Note on this translation
This is an English translation of the German original.
German version: Auftragsverarbeitungsvertrag (AVV) für XHANA
Preamble
This Data Processing Agreement ("DPA") is Annex 1 to the Terms and Conditions (AGB) for the service "XHANA" of XHAUER Media GmbH, Stephansplatz 8/20, 1010 Vienna, Austria, company register number FN 571965 a ("Processor" or "Provider"), and becomes an integral part of the contract upon conclusion of the contract under clause 3 of the Terms. The contracting party is the respective customer ("Controller" or "Customer"). This DPA specifies the data protection obligations of the parties insofar as the Provider processes personal data on behalf of the Customer in providing the Service.
Section 1 Subject matter and duration
1.1 The subject matter of this DPA is the processing of personal data by the Provider on behalf of the Customer for the provision of the XHANA service in accordance with the Terms. This processing comprises the AI-assisted creation and publication of LinkedIn posts based on the content transmitted by the Customer and, where the Analytics function is activated, the retrieval, storage and analysis of performance data on the Customer's posts and profile and the provision of reports and optimisation suggestions in accordance with clause 4.4 of the Terms.
1.2 The duration of this DPA corresponds to the term of the contract of use (including any trial period). The obligations under Section 10 (deletion and return) continue beyond the end of the contract.
Section 2 Nature and purpose of processing, categories of data, data subjects
2.1 Nature and purpose of processing: receiving, storing and analysing the content transmitted by the Customer; transcribing voice messages; analysing transmitted images and documents; creating and maintaining a customer profile for personalisation ("Second Brain"); AI-assisted creation of draft posts; sending and receiving messages via the WhatsApp Business Platform; publishing approved posts via the LinkedIn interface; storing and analysing performance data on the Customer's posts and profile via the LinkedIn interface and presenting it in the web application and in a weekly report via WhatsApp (clause 4.4 of the Terms); planning and managing posts in the web application; logging approvals. The Customer instructs the Provider, as the final processing step of the processing on the Customer's behalf, to completely and irreversibly anonymise personal data contained in content processed within the Service that is to be prepared in accordance with clause 6.4 of the Terms for the purposes of internal service improvement or of training, fine-tuning or evaluating the Provider's own or internally operated models; to that extent, this agreement serves as documentation of the instruction pursuant to Art. 28(3)(a) GDPR. The instruction relates exclusively to the dataset created or technically derived for these purposes and does not cause any anonymisation or deletion of the original and customer data still required for ongoing performance of the contract. The anonymisation itself is still carried out as processing on behalf of the Customer. Only the resulting anonymous data, which no longer relates to any person within the meaning of Recital 26 GDPR, is processed by the Provider outside this agreement and under its own responsibility for the purposes stated in clause 6.4 of the Terms. In addition, before any such use, direct and indirect references to the Customer as well as customer-specific confidential information and trade secrets are removed, abstracted or transformed in accordance with clause 6.4 of the Terms. These measures serve the contractual protection of confidential information and are to be distinguished from anonymisation under data protection law. The Customer's opt-out governed by clause 6.4 of the Terms is deemed a revocation of this instruction with effect for the future. From receipt of the objection, no further anonymisation and preparation of this Customer's data for the training and improvement purposes governed there takes place. The Provider documents the anonymisation process, in particular the methods and tests used and the assessment of the re-identification risk, and makes this documentation available to the Customer on request in accordance with Section 11.
2.2 Categories of personal data: contact and identification data (name, WhatsApp telephone number, LinkedIn profile reference); communication content (text messages, voice messages and their transcripts, images, documents/PDFs, chat histories); the Customer's profile data ("Second Brain": professional background, experience, opinions, anecdotes, linguistic style, business context); post data (drafts, approvals, publication times, published posts); access and authorisation data for publication and, where the Analytics function is activated, for retrieving performance data (LinkedIn OAuth token and authorisations granted); performance data from LinkedIn (metrics on the Customer's posts and profile, e.g. impressions, reactions, comments, follower count; concerning other LinkedIn members, exclusively aggregated numerical values without content or profile data); reports and optimisation suggestions produced from the performance data, insofar as they constitute personal data; technical usage and log data (timestamps, delivery status, processing logs); third-party data contained in the transmitted content (e.g. persons mentioned in narratives).
2.3 Categories of data subjects: the Customer itself or its owner; employees and other users of the Customer; third parties whose data is contained in the transmitted content (e.g. employees, business partners, customers of the Customer, persons mentioned).
