Section 01 Subject matter and duration
1.1 This DPA governs the processing of personal data that eokit carries out on behalf of the Controller when providing the services under the Agreement. Annex 1 describes the subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects.
1.2 This DPA applies for as long as eokit processes personal data on behalf of the Controller, including during an inactive account and the export period after the Agreement ends.
1.3 Where the Controller operates eokit on-premise on its own infrastructure, this DPA applies only to the extent that eokit accesses personal data, for example during installation, maintenance or support.
1.4 Where this DPA and the Agreement conflict on matters of data protection, this DPA takes precedence.
Section 02 Instructions
2.1 eokit processes personal data only on documented instructions of the Controller, unless required to do so by Union or Member State law. In that case, eokit informs the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
2.2 The Controller's instructions are set out in the Agreement and this DPA, and in the configuration the Controller makes in the platform, in particular the selection of connected services, agents, workflows, AI features and user permissions. Additional instructions must be given in text form. Instructions that go beyond the agreed scope of services are treated as a change request and may be charged separately.
2.3 eokit informs the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions. eokit may suspend execution of the instruction until the Controller confirms or changes it.
2.4 The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis for processing personal data with eokit, including personal data in connected services, and for informing data subjects.
2.5 When agents access websites through the virtual desktop on the Controller's instructions, the transmission of data to those websites is an instruction of the Controller. Website operators are not sub-processors of eokit. The Controller is responsible for the lawfulness of such transmissions.
Section 03 Confidentiality
eokit ensures that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after their engagement ends.
Section 04 Security of processing
4.1 eokit implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.
4.2 The measures are subject to technical progress and further development. eokit may implement alternative adequate measures, provided the security level of the measures described in Annex 2 is not reduced. eokit documents material changes.
Section 05 No use for AI training
eokit does not use personal data processed on behalf of the Controller to train, fine-tune or improve AI models. eokit has contractually prohibited its sub-processors from doing so. AI models are hosted by sub-processors in Germany or Luxembourg as listed in Annex 3. External AI models are used only if the Controller allows them.
Section 06 Sub-processors
6.1 The Controller grants eokit general authorisation to engage sub-processors. The sub-processors listed in Annex 3 are approved at the time this DPA is concluded.
6.2 eokit informs the Controller at least 30 days in advance of any intended addition or replacement of sub-processors, by email or within the platform. The Controller may object to the change in text form on reasonable data protection grounds within this period. If the Controller objects, the parties will try in good faith to find a solution. If no solution is found, either party may terminate the affected services with effect from the date the change takes effect. If the Controller does not object within the period, the change is deemed approved.
6.3 eokit imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. eokit remains fully liable to the Controller for the performance of its sub-processors' obligations.
6.4 Services that eokit uses as ancillary services, such as telecommunications, postal services or the maintenance of user hardware, are not sub-processing within the meaning of this section. eokit nevertheless takes appropriate contractual and control measures to protect personal data in these cases as well.
Section 07 International data transfers
7.1 eokit processes personal data primarily within the European Union. Personal data is transferred to a third country only in accordance with Chapter V GDPR.
7.2 For transfers to sub-processors in third countries without an adequacy decision, eokit concludes the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3: processor to processor) and implements additional measures where necessary, based on a transfer impact assessment. Annex 3 indicates which sub-processors are located in a third country and on what basis data is transferred.
7.3 The Controller can request a copy of the relevant safeguards. Commercially sensitive parts may be redacted.
Section 08 Assistance to the Controller
8.1 Considering the nature of the processing, eokit assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. Where possible, the Controller uses the platform's functions to access, correct, export and delete data. If a data subject contacts eokit directly, eokit forwards the request to the Controller without undue delay and does not respond on its own unless instructed to do so.
8.2 eokit assists the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR, considering the nature of the processing and the information available to eokit. This includes support with data protection impact assessments and prior consultations with the supervisory authority.
8.3 eokit may charge reasonable remuneration for assistance that goes beyond the platform's standard functions, unless the need for assistance results from a breach of this DPA by eokit.
Section 09 Personal data breaches
9.1 eokit notifies the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller.
9.2 The notification contains, as far as available, a description of the nature of the breach including the categories and approximate number of data subjects and data records concerned, the name and contact details of a contact point, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its possible adverse effects. Where not all information is available at the same time, eokit provides it in phases without undue further delay.
9.3 eokit takes the necessary measures to secure the data and mitigate possible adverse effects for data subjects, and coordinates further steps with the Controller. Notifications to the supervisory authority and to data subjects are the Controller's responsibility, and eokit supports the Controller with them.
9.4 Notification of a breach does not constitute an acknowledgement of fault or liability by eokit.
Section 10 Deletion and return of data
10.1 When a subscription ends, personal data remains stored in the inactive account in accordance with the Agreement, so that the Controller can resume use. Access tokens for connected services are deleted when the subscription ends.
10.2 If the account is closed, the Controller can export its data for 30 days. After this period eokit deletes all personal data processed on behalf of the Controller, unless Union or Member State law requires storage. If an account remains inactive for 12 months without a new subscription and without login, eokit deletes it after notifying the Controller at least 30 days in advance.
10.3 Copies in backups are deleted in the regular backup cycle, at the latest 90 days after deletion from the production systems. Until then they are protected by the measures in Annex 2 and are not used for any other purpose.
10.4 On request, eokit confirms deletion in text form.
10.5 The index of a connected service is deleted when the Controller disconnects the service or the subscription ends. Content deleted in the connected service is removed from the index continuously, typically within 24 hours.
