Agreement on the processing of personal data on behalf of a controller

under Art. 28 of the General Data Protection Regulation (GDPR), for the Skaldion Chat Agent

The German version of this agreement is binding; this English version is provided for information.

Parties

Controller: the customer accepting this agreement in the customer centre, with the company name and address stored there; contact are the email addresses of the owners of the account in the customer centre.

Processor:
Webvines
Hofgartenstraße 28a, 86551 Aichach, Deutschland
Data protection contact: support@skaldion.de

hereinafter "controller" and "processor", together the "parties". The tenant ID and the booked plan are shown in the customer centre.

Section 1 Subject matter, duration and main contract

1. The processor provides and operates the Skaldion Chat Agent for the controller: an AI chat assistant ("bot") that the controller embeds on its websites via a widget. The bot answers visitors' questions with the help of a language model from the knowledge provided by the controller (own texts, documents, extracted pages of its website), records requests and contact details, and sends the controller a summary at the end of a conversation. The basis is the parties' contract on the use of the Skaldion Chat Agent (hereinafter "main contract"), including a free trial.
2. This agreement governs the rights and obligations of the parties when the processor processes personal data on behalf of the controller. Subject matter, nature and purpose of the processing, types of personal data, categories of data subjects and retention periods are set out in Annex 1. Not covered by this agreement are the customer accounts and memberships in the customer centre (registration, login, invitations, roles, sessions), the members' conversations with the setup assistant and the feedback collected from them, the measurement of usage for plan and billing, as well as contract and payment: the processor processes this data under its own responsibility in accordance with its privacy policy.
3. This agreement applies for the term of the main contract and ends with it without notice being required. Obligations which by their nature continue after the end of the contract (deletion, confidentiality, evidence) remain in force.
4. In the event of conflict between this agreement and the main contract on matters of data protection, this agreement prevails.

Section 2 Instructions

1. The processor processes personal data only on documented instructions from the controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law. In that case, the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).
2. Documented instructions are this agreement, the main contract and the settings and actions of the controller and its members in the customer centre, in particular knowledge, pre-chat form and consent text, requests and recipients of summaries, released domains, reading a website, the retention period for conversations, and deleting conversations, knowledge, bots and the account. The controller issues further instructions in text form (e.g. by email) to the processor's contact.
3. If the processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the controller without undue delay. It may suspend the execution of the instruction until the controller confirms or changes it.
4. The processor does not process the data for its own purposes, in particular not for advertising, profiling, analysis of usage behaviour or training artificial intelligence models, and does not disclose it to third parties unless this agreement provides otherwise.

Section 3 Confidentiality

The processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b), Art. 29 GDPR). This obligation continues after the end of their activity.

Section 4 Security of processing

1. The processor takes the technical and organisational measures under Art. 32 GDPR described in Annex 2. Annex 2 forms part of this agreement.
2. The measures are subject to technical progress. The processor may replace them with equivalent or more effective measures; the level of protection described in Annex 2 must not be undercut. The processor documents significant changes and notifies the controller of them in text form.

Section 5 Sub-processors

1. The controller grants the processor general written authorisation to engage other processors (sub-processors) (Art. 28(2) GDPR). The sub-processors listed as "in use" in Annex 3 are deemed approved upon conclusion of this agreement.
2. The processor informs the controller in text form at least 14 days in advance of any intended addition or replacement of a sub-processor. The controller may object in text form within 14 days of receipt of the notice for an important reason relating to data protection. If it does not object in time, the change is deemed approved.
3. If the controller objects, the parties will seek an amicable solution. If none is found by the planned start, the controller may terminate the main contract extraordinarily as of that date. If, due to a justified objection, the processor cannot provide the contractual service or only with disproportionate effort and the parties cannot agree on a reasonable alternative, the processor may also terminate the main contract extraordinarily with regard to the affected services as of the planned start.
4. The processor shall impose on sub-processors the same data protection obligations as set out in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its data protection obligations, the processor remains liable to the controller as for its own conduct.
5. Ancillary services of third parties without access to the controller's personal data are not sub-processing, for example telecommunications and transport services on the internet, the issuing of TLS certificates, domain name resolution (DNS) or the provision of software operated by the processor itself.

