Data Processing Agreement

1. Entry provisions

1.1 Parties

This Data Processing Agreement ("DPA") according to Art 28 GDPR is concluded between:

CLIENT
in the following „CONTROLLER”
and the

Cortecs GmbH
Althanstraße 4
1090 Vienna
Austria
in the following „PROCESSOR”.

1.2 Definitions

PROCESSOR refers to a processor within the meaning of Art. 4 No. 8 of the General Data Protection Regulation.

DATA refers to personal data within the meaning of Art. 4 No. 1 of the General Data Protection Regulation.

GDPR refers to the General Data Protection Regulation in its current version.

CONTROLLER refers to a controller within the meaning of Art. 4 No. 7 of the General Data Protection Regulation.

CONTRACTING PARTIES include the contractor and the client.

SUB-PROCESSOR refers to another processor whose services the PROCESSOR uses to carry out certain processing activities.

1.3 Preamble

According to Art. 4 No. 8 GDPR, a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller is to be qualified as a processor. In this case, the contracting parties are obliged to conclude a data processing agreement in accordance with Art. 28 GDPR. By signing this DPA, the contracting parties comply with this obligation. The processor provides sufficient guarantees that appropriate technical and organizational measures will be implemented in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subjects (Art. 28 para. 1 GDPR).

2. Main part

2.1 Object, duration, nature and purpose of the processing (Art. 28 para 3 GDPR)

This contract is concluded for an indefinite period. It ends as soon as the provision of the commissioned service ends. The subject and nature of this DPA can be described as follows:

• Receiving, routing, and forwarding input (which may include personal data)
• Returning the result to the CONTROLLER
• Ensuring secure and reliable operation of the routing system

2.2 Type of personal data and categories of data subjects (Art. 28 para 3 GDPR)

Types of DATA: Any personal data submitted via prompts, authentication data, usage metadata and user identifiers

Categories of data subjects: End users of controller, Employees, Customers, Individuals whose personal data is entered into the routing system

2.3 Processing only on documented instruction (Art. 28 para 3 lit a GDPR)

The PROCESSOR will process DATA only on documented instruction from the CONTROLLER within the framework of the agreement made – including with regard to the transfer of DATA to a third country or an international organization – unless the PROCESSOR is obliged to do so by the law of the European Union or the Member States to which the PROCESSOR is subject; in such a case, the PROCESSOR will inform the CONTROLLER of these legal requirements before processing, unless the relevant law prohibits such notification due to an important public interest.

2.4 Obligation of confidentiality (Art. 28 para 3 lit b GDPR)

The PROCESSOR ensures that persons authorized to process the DATA have committed themselves to confidentiality or are under an appropriate statutory obligation of secrecy. This obligation continues even after the contractual relationship has ended.

2.5 Obligation to implement the necessary measures (Art. 28 para 3 lit c GDPR)

The PROCESSOR ensures that all measures required under Article 32 GDPR are taken.

The PROCESSOR has provided the CONTROLLER with a list of the specific technical and organizational measures (hereinafter referred to as "TOMs") that have been taken or are being implemented on an ongoing basis before the conclusion of this data processing agreement. This list of TOMs is attached to this contract as Annex I and is to be regularly re-evaluated and adjusted by the PROCESSOR.

2.6 Support obligations (Art. 28 para 3 lit e GDPR)

The PROCESSOR will assist the CONTROLLER, considering the nature of the processing, with appropriate technical and organizational measures to the extent possible, in fulfilling the CONTROLLER's obligation to respond to requests for exercising the rights of the data subject as set out in Chapter III of the GDPR. The PROCESSOR will only provide information to third parties or data subjects upon instruction from the CONTROLLER.

2.7 Information obligations (Art. 28 para 3 lit f GDPR)

The PROCESSOR will assist the CONTROLLER, considering the nature of the processing and the technical information available to them, in complying with the obligations set out in Articles 32 to 36 of the GDPR.

2.8 Return and deletion of data (Art. 28 para 3 lit g GDPR)

The PROCESSOR will, after the completion of the processing services, either delete or return all DATA at the choice of the CONTROLLER, unless there is an obligation to store the DATA under Union law or the law of the Member States.

2.9 Options for verification (Art. 28 para 3 lit h GDPR)

The PROCESSOR will provide the CONTROLLER with all necessary information to demonstrate compliance with the obligations laid down in Art. 28 GDPR and will allow for and contribute to audits – including inspections – conducted by the CONTROLLER or another auditor mandated by the CONTROLLER.

2.10 Duty to inform in the event of a data breach (Art. 28 para 3 lit h GDPR)

The PROCESSOR will inform the CONTROLLER without delay if they believe that an instruction violates the GDPR or other data protection provisions of the Union or Member States.

