduces such data into the use and this is contractually or organizationally covered.

6. Categories of data subjects

Depending on the use, the following persons in particular may be affected:
employees of the Controller,
customers of the Controller,
prospects,
suppliers,
business partners,
external contacts,
other persons whose data the Controller processes in the course of use.

Annex 2

Technical and Organizational Measures (TOMs)

The following measures describe the level of protection pursuant to Art. 32 GDPR. The Processor may continuously further develop these measures, provided that the overall level of protection is not reduced.

1. Physical access control

Operation of the systems in professional data center and hosting environments with physical access controls.
Physical access to production-relevant infrastructures only for authorized persons of the respective infrastructure operator or of the Processor.
Protection against unauthorized physical access through suitable organizational and technical measures of the respective operator.

2. System access control

Access to productive systems only for authorized persons.
Personalized user IDs.
Authentication mechanisms with an appropriate security level.
Use of multi-factor authentication for administrative access, where technically provided.
Role and authorization concepts.

3. Data access control

Role-based access according to the need-to-know and least-privilege principle.
Restriction of administrative rights to required groups of persons.
Logging of security-relevant administrative access, where appropriate.
Access to systems and interfaces via protected connections.

4. Transfer control

Transfer of personal data only within the scope of the Controller’s instructions or on a contractual or statutory basis.
Securing data transmissions by transport encryption, in particular TLS/HTTPS, where technically customary.
Engagement of Subprocessors only in accordance with this DPA.

5. Input control

Traceability of material administrative changes and system access, where provided by the system and appropriate.
Documented processes for granting and changing authorizations.

6. Processing control

Conclusion of data processing agreements with relevant Subprocessors.
Documented selection and management processes for Subprocessors.
Regular review of contractual and organizational requirements.

7. Availability control

Use of suitable measures to ensure availability and resilience of the systems.
Backup and recovery processes according to the operating model.
Protection against accidental destruction or loss.
Processes for handling technical disruptions and security incidents.

8. Separation control

Tenant separation and logical separation of customer-related data, insofar as the solution is operated in a multi-tenant manner.
Restriction of shared use of resources to technically controlled environments.
Separation of test, development and production environments, where appropriate.

9. Encryption

Transport encryption during data transmission.
Encryption of data at rest, insofar as provided and technically available in the infrastructure or storage model used.
Key and access management according to recognized security principles.

10. Resilience and recoverability

Appropriate measures to ensure the resilience of the systems and services as well as procedures for recovery after disruptions within the scope of the respective operating architecture.

11. Data protection by default / Privacy by Design

Consideration of data protection requirements in the design, operation and further development of the solution, in particular through data-minimizing, role-based and tenant-related usage concepts.

12. Organization and governance

Confidentiality obligations of authorized persons as well as internal processes for data protection, information security, authorizations, support access and incident handling.

Annex 3

Approved Subprocessors and External Communication Channels

The Controller hereby grants general authorization for the use of the Subprocessors and external communication channels listed below, insofar as these are required for the provision of the services.

1. Microsoft Ireland Operations Ltd., Dublin, Ireland

Services used: Database services (Microsoft Azure), AI models (e.g. OpenAI)
Processing location: Data centers within the EU; processing takes place within the framework of the EU Data Boundary for the Microsoft Cloud https://www.microsoft.com/de-de/trust-center/privacy/european-data-boundary-eudb
Third-country reference and safeguards: Access from the USA by the parent company Microsoft Corporation cannot be fully excluded. In such case, the following safeguards exist:
(a) an active certification under the EU-US Data Privacy Framework (available at https://www.dataprivacyframework.gov/list)
(b) additionally, Standard Contractual Clauses (Module 3: processor to processor) as part of the Microsoft DPA
Contractual basis: Microsoft Products and Services Data Protection Addendum https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

2. Google Cloud EMEA Ltd., Dublin, Ireland

Services used: AI models (e.g. Anthropic)
Processing location: Regional EU endpoints of the Google Cloud Platform
Third-country reference and safeguards: Access from the USA by Google LLC cannot be fully excluded. In such case, the following safeguards exist:
(a) certification under the EU-US Data Privacy Framework
(b) additionally, Standard Contractual Clauses (Module 3) as part of the Cloud Data Processing Addendum
Contractual basis: Google Cloud Data Processing Addendum
https://cloud.google.com/terms/data-processing-addendum
Subprocessor list: https://cloud.google.com/terms/subprocessors

3. Amazon Web Services EMEA SARL, Luxembourg

Services used: AI language models (e.g. Anthropic)
Processing location: EU regions
Third-country reference and safeguards: Access from the USA by Amazon Web Services, Inc. cannot be fully excluded. In such case, the following safeguards exist:
(a) certification under the EU-US Data Privacy Framework
(b) additionally, Standard Contractual Clauses (Module 3) as part of the AWS GDPR DPA
Contractual basis: AWS GDPR Data Processing Addendum https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
Subprocessor list: https://aws.amazon.com/compliance/sub-processors/

4. Twilio Ireland Ltd., Dublin, Ireland

Services used: Telephony and communication services
Processing location: EU regions
Third-country reference and safeguards: In the course of providing the services, a transfer to Twilio Inc. (USA) takes place. The following safeguards exist for this purpose:
(a) certification under the EU-US Data Privacy Framework,
(b) approved Binding Corporate Rules pursuant to Art. 47 GDPR,
(c) additionally, Standard Contractual Clauses (Module 3) as part of the Twilio DPA
Contractual basis: Twilio Data Protection Addendum
https://www.twilio.com/en-us/legal/data-protection-addendum
Subprocessor list: https://www.twilio.com/en-us/legal/sub-processors

5. Anthropic: Contracting party for the EEA: Anthropic Ireland Ltd., Dublin, Ireland; processing by Anthropic PBC, San Francisco, USA

Services used: AI models
Processing location: USA. Guaranteed processing exclusively within the EU is currently not offered for direct API access.
Third-country reference and safeguards: There is a transfer to a third country (USA). The transfer mechanism consists of the Standard Contractual Clauses of the European Commission pursuant to Art. 46 GDPR, which form part of the Anthropic Data Processing Addendum. In addition, a Transfer Impact Assessment has been conducted.
Contractual basis: Anthropic Data Processing Addendum https://www.anthropic.com/legal/data-processing-addendum
https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa
Trust Center: https://trust.anthropic.com

6. Mistral AI SAS, Paris, France

Services used: AI models
Processing location: EU regions
Third-country reference and safeguards: No transfer to a third country; processing is carried out by an EU company on EU infrastructure.
Contractual basis: Mistral AI Data Processing Agreement
https://mistral.ai/terms

External Communication Channels

1. Telegram Messenger Inc. / Telegram platform

Classification: External communication channel; not a regular Subprocessor unless a separate data processing agreement pursuant to Art. 28 GDPR exists with Telegram.
Service: Communication between users and agents via Telegram bots; transmission of messages, prompts, instructions, files and responses.
Note: Telegram may process personal data as an independent controller under its own terms. After the content transmitted via Telegram has been received by the agent, further processing by the Processor takes place within the scope of the DPA. Use takes place only insofar as this communication channel has been approved, set up or initiated by the Controller.

Further Subprocessors and external communication channels

Further Subprocessors may be engaged in accordance with this DPA. The Controller will be informed of corresponding changes pursuant to § 5.