Version: 1.0 · Date: 2026-09-28 · German law · English courtesy translation; the German text is binding
This DPA is Annex A to the AUVY Terms for Business Customers. It is concluded as soon as a workspace is created for the Customer, including when an app creates it at sign-in, and at the latest when the Customer accepts the Terms; electronic form suffices (Art. 28 (9) GDPR) and no countersignature is needed. Its content implements the Standard Contractual Clauses of Implementing Decision (EU) 2021/915. Enterprise customers may agree deviations in an order form or DPA addendum. Version history: trust.auvy.ai/changelog.
Parties
Processor: AUVY GmbH, Am Haag 8, 82166 Gräfelfing, Germany · Munich Local Court, HRB 311039 · represented by the managing directors Achim Ströbel and Patrick Schröppel (each with sole power of representation) · Privacy: privacy@auvy.ai · Security: security@auvy.ai · Data protection officer: not appointed
Controller ("Customer"): the organisation named as the contracting party at checkout, in an order form or in a pilot agreement, or for which a workspace was created.
§ 1 Subject matter
(1) AUVY processes personal data on the Customer's behalf solely to provide and operate AUVY as software-as-a-service, including support.
(2) This DPA does not apply where AUVY is itself controller, in particular for accounts, sign-in, billing and platform security, which the Product Privacy Notice covers. There is no processing on behalf for consumer contracts, nor for a personal workspace one of AUVY's apps creates for a person.
(3) Annexes 1 to 4 form part of this DPA.
§ 2 Instructions
(1) AUVY processes the data only on the Customer's documented instructions, unless Union or Member State law requires otherwise; AUVY then informs the Customer beforehand unless the law prohibits it.
(2) The Customer instructs AUVY by using and configuring the product, through support requests, and in text form to privacy@auvy.ai.
(3) If AUVY considers an instruction to infringe data protection law, it informs the Customer without undue delay.
(4) AUVY does not use Customer Data to train or fine-tune AI models. Anonymised, aggregated usage statistics without personal reference remain permitted.
§ 3 Nature of the processing
Subject matter, duration, nature and purpose of the processing, the types of data and the data subjects are set out in Annex 1.
§ 4 Confidentiality
AUVY grants access to Customer Data only to people who need it for operations, support or security and who are bound by confidentiality or a statutory duty of secrecy.
§ 5 Security of processing
AUVY implements at least the technical and organisational measures in Annex 2 (Art. 32 GDPR). AUVY may develop them further as long as the level of protection does not decrease.
§ 6 Sub-processors
(1) The Customer gives general authorisation for the sub-processors in Annex 3 (Art. 28 (2) GDPR). The current list is at trust.auvy.ai/subprocessors.
(2) AUVY announces any addition or replacement at least 30 days in advance by email to the workspace owners and in the Trust Center. The Customer may object on data protection grounds within that period. If the parties find no solution, the Customer may terminate the affected service for cause (§ 8 Terms). If a sub-processor has to be replaced at short notice to keep the service secure or available, AUVY may make the replacement before the period ends; AUVY then informs the Customer without undue delay, and the right to object and to terminate runs from receipt of that notice.
(3) AUVY binds each sub-processor contractually to an equivalent level of data protection and remains liable to the Customer for its performance.
(4) Integrations the Customer activates itself (e.g. Microsoft 365) are not AUVY sub-processors; the connected service is a recipient at the Customer's request. The same applies to third-party apps that an administrator of the Customer installs or that install themselves when one of the Customer's people signs in: they are recipients at the Customer's instruction and receive only what their installation allows. AUVY's own apps are brands of AUVY GmbH and are named in Annex 3.
§ 7 Assistance
(1) AUVY assists the Customer with appropriate technical and organisational measures in responding to data subject requests (Art. 12–22 GDPR). Requests that reach AUVY directly are forwarded to the Customer without undue delay.
(2) AUVY assists the Customer with the obligations under Art. 32 to 36 GDPR (security, notifications, data protection impact assessments, consultation) to the extent AUVY has the necessary information.
