Data Processing Agreement (DPA) – WebChatAgent White-Label

Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

White-Label Solution – Dedicated Instance

Version 2.0 – As of: March 2026

between

WebChatAgent
Dominik Weber
Jöllenbecker Str. 143
33613 Bielefeld
Germany

(hereinafter referred to as "Data Processor" or "Processor")

and

the White-Label Partner

(hereinafter referred to as "Data Controller" or "Controller")

(Processor and Controller hereinafter jointly referred to as "Parties")

Preamble

This Data Processing Agreement (DPA) specifies the data protection rights and obligations of the Parties arising from the main contract concluded between them for the white-label use of WebChatAgent services (hereinafter "Main Contract"). It applies to all processing activities in which the Processor processes personal data on behalf of the Controller.

White-Label Specifics: Under the white-label solution, the Controller receives a dedicated instance of the WebChatAgent platform on a separate server. Only data from the Controller and their end customers is processed on this instance. There is no mixing with data from other WebChatAgent customers.

This DPA is concluded exclusively electronically by consent in the customer account; a signature is not required. The validity of the electronic conclusion in text form results from Art. 28(9) GDPR in conjunction with § 126b of the German Civil Code (BGB). The offer is exclusively addressed to entrepreneurs within the meaning of § 14 BGB (B2B).

Role Distribution: The Controller as White-Label Partner is the controller for the processing of their end customers' data. The Processor acts exclusively as a processor for the Controller. There is no direct contractual relationship between the Processor and the Controller's end customers.

§ 1 Subject Matter, Duration and Definitions

Subject Matter: The subject matter of this DPA is the processing of personal data by the Processor on behalf of the Controller for the fulfillment of the Main Contract. The Controller operates the WebChatAgent platform under their own branding towards their end customers. A detailed description of the subject matter, purpose, type of data and categories of data subjects can be found in the Annex "Subject Matter of Processing".

Duration: The term of this DPA corresponds to the term of the Main Contract. It ends automatically upon termination of the Main Contract.

Definitions: The terms used in this DPA are to be understood in accordance with the General Data Protection Regulation (GDPR). In particular:

Personal Data: any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).
Processing: any operation performed on personal data, whether or not by automated means (Art. 4(2) GDPR).
Controller: the Data Controller (Controller / White-Label Partner), who determines the purposes and means of the processing (Art. 4(7) GDPR).
Processor: the Data Processor (Processor / WebChatAgent), who processes data on behalf of the Controller (Art. 4(8) GDPR).
End Customers: the customers of the Controller who use the Controller's white-label platform.
End Users: the website visitors and users who interact with the chat widgets of the end customers.
Third Country: a state outside the European Economic Area (EEA).

§ 2 Obligations of the Data Processor

Processing on Instructions: The Processor shall process personal data exclusively within the scope of the agreements made and in accordance with documented instructions from the Controller. Instructions are generally issued via the customer account/dashboard. Outside the dashboard, instructions are only permitted in text form; oral instructions are not accepted. Chat conversations are stored for the purpose of providing services, review, support and quality assurance for the Controller and their end customers. The determination of the retention period and the issuance of deletion instructions are the responsibility of the Controller. As a rule, the Controller performs deletions independently via the deletion functions provided in the customer account/dashboard and deletes conversations as soon as they are no longer required for the Controller's purposes. If deletion via the customer account/dashboard is temporarily not possible for technical reasons, the Controller may issue a deletion instruction in text form (e.g., by email); the Processor will implement it within a reasonable period of time.

Unlawful Instructions: The Processor shall inform the Controller immediately if it believes that an instruction violates the GDPR or other applicable data protection provisions. The Processor is entitled to refuse to carry out manifestly unlawful or unreasonable instructions until they are confirmed or modified by the Controller.

Official Orders: If the Processor receives an official order obliging it to disclose data of the Controller, it shall inform the Controller immediately, to the extent legally permissible.

No AI Training: The Processor assures that it will not use personal data of the Controller for training or improving AI base models (own or third-party). The AI used serves exclusively to fulfill the purpose according to the Main Contract.

Confidentiality: The Processor shall ensure that all persons entrusted with the processing of the Controller's data are bound to confidentiality or are subject to an appropriate statutory duty of secrecy.

Security of Processing: The Processor shall take all technical and organizational measures (TOMs) required pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. The specifically implemented TOMs are described in detail in the Annex "Technical and Organizational Measures (TOMs)".

Dedicated Instance: The Controller receives a dedicated server instance. The data of the Controller and their end customers is processed and stored in isolation from other WebChatAgent customers.