Section 6 Place of processing

1. Processing takes place exclusively in the European Union or the European Economic Area. A transfer to a third country or an international organisation only takes place on prior instruction of the controller in text form and only if the requirements of Art. 44 et seq. GDPR are met.
2. If an authority or court outside the EU and the EEA requests the processor or, to its knowledge, a sub-processor to disclose data of the controller, the processor informs the controller without undue delay, where legally permitted, and does not disclose any data without having reviewed the request and consulted the controller.

Section 7 Rights of data subjects

1. If a data subject contacts the processor regarding their rights (Art. 12 to 22 GDPR), the processor forwards the request to the controller without undue delay and does not answer it itself.
2. The processor assists the controller with appropriate technical and organisational measures in fulfilling these rights (Art. 28(3)(e) GDPR). For this purpose, the customer centre offers: viewing each conversation with history and summary, retrieving the history as text, depending on the plan search and export of conversations, deleting individual conversations and deleting all conversations for an email address. Deletion takes effect immediately in the database; the data disappears from the backups with their retention period (Annex 1 no. 5). The processor provides further information at the controller's request.
3. If a visitor has entered personal data of third parties in a conversation or if the controller's knowledge contains personal data, the controller decides on its rectification or erasure; it changes the knowledge in the customer centre itself.

Section 8 Assistance to the controller

Taking into account the nature of the processing and the information available to it, the processor assists the controller in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification of breaches, communication to data subjects, data protection impact assessment, prior consultation), in particular by describing the processing (Annex 1), the measures (Annex 2) and the sub-processors (Annex 3) and by providing information on how the language model and the knowledge search work (Art. 28(3)(f) GDPR).

Section 9 Personal data breaches

1. The processor notifies the controller of a personal data breach affecting the controller's data without undue delay after becoming aware of it, where possible within 24 hours, in text form to the email addresses of the owners in the customer centre. This also applies to breaches at sub-processors as soon as the processor learns of them.
2. The notification contains, where known, the information under Art. 33(3) GDPR: the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; a contact point for further information; the likely consequences; the measures taken or proposed to address and mitigate the breach. Information not yet available is provided without further undue delay.
3. The processor takes without undue delay the measures required to secure the data and to mitigate possible adverse effects on the data subjects. It documents the breach with its cause, effects and remedial action and makes the documentation available to the controller on request.
4. Notification of the supervisory authority (Art. 33 GDPR) and communication to data subjects (Art. 34 GDPR) are the controller's responsibility. The processor only carries them out on the controller's instruction.

Section 10 Deletion and return

1. During the term, the processor deletes the data on its own according to the periods in Annex 1, even without action by the controller.
2. After the end of the main contract, including after the end of a trial without an order, the widget is switched off. The controller can view its conversations in the customer centre for up to 30 days after the end and, where its last plan provided for it, export them; the periods under Annex 1 continue to run, and no separate return takes place. Thereafter, the processor deletes all personal data of the controller (Art. 28(3)(g) GDPR), unless a statutory retention obligation under Union or Member State law applies. If the controller places a new order before then, the new main contract applies.
3. Data in server logs and backups is deleted with their retention periods (Annex 1 no. 5).
4. The processor confirms deletion in text form on request.

Section 11 Evidence and audits

1. The processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by it (Art. 28(3)(h) GDPR).
2. Evidence may be provided by the current description of the measures (Annex 2), written information and the evidence of the sub-processors. Inspections at the processor are possible after notice in text form, as a rule 14 days in advance, during normal business hours and without disrupting operations; auditors must be bound to confidentiality. Data centres and services of sub-processors can only be audited under their rules; their evidence suffices to that extent.
3. Providing existing evidence and written information as well as a reasonable regular review are free of charge. If an inspection requested by the controller causes exceptional effort beyond the usual level, the processor may charge the proven reasonable additional effort after prior agreement. This does not apply if the inspection is required due to a justified suspicion of a data protection breach or an incident for which the processor is responsible.

