Data Processing Agreement (DPA) – WebChatAgent White-Label

Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

White-Label Solution – Multi-Tenant Platform

Version 1.1 – As of: August 2026

between

WebChatAgent
Dominik Weber
Jöllenbecker Str. 143
33613 Bielefeld
Germany

(hereinafter referred to as "Data Processor" or "Processor")

and

the White-Label Partner

(hereinafter referred to as "Data Controller" or "Controller")

(Processor and Controller hereinafter jointly referred to as "Parties")

Preamble

This Data Processing Agreement (DPA) specifies the data protection rights and obligations of the Parties arising from the main contract concluded between them for the white-label use of WebChatAgent services (hereinafter "Main Contract"). It applies to all processing activities in which the Processor processes personal data on behalf of the Controller.

White-Label Specifics: Under the white-label solution, the Controller uses the WebChatAgent platform as a multi-tenant application. The data of the Controller and their end customers is processed logically separated from the data of other tenants. This separation is ensured through tenant-specific identifiers (organization IDs), access restrictions, and the measures described in the Annex "Technical and Organizational Measures (TOMs)".

AI Processing: AI responses are generated using the AI API keys provided and managed by the Processor; AI usage is included in the Controller's monthly message quota. The AI providers used are sub-processors of the Processor (see § 3 and Annex "Approved Sub-Processors").

This DPA is concluded exclusively electronically by consent in the customer account; a signature is not required. The validity of the electronic conclusion in text form results from Art. 28(9) GDPR in conjunction with § 126b of the German Civil Code (BGB). The offer is exclusively addressed to entrepreneurs within the meaning of § 14 BGB (B2B).

Role Distribution: The Controller as White-Label Partner is the controller for the processing of their end customers' data. The Processor acts exclusively as a processor for the Controller. There is no direct contractual relationship between the Processor and the Controller's end customers.

§ 1 Subject Matter, Duration and Definitions

Subject Matter: The subject matter of this DPA is the processing of personal data by the Processor on behalf of the Controller for the fulfillment of the Main Contract. The Controller operates the WebChatAgent platform under their own branding towards their end customers. A detailed description of the subject matter, purpose, type of data and categories of data subjects can be found in the Annex "Subject Matter of Processing".

Duration: The term of this DPA corresponds to the term of the Main Contract. It ends automatically upon termination of the Main Contract.

Definitions: The terms used in this DPA are to be understood in accordance with the General Data Protection Regulation (GDPR). In particular:

Personal Data: any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).
Processing: any operation performed on personal data, whether or not by automated means (Art. 4(2) GDPR).
Controller: the Data Controller (Controller / White-Label Partner), who determines the purposes and means of the processing (Art. 4(7) GDPR).
Processor: the Data Processor (Processor / WebChatAgent), who processes data on behalf of the Controller (Art. 4(8) GDPR).
End Customers: the customers of the Controller who use the Controller's white-label platform.
End Users: the website visitors and users who interact with the chat widgets of the end customers.
Third Country: a state outside the European Economic Area (EEA).

§ 2 Obligations of the Data Processor

Processing on Instructions: The Processor shall process personal data exclusively within the scope of the agreements made and in accordance with documented instructions from the Controller. Instructions are generally issued via the customer account/dashboard. Outside the dashboard, instructions are only permitted in text form; oral instructions are not accepted. Chat conversations are stored for the purpose of providing services, review, support and quality assurance for the Controller and their end customers. The determination of the retention period and the issuance of deletion instructions are the responsibility of the Controller. As a rule, the Controller performs deletions independently via the deletion functions provided in the customer account/dashboard and deletes conversations as soon as they are no longer required for the Controller's purposes. If deletion via the customer account/dashboard is temporarily not possible for technical reasons, the Controller may issue a deletion instruction in text form (e.g., by email); the Processor will implement it within a reasonable period of time.

Unlawful Instructions: The Processor shall inform the Controller immediately if it believes that an instruction violates the GDPR or other applicable data protection provisions. The Processor is entitled to refuse to carry out manifestly unlawful or unreasonable instructions until they are confirmed or modified by the Controller.