Section 11 Information and audits
11.1 eokit makes available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR. This is primarily provided through documentation such as descriptions of the technical and organisational measures, current certifications or audit reports, where available, and answers to reasonable security questionnaires.
11.2 If this information is not sufficient, the Controller may carry out an audit, including an on-site inspection, itself or through an independent auditor bound to confidentiality, who is not a competitor of eokit. Audits take place at most once per calendar year, unless there are concrete indications of a breach of this DPA or a supervisory authority requires an audit. The Controller announces audits at least 30 days in advance in text form. Audits take place during normal business hours without unreasonably disrupting operations, and do not extend to data of other customers.
11.3 The Controller bears its own costs and the costs of the auditor. eokit may charge reasonable remuneration for its own effort, unless the audit reveals a material breach of this DPA by eokit.
11.4 Audits of sub-processors take place primarily through the documentation and audit reports they make available.
Section 12 Liability
The liability of the parties under this DPA is governed by the liability provisions of the Agreement. This does not affect the liability of the parties towards data subjects under Article 82 GDPR.
Section 13 Final provisions
13.1 eokit may amend this DPA where necessary due to changes in law, decisions of supervisory authorities or changes in the services, provided that the level of protection for the Controller is not reduced. Section 22 of the Terms of Service applies accordingly to such changes.
13.2 This DPA is governed by the laws of the Grand Duchy of Luxembourg. The courts of the City of Luxembourg have exclusive jurisdiction, without prejudice to the rights of data subjects and the powers of supervisory authorities.
13.3 If any provision of this DPA is invalid, the remaining provisions remain unaffected. The invalid provision is replaced by a valid provision that comes as close as possible to its purpose and complies with Article 28 GDPR.
Annex 1 Description of the processing
- Subject matter
- provision of the eokit AI automation and collaboration workspace, including AI agents, workflows, chat, integrations with connected services, AI processing and related support.
- Nature of the processing
- collection, storage, organisation, retrieval, analysis, AI-based processing (for example summarising, classifying, extracting and generating content), transmission to connected services as configured by the Controller, export and deletion.
- Purpose
- providing the services under the Agreement in accordance with the Controller's instructions, including operation, maintenance, security and support.
- Types of personal data
- depends on the Controller's use. Typically these are user data (name, email address, role, workspace permissions, login and activity logs, IP address and device data); chat messages and prompts; content of files and data from connected services (for example Microsoft 365, SharePoint and Google Workspace), which may contain any personal data, such as names, contact details, communication content and business information; and AI output based on this content.
- Special categories of personal data (Article 9 GDPR)
- not intended. If the Controller processes such data with eokit, it is responsible for ensuring that this is lawful and for informing eokit where additional measures are needed.
- Categories of data subjects
- the Controller's users (employees and other authorised persons); and persons whose data is contained in the Controller's content and connected services, such as employees, customers, suppliers, business partners and other contacts of the Controller.
- Duration
- for the term of the Agreement and in accordance with Section 10 of this DPA.
Annex 2 Technical and organisational measures
- Encryption
- data in transit is encrypted with current TLS standards. Data at rest is encrypted. Access tokens for connected services are stored in encrypted form.
- Access control
- role-based access controls following the principle of least privilege. Access to production systems is limited to authorised personnel, protected by strong authentication, and logged.
- Separation
- customer data is logically separated by workspace.
- Data minimisation for connected services
- access to connected services is limited to the permissions granted by the Controller, and can be revoked by the Controller at any time.
- AI processing
- AI models are hosted in Germany or Luxembourg. External AI models are used only if the Controller allows them. Customer data is not used for model training. Prompts and outputs are processed only to deliver the requested result.
- Availability and resilience
- regular backups, monitoring of systems and incident response procedures.
- Logging
- logging of security-relevant events and access to production systems. Logs are kept for 90 days unless needed longer to investigate a specific incident.
- Personnel
- confidentiality obligations for all personnel and regular data protection and security training.
- Sub-processor management
- data processing agreements with all sub-processors, and regular review of their measures.
- Testing and evaluation
- regular review and improvement of the effectiveness of security measures.
Annex 3 Approved sub-processors
| Sub-processor | Purpose | Location of processing | Transfer basis |
|---|
| hosting.de GmbH, Germany | hosting of the eokit platform | Germany | |
|---|
| PEWEO SARL, Luxembourg | provision of the server infrastructure rented from hosting.de | Germany | |
|---|
| Mixvoip S.A., Luxembourg | hosting of AI models | Luxembourg | |
|---|
| Infercom, Luxembourg | hosting of AI models | Luxembourg | |
|---|
| LuxProvide S.A. (MeluXina), Luxembourg | hosting of AI models | Luxembourg | |
|---|
| Gcore, Luxembourg | hosting of AI models | Luxembourg | |
|---|
| Crewlads Pvt. Ltd., India | software development | India | EU Standard Contractual Clauses (Module 3) |
|---|
| Resend, Inc., United States | sending transactional emails, such as login links and notifications | United States | EU-US Data Privacy Framework and EU Standard Contractual Clauses (Module 3) |
|---|
| Steffen Holzbau S.A., Luxembourg | hosting of the support ticket system (osTicket) | Luxembourg | |
|---|
| Microsoft Ireland Operations Limited, Ireland | business email for support communication | EU (EU Data Boundary) | for limited access from the United States, the EU-US Data Privacy Framework and the EU Standard Contractual Clauses |
|---|