Section 12 Obligations of the controller

1. The controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. It informs the visitors of its websites under Art. 13 and 14 GDPR; the processor provides a text module for this purpose. It decides whether a pre-chat form and consent to the privacy policy are requested before the chat and provides the link to its privacy policy for this purpose.
2. It only releases the widget for websites it operates itself or is authorised for, and only has websites read in the customer centre for which it has confirmed its authorisation.
3. It does not include in the knowledge any personal data not required to answer visitors' questions, in particular no special categories of data (Art. 9 GDPR) and no data of customers or employees that is not intended for the public.
4. It only configures recipients of summaries that belong to its organisation or act on its behalf. It is itself responsible for the summaries in the recipients' mailboxes.
5. It keeps the access credentials for the customer centre secure, assigns roles only as needed and informs the processor without undue delay if it detects errors or irregularities in the processing.
6. It assesses whether a data protection impact assessment is required for its use, for example if the bot is to answer questions in sensitive areas (e.g. health).

Section 13 Liability

Art. 82 GDPR applies to liability towards data subjects. Between the parties, the liability provisions of the main contract apply. Mandatory statutory liability provisions, in particular under Art. 82 GDPR, remain unaffected.

Section 14 Final provisions

1. Amendments and additions to this agreement require text form. Section 4(2) and Section 5 apply to changes to Annexes 2 and 3.
2. If a provision of this agreement is invalid, the remainder of the agreement remains valid. The parties shall replace the invalid provision with a valid one that comes closest to its purpose.
3. The law of the Federal Republic of Germany applies.
4. To the extent permitted by law, the exclusive place of jurisdiction for all disputes arising from or in connection with this agreement is the processor's registered place of business.
5. This agreement and its annexes are provided in German and English. The German version is binding; the English version is provided for information.

Annexes

• Annex 1: Subject matter, nature and purpose of processing, types of data, data subjects, periods
• Annex 2: Technical and organisational measures
• Annex 3: Sub-processors

The agreement is concluded in electronic form in the processor's customer centre (Art. 28(9) GDPR). The acceptance stored there (time, accepting person, version and checksum of this agreement) replaces the signatures.

Annex 1: Subject matter, nature and purpose of processing, types of data, data subjects, periods

1. Subject matter and purpose

Operation of an AI chat assistant for the controller's websites:

• Chat in the widget: visitors ask questions; the bot searches the controller's knowledge for matching sections and has a language model formulate an answer from them, which appears in the widget. From the second question onwards, the language model rewrites the question together with the previous history into a standalone search query. If the bot finds no matching knowledge, it says so and, depending on the settings, offers to pass the question on to the controller's team.
• Pre-chat form and consent: depending on the controller's settings, the widget asks for salutation, name, email address, company and phone before the chat and obtains consent to the controller's privacy policy.
• Summary: at the end of a conversation (button "End conversation" or after inactivity), the language model creates a customer request from the stored history with contact details, type and request as well as a conversation summary labelled as an AI summary; it is sent by email to the recipient configured by the controller, with the visitor's email address as reply-to address.
• Contact form: if the chat is not available (e.g. quota used up or switched off), the widget shows a contact form; the request is sent to the recipient as a summary without a language model.
• Conversations and unanswered questions in the customer centre: viewing, searching, exporting and deleting conversations; questions without matching knowledge are collected as unanswered questions so that the controller can add to its knowledge.
• Knowledge: the controller's own texts, the extracted text of uploaded documents and the pages of its website that the crawler reads on behalf of the controller; embeddings are created for them and stored in the vector database.
• Test chat: the controller and its members test the bot in the customer centre; these conversations are stored and deleted like conversations in the widget.