Location of Processing: The primary processing of data takes place in a data center in Germany (EU). Transfers to third countries only take place under the conditions of Art. 44 ff. GDPR, in particular through the conclusion of Standard Contractual Clauses (SCC).

§ 3 Sub-Processors

General Authorization: The Controller grants the Processor general authorization to engage further processors (sub-processors) for the provision of the contractual services. A current list of sub-processors engaged by the Processor can be found in the Annex "Approved Sub-Processors".

Information and Objection Right: The Processor shall inform the Controller in text form (e.g., by email or in the customer account) of any intended change regarding the addition or replacement of sub-processors. The Controller may object to such a change in writing or text form within 14 days of receipt of the information for good cause. If no objection is raised, the change shall be deemed approved.

Consequences of an Objection: If the Controller objects in due time and the Processor cannot continue providing the service without the affected sub-processor, the Parties shall seek an appropriate solution. If no agreement is reached, the Controller is entitled to terminate the Main Contract for good cause.

Contractual Obligations: The Processor shall conclude a contract with each sub-processor that imposes essentially the same data protection obligations that apply to the Processor under this DPA (Art. 28(4) GDPR).

Third Country Transfers: For third country transfers to sub-processors, the Standard Contractual Clauses pursuant to Decision (EU) 2021/914 (SCC) are used where required (at least Module 3: Processor to Processor). Annexes I–III of this document apply accordingly as completed annexes to the SCC. The Processor conducts a Transfer Impact Assessment where required and takes additional, appropriate measures where necessary.

Liability: The Processor remains responsible to the Controller for the fulfillment of the sub-processors' obligations. The Processor shall ensure that sub-processors assume at least the same data protection obligations as agreed in this DPA.

Clarifications:
The Processor may use third-party services for the technical provision of the services and for optional features. Whether a third party acts as a sub-processor or as an independent controller depends on the specific integration and service. Where a third party acts as a sub-processor processing personal data on behalf of the Controller, it is listed in the sub-processor list.

Optional Integrations:
Certain features require activation by the Controller or their end customers and result in additional data processing by sub-processors or configured services:

Google Calendar: When the appointment booking function is activated, calendar data (availability, appointment details, email addresses of participants) is processed via the Google Calendar API.
Calendly: When a Calendly integration is activated (e.g., appointment booking/forwarding), appointment and contact data (e.g., name, email address, appointment preferences) is processed via Calendly.
WhatsApp Business: When the WhatsApp integration is activated, messages and contact data are processed via the Meta WhatsApp Business API.
Facebook Messenger: When the Facebook Messenger integration is activated, messages, profile and contact information, and metadata are processed via the Meta Messenger Platform API.
REST API Connectors: The Controller or their end customers can configure their own external REST APIs to which the chatbot transmits data (e.g., CRM systems, order systems, ticketing systems). The configured API endpoints, the transmitted data fields and the authentication methods used are the responsibility of the Controller or their end customers. The Processor transmits the data according to the configuration.
MCP (Model Context Protocol): When using MCP integrations, data can be transmitted to configured external services. The Controller or their end customers are responsible for the selection and review of these services.

Note on API Connectors and MCP: Both REST API Connectors and MCP servers are fully configured by the Controller or their end customers. The Processor merely provides the technical infrastructure to transmit data to the defined endpoints. The Controller as the responsible party is solely responsible for the legality of the data transmission to these third-party services as well as for the conclusion of any required data processing agreements with these services.

§ 4 Rights of Data Subjects

Support Obligation: The Processor shall, where possible, support the Controller with appropriate technical and organizational measures in fulfilling its obligations to respond to requests for the exercise of data subject rights (access, rectification, erasure, restriction, data portability, objection).

Assistance under Art. 32–36 GDPR: Where possible, the Processor shall assist the Controller in meeting its obligations under Art. 32 to 36 GDPR, in particular by providing relevant information on the TOMs, engaged sub-processors, third-country transfers and – where required – performed security and risk considerations, enabling the Controller to, for example, carry out a data protection impact assessment or prepare a prior consultation.

Forwarding: If a data subject addresses a request directly to the Processor, the Processor shall forward the request to the Controller without delay. The Processor shall not engage in direct communication with end customers or end users of the Controller unless the Controller issues a corresponding instruction.

Remuneration: For support services that go beyond the standard functionalities of the service, the Processor may charge reasonable remuneration in accordance with the Main Contract, unless the effort was caused by the Processor's fault.

§ 5 Notification Obligations in Case of Data Protection Incidents

The Processor shall inform the Controller immediately in text form of any breach of the security of personal data (data protection incident) in connection with the data processed for the Controller.

