Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28 GDPR between the Customer and Veryfront GmbH, Finkenstraße 10, 70199 Stuttgart, Germany (“Processor”)

1. Subject Matter

(1) To provide the Platform under the Veryfront General Terms of Use (“Terms”) and any order based on them (together the “Main Contract”), the Processor processes personal data on behalf of the Customer (“Customer Data”). This Agreement sets out the parties' rights and obligations under data protection law for this processing. Terms not defined here have the meaning given in the Terms.

(2) This Agreement does not apply to processing for which the Processor is itself the controller, in particular account management, billing, security, abuse prevention and the evaluation of technical usage data under Section 9 para. 4 of the Terms. The Processor's privacy policy applies to such processing.

(3) Where the Platform is provided as software and operated by the Customer or its service provider (Section 2 para. 2 of the Terms), this Agreement only applies to the extent the Processor accesses Customer Data, in particular when providing support or managed operations.

2. Scope of Processing

(1) The Processor processes Customer Data on behalf of and on the instructions of the Customer. The Customer acts as controller or as processor on behalf of another controller. The Processor acts as processor or sub-processor accordingly.

(2) The purpose, nature and scope of processing, the types of personal data and the categories of data subjects are set out in Appendix 1.

(3) The Processor does not use Customer Data for its own purposes, for general Platform development or to train or improve AI models. It does not sell Customer Data or disclose it to third parties except as permitted by this Agreement.

3. Instructions

(1) The Processor processes Customer Data only on documented instructions from the Customer, unless required to do so by Union or Member State law to which the Processor is subject. In that case, the Processor informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The Customer's instructions are set out in the Main Contract and this Agreement. In addition, the following are documented instructions:

the settings, permissions and configurations the Customer or its Users make in the Platform, including the agents, tools, workflows, schedules and integrations they configure,
the choice of an AI Model, which instructs the Processor to transmit the relevant Customer Data to the inference provider that runs that model (Appendix 2),
actions that agents, including Veryfront Agent, perform within the permissions granted by the Customer or its Users.

Further instructions that require a change to the Processor's standard service are only binding if agreed in text form; any additional remuneration is agreed separately.

(3) The Processor informs the Customer without undue delay if, in its opinion, an instruction infringes data protection law. The Processor may suspend the execution of the instruction until the Customer confirms or changes it.

4. Responsibilities of the Customer

(1) As between the parties, the Customer is responsible for the lawfulness of the processing, including the lawfulness of its instructions, the provision of Customer Data and the information of data subjects. This includes personal data of end users of applications and agents the Customer builds and operates on the Platform. Where the Customer acts as processor, it ensures that its instructions and the engagement of the Processor and its sub-processors are authorised by the relevant controller. The Customer forwards relevant notices and information under this Agreement to that controller without undue delay. The Processor provides the assistance under Sections 9 to 12 through the Customer.

(2) Integrations with third-party services that the Customer connects using its own credentials, and the Customer's own access to AI model providers (Section 2 paras. 3 and 4 of the Terms), are not sub-processing by the Processor. The Customer is responsible for its own agreements with these providers.

(3) The Customer informs the Processor without undue delay if it detects errors or irregularities in the processing.

(4) On request, the Customer provides the Processor with the information required for the Processor's records of processing activities (Art. 30 para. 2 GDPR) and reasonably supports the Processor in cooperating with supervisory authorities.

5. Security of Processing

(1) The Processor implements appropriate technical and organisational measures under Art. 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risk to the rights and freedoms of data subjects.

(2) The parties agree on the measures described in Appendix 3 as an appropriate level of protection at the time this Agreement is concluded. The Processor may adapt the measures to technical and legal developments, provided the overall level of protection described in Appendix 3 is not reduced.

6. Confidentiality and Personnel

(1) The Processor ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(2) The Processor's personnel only access Customer Data to the extent necessary to provide the Platform, for operation, troubleshooting or support, or to comply with legal obligations (Section 9 para. 2 of the Terms).

7. Sub-Processors

(1) The Customer grants the Processor general authorisation to engage sub-processors. The sub-processors engaged when this Agreement is concluded are listed in Appendix 2 and are deemed approved.

(2) The Processor informs the Customer of any intended addition or replacement of a sub-processor at least 14 days before the change by publishing it in the sub-processor list and by email to Customers at the email address they have provided. Where a sub-processor must be replaced at short notice for security or legal reasons, the Processor informs the Customer as early as possible.

