Data Processing Agreement

Last updated: 20 October 2026

This agreement is available in German and English. The German version (Auftragsverarbeitungsvertrag) prevails.

between

the Customer as controller (hereinafter “Controller”)

and

Scavenger AI GmbH, Thurn-und-Taxis-Platz 6, 60313 Frankfurt am Main, Germany, as processor (hereinafter “Processor”; Controller and Processor together the “Parties”)

Preamble

The Controller has engaged the Processor on the basis of the Terms and Conditions of Scavenger AI GmbH or an individually concluded contract (hereinafter “Main Contract”) to provide the services set out there. Performing the contract involves the processing of personal data. Art. 28 GDPR in particular sets certain requirements for such processing on behalf of a controller. To meet these requirements, the Parties conclude the following data processing agreement (hereinafter the “Agreement”), the performance of which is not remunerated separately unless expressly agreed.

§ 1 Definitions

(1) Controller, pursuant to Art. 4 para. 7 GDPR, is the body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

(2) Processor, pursuant to Art. 4 para. 8 GDPR, is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

(3) Personal data, pursuant to Art. 4 para. 1 GDPR, is any information relating to an identified or identifiable natural person (hereinafter “Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

(4) Personal data requiring special protection are personal data pursuant to Art. 9 GDPR revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership of Data Subjects, personal data pursuant to Art. 10 GDPR relating to criminal convictions and offences or related security measures, as well as genetic data pursuant to Art. 4 para. 13 GDPR, biometric data pursuant to Art. 4 para. 14 GDPR, data concerning health pursuant to Art. 4 para. 15 GDPR and data concerning a natural person’s sex life or sexual orientation.

(5) Processing, pursuant to Art. 4 para. 2 GDPR, is any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(6) Supervisory authority, pursuant to Art. 4 para. 21 GDPR, is an independent public authority established by a Member State pursuant to Art. 51 GDPR.

§ 2 Subject Matter

(1) The Processor provides the services set out in the Main Contract to the Controller. In doing so, the Processor gains access to personal data, which the Processor processes for the Controller exclusively on behalf of and on the instructions of the Controller. The scope and purpose of the data processing by the Processor result from the Main Contract and any associated service descriptions. The Controller is responsible for assessing the lawfulness of the data processing.

(2) To specify the mutual rights and obligations under data protection law, the Parties conclude this Agreement. In case of doubt, the provisions of this Agreement take precedence over the provisions of the Main Contract.

(3) The provisions of this Agreement apply to all activities related to the Main Contract in which the Processor and its employees or persons engaged by the Processor come into contact with personal data originating from the Controller or collected for the Controller.

(4) The term of this Agreement follows the term of the Main Contract, unless the following provisions give rise to obligations or termination rights beyond it.

§ 3 Right to Issue Instructions

(1) The Processor may collect, process or use data only within the scope of the Main Contract and in accordance with the Controller’s instructions. If the Processor is required by the law of the European Union or of the Member States to which it is subject to carry out further processing, it informs the Controller of these legal requirements before the processing.

(2) The Controller’s instructions are initially set out in this Agreement and may thereafter be amended, supplemented or replaced by the Controller in writing or in text form through individual instructions. The Controller is entitled to issue such instructions at any time. This includes instructions regarding the correction, deletion and blocking of data.

(3) The Controller documents all instructions issued. Instructions that go beyond the services agreed in the Main Contract are treated as a request for a change of service.

(4) If the Processor believes that an instruction of the Controller violates data protection provisions, it must notify the Controller without undue delay. The Processor is entitled to suspend the execution of the instruction concerned until it is confirmed or changed by the Controller. The Processor may refuse to execute an obviously unlawful instruction.

§ 4 Types of Data Processed, Data Subjects, Third Countries

(1) In performing the Main Contract, the Processor gains access to the personal data specified in Annex 1.

(2) The categories of Data Subjects are set out in Annex 2.

(3) Personal data may be transferred to a third country (outside the EEA) under the conditions of Art. 44 et seq. GDPR.

§ 5 Protective Measures of the Processor

(1) The Processor is obliged to comply with the statutory data protection provisions and not to disclose information obtained from the Controller’s domain to third parties or expose it to their access. Documents and data must be secured against access by unauthorised persons, taking into account the state of the art.

