Data processing agreement
This data processing agreement becomes part of the user contract when that contract is formed. You do not need to request it separately. We provide a signed counterpart on request – write to doclarity@klartext-ai.com.
§ 1 Parties and subject matter
(1) This agreement is concluded between you as the controller and Klartext AI FlexCo, Lerchenfelder Straße 74/2/7, 1080 Wien, as the processor. This contract applies if you use doclarity as a business or public body. If you use doclarity as a private individual for your own documents, we are the controller for their contents as well; this contract then does not apply and only the privacy policy does.
(2) It gives effect to the data protection obligations arising from the user contract for doclarity and applies to all personal data we process on your behalf.
(3) It does not apply to data for which we are ourselves the controller – in particular your account, organisation and billing data. The privacy policy governs those.
(4) Where this agreement and the user contract conflict, this agreement prevails on data protection matters.
§ 2 Subject matter, nature, purpose and duration
(1) The subject matter is the provision of doclarity as software as a service.
(2) Nature of processing: storing, converting to PDF, text recognition (OCR), reading, analysing, altering (applying a tag structure, generating alternative texts, adjusting colour contrast), making available for retrieval, and deleting the documents you upload and the results produced from them. Processing is entirely automated; our staff do not look at your documents. The only exception is looking at individual documents or elements where you share them on your instruction (terms and conditions, § 8(6) and (7)), and a legal obligation.
(3) Purpose: producing accessible PDF documents to PDF/UA and making the results available to you. We do not process the data for our own purposes. In particular, we do not evaluate your documents to improve the service. The extended processing on the free plan described in the privacy policy concerns documents of private individuals only and does not take place under this contract.
(4) Duration: for the term of the user contract. The obligations in § 10 survive it.
§ 3 Data categories and data subjects
(1) Categories of personal data: the content of the documents you upload is determined by you alone. It may typically include names, addresses, contact details, job titles and organisational designations, contractual and financial data, images, and any other information contained in your documents.
(2) Categories of data subjects: the people named in your documents – for example employees, customers, citizens, business partners.
(3) Special categories (Art. 9 GDPR): the service processes the content you upload without categorising it by subject matter. You decide which documents you upload and ensure you have an appropriate legal basis for processing special categories. If you intend to have such data processed regularly, please speak to us beforehand so that we can set the measures together.
§ 4 Processing on instructions
(1) We process personal data only on your documented instructions, unless required to process by Union or Member State law. In that case we inform you of the legal requirement before processing, unless the law prohibits it.
(2) Your use of the service within its contractually intended scope constitutes an instruction. Instructions beyond that are to be given in text form to doclarity@klartext-ai.com.
(3) If we consider an instruction unlawful, we tell you without delay and may suspend its execution until you confirm it.
§ 5 Confidentiality
Everyone at our organisation with access to your data is bound to confidentiality and has been instructed on the applicable data protection rules. The obligation continues after their engagement ends.
§ 6 Technical and organisational measures
We implement the measures required by Art. 32 GDPR, in particular:
- Encryption: transport encryption (TLS) on every connection; encryption at rest in object storage and the database.
- Physical security: operation exclusively in sub-processors' data centres certified to ISO/IEC 27001.
- Access control: personal accounts, passwords stored only as a cryptographic hash, role-based permissions, separation by organisation. Platform-wide administrator rights are held by staff of Klartext AI FlexCo only.
- Tenant separation: documents are bound to their organisation; access across organisation boundaries is prevented server-side.
- Logging: server and access logs are deleted after 14 days at the latest. Audit records are something else, for example of shares for inspection and of consents given; the longer retention periods stated in the privacy policy apply to those.
- Availability: regular database backups, redundant object storage. Deleted data remains in backups for up to 30 days and is overwritten there in the normal rotation; it is not restored in the meantime, except to restore the system after an outage.
- Resilience and restoration: separate development, test and production environments; restoration from backups.
- Review: source code changes are reviewed before going live; automated tests pin the access boundaries.
We may develop these measures further, provided the level of protection is not reduced.
§ 7 Sub-processors
(1) You grant us general authorisation to engage the sub-processors below. Agreements are in place with all of them imposing the same obligations this agreement imposes on us. The list below is maintained together with the privacy policy, so that the two documents cannot drift apart. It therefore also contains providers that process only data for which we are ourselves the controller, for example in connection with email correspondence or the management of business contacts, and providers that process only documents of private individuals. Such entries concern no processing under this contract; they are marked accordingly in the column on scope.