2. Nature of processing

Collection (in the widget, in the customer centre, when reading the website), storage, transfer to the AI providers to generate answers, search queries, summaries and embeddings, sending the summary by email, searching, displaying, exporting, deletion.

3. Types of personal data

With each request to the language model, instructions, matching sections of the knowledge, the history of the current conversation and the known visitor details are sent to the AI provider (Annex 3); for embeddings only the respective text or search query.

Processing special categories of personal data within the meaning of Art. 9 GDPR is not the purpose of the service, but may result from visitors' input or from the controller's knowledge. The controller ensures that a lawful basis exists for this and assesses whether additional safeguards are required.

4. Categories of data subjects

• Visitors to the controller's websites who use the widget or submit the contact form
• Persons whose data the controller has stored in the knowledge or published on its website (e.g. contact persons), and persons named by visitors in a conversation
• Employees and agents of the controller, insofar as they hold conversations in the test chat, appear in the knowledge or on images, or are configured as recipients of summaries

5. Retention periods

Annex 2: Technical and organisational measures

Processor: Webvines (Skaldion Chat Agent)

This annex describes the measures implemented in the application and in the server set-up scripts. Anything still being implemented is expressly marked as such and is not warranted.

Preliminary note: split between hosting providers, AI providers and processor

The platform runs on a virtual server (Cloud VPS) of Contabo GmbH in a data centre in Germany; encrypted backups are additionally stored in a Storage Box of Hetzner Online GmbH in Germany (Annex 3). Under their data processing agreements, the hosting providers are responsible for their data centres: physical access, power supply, cooling, fire protection, hardware and the destruction of storage media. The processor alone is responsible for everything running on the server: security and patching of the systems, encryption, separation of tenants, deletion and backups.

The language model and the embeddings run at AI providers in the EU (Annex 3). They only receive the data required for an individual request, over an encrypted connection and with an access key that is stored only on the server. The security of their data centres and models is governed by their data processing agreements.

1. Confidentiality (Art. 32(1)(b) GDPR)

1.1 Physical access control

• Data centres: measures of the hosting providers under their data processing agreements.
• The processor does not operate servers on its own premises. Personal data of visitors is not stored permanently on the processor's workstations. Administrative access to production systems only takes place where required for operation, maintenance or troubleshooting.

1.2 System access control

• Server login only via SSH with a key; password login is disabled. SSH does not listen on the standard port and only accepts defined system users.
• Packet filter on the server: only the SSH port and the web ports (80, 443) are reachable from outside. The database, the cache (Redis) and the vector database (Qdrant) are only reachable on the server itself; an additional filter only allows the application's system users to connect to the cache and the vector database. Both additionally require a password or an access key.
• Platform administration only for the processor's administrators: login with password and two-factor authentication (or passkey), permissions via roles, excluded from search engines.
• Customer centre: login with email address and password (at least 10 characters with letters and numbers, stored only as a hash) and, optionally, a second factor (TOTP with recovery codes). Failed attempts are limited; after five wrong second-factor codes, the account is locked for codes for 15 minutes. Registration gives the same response for known and unknown addresses. Confirmation links are signed and valid for 60 minutes, password reset links for 60 minutes, invitations for 7 days (stored only as a hash). A new password or a confirmed new email address ends all other sessions; locked accounts are rejected on every request.
• Visitors have no accounts. After checking the origin (only domains released by the customer), the widget receives an encrypted session key bound to the bot and the origin and valid for at most 120 minutes. A conversation can only be continued with its ID and a conversation key issued by the server and stored only as a hash.

1.3 Data access control

• Roles in the customer centre: owner (everything), administrator (everything except contract and payment), editor (knowledge and texts), agent (read conversations). Only owners and administrators can delete conversations and change the retention period; only roles with management rights can change the recipients of summaries.
• The processor's administrators see key figures per tenant in the administration (e.g. number of conversations, usage), but no conversation content.
• Secrets (application key, credentials for database, cache, vector database, AI providers, payment provider, email delivery) are generated or entered on the server, kept only there with restricted file permissions and never in the source code repository. Access to the AI providers is limited to the respective project or the required permissions.
• Separate system users for the web application, deployment, the vector database and the build of the user interface, each with the permissions required; the web server only reads the application's public files.
• Images for the widget's appearance (logo, avatar, icon) are stored per bot and only accepted as PNG, JPG or WebP.