Official Orders: If the Processor receives an official order obliging it to disclose data of the Controller, it shall inform the Controller immediately, to the extent legally permissible.

No AI Training: The Processor assures that it will not use personal data of the Controller for training or improving AI base models (own or third-party). The AI used serves exclusively to fulfill the purpose according to the Main Contract.

AI API Usage: The Processor provides the AI API keys and transmits personal data (chat messages, context data) to the AI providers for response generation. The AI providers are sub-processors of the Processor (see § 3 and Annex "Approved Sub-Processors"). The Processor ensures that data processing agreements or Standard Contractual Clauses (SCC) are concluded with the AI providers.

Confidentiality: The Processor shall ensure that all persons entrusted with the processing of the Controller's data are bound to confidentiality or are subject to an appropriate statutory duty of secrecy.

Security of Processing: The Processor shall take all technical and organizational measures (TOMs) required pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. The specifically implemented TOMs are described in detail in the Annex "Technical and Organizational Measures (TOMs)".

Tenant Separation: The data of the Controller and their end customers is processed and stored in a multi-tenant infrastructure, logically separated from the data of other tenants. The separation is ensured through tenant-specific identifiers (organization IDs) and access restrictions (see Annex "Technical and Organizational Measures (TOMs)").

Location of Processing: The primary processing of data takes place in a data center in Germany (EU). Transfers to third countries only take place under the conditions of Art. 44 ff. GDPR, in particular through the conclusion of Standard Contractual Clauses (SCC).

§ 3 Sub-Processors

General Authorization: The Controller grants the Processor general authorization to engage further processors (sub-processors) for the provision of the contractual services. A current list of sub-processors engaged by the Processor can be found in the Annex "Approved Sub-Processors".

Information and Objection Right: The Processor shall inform the Controller in text form (e.g., by email or in the customer account) of any intended change regarding the addition or replacement of sub-processors. The Controller may object to such a change in writing or text form within 14 days of receipt of the information for good cause. If no objection is raised, the change shall be deemed approved.

Consequences of an Objection: If the Controller objects in due time and the Processor cannot continue providing the service without the affected sub-processor, the Parties shall seek an appropriate solution. If no agreement is reached, the Controller is entitled to terminate the Main Contract for good cause.

Contractual Obligations: The Processor shall conclude a contract with each sub-processor that imposes essentially the same data protection obligations that apply to the Processor under this DPA (Art. 28(4) GDPR).

Third Country Transfers: For third country transfers to sub-processors, the Standard Contractual Clauses pursuant to Decision (EU) 2021/914 (SCC) are used where required (at least Module 3: Processor to Processor). Annexes I–III of this document apply accordingly as completed annexes to the SCC. The Processor conducts a Transfer Impact Assessment where required and takes additional, appropriate measures where necessary.

Liability: The Processor remains responsible to the Controller for the fulfillment of the sub-processors' obligations. The Processor shall ensure that sub-processors assume at least the same data protection obligations as agreed in this DPA.

AI providers as sub-processors: The AI providers listed in the Annex "Approved Sub-Processors" (OpenAI, Microsoft/Azure OpenAI, Google/Gemini, xAI, Mistral, Anthropic) are sub-processors of the Processor. The Processor concludes data processing agreements or Standard Contractual Clauses (SCC) with these providers and assumes responsibility for their compliance.

Clarifications:
The Processor may use third-party services for the technical provision of the services and for optional features. Whether a third party acts as a sub-processor or as an independent controller depends on the specific integration and service. Where a third party acts as a sub-processor processing personal data on behalf of the Controller, it is listed in the sub-processor list.