§ 8 Personal data breaches
(1) AUVY notifies the Customer of a breach affecting Customer Data without undue delay and at the latest 24 hours after becoming aware of it, at the Customer's registered contact address.
(2) The notification contains, as far as known, the information under Art. 33 (3) GDPR. AUVY provides missing information as soon as it is available.
§ 9 Evidence and audits
(1) AUVY makes available the information necessary to demonstrate compliance with Art. 28 GDPR.
(2) The Customer, or an auditor it appoints who is bound to confidentiality, may audit compliance at most once a year, with at least 20 business days' notice, during business hours and without disrupting other customers. These limits do not apply where there is a specific cause or a regulatory order. Existing certificates and audit reports may replace an audit. The Customer bears the costs unless the audit reveals a material breach by AUVY.
§ 10 Transfers to third countries
AUVY transfers personal data to third countries only in compliance with Chapter V GDPR. Annex 4 describes the safeguards.
§ 11 Return and deletion
(1) The Customer can download Customer Data at any time using the export functions.
(2) After the end of the contract AUVY deletes Customer Data within 30 days, unless a statutory retention obligation applies. Encrypted backups are overwritten in the regular 30-day rotation and are used only for restoration until then. On request AUVY confirms deletion in text form.
§ 12 Professional secrets (§ 203 German Criminal Code)
(1) Third-party secrets within the meaning of § 203 StGB (e.g. of lawyers, tax advisers, doctors) may be processed in AUVY only after the Customer has notified this in text form and AUVY has confirmed it in text form. Without this activation, entering them is prohibited.
(2) AUVY confirms activation only if (a) the staff involved are bound under § 203 (4) StGB, (b) only sub-processors with an equivalent obligation are used (where necessary by switching off individual functions such as web search) and (c) the additional measures for the workspace are documented. Activation is available to customers on a Business or Enterprise contract; the request is made from the workspace or in text form to privacy@auvy.ai.
§ 13 Term, liability, final provisions
(1) This DPA applies for as long as AUVY processes Customer Data for the Customer.
(2) Liability follows Art. 82 GDPR and § 14 Terms; the liability limits of the Terms do not apply to claims under Art. 82 GDPR (§ 14 (4) Terms).
(3) German law applies. Place of jurisdiction is Munich where the Customer is a merchant or a legal entity under public law. In case of conflict, this DPA prevails over other contract terms insofar as the protection of personal data is concerned.
Annex 1: Description of the processing
| Purpose | Providing AUVY: workspaces, collaboration, AI-assisted processing, web search, voice features, export, deletion and support; AUVY's own apps such as Outeva, where installed in the workspace |
| Nature | Storing, retrieving, organising, processing for AI requests, transmitting to sub-processors under Annex 3, deleting |
| Duration | Term of the contract plus the deletion period under § 11 |
| Data subjects | The Customer's employees and agents; people named in workspace content; meeting participants when voice features are used; contacts at the Customer's prospects, customers and business partners when the Customer uses Outeva |
| Types of data | Workspace content (documents, notes, messages, prompts, AI outputs), files, audio and transcripts for voice features, meeting audio and video and their recordings when a meeting is recorded, search queries and requested URLs for web search, email and calendar content the Customer connects, content in AUVY's own apps (for Outeva: companies, contacts, appointments, offers and campaigns), user and workspace identifiers |
| Special categories (Art. 9 GDPR) | Not intended. Permitted only where the Customer has a legal basis and informs AUVY in advance |
| § 203 StGB | Only after activation under § 12 |
Annex 2: Technical and organisational measures
As of 2026-09-28.
