Data Processing Agreement

1. Entry provisions

1.1 Parties

This Data Processing Agreement ("DPA") according to Art 28 GDPR is concluded between:

CLIENT
in the following „CONTROLLER"
and the

Cortecs GmbH
Althanstraße 4
1090 Vienna
Austria
in the following „PROCESSOR".

1.2 Definitions

PROCESSOR refers to a processor within the meaning of Art. 4 No. 8 of the General Data Protection Regulation.

DATA refers to personal data within the meaning of Art. 4 No. 1 of the General Data Protection Regulation contained in PAYLOAD DATA and, where applicable, OPERATIONAL METADATA.

PAYLOAD DATA and OPERATIONAL METADATA have the meanings as defined in Section 1 of the Terms and Conditions.

GDPR refers to the General Data Protection Regulation in its current version.

CONTROLLER refers to a controller within the meaning of Art. 4 No. 7 of the General Data Protection Regulation.

CONTRACTING PARTIES include the CONTROLLER and the PROCESSOR.

SUB-PROCESSOR refers to another processor whose services the PROCESSOR uses to carry out certain processing activities.

SERVICE refers to the AI Gateway and Routing Infrastructure provided by the PROCESSOR, as defined in Section 1 of the Terms and Conditions.

Unless otherwise defined in this Agreement, the terms used herein shall have the meaning assigned to them in the General Data Protection Regulation.

1.3 Preamble

According to Art. 4 No. 8 GDPR, a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller is to be qualified as a processor. In this case, the CONTRACTING PARTIES are obliged to conclude a data processing agreement in accordance with Art. 28 GDPR. By signing this DPA, the CONTRACTING PARTIES comply with this obligation. The processor provides sufficient guarantees that appropriate technical and organizational measures will be implemented in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subjects (Art. 28 para. 1 GDPR).

2. Main part

2.1 Object, duration, nature and purpose of the processing (Art. 28 para 3 GDPR)

This contract is concluded for an indefinite period. It ends automatically upon the termination or expiration of the Terms and Conditions between the CONTROLLER and the PROCESSOR. The subject and nature of this DPA can be described as follows:

• Receiving, routing, and forwarding input (which may include personal data)
• Returning the result to the CONTROLLER
• Processing OPERATIONAL METADATA for authentication, configuration, routing, metering, security, debugging and reliable operation of the SERVICE.

The PROCESSOR shall not use the DATA provided for Processing for any purposes other than those specified, and in particular not for its own purposes.

2.2 Type of personal data and categories of data subjects (Art. 28 para 3 GDPR)

Types of DATA: Personal data contained in PAYLOAD DATA during transit and OPERATIONAL METADATA.

Categories of data subjects: End users of controller, Employees, Customers, Individuals whose personal data is entered into the routing system

2.3 Processing only on documented instruction (Art. 28 para 3 lit a GDPR)

The PROCESSOR will process DATA only on documented instruction from the CONTROLLER within the framework of the agreement made – including with regard to the transfer of DATA to a third country or an international organization – unless the PROCESSOR is obliged to do so by the law of the European Union or the Member States to which the PROCESSOR is subject; in such a case, the PROCESSOR will inform the CONTROLLER of these legal requirements before processing, unless the relevant law prohibits such notification due to an important public interest.

The PROCESSOR shall ensure that the employees involved in Processing the CONTROLLER's DATA and other persons working for the PROCESSOR are prohibited from Processing the DATA contrary to the instructions of the CONTROLLER.

Use of BYOK Credentials constitutes the CONTROLLER's documented instruction to transmit DATA to the selected provider. The PROCESSOR's provider-specific retention and no-training assurances do not apply to the selected provider unless expressly confirmed otherwise.

2.4 Obligation of confidentiality (Art. 28 para 3 lit b GDPR)

The PROCESSOR ensures that persons authorized to process the DATA have committed themselves to confidentiality or are under an appropriate statutory obligation of secrecy. This obligation continues even after the contract concluded with the person authorised to process the DATA has expired or Processing has ended.

2.5 Obligation to implement the necessary measures (Art. 28 para 3 lit c GDPR)

The PROCESSOR ensures that all measures required under Article 32 GDPR are taken.

The PROCESSOR has provided the CONTROLLER with a list of the specific technical and organizational measures (hereinafter referred to as "TOMs") that have been taken or are being implemented on an ongoing basis before the conclusion of this data processing agreement. This list of TOMs is attached to this contract as Annex I and is to be regularly re-evaluated and adjusted by the PROCESSOR. The PROCESSOR may unilaterally adapt these TOMs to reflect technological progress, provided the overall security level is not materially degraded. The CONTROLLER's prior approval is required only for changes that materially reduce the overall security level.

2.6 Support obligations (Art. 28 para 3 lit e GDPR)

The PROCESSOR will assist the CONTROLLER, considering the nature of the processing, with appropriate technical and organizational measures to the extent possible, in fulfilling the CONTROLLER's obligation to respond to requests for exercising the rights of the data subject as set out in Chapter III of the GDPR. The PROCESSOR will only provide information to third parties or data subjects upon instruction from the CONTROLLER.