(2) Within its area of responsibility, the Processor organises its internal operations so that they meet the particular requirements of data protection. It has taken the technical and organisational measures set out in Annex 3 for the adequate protection of the Controller’s data pursuant to Art. 32 GDPR, which the Controller recognises as adequate. The Processor reserves the right to change the security measures taken, while ensuring that the contractually agreed level of protection is not undercut.

(3) Persons employed by the Processor in processing the data are prohibited from collecting, processing or using personal data without authorisation. The Processor obliges all persons it entrusts with processing and performing this Agreement (hereinafter “Staff”) accordingly (obligation of confidentiality, Art. 28 para. 3 lit. b GDPR) and ensures compliance with this obligation with due care.

(4) The Processor has appointed a data protection officer. The Processor’s data protection officer is heyData GmbH, Schützenstr. 5, 10117 Berlin, datenschutz@heydata.eu, www.heydata.eu.

(5) Authorised Staff of the Processor access the Controller’s data only to the extent necessary for support, operation and security of the services and to fulfil legal obligations.

(6) The Processor does not use the Controller’s data to train or fine-tune AI models, neither its own models nor those of its sub-processors. AI models are used for inference only.

§ 6 Information Obligations of the Processor

(1) In the event of disruptions, suspected data protection breaches or breaches of the Processor’s contractual obligations, suspected security incidents or other irregularities in the processing of personal data by the Processor, by persons employed by it in the context of the engagement or by third parties, the Processor informs the Controller without undue delay. The same applies to audits of the Processor by the data protection supervisory authority. The notification of a personal data breach contains at least the following information:

a) a description of the nature of the personal data breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of personal data records concerned; b) a description of the measures taken or proposed by the Processor to address the breach and, where appropriate, measures to mitigate its possible adverse effects; c) a description of the likely consequences of the personal data breach.

(2) The Processor takes the necessary measures to secure the data and mitigate possible adverse consequences for the Data Subjects without undue delay, informs the Controller thereof and requests further instructions.

(3) The Processor is furthermore obliged to provide the Controller with information at any time insofar as the Controller’s data is affected by a breach pursuant to paragraph 1.

(4) The Processor informs the Controller of significant changes to the security measures pursuant to § 5 para. 2.

§ 7 Audit Rights of the Controller

(1) The Controller may satisfy itself of the Processor’s technical and organisational measures before processing begins and annually thereafter. For this purpose, it may, for example, obtain information from the Processor, have existing expert certificates, certifications or internal audits presented, or, after timely coordination during normal business hours, inspect the Processor’s technical and organisational measures in person or have them inspected by a competent third party, provided that the third party is not a competitor of the Processor. The Controller carries out audits only to the extent necessary and does not disproportionately disrupt the Processor’s operations.

(2) Upon the Controller’s oral or written request, the Processor undertakes to provide the Controller within a reasonable period with all information and evidence required to audit the Processor’s technical and organisational measures.

(3) The Controller documents the audit result and informs the Processor of it. In the event of errors or irregularities that the Controller discovers, in particular when reviewing the results of the processing, it must inform the Processor without undue delay. If the audit reveals facts whose future avoidance requires changes to the prescribed procedure, the Controller informs the Processor of the necessary procedural changes without undue delay.

§ 8 Use of Service Providers

(1) The contractually agreed services are performed with the involvement of the service providers listed in Annex 4 (hereinafter “Sub-processors”). The Controller grants the Processor its general authorisation within the meaning of Art. 28 para. 2 s. 1 GDPR to engage further Sub-processors or replace those already engaged within the scope of its contractual obligations.

(2) The Processor informs the Controller before any intended change concerning the addition or replacement of a Sub-processor. The Controller may object to an intended addition or replacement of a Sub-processor for an important reason under data protection law.

(3) The objection to the intended addition or replacement of a Sub-processor must be raised within 2 weeks of receipt of the information about the change. If no objection is raised, the addition or replacement is deemed approved. If there is an important reason under data protection law and the Controller and the Processor cannot reach an amicable solution, the Processor has a special right of termination effective at the end of the month following the objection.

(4) When engaging Sub-processors, the Processor obliges them in accordance with the provisions of this Agreement.

