Data processing agreement (Vertrag zur Auftragsverarbeitung)

§ 1 Subject matter and duration

TCB GmbH (the processor, „Auftragsverarbeiterin“) processes personal data for the customer (the controller, „Verantwortlicher“) solely in order to forward requests from the OCTOVO program to a language model and to return the answer. The processing lasts as long as the main contract.

Not the subject of this agreement is the processing on the controller’s device: mailbox, files, contacts, calendar and the memory remain there and are technically inaccessible to the processor.

§ 2 Nature, purpose, categories of data, data subjects

Nature of the processing

Transmission (pass-through) to sub-processors, counting of the volume

Purpose

Producing text drafts, summaries, classifications and suggested actions

Categories of data

Content of the respective request: excerpts from messages, documents, appointments, contact details

Data subjects

The controller themselves and their communication partners (customers, suppliers, employees)

§ 3 Instructions

The processor processes data solely on documented instructions. The controller’s use of OCTOVO counts as an instruction. If the processor considers an instruction unlawful, it communicates this without delay.

§ 4 Confidentiality

All persons involved in the processing are bound to confidentiality and trained in the essentials of data protection.

§ 5 Technical and organisational measures (Art. 32 DSGVO)

• Encryption in transit (TLS 1.3) and at rest; backups encrypted
• No storage of content in normal operation — pass-through without caching, logs without payload
• Separation of development, test and production environments
• Access to production systems only via personal keys, two-factor requirement, logged
• Role and permission concept following the principle of least privilege
• Incident reporting channels with a response within 24 hours, notification of the controller without delay
• Annual review of the measures, documented
• Deletion concept with automatic time limits (diagnostic recordings at most 7 days)

§ 6 Sub-processors

The controller consents to the use of the service providers listed under sub-processors in the section “Working on our behalf” („In unserem Auftrag tätig“). We announce replacements or additions at least 30 days in advance; the controller may object and in that case terminate for cause. Contracts with equivalent obligations are in place with all sub-processors.

The parties listed in the second section of the same page are not the subject of this consent and are not sub-processors: there, the controller’s device establishes the connection itself, without instruction and without involvement of the processor.

§ 7 Third country

The language models are operated by Anthropic PBC in the USA. The transfer is safeguarded by the EU Commission’s standard contractual clauses, supplemented by technical measures (transport encryption, minimisation of the transmitted excerpts, requested non-storage).

§ 8 Support obligations

The processor supports the controller with data subject requests, data protection impact assessments and notifications to supervisory authorities, insofar as this is possible for it with the information available to it. Since no content is stored in normal operation, it cannot provide information about individual content — the corresponding data resides with the controller on their device.

§ 9 Deletion and return

After the contract ends, account and billing data is deleted unless statutory retention obligations stand in the way. Content does not exist and can therefore be neither handed over nor deleted.

§ 10 Evidence

On request, the processor demonstrates compliance through self-disclosure and documentation. On-site audits are possible after announcement with reasonable notice and without impairing operations.