2.7 Assistance and breach notification (Art. 28 para 3 lit f and Art. 33 para 2 GDPR)

The PROCESSOR will assist the CONTROLLER, considering the nature of the processing and the technical information available to them, in complying with the obligations set out in Articles 32 to 36 of the GDPR.

The PROCESSOR shall inform the CONTROLLER without undue delay upon becoming aware of confirmed disruptions, violations, or infringements of data protection provisions or provisions in this contract by persons he has employed or third parties he has appointed. The PROCESSOR may not issue notifications of data breaches according to Art. 33 or 34 GDPR on behalf of the CONTROLLER. However, he shall promptly take all necessary measures required to safeguard the DATA and mitigate any possible negative effects for the data subjects, as well as discuss this with the CONTROLLER.

2.8 Return and deletion of data (Art. 28 para 3 lit g GDPR)

The PROCESSOR will, after the completion of the processing services, either delete or return all DATA at the choice of the CONTROLLER, unless there is an obligation to store the DATA under Union law or the law of the Member States.

Notwithstanding the general deletion obligations:

• Processor Retention: The parties acknowledge that PAYLOAD DATA is processed by the PROCESSOR solely in volatile memory and is deleted immediately from the PROCESSOR's infrastructure upon the completion of the routing request. Consequently, the manual return or recovery of PAYLOAD DATA by the PROCESSOR is technically impossible. OPERATIONAL METADATA may be retained for up to twelve (12) months.
• Sub-processor Retention: DATA transmitted to an Inference Sub-processor is subject to the data retention policies of that specific provider. The CONTROLLER acknowledges that while the PROCESSOR provides technical filters to select providers with Zero Data Retention, it is the CONTROLLER'S responsibility to configure their routing logic to avoid Sub-processors whose retention policies do not meet their compliance requirements.

2.9 Options for verification (Art. 28 para 3 lit h GDPR)

The PROCESSOR will provide the CONTROLLER with all necessary information to demonstrate compliance with the obligations laid down in Art. 28 GDPR and will allow for and contribute to audits (including inspections) conducted by the CONTROLLER or another auditor mandated by the CONTROLLER.

2.10 Obligation to remonstrate regarding instructions that may infringe applicable law (Art. 28 para 3 lit h GDPR)

The PROCESSOR will inform the CONTROLLER immediately if they believe that an instruction infringes the GDPR or other data protection provisions of the Union or Member States.

The CONTROLLER may verify compliance pursuant to Art. 28 GDPR. The PROCESSOR shall satisfy this primarily by providing its current security certification or audit report (e.g. ISO 27001 or equivalent). Any further audits requested by the CONTROLLER must be submitted with 30 days' prior written notice, occur during regular business hours at the CONTROLLER's expense, and strictly avoid disruption to the PROCESSOR's operations.

2.11 Engagement of sub-contractors (Art. 28 para 4 GDPR)

If the PROCESSOR engages the services of another processor (hereinafter referred to as SUB-PROCESSOR) to carry out certain processing activities on behalf of the CONTROLLER, the same data protection obligations as set out in the contract or other legal instruments between the CONTROLLER and the PROCESSOR will be imposed on this SUB-PROCESSOR by means of a contract or other legal instrument under Union law or the law of the relevant Member States. In particular, sufficient guarantees must be provided that the appropriate technical and organizational measures will be implemented in such a manner that the processing will meet the requirements of the GDPR. If the SUB-PROCESSOR fails to fulfill its data protection obligations, the PROCESSOR will remain liable to the CONTROLLER for the performance of that SUB-PROCESSOR's obligations.

The CONTROLLER acknowledges that the SERVICE allows for the dynamic selection of Upstream Inference Providers, either specifically or generally, through its routing configuration. The CONTROLLER authorizes specific Sub-processors by configuring the routing logic (e.g., via Dashboard or API parameters) to direct traffic to those providers. If the CONTROLLER configures the SERVICE to avoid specific providers, those entities shall not process the CONTROLLER'S DATA.

Upstream Inference Providers

These sub-processors are engaged to provide generative AI inference. When the CONTROLLER uses the Services, DATA put into the routing system is processed by these providers to generate a response.

Routing Service Sub-processors

These sub-processors provide essential services to operate the routing infrastructure. The sub-processors used for router hosting in this category will necessarily process DATA that flows through our Services for the purpose of operating and delivering the service.

The CONTRACTING PARTIES agree that the CONTROLLER'S SERVICE configuration serves as a documented instruction and, where applicable, general written authorisation. If the CONTROLLER opts for the full availability of providers, new SUB-PROCESSORS are authorized upon their addition to the SERVICE interface and may be excluded by the CONTROLLER at any time. If the CONTROLLER has applied a restricted or customized provider selection, new SUB-PROCESSORS will not be engaged until authorized via the SERVICE interface. Once a provider is excluded, the PROCESSOR will not route further DATA to that provider. The ability to modify these settings at any time constitutes a prompt and effective objection mechanism.