| Area | Measure |
|---|---|
| Storage location | Customer Data is stored exclusively in Hetzner data centres in Helsinki (EU) |
| Encryption in transit | TLS 1.2 or higher for all external connections |
| Encryption of stored data | Backups encrypted with AES-256-GCM |
| Backups | MongoDB and PostgreSQL (identity and accounts) daily, vector index weekly, encrypted in Hetzner Object Storage (Helsinki), 30-day retention |
| Tenant separation | Logical separation per workspace; the server determines the workspace, not the client |
| Access and sign-in | Role-based permissions, least privilege for operational access; passkeys/WebAuthn and multi-factor sign-in for customer accounts; identity data in AUVY-operated PostgreSQL in Helsinki |
| Physical security | Through the data centre operator Hetzner (ISO/IEC 27001-certified data centres) |
| Change and operations | Code review, controlled deployments, timely security updates, monitoring and alerting |
| Logging | Security-relevant events (sign-in, failed attempts, administrative actions) are logged centrally |
| Incident management | Documented process with notification under § 8 |
| Data minimisation | Optional features receive data only when used; no third-party analytics; no model training on Customer Data |
| Deletion and export | In-product export; deletion under § 11 |
Annex 3: Sub-processors
Register v1.0 · 2026-09-28 · current list: trust.auvy.ai/subprocessors
| Provider | Service | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and storage of all Customer Data | All types of data under Annex 1 | EU (Helsinki) |
| Amazon Web Services EMEA SARL | AI models and compute (Amazon Bedrock, EU inference profiles); Bedrock stores no requests | Content of each AI request (prompts, workspace content and files sent with it) | EU (Frankfurt, Stockholm, Ireland, Paris, Milan, Spain) |
| Microsoft Ireland Operations Ltd. | AI models and compute (Azure OpenAI, Azure AI Foundry) and speech recognition; Microsoft may keep Azure OpenAI prompts and responses for up to 30 days for abuse monitoring | Content of each AI request; audio and transcripts for voice features | EU (Frankfurt, Sweden) |
| Google Cloud EMEA Limited | AI models and compute (Vertex AI: Gemini models and text embeddings), processed per request; Google may cache inputs in memory for up to 24 hours | Content of each AI request (prompts, workspace content and files sent with it) | EU (Netherlands) |
| Linkup SAS | Web search and retrieval of public web pages | Search queries, requested URLs | EU |
| Resend Inc. | Delivery of the system emails AUVY sends through OpenPulse Mail, and receipt of email sent to project addresses | Sender and recipient addresses, email content and attachments, delivery status | EU (Ireland) |
| Stripe Payments Europe, Ltd. | Payment processing, mainly AUVY's own billing data, named for completeness | Customer billing details, payment method | EU (Ireland) |
None of these receives Customer Data for model training.
Services AUVY runs itself (brands of AUVY GmbH, not a third party, named for transparency):
| Service | Service provided | Data | Location |
|---|---|---|---|
| OpenPulse (AUVY GmbH) | Live collaboration, meetings and system email (OpenPulse Mail), on AUVY's servers at Hetzner | Document edits, messages and presence in real time; meeting audio and video; recordings when a meeting is recorded; for system email (sign-in, notifications): recipient address, email content and delivery status | EU (Helsinki) |
| Outeva (AUVY GmbH) | Sales, marketing and customer success as an app in the workspace, on AUVY's servers at Hetzner | Companies, contacts, appointments, offers and campaigns the Customer creates in Outeva; workspace content in the areas Outeva is installed for | EU (Helsinki) |
Annex 4: Transfers to third countries
(1) Customer Data is stored and processed in the EU (Annex 3). AWS, Microsoft and Stripe act through EU entities.
(2) Resend Inc. is based in the USA; processing takes place in the EU (Ireland), and access from the USA is possible. The basis is the EU-US Data Privacy Framework, alternatively the Standard Contractual Clauses 2021/914 (Module 3).
(3) Further third-country transfers take place only under § 6 (advance notice) and with safeguards under Chapter V GDPR. The Customer receives copies of the safeguards on request to privacy@auvy.ai.
Signatures (optional, for enterprise contracts)
| Customer | AUVY GmbH | |
|---|---|---|
| Name, role | ||
| Place, date | ||
| Signature |
§ 12 activation: ☐ requested on ________ ☐ confirmed on ________