Draft – pending legal review

Data Processing Agreement under Art. 28 GDPR (Template)

This English version is provided for convenience. The German version (Auftragsverarbeitungsvertrag) is legally binding.

This template is intended for businesses and organisations that use our plugins to process personal data of third parties, for example customers, suppliers or employees. Fill in the controller details and send the agreement to tim@ki-katapult.de. The agreement is concluded once the processor confirms receipt by email. Conclusion in this electronic form satisfies Art. 28(9) GDPR.

Parties

Controller (client):
Name / company: ____
Address: ____
Contact person and email: ____

Processor (contractor):
Tim Eiko Neunzig, KI Katapult
Alpenstrasse 13, 14542 Werder (Havel), Germany
Email: tim@ki-katapult.de

1. Subject matter and duration

(1) This agreement covers the processing of personal data by the processor when providing the plugins for ChatGPT described on https://plugins.ki-katapult.de, to the extent the controller uses these plugins for its own purposes.

(2) The agreement applies from conclusion for an indefinite period, for as long as the controller uses the plugins. Either party may terminate it at any time in text form.

2. Nature, purpose, types of data and data subjects

(1) Nature and purpose of processing: receiving the inputs sent by the controller through ChatGPT (text, parameters, files), processing them automatically to perform the requested function (for example creating, checking, converting or merging documents, applying calculation rules), returning the result and providing output files for download for a limited time.

(2) Types of personal data: depending on the plugin used and the controller's inputs, in particular:

• names, addresses and contact details,
• invoice, order and contract data including VAT identification numbers and tax numbers (no card data),
• bank details (IBAN, BIC, account holder, creditor and mandate references), where contained in invoices or bank exports,
• booking data (amounts, booking texts, document numbers, advisor and client numbers),
• employee data, for example names, working times and rosters,
• travel data (traveller name, travel times, destinations, receipt amounts),
• appointment and calendar data,
• letter texts and other content of documents submitted by the controller.

Special categories of personal data (Art. 9 GDPR) are processed only if the controller submits documents containing such data (for example medical certificates in the PDF plugin or health-related details in a letter).

(3) Categories of data subjects: customers, prospects, suppliers and business partners of the controller and their contact persons, employees of the controller, other persons whose data is contained in submitted documents.

3. Instructions

(1) The processor processes the data only on documented instructions from the controller, unless required to do so by Union or German law. In that case the processor informs the controller of that legal requirement before processing, unless the law prohibits this.

(2) The instructions are set out in this agreement and in each call of a plugin function by the controller or its users. Further instructions are given by the controller in text form.

(3) The processor informs the controller without undue delay if, in its opinion, an instruction infringes data protection law.

4. Obligations of the processor

(1) The processor processes the data personally. Where it engages other persons, it commits them to confidentiality unless they are under a statutory obligation of confidentiality.

(2) The processor implements the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further provided the level of protection is not reduced.

(3) The processor processes the data exclusively in Germany. No transfer to third countries takes place.

5. Sub-processors

(1) The controller authorises the sub-processors listed in Annex 2.

(2) The processor informs the controller in text form, at the email address given on conclusion and additionally by publication on this page, at least 14 days in advance of any intended addition or replacement of a sub-processor. The controller may object for a material data protection reason. In case of objection, either party may terminate this agreement; the controller then stops using the plugins.

(3) The processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement.

6. Assistance to the controller

(1) The processor assists the controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). As inputs are not stored and output files are deleted after 60 minutes, the processor will generally hold no data to which such a request could relate.

(2) The processor assists the controller in complying with the obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to it.

(3) If a data subject contacts the processor directly, the processor refers them to the controller where attribution is possible.

7. Personal data breaches

The processor notifies the controller without undue delay in text form of any personal data breach it becomes aware of. The notification contains, as far as known, the information under Art. 33(3) GDPR.

8. Deletion

(1) Inputs are deleted once the respective processing is complete. Output files are deleted automatically 60 minutes after creation.

(2) The controller hereby chooses deletion instead of return (Art. 28(3)(g) GDPR). After termination the processor holds no data of the controller. On request it confirms this in text form.

(3) Operational logs without content and without IP addresses (plugin, function, success or error, duration, size bucket) are, in the parties' assessment, not personal data of the controller and are rotated by size (at most 10 MB per service; the oldest entries are overwritten).

9. Evidence and audits

(1) On request, the processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

(2) The processor allows for audits, including inspections, by the controller or an auditor mandated by it who is bound to confidentiality. Audits must be announced with reasonable notice, as a rule at least 14 days in advance. They are carried out primarily through written information; on-site audits are limited to what is necessary. For the data centre, the processor may refer to the evidence provided by the sub-processor.

(3) As the service is free of charge, each party bears its own costs of an audit. For on-site audits the controller reimburses the processor's reasonable time, unless the audit reveals a breach by the processor of this agreement or of data protection law.

10. ChatGPT and OpenAI

(1) The controller uses the plugins through ChatGPT. OpenAI is neither a sub-processor of the processor nor a party to this agreement.

(2) Processing by OpenAI in ChatGPT, including the conversation, the inputs and the returned results, is governed solely by the relationship between the controller and OpenAI. The controller is itself responsible for ensuring the data protection requirements for that processing, for example through its own agreement with OpenAI.

(3) The processor points out: depending on the ChatGPT plan, OpenAI is the controller's processor (plans with a data processing agreement, for example business plans) or an independent controller (plans for individuals). In the latter case the controller should check whether it may enter personal data of third parties into ChatGPT at all.

11. Liability and final provisions

(1) Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the Terms of Use apply otherwise.

(2) In case of conflict between this agreement and the terms of use, this agreement prevails on matters of data protection.

(3) Amendments and additions require text form. German law applies.

Place, date: ____

Controller: ____

Processor: Tim Eiko Neunzig, KI Katapult ____

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Location and infrastructure

• Processing exclusively on a server in a data centre of Hetzner Online GmbH in Germany.
• Physical security of the data centre (access control, video surveillance, fire protection) provided by Hetzner; according to Hetzner, it is certified under ISO/IEC 27001.

Access

• Administrative access to the server only by the processor personally, through encrypted connections with key-based authentication.
• No user accounts, no user database.

Transmission

• All connections between ChatGPT, website, download links and server are encrypted with TLS.
• Download links for output files are signed, not guessable and valid for 60 minutes.

Storage and deletion

• Inputs are processed in memory or temporary storage and deleted once processing is complete.
• Output files are deleted automatically 60 minutes after creation.
• No backups of inputs or output files.

Logging

• Operational logs contain only plugin name, function name, success or error, duration and file size bucket.
• No content, no file names, no download links, no IP addresses, no user identifiers in logs.

Separation and purpose limitation

• Each call is processed separately; data from different calls is not combined.
• Inputs are not used for any other purpose, in particular not for training AI models.

Availability and review

• Regular security updates of operating system and software.
• Review of the measures whenever the plugins or the infrastructure change materially.

Annex 2: Sub-processors