Data processing agreement

1. Subject and duration

The processor provides Klarto to the controller. The duration corresponds to the term of the main contract.

2. Nature and purpose of processing

Operation of meetings, chat and knowledge per room, AI features and, if the controller enables it, transcription and summaries. Audio and video are only processed live and are not stored. There is no per-person evaluation and no sentiment analysis.

3. Types of data and data subjects

• Account and master data of users (name, email address, role)
• Chat messages and content in rooms
• Transcripts and summaries, only after approval and activation by the controller
• Technical usage and log data

Data subjects are employees of the controller as well as guests and other participants.

4. Instructions and confidentiality

The processor only processes the data on documented instructions from the controller. If it considers an instruction unlawful, it points this out immediately. Persons with access are bound to confidentiality. Administrators do not read content.

5. Technical and organisational measures

• Operation in data centres of Hetzner Online GmbH in Nuremberg and Falkenstein, certified to ISO 27001
• Encrypted transmission (TLS) and secured storage of transcripts
• Role-based access control and separation of data per customer
• Labelling of the AI and approval before every spoken contribution

[OFFEN] Add a complete description of the measures under Art. 32 GDPR as an annex.

6. Sub-processors

The processor only uses service providers from the EU: Hetzner Online GmbH, Gunzenhausen (data centres Nuremberg and Falkenstein), for hosting including GPU servers. It informs the controller in advance about new sub-processors; the controller can object.

[OFFEN] Complete the list, e.g. Mistral AI SAS, Paris, if the language model or voice runs via the Mistral API, as well as email delivery. If AI processing takes place in Paris, adjust the statement “the AI also runs in Nuremberg and Falkenstein”.

7. Place of processing

Processing takes place exclusively in the EU. There is no transfer to third countries, in particular not to the USA.

8. Support and notifications

The processor supports the controller with requests from data subjects and with the obligations under Art. 32 to 36 GDPR. It reports personal data breaches without undue delay.

9. Deletion and return

The controller stays in control of the data. On the controller’s request, the processor deletes data in accordance with the GDPR. After the end of the services, it deletes all data or returns it at the controller’s choice, unless there is an obligation to store it (Art. 28 (3) (g) GDPR).

10. Evidence and audits

The processor provides the information necessary to demonstrate compliance and allows audits after timely notice.