Data processing agreement (DPA)

This is a translation of the German data processing agreement. In case of discrepancies, the German version prevails.

1. Preamble

This Data Processing Agreement ("DPA") is entered into between:

• Controller: the customer using the services of Creativate Technologies GmbH ("Controller")
• Processor: Creativate Technologies GmbH, Lahnstraße 65, 60326 Frankfurt am Main, Germany ("Processor")

This DPA supplements and forms part of the Terms of Use. It governs the processing of personal data by the Processor on behalf of the Controller pursuant to Art. 28 GDPR. Annex 1 (sub-processors) and Annex 2 (technical and organisational measures) form part of this DPA.

2. Subject matter, nature and purpose of processing

The Processor processes personal data on behalf of the Controller solely to provide the services under the Terms of Use, in particular:

• providing the c:node application, hosting and storing content (chats, files, memory, drafts, calculations)
• AI-supported analysis, answering questions, summarising and drafting by language models
• reading and – only after approval by an authorised person – writing to services connected by the Controller (connectors, e.g. email, calendars, file storage, task, CRM and accounting systems)
• running routines (scheduled tasks) whose result is always a draft requiring approval
• managing users, roles, teams and permissions within the Controller's organisation
• providing interfaces (API, MCP) to the Controller's applications
• support, troubleshooting and security in connection with the above

Processing takes place in the EU as a rule (AWS, Frankfurt). Processing in third countries is carried out only by the sub-processors listed in Annex 1 and only in accordance with section 8.

3. Categories of data subjects

• users (employees, agents or representatives of the Controller)
• persons whose data appear in the Controller's content: customers, suppliers, business partners, citizens, applicants, other contacts (e.g. in emails, calendars, documents, tasks)
• end users of the Controller's products or services, where the Controller processes their data

4. Types of personal data

• identity and contact data (name, email, phone, role, organisation)
• account, role and permission data
• content data: questions, answers, files, notes, drafts, calculations
• data from connected services: emails (metadata and, if chosen, content), appointments, files, tasks, CRM and accounting data to the extent enabled by the Controller
• log and usage data (approvals, routine runs, usage counters, technical logs)
• special categories (Art. 9 GDPR) only where the Controller brings them into content; the Processor processes detected special categories only with models in the EU or on its own servers (Annex 2, no. 7)

5. Duration of processing

Processing lasts for the term of the user agreement. After termination, the data is deleted or returned in accordance with section 11.

6. Obligations of the Processor

The Processor shall:

a) process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it shall inform the Controller of that legal requirement before processing unless the law prohibits this. Instructions are the user agreement, this DPA and the settings the Controller makes in c:node (e.g. the "EU only" model policy, enabled connectors, approval rules);

b) immediately inform the Controller if, in its opinion, an instruction infringes data protection law (Art. 28(3), third sentence, GDPR);

c) ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;

d) take all measures required under Art. 32 GDPR; the measures are described in Annex 2 and may only be replaced by equivalent or better ones;

e) respect the conditions for engaging another processor (section 7);

f) assist the Controller by appropriate technical and organisational measures in responding to data subject requests (section 9);

g) assist the Controller in complying with Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation) and provide the necessary information, in particular on the AI models and sub-processors used;

h) at the Controller's choice, delete or return all personal data after the end of the provision of services (section 11);

i) make available to the Controller all information necessary to demonstrate compliance with these obligations and allow for audits (section 12);

j) not use the Controller's data for its own purposes, in particular not for training AI models, and not permit training by sub-processors.

7. Sub-processors

(1) The Controller grants general authorisation for the sub-processors listed in Annex 1.

(2) The Processor informs the Controller at least 30 days before engaging or replacing a sub-processor, by email or in the application. The Controller may object within this period for an important data protection reason. If no agreement is reached, the Controller may terminate the affected service or the contract for cause.

(3) The Processor imposes on each sub-processor by contract substantially the same data protection obligations as set out in this DPA (Art. 28(4) GDPR) and remains liable for their compliance.

(4) Services that the Controller itself connects to c:node (connectors, its own API keys for language models, its own AI clients via MCP) are not sub-processors under this DPA. The Controller's contractual relationship with the respective provider applies to them.

8. Transfers to third countries

Transfers to countries outside the EEA take place only under the conditions of Art. 44 et seq. GDPR:

• on the basis of the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, or
• on the basis of the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 3 processor to sub-processor) with a transfer impact assessment and supplementary measures.

If the Controller chooses the "EU only" model policy, no third-country transfer takes place for AI processing.

9. Data subject rights

The Processor assists the Controller with requests under Art. 15 to 22 GDPR. For this purpose, export (Art. 15, 20), deletion of content and accounts (Art. 17) and deactivation (Art. 18) are available in the application and the account. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay.