Optional Integrations:
Certain features require activation by the Controller or their end customers and result in additional data processing by sub-processors or configured services:

Calendly (optional link): The Controller or their end customers may embed a Calendly link or widget in the chat. No data processing by the Processor takes place here; data is processed directly between the end user and Calendly. The Controller (or their end customer) is responsible for any agreement of their own with Calendly. Calendly is therefore not a sub-processor of the Processor.
REST API Connectors: The Controller or their end customers can configure their own external REST APIs to which the chatbot transmits data (e.g., CRM systems, order systems, ticketing systems). The configured API endpoints, the transmitted data fields and the authentication methods used are the responsibility of the Controller or their end customers. The Processor transmits the data according to the configuration.
File data sources (SharePoint/OneDrive, Google Drive, Nextcloud/WebDAV, SFTP/FTPS): When activated, the Processor accesses a directory designated by the Controller in the respective system on the Controller's behalf and reads the files stored there in order to index their text content as the chatbot's knowledge base. Processed data includes file contents, file names, paths, sizes and modification timestamps – including any personal data contained in those files. Retrieval is continuous at the interval configured by the Controller; new and changed files are read again. The credentials for the respective system are stored encrypted. The Controller ensures that it is entitled to connect the directory, that no data is stored there which must not be available to the chatbot, and that the data subjects have been informed accordingly.
MCP (Model Context Protocol): When using MCP integrations, data can be transmitted to configured external services. The Controller or their end customers are responsible for the selection and review of these services.
Email Mailbox Connection: When the email channel is activated, the Processor accesses an email mailbox designated by the Controller or their end customer via IMAP/SMTP in order to answer incoming emails automatically or to create draft replies. Processed data includes incoming emails (sender address, name, subject, content, header metadata) and the generated replies. The mailbox credentials are stored encrypted. Retrieval is continuous; emails from third parties arriving in this mailbox are also processed. On a sender's first contact, the prior correspondence with that address already present in the mailbox (received and sent emails) may additionally be read once as reply context; such pre-existing emails are never answered. The Controller ensures that it or its end customer is authorized to connect the mailbox and that the data subjects are informed accordingly.

Note on API Connectors and MCP: Both REST API Connectors and MCP servers are fully configured by the Controller or their end customers. The Processor merely provides the technical infrastructure to transmit data to the defined endpoints. The Controller as the responsible party is solely responsible for the legality of the data transmission to these third-party services as well as for the conclusion of any required data processing agreements with these services.

§ 4 Rights of Data Subjects

Support Obligation: The Processor shall, where possible, support the Controller with appropriate technical and organizational measures in fulfilling its obligations to respond to requests for the exercise of data subject rights (access, rectification, erasure, restriction, data portability, objection).

Assistance under Art. 32–36 GDPR: Where possible, the Processor shall assist the Controller in meeting its obligations under Art. 32 to 36 GDPR, in particular by providing relevant information on the TOMs, engaged sub-processors, third-country transfers and – where required – performed security and risk considerations, enabling the Controller to, for example, carry out a data protection impact assessment or prepare a prior consultation.

Forwarding: If a data subject addresses a request directly to the Processor, the Processor shall forward the request to the Controller without delay. The Processor shall not engage in direct communication with end customers or end users of the Controller unless the Controller issues a corresponding instruction.

Remuneration: For support services that go beyond the standard functionalities of the service, the Processor may charge reasonable remuneration in accordance with the Main Contract, unless the effort was caused by the Processor's fault.

§ 5 Notification Obligations in Case of Data Protection Incidents

The Processor shall inform the Controller immediately in text form of any breach of the security of personal data (data protection incident) in connection with the data processed for the Controller.

The notification shall be made without undue delay after becoming aware of the incident and in good time to enable the Controller to meet its own notification obligations (in particular Art. 33 and 34 GDPR); it shall contain at least the following information (where available):

A description of the nature of the breach, including the categories and approximate number of data subjects and data records concerned.
Name and contact details of the data protection officer (if appointed) or another contact point.
A description of the likely consequences of the breach.
A description of the measures taken or proposed by the Processor to remedy the breach and to mitigate its possible adverse effects.

The Processor shall support the Controller in reporting to the supervisory authority and notifying the data subjects. Communication with end customers and end users of the Controller shall be carried out exclusively by the Controller.