2.4 Special categories of personal data (Art. 9 GDPR) are not the subject of the commissioned processing; clause 2.5 of the Terms applies accordingly. The Service processes transmitted content automatically and without distinguishing between data categories by content; if transmitted content nevertheless contains or reveals special categories of personal data, it may therefore, for system-related reasons, flow into the processing under Section 2.1 – including transcription, the customer profile ("Second Brain") and draft posts. However, the Provider does not carry out any analysis, categorisation or use directed at the special category as such (in particular no profiling based on health data, political opinions, religious beliefs or comparable characteristics) that goes beyond the provision of the services in accordance with the contract; content identified as such data is not used for training the Provider's own models under Section 2.1. Where such content concerns the Customer itself and was knowingly transmitted by the Customer for the provision of the services, its processing within the Service is deemed to be covered by the Customer's instructions. If, in the course of normal service provision, the Provider becomes aware that transmitted content contains special categories of personal data of third parties, it shall inform the Customer without undue delay in text form; the Customer hereby gives the documented instruction (Art. 28(3)(a) GDPR) to delete such identified third-party data without undue delay or remove it from the customer profile, unless the Customer gives a different documented instruction in the individual case within five working days (Werktage, including Saturdays but excluding Sundays and Austrian public holidays). The Provider has no general obligation to proactively check or monitor content. The Provider documents such incidents (time, affected content in categorised form, measures taken) and supports the Customer in accordance with Section 8 in meeting its obligations under Art. 32 to 36 GDPR. Responsibility for the admissibility of transmitting such data and for the existence of an exception under Art. 9(2) GDPR lies with the Customer as controller.
Section 3 Customer's right to issue instructions
3.1 The Provider processes the data exclusively on documented instructions from the Customer, unless it is required to process them by Union or Member State law; in that case, it informs the Customer of that legal requirement before processing, unless that law prohibits such information.
3.2 The Terms, this DPA and the Customer's use of the functions of the Service (in particular transmission of content, approvals, scheduling and deletion actions) are deemed documented instructions. Supplementary individual instructions must be given in text form.
3.3 If the Provider considers that an instruction infringes the GDPR or other data protection provisions, it shall inform the Customer without undue delay and is entitled to suspend execution until the instruction is confirmed or amended.
Section 4 Confidentiality
The Provider ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on instructions. This obligation continues after their activity has ended.
Section 5 Technical and organisational measures (TOMs)
5.1 The Provider implements the technical and organisational measures described in Appendix A in accordance with Art. 32 GDPR and continuously adapts them to technical developments. Reducing protection below the agreed level is not permitted.
5.2 The Customer is itself responsible for the security of its own systems and access credentials (in particular its WhatsApp account, LinkedIn account and login credentials for the web application).
Section 6 Sub-processors
6.1 The Customer grants general authorisation for the engagement of sub-processors. The sub-processors engaged at the time the contract is concluded are listed in Appendix B.
6.2 The Provider informs the Customer of any intended changes (addition or replacement) at least 14 days before they take effect, in text form (e.g. by email or via the web application). The Customer may object to the change on qualifying data-protection grounds within this period of 14 days. In the event of an objection, either party is entitled to terminate the contract of use with effect from the date on which the change takes effect if no reasonable remedy is possible.
6.3 The Provider imposes on sub-processors, by contract, the same data protection obligations as are set out in this DPA, insofar as these obligations apply to the processing activities specifically entrusted to the respective sub-processor. If a sub-processor fails to fulfil its obligations, the Provider is liable to the Customer for the performance of that sub-processor's obligations in accordance with Art. 28(4) GDPR.
6.4 The following are not sub-processors within the meaning of this DPA: Digistore24 GmbH (an independent controller for payment processing, clause 7 of the Terms) and LinkedIn within the scope of the Customer's own user relationship with LinkedIn. LinkedIn is the recipient of the posts individually approved by the Customer under clauses 4.2 and 5 of the Terms and, where the Analytics function is activated, the source of the performance data under clause 4.4 of the Terms. The OAuth process grants only the technical access authorisations; it does not replace the separate express approval of a post for publication.
Section 7 Processing in third countries
7.1 Processing takes place in the EEA and, through the sub-processors listed in Appendix B, in third countries (in particular the USA).
7.2 Transfers to third countries take place only on the basis of an adequacy decision (in particular the EU-US Data Privacy Framework for certified recipients) or appropriate safeguards pursuant to Art. 46 GDPR (in particular EU standard contractual clauses, where applicable with supplementary measures). The mechanisms applicable to each sub-processor are set out in Appendix B.
Section 8 Assistance to the Customer
8.1 The Provider assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12–23 GDPR: in particular access, rectification, erasure, data portability). The Provider forwards requests received directly by it to the Customer without undue delay and does not answer them itself.
8.2 Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in complying with the obligations under Art. 32–36 GDPR (security of processing, notification of breaches, data protection impact assessment, prior consultation).
8.3 The Provider may charge for assistance that goes beyond the usual level or results from circumstances within the Customer's sphere, on a time-and-materials basis at reasonable rates.