2.12 No Training on Customer Data

The PROCESSOR shall not itself use DATA to train or fine-tune any Artificial Intelligence model.

Regarding SUB-PROCESSORS, the PROCESSOR shall only engage Inference Providers whose contractual terms applicable to the relevant services prohibit the use of DATA submitted through those services to train or fine-tune Artificial Intelligence models.

3. Closing provisions

3.1 Partial invalidity / Severability clause

Invalid provisions of individual contractual components of this DPA do not affect the validity of the remaining provisions. Instead of the invalid provisions, appropriate replacement provisions shall apply, which, in light of the purpose of the contract, come closest to what the CONTRACTING PARTIES would have intended if they had known about the invalidity. The same applies to contractual gaps. In case of doubt, the rules of Art. 28 GDPR shall apply.

3.2 Applicable law and place of jurisdiction

This agreement (and all contractual components related to it) is governed by Austrian law and is deemed to be validly agreed upon. The application of the United Nations Convention on Contracts for the International Sale of Goods (CISG) is excluded.

For the resolution of disputes regarding the validity of this agreement (and all contractual components related to it), arising from the contract and after the termination of this contract, the court with jurisdiction over the 9th district of Vienna is exclusively declared competent.

3.3 Costs of participation

The PROCESSOR is entitled to a separate reimbursement of reasonable, documented costs for the cooperation required by law and contract (especially in the course of an audit or the exercise of data subject rights), except to the extent such assistance is required due to PROCESSOR's breach of this DPA, breach of applicable data protection law, or a security incident caused by PROCESSOR. Also, there is no claim for reimbursement of costs if the effort in this context is less than four hours per month.

3.4 Order of precedence

In the event of contradictions, the regulations in this DPA and its annex shall take priority over the regulations in the Main Contract.

Annex - TOMs

Technical measures

1. Data transmission

All personal data is transmitted exclusively over secure communication channels using strong encryption (TLS 1.2 or higher). This applies to both external traffic between the Controller and the Service, as well as internal traffic between the Gateway and Upstream Inference Providers, ensuring end-to-end security of the payload. All APIs and web interfaces are accessible only via HTTPS, with HTTP Strict Transport Security (HSTS) enforced to prevent protocol downgrade attacks.

2. Access control

Access to systems is restricted to authorized users via robust authentication mechanisms including API Keys. Sensitive authentication data, specifically Upstream API Keys and Customer API credentials, are encrypted at rest using industry-standard algorithms (e.g., AES-256) and are never stored in plain text. Administrative access to the production routing infrastructure is limited to a minimal set of authorized personnel based on the principle of least privilege and requires Multi-Factor Authentication (MFA).

3. Data economy

The processing of Content Data (specifically Prompts and Completions) is performed strictly in volatile memory (RAM). Content Data is not written to persistent storage or disk at any point during the routing process. Once the API response is returned to the Controller, the payload data is immediately discarded from the Processor's infrastructure, enabling Zero Data Retention.

4. Backup and system recovery

Regular backups are performed to ensure the resilience of Account Data, including user configurations, billing records, and routing rules. Crucially, Payload Data (prompts & completions) is explicitly excluded from all backup routines to ensure compliance with the zero-retention policy. The routing infrastructure utilizes a multi-cloud strategy; if a primary Upstream Provider fails, the system is architected to automatically failover to configured backup providers (if enabled by the Customer) to ensure high availability without compromising data retention standards.

5. Privacy by design

Privacy principles are integrated into the architecture from the outset, specifically through the strict separation of logging data. System logs capture only operational metadata (such as timestamps, token counts, and error codes) required for metering and debugging, while technical filters ensure that the actual Payload is never written to system logs or debugging traces.

Organizational measures

1. Data protection policies and procedures

Creation of clear data protection policies and procedures to ensure compliance with the GDPR and clearly define the responsibilities of employees. Ensuring that data protection policies are regularly reviewed, updated, and understood and followed by all employees.

2. Awareness

Regular training sessions and training materials for employees to raise their awareness of data protection regulations and keep them up to date with best data protection practices.

3. Data confidentiality

Employees are obligated to maintain data confidentiality.

4. Data processing agreements

Conclusion of written contracts with processors that regulate the processing of personal data in accordance with the requirements of the GDPR and ensure that processors implement appropriate security measures.

5. Incident-response plan

Development of a clear plan for responding to data breaches, which includes procedures for reporting incidents, investigating data breaches, and notifying affected individuals.

6. Need-to-know principle

The need-to-know principle is strictly implemented and technically supported by appropriate authorization concepts.

* "Third Country" includes all countries other than (1) the Member States of the European Union and (2) the Member States of the European Economic Area, which means, in addition to the EU Member States, Iceland, Liechtenstein and Norway.

**"ZDR" denotes Zero Data Retention. In the absence of an explicit policy from the provider, a conservative assumption of 'No ZDR' is applied.