§ 6 Audit Rights of the Controller

The Processor shall provide the Controller, upon request, with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and shall allow audits by the Controller or an auditor bound to confidentiality.

Audits shall primarily be conducted as document reviews/remote audits (e.g., questionnaires, TOMs, sub-processor lists, evidence in the form of configurations/screenshots with redactions).

On-site audits are only permissible if they are demonstrably necessary after remote evidence is insufficient, or on special occasions (e.g., serious data protection incident). Inspection of the Processor's private residential premises is excluded. Where an on-site audit is required, it shall alternatively be conducted via video review, in a neutral meeting room, or – where applicable – at involved third-party service providers/data centers within the scope of the evidence possible there.

Audits are generally limited to once every 12 months, except on special occasions. They must be announced at least 14 days in advance and conducted during normal business hours; scope and duration shall be limited to the minimum required.

The Controller bears the costs of its audit. The Processor's effort for participation/documentation shall be compensated after prior agreement at an hourly rate of €100/h.

White-Label Note: The audit right is exclusively granted to the Controller (White-Label Partner). End customers of the Controller have no direct audit right against the Processor.

§ 7 Deletion and Return upon Contract Termination

Upon termination of the Main Contract, the Processor is obligated, at the Controller's choice, to either return or delete all personal data processed on behalf of the Controller.

Deletion in the production/live systems shall be performed within a reasonable period of time (typically up to 30 days) after termination or upon the Controller's instruction, unless statutory retention obligations prevent deletion.

Deletion also includes the deactivation and removal of the Controller's tenant-specific data and configuration (deprovisioning). Backup copies are retained as part of a rotating backup concept and are automatically overwritten or deleted after expiry of the applicable retention/rotation period; during this period, backups are not used productively and are accessed only for restore purposes.

The Processor shall provide evidence of the deletion or return performed upon request in text form.

Statutory retention obligations (e.g., from commercial or tax law) remain unaffected by this provision. The Processor will inform the Controller of such obligations and block the processing of the affected data for other purposes.

§ 8 Final Provisions

Priority: In the event of conflicts between this DPA and the Main Contract or other agreements, the provisions of this DPA shall prevail in data protection matters.

Amendments: Amendments and additions to this DPA require text form.

Applicable Law and Jurisdiction: This DPA is governed by German law. The place of jurisdiction is determined by the provisions of the Main Contract.

Invalid Provisions: Should individual provisions of this contract be or become invalid, the applicable statutory provision shall take their place. The validity of the remaining provisions shall not be affected.

Annex: Subject Matter of Processing (White-Label)

Subject Matter and Nature of Processing: Provision of the WebChatAgent platform as a multi-tenant white-label solution that enables the Controller to offer their end customers an AI-powered chat widget under their own branding. Processing includes hosting the platform infrastructure, storing, managing and deleting chat conversations, generating AI responses via external APIs, and related support, analysis and billing functions.

Purposes of Processing:

Operation of the white-label platform for the Controller
Enabling multi-tenant operation for the Controller's end customers
Management and hosting of knowledge base content (e.g., uploaded documents), if used by the Controller
Creation, storage and use of vector embeddings for semantic search/retrieval (if used by the Controller)
Management, storage and provision of chat conversations for the Controller and their end customers
Generation of AI responses via connected language model APIs
Customer management, support and quality assurance for the Controller
Web and cloud hosting of the platform infrastructure
Billing for paid services between Processor and Controller
Integration with external services (e.g., Calendly), if activated by the Controller or their end customers
Processing of attachments from the chat and WhatsApp channels (images, documents, voice messages) in order to answer them, including conversion of voice messages to text, if permitted
Operation of an AI-powered phone assistant (voice AI) that receives and answers incoming calls on a provisioned phone number, if activated by the Controller or its end customers
Provision of tools and APIs for extended integrations (e.g., REST API Connectors, MCP)

Duration of Processing: The duration corresponds to the term of the Main Contract.