(5) A sub-processing relationship within the meaning of these provisions does not exist if the Processor engages third parties for services that are to be regarded as purely ancillary services. These include, for example, postal, transport and shipping services, cleaning services, telecommunications services without specific reference to services the Processor provides for the Controller, and security services. Maintenance and testing services constitute sub-processing relationships requiring approval insofar as they are provided for IT systems that are also used in connection with the provision of services for the Controller.

(6) Personal data may be transferred to a third country (outside the EEA) under the conditions of Art. 44 et seq. GDPR.

§ 9 Requests and Rights of Data Subjects

(1) Where possible, the Processor supports the Controller with appropriate technical and organisational measures in fulfilling its obligations under Art. 12–22 and 32 to 36 GDPR.

(2) If a Data Subject asserts rights, such as to information, correction or deletion of their data, directly against the Processor, the Processor does not respond on its own but refers the Data Subject to the Controller and awaits its instructions.

§ 10 Liability

(1) In the internal relationship with the Processor, the Controller alone is responsible to the Data Subject for compensation for damage that a Data Subject suffers due to data processing or use within the scope of the processing on behalf that is inadmissible or incorrect under data protection law.

(2) The Processor is liable without limitation for damage insofar as the cause of the damage is based on an intentional or grossly negligent breach of duty by the Processor, its legal representative or vicarious agents.

(3) For negligent conduct, the Processor is liable only for the breach of an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the Controller regularly relies and may rely, but limited to the average damage typical for the contract. Otherwise, the Processor’s liability – including for its vicarious agents – is excluded.

(4) The limitation of liability pursuant to § 10 para. 3 does not apply to claims for damages arising from injury to life, body or health or from the assumption of a guarantee.

§ 11 Termination of the Main Contract

(1) After termination of the Main Contract, the Processor returns to the Controller all documents, data and data carriers provided to it or – at the Controller’s request, unless there is an obligation to store the personal data under Union law or the law of the Federal Republic of Germany – deletes them. This also applies to any data backups at the Processor. The Processor must provide documented proof of proper deletion upon request.

(2) The Controller has the right to check the complete and contractual return or deletion of the data at the Processor in an appropriate manner.

(3) The Processor is obliged to treat data that became known to it in connection with the Main Contract confidentially even after the end of the Main Contract. This Agreement remains valid beyond the end of the Main Contract as long as the Processor holds personal data that was forwarded to it by the Controller or that it collected for the Controller.

§ 12 Final Provisions

(1) Insofar as the Processor does not expressly perform support activities under this Agreement free of charge, it may charge the Controller a reasonable fee for them, unless the Processor’s own actions or omissions directly made this support necessary.

(2) Amendments and additions to this Agreement require text form. This also applies to any waiver of this form requirement. The priority of individual contractual agreements remains unaffected.

(3) Should individual provisions of this Agreement be or become wholly or partially invalid or unenforceable, the validity of the remaining provisions is not affected.

(4) This Agreement is governed by German law.

(5) This Agreement is concluded in electronic form (Art. 28 para. 9 GDPR) when the Controller accepts the Terms and Conditions of Scavenger AI GmbH, of which it forms part. If the Parties have concluded an individual data processing agreement, that agreement takes precedence.

---

Annex 1 – Description of Data / Data Categories

• Login information (name, email address, etc.)
• Meta and communication data
• Usage data
• Content data uploaded or entered by users or retrieved from connected data sources, insofar as it contains personal data

Annex 2 – Description of Data Subjects / Groups of Data Subjects

Employees of the Controller, third parties

Annex 3 – Technical and Organisational Measures of the Processor

1. Introduction

This document summarises the technical and organisational measures taken by the Processor within the meaning of Art. 32 para. 1 GDPR. These are measures with which the Processor protects personal data. The document is intended to support the Controller in fulfilling its accountability obligation under Art. 5 para. 2 GDPR.