1.4 Separation control

• Tenant separation in the application: every row of tenant data carries its tenant's ID. A central filter makes queries without an active tenant fail ("fail-closed"); creating, changing or deleting data of another tenant is rejected. Composite foreign keys prevent knowledge or conversations from being attached to a bot of another tenant.
• Vector database: every vector carries tenant and bot; every search filters on both, and every hit is checked against the database before use (only existing, active sections of the bot itself). The vector database only holds vectors and IDs, no text.
• Automated tests check for the user interface, interfaces, search and background jobs that tenants cannot see each other's data; the security-relevant tests also run against MySQL.
• Development and testing only locally with test data; automated tests never talk to real AI providers.
• Contract and billing data is kept in separate tables, apart from conversations and knowledge. The licence management is a separate system and receives no visitor data.

1.5 Encryption, pseudonymisation and data minimisation

• Conversation content, visitor details (name, email address, company, phone, salutation), titles and summaries of conversations, unanswered questions and the feedback collected from the setup assistant are stored encrypted in the database (AES-256). The key is kept only on the server and in the encrypted backup.
• Searching conversations works without decryption via keyed hash values (HMAC) that differ per tenant.
• Visitor consents are stored with time, version of the text, link and shortened IP address (IPv4 to /24, IPv6 to /48).
• Server logs contain no conversation content; IP addresses in the access log are shortened, access keys and tokens in URLs are redacted.
• The AI providers only receive the data required for the individual answer (instructions, matching sections of the knowledge, the history of the current conversation and the details the visitor has provided). For providers with a response cache, the application requests that requests are neither answered from nor stored in the cache.
• The customer's knowledge (own texts, extracted text of uploaded documents, extracted pages of its website) is not stored encrypted because it is needed for search; for uploaded documents only the extracted text is stored, not the file.

2. Integrity (Art. 32(1)(b) GDPR)

2.1 Transfer control

• All connections to the platform are encrypted: HTTPS with TLS and HSTS, certificates from Let's Encrypt. Connections to the AI providers, the payment provider, the licence management and the Storage Box are encrypted as well (TLS or SSH).
• The application only contacts the AI providers from the server; visitors' browsers have no connection to them.
• The customer centre and the widget do not load content from other servers (fonts and scripts are served by the platform itself). No content delivery network, no analytics or tracking services. The widget sets no cookies; in the browser's session storage it only remembers whether the welcome teaser has been closed.
• The widget only responds to websites whose domain the customer has released (origin check, CORS only for that origin).
• Emails (summaries, account management) are kept encrypted in the queue until they are sent and are delivered to the email service via TLS.
• The crawler ("read website") only fetches public addresses via http/https on ports 80 and 443; every address and every redirect is checked beforehand (no internal networks), it respects robots.txt and identifies itself as SkaldionBot with a link to an information page.

2.2 Input control

• Settings, knowledge and conversations only change after login to the customer centre with the appropriate role or via the widget with a valid session key.
• Deletions leave tombstones (type and ID, no content) so that restoring a backup does not bring deleted data back.
• Every call to an AI provider is logged with tenant, bot, purpose, provider, model and number of tokens, without content.
• Configuration and code only change via the versioned repository and scripts; the server set-up is fully scripted.

3. Availability and resilience (Art. 32(1)(b) and (c) GDPR)

• Data centre: power supply, cooling, fire protection and network connectivity by the hosting provider under its data processing agreement.
• Automatic security updates of the operating system. Web server and vector database are installed in pinned versions, downloads are verified with checksums.
• Services are monitored by the operating system and restarted after a crash.
• Resilience: limits per tenant for messages per minute, concurrent conversations, conversations and AI budget per month; throttling per AI provider with a queue. If a provider is overloaded or disrupted, a second provider can step in; if no quota is left, the widget shows a contact form instead of an AI answer.
• Monitoring: the application provides a protected check endpoint for database, background jobs, vector database, deletion jobs, AI providers, backups and load. Automatic polling by the processor's monitoring system with alert rules is being implemented and is not part of the measures warranted here.