(3) The Customer may object to the change in text form within 14 days of the notice, stating specific data protection grounds. If no objection is raised, the change is deemed approved. If the Customer objects, the parties seek a mutually agreed solution; the Processor may in particular offer an alternative, for example a different AI Model. Until the objection is resolved, the Processor does not transfer the affected Customer Data to the proposed sub-processor. If no solution is found within 14 days of the objection, either party may terminate the affected services before that sub-processor is used for the Customer's data. If an urgent replacement under paragraph 2 cannot be deferred, the Processor suspends the affected processing until the parties agree on a solution or the affected services end.

(4) The Processor imposes on each sub-processor, by contract, data protection obligations that offer at least the level of protection of this Agreement (Art. 28 para. 4 GDPR). The Processor remains responsible to the Customer for the sub-processor's performance of these obligations.

8. International Data Transfers

(1) The Processor processes Customer Data within the European Union or the European Economic Area, except as provided in paragraph 2.

(2) Personal data is transferred to a third country only on documented instructions from the Customer. Such instructions comprise (a) the selection of an AI Model or service identified in Appendix 2 as processing outside the EU/EEA; the Processor logs the selection, and (b) the approval of the sub-processors listed in Appendix 2 with the processing locations stated there. Deviations are permitted only where the Processor is required to do so by Union or Member State law. The Processor agrees with each recipient in a third country an appropriate instrument under Art. 44 et seq. GDPR, in particular the European Commission's Standard Contractual Clauses (Module 3), together with the required assessment of the level of data protection in a Transfer Impact Assessment (TIA), unless an adequacy decision of the European Commission applies, for example the EU-U.S. Data Privacy Framework. If an instrument ceases to apply or there are substantiated doubts about its effectiveness, the Processor informs the Customer without undue delay and may suspend the affected processing or move it to the EU/EEA.

(3) For the avoidance of doubt, the Customer is responsible for the lawfulness of its selection, in particular the legal basis for processing and the information provided to data subjects.

9. Data Subject Rights

(1) Taking into account the nature of the processing, the Processor assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights under Chapter III GDPR. In particular, the Platform provides functions to view, export, correct and delete Customer Data.

(2) The Customer instructs the Processor to process requests from Users to correct their account or profile data or to deactivate or delete their user account and the data associated solely with it without prior consultation, where the request is made through the Processor's usual support channels and the User's identity has been verified by appropriate means, for example via the email address associated with the account.

(3) The Processor forwards any other request it receives from a data subject to the Customer without undue delay and does not respond to it itself, except to refer the data subject to the Customer.

10. Notification and Assistance

(1) The Processor notifies the Customer without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting Customer Data. The notification contains the information available to the Processor at that time, in particular the information required under Art. 33 para. 3 GDPR; the Processor provides further information as soon as it becomes available. The Processor takes the measures necessary to secure the data and to mitigate possible adverse consequences.

(2) Taking into account the nature of the processing and the information available to it, the Processor assists the Customer or, where the Customer acts as processor, the relevant controller through the Customer, in complying with obligations under Arts. 32 to 36 GDPR, in particular with notifications to supervisory authorities and communications to data subjects, data protection impact assessments and prior consultations. Whether a notification or communication obligation exists is for the relevant controller to assess.

(3) The parties agree in advance on reasonable remuneration for assistance that significantly exceeds the usual scope, unless the assistance is required because of a breach of this Agreement by the Processor.

11. Return and Deletion

(1) On termination of the Main Contract, the Customer may choose return followed by deletion, or deletion without prior return, of Customer Data by instruction in text form through the Processor's usual support channels. During the term of the Main Contract and for the retrieval period under Section 16 para. 2 of the Terms, the Customer can export its Customer Data using the export functions of the Platform. If those functions do not permit complete return, the Processor assists with return of the remaining Customer Data. Section 16 para. 3 of the Terms (switching under the Data Act) remains unaffected.

(2) After the retrieval period and any switching have ended, the Processor deletes the Customer Data within 30 calendar days, unless Union or Member State law requires further storage. Deletion from backups takes place in accordance with the backup cycle, at the latest within 90 calendar days after the retrieval period and any switching have ended. The Processor passes the applicable deletion instruction to its sub-processors using the available deletion procedures; termination of the Customer's contract does not itself terminate the Processor's supplier accounts. For copies held by sub-processors that the Processor cannot delete itself, the deletion periods and triggers in the respective data processing agreement apply instead. On request, the Processor identifies the affected data, the applicable deletion trigger and period, and confirms completed deletion in text form. Until deletion, retained Customer Data remains protected under this Agreement and is processed only as necessary for secure retention, restoration or to comply with Union or Member State law. Data restored from backups remains subject to the deletion instruction.