Types of Personal Data:

Master and contact data: Name, email address, company, phone number (as provided by the Controller, their end customers or end users).
Content data: Chat messages (questions from end users, AI responses) and transmitted attachments. Attachments are files and images uploaded in the chat widget as well as, if the WhatsApp channel is enabled and media is permitted there, images, documents and voice messages sent via WhatsApp. The attachment file is stored for 7 days and then deleted automatically; only file name, file type and file size remain in the conversation afterwards. To answer a voice message, it is either passed directly to the selected language model or converted to text beforehand; the transcript becomes part of the conversation history.
Telephony/voice data (if the phone channel is activated): caller's phone number (where transmitted), spoken conversation content (processed in real time, without permanent audio recording), text transcript of the call (only with the caller's explicit consent), automatically generated call summary, and call metadata (time, duration, language).
Registration/identity verification data (only when booking phone numbers in countries with registration requirements): name and address of the number holder, company and registration details, and supporting documents uploaded by the Controller or its end customers (e.g., commercial register excerpt, identity document, proof of address). This data is transmitted to the telephony infrastructure provider for the legally required identity check and is not permanently stored by the Processor, but merely passed through. The Controller informs its end customers accordingly.
Email channel data (if the mailbox connection is activated): email addresses and names of senders and recipients, subject lines, email content, email headers and metadata (e.g., message IDs, timestamps), and the credentials of the connected mailbox (stored encrypted). File attachments are not analyzed for content.
Knowledge base/document content: Content from documents or wiki content provided by the Controller (may contain personal data), if used by the Controller.
Derived data: Vector embeddings/index data derived from knowledge base content (may contain personal data), if used by the Controller.
Usage, log, meta and telemetry data: IP address (possibly anonymized), browser type, operating system, referrer URL, access timestamp, device information.
Tenant data: Data for distinguishing the Controller's end customers within the platform.
API Connector data: Data fields defined by the Controller or their end customers that are transmitted to external APIs.
Session context data from the embedding page: Contextual details about the current visitor (e.g., name, customer, contract or case numbers, reference tokens) passed to the chat widget by the systems of the Controller or their end customers (e.g., CRM, customer portal) when embedding the widget. Transmitted per request to the language model for answer generation and not stored as a separate record; they may, however, be contained in bot replies (conversation history) and in transmissions to configured external systems (API Connectors, MCP servers, lead capture) and be stored there.

Categories of Data Subjects:

End customers of the Controller who use the white-label platform.
End users of the end customers (website visitors who interact with chat widgets).
Callers who use the phone assistant of an end customer of the Controller (if the phone channel is activated).
Persons who send emails to a mailbox connected by the Controller or their end customers (if the email channel is activated), including third parties whose emails arrive in this mailbox.
Administrators and users of the Controller who manage the platform.

Sources of Data:

Direct inputs from data subjects (end users) in the chat widgets.
Embedding websites and systems operated by the Controller or their end customers that pass session context data to the chat widgets.
Inputs and configurations by the Controller and their end customers in the dashboards.
Automatic collection during use of the service.
Return data from configured REST API Connectors and MCP servers.
Where applicable, via interfaces to connected third-party services (e.g., Calendly).
Content from email mailboxes connected by the Controller or their end customers (if the email channel is activated).

Annex: Technical and Organizational Measures (TOMs)

The Processor has implemented the following measures pursuant to Art. 32 GDPR to ensure the security of processing.

1. Organizational Measures & Governance

Data Protection Management: Documented data protection and security concept as well as regular, event-driven review and updates (e.g., after material changes; typically at least once per year).
Records of Processing Activities: Maintenance of an internal record of processing activities pursuant to Art. 30(2) GDPR.
Roles & Permissions: Implementation of a role and authorization concept based on the need-to-know principle.
Tenant Separation: Technical and organizational separation of data between different tenants (the Controller, their end customers, and other customers) within the multi-tenant platform through tenant-specific identifiers (organization IDs) and access controls (multi-tenant operation).
Security Policies: Documented baseline rules for information security and data protection (e.g., password/MFA policy, patch process, handling of support access).
Deletion Concept: Documented deletion and retention concept (production/live systems) and rules for secure destruction of physical media, where such media are used.
No Right of Retention: The Processor does not exercise any right of retention over the Controller's data.