The notification shall be made with the aim of informing the Controller within 24 hours of becoming aware of the incident and shall contain at least the following information (where available):

A description of the nature of the breach, including the categories and approximate number of data subjects and data records concerned.
Name and contact details of the data protection officer (if appointed) or another contact point.
A description of the likely consequences of the breach.
A description of the measures taken or proposed by the Processor to remedy the breach and to mitigate its possible adverse effects.

The Processor shall support the Controller in reporting to the supervisory authority and notifying the data subjects. Communication with end customers and end users of the Controller shall be carried out exclusively by the Controller.

§ 6 Audit Rights of the Controller

The Processor shall provide the Controller, upon request, with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and shall allow audits by the Controller or an auditor bound to confidentiality.

Audits shall primarily be conducted as document reviews/remote audits (e.g., questionnaires, TOMs, sub-processor lists, evidence in the form of configurations/screenshots with redactions).

On-site audits are only permissible if they are demonstrably necessary after remote evidence is insufficient, or on special occasions (e.g., serious data protection incident). Inspection of the Processor's private residential premises is excluded. Where an on-site audit is required, it shall alternatively be conducted via video review, in a neutral meeting room, or – where applicable – at involved third-party service providers/data centers within the scope of the evidence possible there.

Audits are generally limited to once every 12 months, except on special occasions. They must be announced at least 14 days in advance and conducted during normal business hours; scope and duration shall be limited to the minimum required.

The Controller bears the costs of its audit. The Processor's effort for participation/documentation shall be compensated after prior agreement at an hourly rate of €100/h.

White-Label Note: The audit right is exclusively granted to the Controller (White-Label Partner). End customers of the Controller have no direct audit right against the Processor.

§ 7 Deletion and Return upon Contract Termination

Upon termination of the Main Contract, the Processor is obligated, at the Controller's choice, to either return or delete all personal data processed on behalf of the Controller.

Deletion in the production/live systems shall be performed within a reasonable period of time (typically up to 30 days) after termination or upon the Controller's instruction, unless statutory retention obligations prevent deletion.

Deletion also includes decommissioning (deprovisioning) of the dedicated instance. Backup copies are retained as part of a rotating backup concept and are automatically overwritten or deleted after expiry of the applicable retention/rotation period; during this period, backups are not used productively and are accessed only for restore purposes.

The Processor shall provide evidence of the deletion or return performed upon request in text form.

Statutory retention obligations (e.g., from commercial or tax law) remain unaffected by this provision. The Processor will inform the Controller of such obligations and block the processing of the affected data for other purposes.

§ 8 Final Provisions

Priority: In the event of conflicts between this DPA and the Main Contract or other agreements, the provisions of this DPA shall prevail in data protection matters.

Amendments: Amendments and additions to this DPA require text form.

Applicable Law and Jurisdiction: This DPA is governed by German law. The place of jurisdiction is determined by the provisions of the Main Contract.

Severability Clause: Should individual provisions of this contract be or become invalid, the validity of the remaining provisions shall not be affected. The Parties undertake to replace the invalid provision with a valid one that comes closest to the economic purpose of the original provision.

Annex: Subject Matter of Processing (White-Label)

Subject Matter and Nature of Processing: Provision of a dedicated white-label instance of the WebChatAgent platform that enables the Controller to offer their end customers an AI-powered chat widget under their own branding. Optionally, the Controller may use a Team Wiki/Knowledge Base portal (e.g., on a subdomain) within the white-label solution to provide content and enable access to the chatbot (optionally password-protected). Processing includes hosting the dedicated application instance, storing, managing and deleting chat conversations, generating AI responses via external APIs, and related support, analysis and billing functions.

Purposes of Processing:

Operation of the dedicated white-label platform for the Controller
Enabling multi-tenant operation for the Controller's end customers
Operation of the Team Wiki/Knowledge Base portal within the white-label solution (if used by the Controller)
Management and hosting of knowledge base content (e.g., uploaded documents), if used by the Controller
Creation, storage and use of vector embeddings for semantic search/retrieval (if used by the Controller)
Management, storage and provision of chat conversations for the Controller and their end customers
Generation of AI responses via connected language model APIs
Customer management, support and quality assurance for the Controller
Web and cloud hosting of the dedicated infrastructure
Billing for paid services between Processor and Controller
Integration with external services (e.g., Google Calendar, WhatsApp Business, Facebook Messenger), if activated by the Controller or their end customers
Provision of tools and APIs for extended integrations (e.g., REST API Connectors, MCP)

Duration of Processing: The duration corresponds to the term of the Main Contract.