(3) If the Customer deletes its account itself, this is an instruction to delete the Customer Data without a retrieval period (Section 16 para. 4 of the Terms).

(4) The Processor may retain documentation that serves as evidence of proper processing beyond the end of this Agreement in accordance with the applicable retention periods.

12. Information and Audits

(1) On request, the Processor provides the Customer with all information necessary to demonstrate compliance with Art. 28 GDPR and this Agreement.

(2) The Processor primarily demonstrates compliance through up-to-date documentation of its technical and organisational measures, answers to reasonable questionnaires and, where available, current certificates or audit reports from independent bodies (for example ISO/IEC 27001 or SOC 2 Type II), including those of its sub-processors.

(3) If this information is not sufficient in an individual case, or if there are specific indications of a breach of this Agreement, the Customer may carry out an inspection itself or have it carried out by an auditor bound to confidentiality. Routine inspections take place after at least 30 days' notice. Shorter reasonable notice applies where a personal data breach, specific indications of a material breach of this Agreement or a binding legal deadline makes an earlier inspection necessary. Inspections take place during normal business hours, where possible remotely, and may not unreasonably disrupt the Processor's operations. An auditor may not be a competitor of the Processor. The Processor may restrict access to information to the extent necessary to protect other customers' data, security and trade secrets.

(4) Each party bears its own costs of an inspection. The Customer reimburses the Processor's reasonable effort for more than one inspection per calendar year, unless the inspection reveals a material breach of this Agreement by the Processor. Inspections by supervisory authorities are not limited by this Section.

13. Liability

As between the parties, the liability provisions of the Terms (Section 13) apply. Art. 82 GDPR remains unaffected.

14. Term and Termination

This Agreement applies for the term of the Main Contract and thereafter until the Processor has deleted all Customer Data.

15. Final Provisions

(1) In the event of conflicts, this Agreement takes precedence over the Main Contract on data protection matters.

(2) Unless otherwise provided in this Agreement, the provisions of the Terms apply, in particular on governing law and place of jurisdiction (Section 20 of the Terms).

(3) Changes to this Agreement require the Customer's consent; Section 19 of the Terms applies accordingly. Changes to Appendix 2 are governed by Section 7. The Processor may update Appendix 3 in accordance with Section 5 para. 2.

(4) If a provision of this Agreement is or becomes invalid, the remaining provisions remain unaffected. The invalid provision is replaced by a provision that comes closest to its purpose and meets the requirements of Art. 28 GDPR.

(5) The English version is authoritative; the German version is provided for information.

Appendix 1: Purpose, Nature and Scope of Processing

Purpose: provision of the Platform under the Main Contract, in particular developing, testing, deploying, running and operating the Customer's AI applications and agents, providing access to AI Models, integrations and tools, and support.

Nature of processing: storage, hosting, structuring, transmission to inference providers and connected services, execution of agents, workflows and tasks, display, export and deletion.

Types of personal data (in each case to the extent contained in the data the Customer processes on the Platform):

User data: names, email addresses, roles, permissions and authentication data of Users,
Content data: prompts, chat messages, uploaded files, knowledge, generated output and other Customer Content,
Project data: project source code, configurations, agents, skills, tools, workflows, schedules, webhooks and environment variables,
Execution data: runs, logs, traces and other records of the execution of agents, workflows and applications,
Integration data: data retrieved from or sent to third-party services the Customer connects,
Application data: data of end users of applications and agents the Customer deploys on the Platform, such as their messages, inputs and identifiers.

Special categories of personal data: only if the Customer inputs them in accordance with Section 11 para. 4 of the Terms.

Categories of data subjects:

Users and other employees, contractors and representatives of the Customer,
end users of the Customer's applications and agents,
other persons whose personal data the Customer or its end users enter into the Platform or retrieve via integrations.

Duration: term of the Main Contract plus the retrieval and deletion periods under Section 11.