2. Training and Confidentiality Measures (where employees/other persons are engaged)

Confidentiality Commitment: Where the Processor engages employees or other authorized persons, such persons are bound to confidentiality in text form before commencing their activities.
Training & Awareness: Where employees are engaged, appropriate awareness measures on data protection and information security are carried out.
Home/Mobile Office Regulations: Documented minimum requirements for administrative access (e.g., device lock, encrypted storage, screen lock, no use by third parties).
Offboarding: Where applicable: timely revocation of access rights upon role change/leaving.
Clean Desk: Appropriate measures for home office environments (e.g., screen lock, secure storage of physical documents, where any exist).

3. Physical Access, System Access and Data Access Control

Physical Access Control: Servers are operated in data centers of netcup GmbH in Germany (EU). The data center provider implements multi-level security zones, appropriate access controls and surveillance measures; certifications (e.g., ISO/IEC 27001) exist where provided by the data center provider and can be used as available evidence.
System Access Control: Secure password policies, storage exclusively as hash values. Use of a password manager. Two-factor authentication (2FA/MFA) for administrative infrastructure access, where supported by the respective service/system. Network and host firewalls as well as appropriate endpoint/system protection measures (e.g., operating system security features) and rate limiting.
Data Access Control: Differentiated role and rights concept. Regular review of assigned permissions. Logging of administrative accesses.

4. Communication, Transport and Availability Control

Encryption: Exclusively encrypted data transmission via TLS 1.2 or higher.
Hardening & Patch Management: Regular hardening of systems and timely installation of security patches.
Availability: Appropriate measures to ensure availability and recoverability (e.g., monitoring, regular encrypted backups, documented restore procedures; redundancy where technically/contractually available).
Intrusion Detection/Prevention (IDS/IPS): Use of systems or functions for detection and defense against attacks (where available and depending on system).

5. AI-Specific Security Measures

Risk Consideration: Event-driven risk consideration for the use of AI models and their data flows (e.g., purpose limitation, data minimization, transfers), adapted to the type, scope and risk of the processing.
Transparency: Providing a notice in the chat widget that responses are AI-generated.
Data Minimization: Only the data necessary for the request is transmitted to the AI API.
Accuracy & Robustness: Measures to monitor AI response quality (e.g., feedback/correction features), where provided in the service.
Ensuring Data Subject Rights: Technical provisions for implementing deletion and access requests.
Incident Reporting: Processes for identifying and reporting security incidents related to AI usage within the general incident response processes.

Annex: Approved Sub-Processors

The Controller grants general authorization for the use of the following sub-processors.

The listed AI providers process the content from all channels activated by the Controller (chat widget, inline chat, WhatsApp, phone and email channel); the purpose description "generation of AI responses" covers these channels equally.