2.11 Engagement of sub-contractors (Art. 28 para 4 GDPR)

If the PROCESSOR engages the services of another processor (hereinafter referred to as SUB-PROCESSOR) to carry out certain processing activities on behalf of the CONTROLLER, the same data protection obligations as set out in the contract or other legal instruments between the CONTROLLER and the PROCESSOR will be imposed on this SUB-PROCESSOR by means of a contract or other legal instrument under Union law or the law of the relevant Member States. In particular, sufficient guarantees must be provided that the appropriate technical and organizational measures will be implemented in such a manner that the processing will meet the requirements of the GDPR. If the SUB-PROCESSOR fails to fulfill its data protection obligations, the PROCESSOR will be liable to the CONTROLLER for the compliance with the obligations of that SUB-PROCESSOR.

The CONTROLLER agrees to the engagement of the mentioned SUB-PROCESSORS. The CONTROLLER grants a general authorization for the PROCESSOR to engage other SUB-PROCESSORS. However, the PROCESSOR must always inform the CONTROLLER of any intended changes regarding the engagement or replacement of other SUB-PROCESSORS. The CONTROLLER has the right to object to such changes within 14 days (Art. 28 para. 2 GDPR), otherwise, consent is assumed. The PROCESSOR undertakes to comply with the conditions set out in Art. 28 para. 2 and 4 GDPR for the engagement of another SUB-PROCESSOR (Art. 28 para. 3 lit d GDPR).

3. Closing provisions

3.1 Partial invalidity / Severability clause

Invalid provisions of individual contractual components of this DPA do not affect the validity of the remaining provisions. Instead of the invalid provisions, appropriate replacement provisions shall apply, which, in light of the purpose of the contract, come closest to what the CONTRACTING PARTIES would have intended if they had known about the invalidity. The same applies to contractual gaps. In case of doubt, the rules of Art. 28 GDPR shall apply.

3.2 Applicable law and place of jurisdiction

This agreement (and all contractual components related to it) is governed by Austrian law and is deemed to be validly agreed upon. The application of the United Nations Convention on Contracts for the International Sale of Goods (CISG) is excluded.

For the resolution of disputes regarding the validity of this agreement (and all contractual components related to it), arising from the contract and after the termination of this contract, the court with jurisdiction over the 9th district of Vienna is exclusively declared competent.

3.3 Costs of participation

The PROCESSOR is entitled to a separate reimbursement of costs for the cooperation required by law and contract (especially in the course of an audit or the exercise of data subject rights). However, there is no claim for reimbursement of costs if the effort in this context is very low (effort of less than one hour per month).

Annex - TOMs

Technical measures

1. Data transmission

All personal data is transmitted over secure communication channels. Encryption in transit is ensured using Transport Layer Security (TLS). This protects data from unauthorized access, manipulation, or disclosure. All APIs and web interfaces are accessible only via HTTPS, with strict enforcement of secure connections.

2. Access control

Access to systems and data is restricted to authorized users through robust authentication and authorization measures. Authentication is enforced using mechanisms such as passwords, API keys, and Bearer Tokens. Access rights are assigned based on user roles and responsibilities, following the principle of least privilege. Authorization mechanisms are implemented to ensure users can only access functions necessary for their tasks.

3. Data economy

The collection and processing of personal data is strictly limited to what is necessary for the intended purpose, such as short-term caching. No data is used for training underlying AI models, thereby eliminating risks of conversational data leakage. Mechanisms are in place to allow users to configure data retention settings and ensure that data is deleted as soon as it is no longer required.

4. Backup and system recovery

Data is backed up regularly and stored in secure, access-controlled locations. System integrity checks are routinely performed to ensure the reliability of backups. Critical system components are deployed with redundancy and monitored continuously to minimize downtime. A multi-cloud recovery strategy is implemented, enabling continued operation even in the event of failure of an underlying cloud provider.

5. Privacy by design

Integration of data protection principles into the development of systems, products, and services to ensure compliance with the GDPR from the outset.

Organizational measures

1. Data protection policies and procedures

Creation of clear data protection policies and procedures to ensure compliance with the GDPR and clearly define the responsibilities of employees. Ensuring that data protection policies are regularly reviewed, updated, and understood and followed by all employees.

2. Awareness

Regular training sessions and training materials for employees to raise their awareness of data protection regulations and keep them up to date with best data protection practices.

3. Data confidentiality

Employees are obligated to maintain data confidentiality.

4. Data processing agreements

Conclusion of written contracts with processors that regulate the processing of personal data in accordance with the requirements of the GDPR and ensure that processors implement appropriate security measures.

5. Incident-response plan

Development of a clear plan for responding to data breaches, which includes procedures for reporting incidents, investigating data breaches, and notifying affected individuals.

6. Need-to-know principle

The need-to-know principle is strictly implemented and technically supported by appropriate authorization concepts.