Types of Personal Data:

Master and contact data: Name, email address, company, phone number (as provided by the Controller, their end customers or end users).
Content data: Chat messages (questions from end users, AI responses), transmitted attachments.
Knowledge base/document content: Content from documents or wiki content provided by the Controller (may contain personal data), if used by the Controller.
Derived data: Vector embeddings/index data derived from knowledge base content (may contain personal data), if used by the Controller.
Usage, log, meta and telemetry data: IP address (possibly anonymized), browser type, operating system, referrer URL, access timestamp, device information.
Tenant data: Data for distinguishing the Controller's end customers within the platform.
API Connector data: Data fields defined by the Controller or their end customers that are transmitted to external APIs.

Categories of Data Subjects:

End customers of the Controller who use the white-label platform.
End users of the end customers (website visitors who interact with chat widgets).
Administrators and users of the Controller who manage the platform.

Sources of Data:

Direct inputs from data subjects (end users) in the chat widgets.
Inputs and configurations by the Controller and their end customers in the dashboards.
Automatic collection during use of the service.
Return data from configured REST API Connectors and MCP servers.
Where applicable, via interfaces to connected third-party services (e.g., WhatsApp, Facebook Messenger, Google Calendar).

Annex: Technical and Organizational Measures (TOMs)

The Processor has implemented the following measures pursuant to Art. 32 GDPR to ensure the security of processing.

1. Organizational Measures & Governance

Data Protection Management: Documented data protection and security concept as well as regular, event-driven review and updates (e.g., after material changes; typically at least once per year).
Records of Processing Activities: Maintenance of an internal record of processing activities pursuant to Art. 30(2) GDPR.
Roles & Permissions: Implementation of a role and authorization concept based on the need-to-know principle.
Tenant Separation: Technical and organizational separation of data between different end-customer tenants of the Controller within the dedicated instance (multi-tenant operation).
Security Policies: Documented baseline rules for information security and data protection (e.g., password/MFA policy, patch process, handling of support access).
Deletion Concept: Documented deletion and retention concept (production/live systems) and rules for secure destruction of physical media, where such media are used.
No Right of Retention: The Processor does not exercise any right of retention over the Controller's data.

2. Training and Confidentiality Measures (where employees/other persons are engaged)

Confidentiality Commitment: Where the Processor engages employees or other authorized persons, such persons are bound to confidentiality in text form before commencing their activities.
Training & Awareness: Where employees are engaged, appropriate awareness measures on data protection and information security are carried out.
Home/Mobile Office Regulations: Documented minimum requirements for administrative access (e.g., device lock, encrypted storage, screen lock, no use by third parties).
Offboarding: Where applicable: timely revocation of access rights upon role change/leaving.
Clean Desk: Appropriate measures for home office environments (e.g., screen lock, secure storage of physical documents, where any exist).

3. Physical Access, System Access and Data Access Control

Physical Access Control: Servers are operated in data centers of netcup GmbH in Germany (EU). The data center provider implements multi-level security zones, appropriate access controls and surveillance measures; certifications (e.g., ISO/IEC 27001) exist where provided by the data center provider and can be used as available evidence.
System Access Control: Secure password policies, storage exclusively as hash values. Use of a password manager. Two-factor authentication (2FA/MFA) for critical systems and administrative access. Network and host firewalls as well as appropriate endpoint/system protection measures (e.g., operating system security features) and rate limiting.
Data Access Control: Differentiated role and rights concept. Regular review of assigned permissions. Logging of administrative accesses.

4. Communication, Transport and Availability Control

Encryption: Exclusively encrypted data transmission via TLS 1.2 or higher.
Hardening & Patch Management: Regular hardening of systems and timely installation of security patches.
Availability: Appropriate measures to ensure availability and recoverability (e.g., monitoring, regular encrypted backups, documented restore procedures; redundancy where technically/contractually available).
Intrusion Detection/Prevention (IDS/IPS): Use of systems or functions for detection and defense against attacks (where available and depending on system).

5. AI-Specific Security Measures

Risk Consideration: Event-driven risk consideration for the use of AI models and their data flows (e.g., purpose limitation, data minimization, transfers), adapted to the type, scope and risk of the processing.
Transparency: Providing a notice in the chat widget that responses are AI-generated.
Data Minimization: Only the data necessary for the request is transmitted to the AI API.
Accuracy & Robustness: Measures to monitor AI response quality (e.g., feedback/correction features), where provided in the service.
Ensuring Data Subject Rights: Technical provisions for implementing deletion and access requests.
Incident Reporting: Processes for identifying and reporting security incidents related to AI usage within the general incident response processes.

Annex: Approved Sub-Processors

The Controller grants general authorization for the use of the following sub-processors.