Appendix 2: Sub-Processors

Sub-processor	Purpose	Data	Location	Transfer mechanism
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of the Platform	Customer Data	Germany	–
Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland	Storage and delivery of uploaded files and assets; inference for models of Anthropic, Google and Mistral AI (Vertex AI)	Customer Data	EU for configured storage and inference; further processing outside the EU possible	Google CDPA, Appendix 3: EU-U.S. Data Privacy Framework for covered U.S. transfers; EU Standard Contractual Clauses where applicable. Transfer solution.
Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland	Inference for models of OpenAI (Azure AI Foundry, EU Data Zone); storage of disaster-recovery backups	Customer Data	EU Data Zone inference; backup storage in Germany; further processing outside the EU possible	Microsoft DPA: EU Standard Contractual Clauses and additional safeguards (Appendix C); Microsoft also participates in the EU-U.S. Data Privacy Framework.
Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France	Inference for models of DeepSeek, Alibaba Cloud (Qwen) and Z.ai (GLM)	Customer Data	EU	Scaleway runs the models; model publishers do not receive Customer Data. Transfers outside the EU are subject to the Scaleway DPA, including prior information and applicable EU Standard Contractual Clauses.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA	Content delivery and protection against malicious traffic	Network and traffic data, Customer Data in transit	Global network	Cloudflare DPA, section 6: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Raintank Inc., d/b/a Grafana Labs, 165 Broadway, 23rd Floor, New York, NY 10006, USA	Logging, metrics and tracing	Logs and technical metadata, which may contain Customer Data	Germany; access and further processing outside Germany, including in the USA, possible	EU Standard Contractual Clauses under Grafana DPA, Schedule 2.
Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA	Error monitoring, diagnostics and in-app feedback	Error and diagnostic data, user identifiers and submitted feedback, which may include Customer Data, screenshots and attachments	Germany (regional telemetry storage); further processing in the USA possible	Sentry DPA, Schedule 3: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Twilio Ireland Limited (SendGrid), 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland	Sending emails	Email addresses and email content	USA	Twilio DPA, Schedule 3: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required.
Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland (PDF Embed API)	In-browser document viewer	Technical request data and anonymous usage data	PDF rendering in the User's browser; further processing by Adobe outside the EU possible	Adobe describes Standard Contractual Clauses between its relevant group companies and applicable adequacy decisions.
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Office Online viewer)	In-browser document viewer	Document URL, file name and document content	Worldwide, including the USA	Microsoft describes EU Standard Contractual Clauses and participation in the EU-U.S. Data Privacy Framework for covered transfers in its Privacy Statement.

Appendix 3: Technical and Organisational Measures

1. Confidentiality

Physical access: the Platform runs in data centres of Hetzner and Google Cloud certified under ISO/IEC 27001, whose physical security is managed by these providers. Veryfront does not operate its own data centres.
Veryfront premises and devices: work computers are kept in workspaces protected against unauthorised physical access.
System access: individual accounts for all personnel, strong passwords and multi-factor authentication for administrative access, encrypted end devices, automatic screen lock.
Data access: role-based access control in the Platform with project-level permissions; administrative access to production systems restricted to a minimum number of authorised personnel and logged; access rights are reviewed when personnel or roles change, and access no longer needed is removed.
Separation: logical separation of customer data by account and project; separation of production, staging and development environments.
Encryption: encryption in transit (TLS) for external connections to the Platform; credentials and tokens for integrations stored encrypted; central management of deployment secrets.

2. Integrity

Transmission control: encrypted connections only; protection against unauthorised network access.
Input control: logging of administrative access and configuration changes; traceability of changes to projects through version history.
Development: code review before release; infrastructure as code under version control; automated tests and dependency scanning.

3. Availability and Resilience

Redundant infrastructure and protection against overload attacks,
Monitoring of availability and errors with automatic alerting,
Regular backups (retention: 30 days), additional off-site disaster-recovery backups (retention: 90 days) and tested restoration,
A 7-day recovery period after soft deletion of uploads, assets and releases,
Incident and emergency procedures.

4. Regular Review

Data protection management: documented data protection and information security guidelines; confidentiality obligations for personnel with production access; data protection impact assessments where required.
Vulnerability management: regular security updates.
Incident response: documented process for detecting, assessing and reporting security incidents and personal data breaches, including the notification of Customers under Section 10.
Data protection by design and by default: collection of only the data necessary for the respective purpose; privacy-friendly default settings.
Sub-processor control: careful selection of sub-processors, data processing agreements and, where required, Standard Contractual Clauses; deletion of data after the end of the contract.