Data Processing Agreement (DPA)

Read the template

The DPA you conclude in your account is available to read in advance – as a Google Doc with placeholders for your details. There you can also see the annexes on subprocessors and technical measures before you sign.

Open DPA template (opens in a new tab)

The non-disclosure agreement (NDA) is also available: Open NDA template (opens in a new tab).

When is a data processing agreement required?

If the inputs your company sends to the SeibertGPT web chat or API contain personal data – such as names or data of your customers – Seibert Group GmbH processes this data on your behalf. Your company is then the controller, and Seibert Group GmbH the processor. In this case, Art. 28 GDPR requires a data processing agreement (DPA; in German: Auftragsverarbeitungsvertrag, AVV).

We conclude a DPA pursuant to Art. 28 GDPR with business customers. You create it yourself right after creating your account and sign it online.

Our DPA at a glance

  • Framework agreement: The DPA applies to all processing of personal data that we carry out for your company in the context of SeibertGPT. It is not remunerated separately.
  • Only on your instructions: We process your data exclusively on your documented instructions and for the purposes set out in the agreement – never for our own purposes. If we consider an instruction to violate data protection law, we will inform you without undue delay.
  • Processing in the EU: Processing takes place exclusively in the EU or the European Economic Area. Any relocation of the processing to a third country requires your prior consent and that the requirements of Art. 44 to 49 GDPR are met.
  • Confidentiality: All persons working with your data are bound to confidentiality in writing – including beyond the end of the agreement.
  • Technical and organizational measures: We take the measures required under Art. 32 GDPR; they form a binding part of the agreement as an annex.
  • Incident notification: In the event of a personal data breach or a suspected breach, we will inform you without undue delay, at the latest within 36 hours, with the information required under Art. 33(3) GDPR.
  • Subprocessors: The subprocessors engaged are listed in the agreement. We announce changes in advance; you can object within two weeks.
  • Data subject rights: We support you with requests from data subjects – providing information within 4 business days and carrying out rectification, erasure or restriction on your instructions within 3 business days.
  • Audit rights: You can verify compliance with the agreement – including by means of evidence such as information security certificates (e.g. ISO/IEC 27001).
  • Deletion after the end of the agreement: After the end of the agreement, we will, at your choice, return your data or delete it completely and confirm the deletion in writing, unless there is a statutory retention obligation.
  • Term: The DPA runs for the term of the main agreement (SeibertGPT usage agreement) and ends with it.
  • Liability and governing law: Liability is governed by Art. 82 GDPR. German law applies; the place of jurisdiction is Wiesbaden.

Subprocessors

  • Verda Cloud Oy (formerly DataCrunch Oy), Töölönlahdenkatu 2, 00100 Helsinki, Finland – GPU infrastructure for operating the language model. Place of processing: Helsinki, Finland (EU). A data processing agreement pursuant to Art. 28 GDPR is in place with Verda.
  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – operation of the hosting platform. Place of processing: Nuremberg and Falkenstein, Germany (EU). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Technical and organizational measures

The measures laid down in the DPA as an annex include, among others:

  • encrypted transmission (HTTPS) and access to personal data only via authenticated channels,
  • administrative access to servers only with a personal key over encrypted connections,
  • disk encryption on laptops and backup media,
  • central password management, uniquely assigned user accounts and a defined authorization process,
  • monitoring and logging of access as well as regular security updates,
  • an appointed data protection officer and regular review of the effectiveness of the measures.

Seibert Group GmbH is certified according to ISO/IEC 27001. You can find information on the Seibert Group's information security and data protection in the Seibert Group Trust Center (opens in a new tab). How SeibertGPT handles your data is described on the Security & data processing page.

Concluding the DPA

Sign in and open “Contracts” in your account. There, enter your company name and address and the person who will sign the agreement. You will then receive the invitation to sign by email. You can also conclude a non-disclosure agreement (NDA) the same way.