Company	Location	Purpose of Processing	Data Protection Guarantee
netcup GmbH	Germany (EU)	Hosting of dedicated server infrastructure, databases and backups	Data Processing Agreement (DPA)
Cloudflare, Inc. (and affiliated entities, as applicable)	EU / USA	DNS/reverse proxy/CDN/TLS termination and security functions for service delivery	Data Processing Agreement (DPA) / Standard Contractual Clauses (SCC), where required
OpenAI Ireland Ltd. / OpenAI, L.L.C.	EU / USA	Generation of AI responses via API	Standard Contractual Clauses (SCC)
Google Ireland Ltd. / Google LLC	EU / USA	Generation of AI responses via Gemini API	Standard Contractual Clauses (SCC)
X.AI Corp. (xAI)	USA	Generation of AI responses via Grok API	Standard Contractual Clauses (SCC)
Mistral AI SAS	France (EU)	Generation of AI responses via Mistral API	Data Processing Agreement (DPA)
Anthropic, PBC	USA	Generation of AI responses via Claude API	Standard Contractual Clauses (SCC)
Stripe Payments Europe, Ltd. (Optional)	Ireland (EU)	Payment processing	Data Processing Agreement (DPA)
Fastmail Pty Ltd. (Optional)	Australia / USA	Email delivery (transactional and system emails)	Standard Contractual Clauses (SCC)
Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Optional)	EU / USA	Channel integration for WhatsApp Business and Facebook Messenger	Standard Contractual Clauses (SCC)
Google Ireland Ltd. / Google LLC (Optional)	EU / USA	Google Calendar integration for appointment bookings	Standard Contractual Clauses (SCC)
Calendly, LLC (Optional)	USA	Appointment booking/management via Calendly	Standard Contractual Clauses (SCC)
The Rocket Science Group LLC d/b/a Mailchimp (Intuit Inc.) (Optional)	USA	Newsletter delivery for marketing communication	Standard Contractual Clauses (SCC)

Annex: Standard Contractual Clauses (SCC) – Completed Annexes

For data transfers to sub-processors in third countries (e.g., USA), the Standard Contractual Clauses of the EU Commission (Decision (EU) 2021/914) are agreed. The following annexes apply as the annexes to be completed pursuant to the SCC.

ANNEX I TO THE SCC

A. LIST OF PARTIES

Data Exporter:
Name: The White-Label Partner ("Controller")
Activity: Controller for the processing of data of their end customers and their end users in the context of their business activities.

Data Importer:
Name: WebChatAgent ("Processor")

B. DESCRIPTION OF TRANSFER

Categories of Data Subjects: See Annex "Subject Matter of Processing".
Categories of Personal Data: See Annex "Subject Matter of Processing".
Special Categories of Data (if applicable): No special categories of data (Art. 9 GDPR) are knowingly processed.
Frequency of Transfer: Continuous, depending on the use of the service.
Nature of Processing: See Annex "Subject Matter of Processing".
Purpose(s) of Data Transfer and Further Processing: See Annex "Subject Matter of Processing".
Duration of Processing / Retention Period: Corresponds to the duration of the Main Contract.

ANNEX II TO THE SCC

TECHNICAL AND ORGANIZATIONAL MEASURES
The technical and organizational measures implemented by the Data Importer are described in detail in the Annex "Technical and Organizational Measures (TOMs)" of this DPA.

ANNEX III TO THE SCC

LIST OF SUB-PROCESSORS
The Data Importer has the authorization of the Data Exporter to engage the companies listed in the Annex "Approved Sub-Processors" of this DPA as sub-processors.

Dashboard Summary (Executive Summary)

Your Data Processing Agreement (DPA) with WebChatAgent – White-Label

By agreeing to this DPA pursuant to Art. 28 GDPR, we govern the data processing for your white-label solution. Here are the key points:

Your Role: As a White-Label Partner, you are the "Controller" for your end customers' and their users' data.

Our Role: We are your "Processor". We only process data according to your instructions on your dedicated instance.

Dedicated Instance: You receive your own server on which only your data and that of your end customers is processed.

No Direct Contact: We do not communicate directly with your end customers. All communication goes through you.

Our Promise:

Purpose Limitation: We only use your data for the agreed purpose.
No AI Training: We do not train AI models with your personal data.
Security: Your data is protected by comprehensive technical and organizational measures.
Data Isolation: Your data is processed separately from other WebChatAgent customers.

Location & Sub-Processors: Your data is primarily hosted in Germany (EU). For AI features, we use vetted partners. Transfers to third countries are secured by EU Standard Contractual Clauses.

Validity: This agreement is valid with your consent and is linked to the term of your Main Contract.