Company	Location	Purpose of Processing	Data Protection Guarantee	Scope
netcup GmbH	Germany (EU)	Hosting of server infrastructure, databases and backups	Data Processing Agreement (DPA)	All WL packages
Cloudflare, Inc. (and affiliated entities, as applicable)	EU / USA	DNS/reverse proxy/CDN/TLS termination and security functions for service delivery	Data Processing Agreement (DPA) / Standard Contractual Clauses (SCC), where required	All WL packages
OpenAI Ireland Ltd. / OpenAI, L.L.C.	EU / USA	Generation of AI responses via API when an OpenAI US model is selected or the Controller's own OpenAI API key is used; real-time speech-to-speech processing in the phone channel, if activated by the Controller or its end customers	Standard Contractual Clauses (SCC)	All WL packages
Microsoft Ireland Operations Ltd. (Azure OpenAI)	EU (EU Data Zone)	Provision of the GPT models for response generation when an Azure EU model is selected, operated via Azure OpenAI with Data Zone deployment (EU): prompts and outputs are processed by Microsoft within EU member states; the data is not used for training and is not available to OpenAI. For abuse monitoring, Microsoft may store prompts and outputs for up to 30 days in the geography of the resource (Germany); any human review for EEA deployments is performed by Microsoft personnel located in the EEA.	Microsoft Products and Services Data Protection Addendum (DPA); processing within the EU Data Zone	All WL packages
Google Ireland Ltd. / Google LLC	EU (Frankfurt / EU region) / USA	Generation of AI responses (Gemini API, or via Vertex AI EU when an EU model is selected). Internal processing is carried out via Vertex AI in the EU with EU data residency and without use for training: response generation, automatic translations, internal AI helper functions and the automatic call summary in the EU region Frankfurt (europe-west3); the generation of vector embeddings and indexing of the knowledge base via the EU multi-region. Additionally, real-time voice processing in the phone channel, if activated by the Controller or its end customers.	Standard Contractual Clauses (SCC); for Vertex AI EU additionally the Google Cloud Data Processing Addendum (DPA) with EU data residency	All WL packages
X.AI Corp. (xAI)	USA / EU (eu-west-1)	Generation of AI responses via the Grok API. If activated for the phone channel, additionally speech processing (speech-to-text and/or text-to-speech) in real time via the EU region (eu-west-1); the transmitted speech and text data may be stored by xAI in accordance with its retention periods (no zero-retention agreement in place).	Standard Contractual Clauses (SCC)	All WL packages
Mistral AI SAS	France (EU)	Generation of AI responses via Mistral API	Data Processing Agreement (DPA)	All WL packages
Anthropic, PBC (Claude via Google Vertex AI EU)	EU (Frankfurt / EU region)	Provision of the Claude models (incl. Sonnet 4.5/4.6) for response generation, operated via Google Vertex AI in the EU (Frankfurt/EU region). Processing takes place at Google Cloud in the EU and is governed by Google Cloud's terms; the data is not used for training.	Google Cloud Data Processing Addendum (DPA), EU data residency	All WL packages
Twilio Ireland Ltd. / Twilio Inc. (Optional)	EU / USA	Telephony infrastructure for the phone channel: provisioning of phone numbers, call setup/routing and real-time transmission of call audio, if activated by the Controller or its end customers. For phone numbers in countries with registration requirements, additionally the receipt and review of the number-holder data and supporting documents required for the regulatory number registration (identity check). No audio recordings are permanently stored.	Standard Contractual Clauses (SCC) / EU-US Data Privacy Framework	All WL packages
Deepgram, Inc. (Optional)	EU	Speech-to-text (speech recognition) via the EU region (api.eu.deepgram.com) in two cases: first, the caller audio in the phone channel in real time, if the cascaded voice assistant is used by the Controller or its end customers; second, voice messages sent by end users via the WhatsApp channel, if that channel is enabled for the Controller or its end customer, media is permitted there, and the selected language model cannot process audio itself. No audio data is permanently stored.	Standard Contractual Clauses (SCC)	All WL packages
ElevenLabs, Inc. (Optional)	USA	Text-to-speech (speech synthesis) of the AI responses in the phone channel in real time, if the cascaded voice assistant is used by the Controller or its end customers. The transmitted response text and the generated audio may be stored by ElevenLabs in accordance with its retention periods (no zero-retention agreement in place).	Standard Contractual Clauses (SCC) / EU-US Data Privacy Framework	All WL packages
Cartesia, Inc. (Optional)	USA	Speech processing (speech-to-text, text-to-speech and/or voice agent) in the phone channel in real time, if the provider is activated for the cascaded voice assistant of the Controller or its end customers. The transmitted speech and text data may be stored by Cartesia; the Zero Data Retention mode is only available in the enterprise plan.	Standard Contractual Clauses (SCC)	All WL packages
Stripe Payments Europe, Ltd. (Optional)	Ireland (EU)	Payment processing	Data Processing Agreement (DPA)	All WL packages
Fastmail Pty Ltd. (Optional)	Australia / USA	Sending platform system emails to the Controller (e.g., account/billing notifications)	Standard Contractual Clauses (SCC)	Platform → Controller only
Amazon Web Services EMEA SARL (Amazon SES) (Optional)	Luxembourg (EU); sending region Frankfurt, Germany (eu-central-1)	Delivery of the platform's own newsletters and bulk service announcements to platform contacts; processing of recipient email address, name where provided, message content and delivery information	AWS Data Processing Addendum (DPA); Standard Contractual Clauses (SCC), where required	Platform's own communications only; no delivery on behalf of the Controller to its end customers/end users
The Rocket Science Group LLC d/b/a Mailchimp (Intuit Inc.) (Optional)	USA	Newsletter delivery for marketing communication	Standard Contractual Clauses (SCC)	All WL packages