| Processor | Purpose | Location | Transfer outside the EEA |
|---|---|---|---|
| Hetzner Online GmbH | Server operation (virtual machines) running the application | Nuremberg, Germany | None – data stays in the EU/EEA |
| Scaleway SAS | Object storage for uploaded and tagged documents, and the PostgreSQL database (account, organisation and usage data) | Amsterdam, Netherlands | None – data stays in the EU/EEA |
| Scaleway SAS | Transactional email (invitations, password resets, status notifications) | Paris, France | None – data stays in the EU/EEA |
| Google Cloud EMEA Limited (Vertex AI) | AI-assisted analysis and tagging of document content. Zero data retention is enabled: content is held only for the duration of processing, is not stored, and is not used for model training. | EU multi-region (European data centres) | None, the data stays in the EU/EEA. Processing outside the EU takes place only after explicit activation by a person holding the Owner role (section 6). |
| Google Cloud EMEA Limited (Vertex AI) | AI-assisted analysis and tagging of document contents where the worldwide processing option is active. Zero Data Retention enabled: held only for the duration of the processing, not stored, not used for model training only where the worldwide processing option is active | Data centres worldwide, including outside the EU | EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), in the alternative explicit consent (Art. 49(1)(a) GDPR) |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing for paid plans. Payment details are collected by Stripe directly; we store no full card data. | Dublin, Ireland | Where data reaches Stripe, Inc. (USA), on the basis of the EU standard contractual clauses. |
| Anthropic PBC | Automated quality analysis of documents uploaded by private individuals on the free plan, under the Commercial Terms including a data processing agreement; no model training private individuals on the free plan only, with consent | USA | EU standard contractual clauses (part of the data processing addendum). |
| Google Ireland Limited (Google Workspace) | Email mailboxes and business correspondence contact and correspondence data only, no document contents | Google data centres in the EU and worldwide | EU Standard Contractual Clauses, where data reaches Google LLC in the United States |
| Notion Labs, Inc. | Management of prospect and business contact data (section 9 of the privacy policy) contact and correspondence data only, no document contents | United States | EU Standard Contractual Clauses (part of Notion's data processing agreement) |
(2) We give notice of changes in text form at least four weeks before they take effect. You may object within that period on substantial data protection grounds. If we consider the engagement necessary and the objection cannot be resolved, either party may terminate the user contract with effect from the date of the change.
(3) The automated quality analysis by Anthropic PBC concerns only documents uploaded by private individuals on the free plan, and even there only with their separate consent under Art. 6(1)(a) GDPR. It does not take place under this contract; documents of businesses and public bodies are not transferred to Anthropic.
(4) Processing outside the EU. By default we process your documents exclusively in the European Union. A person holding the Owner role can additionally activate worldwide processing in the account settings. That activation is at the same time an instruction under Art. 28 GDPR and your authorisation to engage the sub-processor concerned outside the EU as well. As the controller you ensure that you have a legal basis for this; the consent of individual users does not substitute for it. The transfer is covered by the EU standard contractual clauses under Art. 46(2)(c) GDPR. The option is off by default and can be switched off at any time with effect for the future; we record who activated or deactivated it and when.
§ 8 Third-country transfers
By default processing takes place exclusively in the European Union: servers in Nuremberg, storage and database in Amsterdam, email dispatch in Paris, AI processing through the regional EU multi-region endpoint of Google Cloud.
Under this contract a transfer to a third country occurs in two cases: in payment processing, where data reaches Stripe, Inc. in the USA, and, only where the worldwide processing option is active (§ 7(4)), in the analysis of document content by Google Cloud EMEA Limited. Both are covered by the EU standard contractual clauses under Art. 46(2)(c) GDPR.
Should Google exceptionally access data from a third country in the course of a support case, the EU standard contractual clauses from the data processing agreement with Google apply as well.
The transfer to Anthropic PBC named in the list concerns only documents of private individuals and does not take place under this contract.
§ 9 Assistance obligations
(1) Data subject rights. If a data subject contacts us directly, we forward the request to you without delay and do not answer it ourselves. We assist you with appropriate measures in responding to requests for access, rectification, erasure, restriction, objection and portability. You can view, change and delete your documents yourself in the application at any time.
(2) Personal data breaches. If we become aware of a personal data breach affecting your data, we inform you without undue delay, as a rule within 24 hours of becoming aware, and provide the information you need for a notification under Art. 33 and 34 GDPR.
(3) Data protection impact assessment. We support you with a assessment under Art. 35 GDPR and any prior consultation under Art. 36 GDPR, using the information available to us.
§ 10 Deletion and return after the contract ends
(1) You can download and delete your documents yourself throughout the contract term. Deleting in the application removes the original file, every intermediate artefact and the result from object storage, along with the database record. Deleted data remains in backups for up to 30 days and is overwritten there in the normal rotation (§ 6).
(2) After the contract ends you have 30 days to download your data. We delete it afterwards, or sooner at your request.
(3) Data we are legally required to retain is excepted – in particular billing records under § 132 BAO and § 212 UGB. We process those solely for that purpose and otherwise restrict their processing.
(4) We confirm deletion in text form on request.
§ 11 Evidence and audits
(1) On request we demonstrate compliance with this agreement by appropriate means, in particular by providing information about the technical and organisational measures in place and evidence from our sub-processors.
(2) You are entitled to satisfy yourself of compliance – with reasonable advance notice, during normal business hours, and without disrupting operations. Audits may be carried out by independent auditors, provided they are not in competition with us and are bound to confidentiality.
(3) We may charge reasonable remuneration for audit effort going beyond the provision of information.
§ 12 Liability
Art. 82 GDPR governs liability. As between the parties, the liability provisions of the user contract (terms and conditions, § 11) apply in addition, to the extent Art. 82 GDPR does not preclude this.
§ 13 Final provisions
(1) Amendments to this agreement require text form.
(2) If a provision is invalid, the rest of the agreement remains effective and the statutory rule takes its place.
(3) Austrian law applies. The mandatory requirements of the GDPR remain unaffected.