10. Personal data breach notification

The Processor notifies the Controller of personal data breaches without undue delay and at the latest within 48 hours of becoming aware of them. The notification contains, as far as known:

• a description of the nature of the breach, the categories and approximate number of data subjects and records concerned
• the likely consequences
• the measures taken or proposed
• a contact point for further information

11. Deletion and return

After termination of the user agreement:

• the Processor provides the data to the Controller on request in a common, machine-readable format (export)
• the Processor deletes all personal data of the Controller at the latest 30 days after the end of the contract, including copies; backup copies and file versions are overwritten in the regular cycle, at the latest after a further 30 days
• data is retained only where Union or Member State law requires storage
• the Processor confirms deletion in writing on request

12. Evidence and audits

The Processor demonstrates compliance with this DPA by appropriate documentation (e.g. these annexes, records of processing activities, test reports, certificates of the sub-processors). In addition, the Controller may carry out audits, including inspections, itself or through an auditor bound to confidentiality:

• with at least 30 days' written notice, shorter where there is a specific reason (e.g. a data breach)
• during normal business hours and without disproportionate disruption of operations
• in principle at the Controller's expense

13. Officer lookup and public data from the c:node Graph

(1) c:node can support answers with data from the c:node Graph, a body of public sources operated by the Processor. This includes the officer lookup: in response to a question about a specific company, c:node names the officers registered in the commercial register (e.g. managing directors, board members, authorised signatories) from the open dataset of OffeneRegister.de / OpenCorporates (CC BY 4.0, historical register status 2018/2019), with the source and a note on the historical status. The answer is produced by fixed rules; the names are not transmitted to any language model.

(2) The Processor is itself the controller (Art. 4(7) GDPR) for the data set of the c:node Graph, including the register data; it informs data subjects under Art. 14 GDPR in its privacy policy and handles objections under Art. 21 GDPR via a block list.

(3) As soon as such information is stored or further used in a chat, draft or file of the Controller, it becomes part of the Controller's content and is processed under this DPA. The Controller uses the information only for its own business purposes (e.g. customer, supplier and partner checks) and takes the historical status into account.

(4) The feature is enabled per organisation. If a person is blocked under paragraph 2, the block also takes effect immediately for the Controller's future queries.

14. Liability, precedence, final provisions

Art. 82 GDPR applies to liability; otherwise the liability provisions of the Terms of Use apply. In the event of conflicts, this DPA takes precedence over the Terms of Use in data protection matters. An individual DPA can be agreed for enterprise customers: legal@creativate.tech.

15. Contact

Creativate Technologies GmbH Lahnstraße 65, 60326 Frankfurt am Main, Germany Email: legal@creativate.tech Data protection contact: privacy@creativate.tech

Annex 1 – Sub-processors

Self-hosted on the AWS infrastructure in Frankfurt and therefore not separate sub-processors: databases (PostgreSQL with pgvector, SQLite), c:node Graph and officer lookup (nena-serve), speech recognition (Whisper), embedding models, own language models (Ollama), monitoring (Grafana, Loki, Prometheus), central account (auth.c-node.ai).

Not used for customer content but for the contractual relationship with the Controller: Stripe (payment processing), Haufe-Lexware (bookkeeping), Mautic/EspoCRM (self-hosted, customer management). For these, the Processor is itself the controller.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality – physical access: AWS data centres in Frankfurt (certified, among others, to ISO/IEC 27001, SOC 2); no own server rooms.
2. System access: sign-in via the central account with email code, link, password (PBKDF2 hash) or Google/Microsoft; sessions as HttpOnly cookies with limited lifetime; abuse protection and rate limiting at all sign-in points (ALTCHA, no third party); administrative server access only via SSH key, firewall opened only when needed and for individual addresses.
3. Data access: role and permission concept per organisation (owner, administrator, member); separation of data per organisation with access rules in the database (row-level security); personal content is not visible even to administrators; team and organisation memory only after approval.
4. Separation: separate tenants or dedicated instances for customers; trial environment (try.c-node.ai) separate from production.
5. Encryption: TLS for all connections; files in S3 encrypted server-side (AES-256); access tokens for connected services and customers' own API keys stored encrypted (own API keys with AES-256-GCM).
6. Pseudonymisation: for some model calls, personal details are replaced with placeholders before transmission; extension to all calls is planned (privacy gateway). Email addresses and credentials are masked in application logs.
7. AI-specific measures: model policy per organisation (e.g. "EU only", which users cannot override); detected special categories (Art. 9 GDPR) only to models in the EU or own models; no use of customer data for training; usage log of model calls without content; evaluations before every release (including approval safety).
8. Integrity – mandatory approval: every external effect (email, appointment, document, task, message in connected services) requires the explicit approval of an authorised person in c:node; sending is a second approval step; approvals via API and MCP are technically excluded; every approval is logged with person, time and changes.
9. Input control: logging of security-relevant events (sign-ins, role changes, approvals, routine runs, block list changes) without content.
10. Availability and resilience: operation in AWS Frankfurt; regular backups; documented recovery and rollback per release; monitoring with alerting (Grafana, Prometheus, Loki; logs 30 days).
11. Regular review: security checks in the development process (code review, automated tests, architecture rules for model calls, dependency and licence checks); incident management with notification to the Controller within 48 hours; annual review of these measures.
12. Processor control: sub-processors only according to Annex 1 and with a contract under Art. 28(4) GDPR; staff committed to confidentiality.
13. Data protection by design: data minimisation (e.g. synchronisation by default only metadata; push notifications without content; officer lookup without place of residence, date of birth, address); deletion and export by users themselves; privacy-friendly defaults (new features off by default and to be enabled per organisation).

Last updated: 21 October 2026 (version 2.1.0) Creativate Technologies GmbH