Email delivery in white-label operation: Emails sent on behalf of the Controller to its end customers/end users (e.g., invitations, notifications) are sent via the Controller's own SMTP credentials stored in the white-label dashboard. The email/SMTP provider chosen by the Controller is not a sub-processor of the Processor; the Controller is responsible for entering into any agreement of its own with that provider. The platform email service listed above (Fastmail) is used solely for system emails from the Processor to the Controller itself.

Annex: Standard Contractual Clauses (SCC) – Completed Annexes

For data transfers to sub-processors in third countries (e.g., USA), the Standard Contractual Clauses of the EU Commission (Decision (EU) 2021/914) are agreed. The following annexes apply as the annexes to be completed pursuant to the SCC.

ANNEX I TO THE SCC

A. LIST OF PARTIES

Data Exporter:
Name: The White-Label Partner ("Controller")
Activity: Controller for the processing of data of their end customers and their end users in the context of their business activities.

Data Importer:
Name: WebChatAgent ("Processor")

B. DESCRIPTION OF TRANSFER

Categories of Data Subjects: See Annex "Subject Matter of Processing".
Categories of Personal Data: See Annex "Subject Matter of Processing".
Special Categories of Data (if applicable): No special categories of data (Art. 9 GDPR) are knowingly processed.
Frequency of Transfer: Continuous, depending on the use of the service.
Nature of Processing: See Annex "Subject Matter of Processing".
Purpose(s) of Data Transfer and Further Processing: See Annex "Subject Matter of Processing".
Duration of Processing / Retention Period: Corresponds to the duration of the Main Contract.

ANNEX II TO THE SCC

TECHNICAL AND ORGANIZATIONAL MEASURES
The technical and organizational measures implemented by the Data Importer are described in detail in the Annex "Technical and Organizational Measures (TOMs)" of this DPA.

ANNEX III TO THE SCC

LIST OF SUB-PROCESSORS
The Data Importer has the authorization of the Data Exporter to engage the companies listed in the Annex "Approved Sub-Processors" of this DPA as sub-processors.

Dashboard Summary (Executive Summary)

Your Data Processing Agreement (DPA) with WebChatAgent – White-Label

By agreeing to this DPA pursuant to Art. 28 GDPR, we govern the data processing for your white-label solution. Here are the key points:

Your Role: As a White-Label Partner, you are the "Controller" for your end customers' and their users' data.

Our Role: We are your "Processor". We only process data according to your instructions.

Tenant Separation: Your data and that of your end customers is processed logically separated from other tenants (tenant-specific identifiers, access controls).

No Direct Contact: We do not communicate directly with your end customers. All communication goes through you.

AI Responsibility: We provide the AI API keys. The AI providers (Microsoft/Azure, OpenAI, Google, etc.) are our sub-processors – we handle the contracts with them.

Our Promise:

Purpose Limitation: We only use your data for the agreed purpose.
No AI Training: We do not train AI models with your personal data.
Security: Your data is protected by comprehensive technical and organizational measures.
Logical Data Separation: Separation from other tenants is achieved through tenant-specific identifiers (organization IDs) and access controls.

Location & Sub-Processors: Your data is primarily hosted in Germany (EU). For AI features we use vetted partners as sub-processors. Transfers to third countries are secured by EU Standard Contractual Clauses.

Validity: This agreement is valid with your consent and is linked to the term of your Main Contract.