4. Recoverability (Art. 32(1)(c) GDPR)

• The server can be fully rebuilt from the repository using scripts, also at another provider.
• Database, vector database, stored files and the application key are backed up daily. Backups are encrypted (age) and sealed (HMAC); the decryption key is not stored on the server. They are kept on the server and in the Storage Box (Annex 3) and deleted after 7 days.
• A restore re-applies all deletions since the backup (tombstones, deletion jobs for the vector database, retention periods), so that deleted data does not return. A trial restore alongside live operation verifies this.

5. Deletion

• Conversations with messages, unanswered questions and search terms are deleted automatically every day after the customer's retention period (default 90 days without activity), and immediately in the customer centre, individually or per email address.
• Deleted knowledge disappears from the database immediately and from the vector database via a deletion job that is created in the same transaction, retried until the vector database confirms it, and cross-checked every hour (vectors without a section are deleted).
• Deleting a bot or an entire tenant removes knowledge, documents, website pages, conversations or all of the tenant's data in both databases.

6. Regular testing, assessment and evaluation (Art. 32(1)(d) GDPR)

• Automated tests on every change, including tenant separation, roles, every deletion path (after deletion, search finds nothing in either database) and the origin check in the widget.
• Review of these measures on every significant change, at least once a year.
• Ongoing monitoring of available security updates and known vulnerabilities.
• Procedure for personal data breaches: detect, assess, inform affected controllers without undue delay (target: within 24 hours), contain, document.

7. Data protection by design and by default (Art. 25 GDPR)

• The pre-chat form and contact fields are off by default; the customer decides which details are requested and whether they are mandatory. Consent to the privacy policy is never pre-ticked.
• The widget always identifies itself as an AI assistant with the notice that answers may contain errors; the summary is labelled as an AI summary.
• Contact details in the summary only come from what the visitor has provided.
• Own retention periods, even without action by the customer.
• For an existing conversation, the history from the browser is not used; the server only works with the stored history.

8. Organisational measures

• Only the processor itself has access to the production systems. Other persons only receive access if they are bound to confidentiality (Section 3 of the agreement).
• Operating procedures (set-up, deployment, backup, restore, deletion) are documented in the repository.
• Customer and visitor data is not used to train AI models.
• AI-assisted development tools receive no access to personal production data, credentials or other secrets. Such data is only processed by further external AI services if the service has been reviewed under data protection law, engaged as a sub-processor and approved under Section 5 of the agreement.
• Data protection contact: support@skaldion.de

Annex 3: Sub-processors

Processor: Webvines (Skaldion Chat Agent)

In use (approved under Section 5(1) of the agreement)

For each request, the AI providers (nos. 3 and 4) only receive the data required: instructions, matching sections of the knowledge, the history of the current conversation and the details the visitor has provided; for embeddings only the individual text or search query. They process the data only to generate the answer and not to train models. [To be checked against the contracts and terms of Scaleway and mittwald before approval, including any temporary storage of requests for errors or abuse; see pruefhinweise.md.]

Notes

• The processor does not transfer personal data to third countries. All sub-processors listed above process the data in the EU (Germany, France).
• Providers that receive no data of visitors or conversations are not sub-processors: domain name resolution (DNS), the issuing of TLS certificates and the processor's licence and monitoring platform (it only contains contract data of the tenants and technical metrics of the server).
• The payment provider Stripe is not a sub-processor: it only receives contract and payment data of the customer, for which the processor is itself responsible, and never any visitor data.
• The websites that the controller has read in the customer centre are fetched by the processor's own server; no data is transferred to third parties in the process.