2. Confidentiality (Art. 32 para. 1 lit. b GDPR)

2.1. Physical access control

The following implemented measures prevent unauthorised persons from gaining access to the data processing facilities:

• Identity checks by the porter or at reception
• Key management / key log
• Instruction to Staff not to work in publicly accessible premises (e.g. cafés)
• Working from home: unauthorised persons have no access to Staff’s homes
• Working from home: instruction to Staff to work, where possible, in a study separated from living areas

2.2. System access control

The following implemented measures prevent unauthorised persons from gaining access to the data processing systems:

• Authentication with user name and password
• Use of anti-virus software
• Creation of user profiles
• Use of two-factor authentication
• General instruction to lock the desktop manually when leaving the workplace

2.3. Data access control

The following implemented measures ensure that unauthorised persons have no access to personal data:

• The number of administrators is kept as small as possible
• Secure storage of data carriers
• Management of user rights by system administrators

2.4. Separation control

The following measures ensure that personal data collected for different purposes is processed separately:

• Separation of production and test systems
• Logical client separation (in software)
• Data records tagged with purpose attributes / data fields

3. Integrity (Art. 32 para. 1 lit. b GDPR)

3.1. Transfer control

It is ensured that personal data cannot be read, copied, changed or removed without authorisation during transfer or storage on data carriers, and that it can be checked which persons or bodies have received personal data. The following measures are implemented for this purpose:

• Wi-Fi encryption (WPA2 with a strong password)
• Logging of access and retrieval

3.2. Input control

The following measures ensure that it can be checked who processed personal data in data processing systems and when:

• Logging of the entry, change and deletion of data
• Traceability of the entry, change and deletion of data through individual user names (not user groups)
• Instruction to Staff to delete data only after consultation

4. Availability and Resilience (Art. 32 para. 1 lit. b GDPR)

The following measures ensure that personal data is protected against accidental destruction or loss and is always available to the client:

• Fire and smoke detection systems
• Uninterruptible power supply (UPS)
• Regular backups
• Hosting (at least of the most important data) with a professional hosting provider

5. Procedures for Regular Review, Assessment and Evaluation (Art. 32 para. 1 lit. d GDPR; Art. 25 para. 1 GDPR)

5.1. Data protection management

The following measures are intended to ensure an organisation that meets the basic requirements of data protection law:

• Use of the heyData platform for data protection management
• Appointment of heyData as data protection officer
• Obligation of Staff to data secrecy
• Regular data protection training for Staff
• Maintaining a record of processing activities (Art. 30 GDPR)

5.2. Incident response management

The following measures are intended to ensure that reporting processes are triggered in the event of data protection breaches:

• Reporting process for personal data breaches pursuant to Art. 4 no. 12 GDPR to the supervisory authorities (Art. 33 GDPR)
• Reporting process for personal data breaches pursuant to Art. 4 no. 12 GDPR to the Data Subjects (Art. 34 GDPR)
• Involvement of the data protection officer in security incidents and data breaches
• Use of anti-virus software

5.3. Data protection by default (Art. 25 para. 2 GDPR)

The following implemented measures take into account the principles of “privacy by design” and “privacy by default”:

• No more personal data is collected than is necessary for the respective purpose.

5.4. Order control

The following measures ensure that personal data can only be processed in accordance with the instructions:

• Written instructions to the contractor or instructions in text form (e.g. through a data processing agreement)
• Ensuring the destruction of data after the end of the engagement, e.g. by requesting corresponding confirmations
• Confirmation from contractors that they oblige their own staff to data secrecy (typically in the data processing agreement)
• Careful selection of contractors (in particular with regard to data security)
• Ongoing review of contractors and their activities

Annex 4 – Current Sub-processors

Name	Function	Application	Server location
Okta, Inc., 100 First Street, San Francisco, California 94105, USA	Authentication management	Scavenger app	EU
Vercel Inc., 340 S Lemon Ave Unit 4133 Walnut, CA, USA	Website hosting	Scavenger app	USA
Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland	Model hosting	Scavenger app	EU
Microsoft Ireland Operations, Ltd. (address above)	Azure Bot Service: relaying messages in Microsoft Teams	Strategy Agent	EU (West Europe); entry through Microsoft’s global endpoints
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg	Database; AI models (Amazon Bedrock)	Scavenger app	EU
Amazon Web Services EMEA SARL (address above)	Hosting, databases, storage, sign-in (Amazon Cognito), AI models (Amazon Bedrock), delivery of the web application (Amazon CloudFront)	Strategy Agent	EU (Frankfurt; AI models in EU regions); CloudFront worldwide, only web application files and IP addresses