Section 9 Notification of personal data breaches
The Provider notifies the Customer of any personal data breach affecting the data processed on its behalf without undue delay after becoming aware of it, and in any event within 48 hours, in text form to the contact address provided by the Customer. The notification contains, where available, the information specified in Art. 33(3) GDPR; information may be provided in phases. Notification of the supervisory authority and of data subjects is the Customer's responsibility.
Section 10 Deletion and return
10.1 After termination of the contract of use, the Provider, at the Customer's choice, deletes all personal data processed on the Customer's behalf (including the customer profile and content data) or returns it to the Customer in a common, machine-readable format and subsequently deletes existing copies. The Customer makes this choice by instruction in text form no later than 30 days after the end of the contract; until then, the Customer may change a choice already made. If no instruction is given in time, deletion is deemed to have been chosen. Deletion takes place within 90 days by means of logged deletion instructions and also covers backup copies in accordance with the regular backup cycle under Appendix A no. 6; until deletion or return is complete, the Provider continues to ensure compliance with this DPA and no longer actively processes the data. On request, the Provider confirms the deletion to the Customer in text form. Statutory retention obligations under Union or Member State law remain unaffected; to that extent, processing is restricted. Voice messages and PDF files are not stored permanently in the Provider's own active file storage; files temporarily present for processing are discarded immediately after processing is complete. Transcripts and summaries produced are treated as content data under the preceding rules. Image and video uploads are removed from the active media storage 30 days after upload. In this respect, the right to choose to have the data returned relates only to files that still exist; backup copies are subject to the preceding deletion rules, and temporary storage at sub-processors is subject to Section 10.2. The following rules additionally apply to performance data retrieved from LinkedIn and to reports and analyses derived from it: after revocation of the access authorisations required for this, a deletion request by the Customer or termination of the contract of use, further retrieval and ongoing analysis cease without undue delay. A revocation declared at LinkedIn is detected at the next automated retrieval (usually within one day); the data concerned is then deleted without undue delay. Following a deletion request by the Customer, the data is deleted within 14 days; after termination of the contract of use, it is deleted together with the other data within the period under the fourth sentence. Any existing statutory right to choose to have the data returned remains unaffected; where return is requested, the data is made available in a common, machine-readable format before deletion. The general 90-day period does not constitute a permissible minimum retention period for LinkedIn performance data: the shorter storage and deletion periods applicable under the LinkedIn terms must be observed unless mandatory law precludes this. The Provider documents the periods applicable to the data categories used and also applies them to copies, cached data and personal or customer-related derivatives. This includes arranging deletion at the sub-processors engaged and the handling of backup copies; deleted data must not re-enter active processing when data is restored. Reports already delivered to the Customer in its own systems or WhatsApp account are at the Customer's disposal and are not deleted from these systems by the Provider. Mandatory statutory retention obligations remain unaffected; to that extent, the data concerned is blocked and processed only for the statutory retention purpose.
10.2 For the sub-processors listed in Appendix B, their contractually committed deletion periods apply (for the AI providers, in accordance with their business-customer terms: by default, deletion of inputs and outputs within 30 days; no use of the data for model training).
Section 11 Evidence and audits
11.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. Current self-disclosures, certificates and reports (including those of the sub-processors) serve primarily for this purpose.
11.2 In addition, the Customer may carry out audits, including inspections, or have them carried out by an auditor who is bound to confidentiality and is not a competitor of the Provider. Audits take place with reasonable advance notice (at least 14 days), during normal business hours and no more than once a year. Where there is a specific reason – in particular (i) a personal data breach under Section 9, (ii) an order or investigation by a data protection supervisory authority concerning the processing on behalf of the Customer, or (iii) specific indications of a material breach of this DPA – the annual limit and the 14-day notice period do not apply; in these cases, reasonable short advance notice suffices. Audits must not unreasonably disrupt business operations; each party bears its own costs.
Section 12 Liability
The parties' liability under this DPA is governed by clause 12 of the Terms. Mandatory liability under Art. 82 GDPR towards data subjects (external relationship) remains unaffected; the limitations govern exclusively internal recourse between the parties.
Section 13 Final provisions
13.1 In the event of conflicts between this DPA and the Terms, this DPA takes precedence on matters of data protection law.
13.2 The laws of the Republic of Austria apply; jurisdiction lies with the courts of Vienna (clause 14 of the Terms).
13.3 Amendments to this DPA are governed by clause 13 of the Terms.
Appendix A: Technical and organisational measures (Art. 32 GDPR)
1. Encryption: All data transfers between the system components and to sub-processors (WhatsApp Business Platform, AI interfaces, database, web application, media storage) are encrypted in transit (TLS 1.2+); database connections of the processing infrastructure are restricted to encrypted connections. The central data store (database) is encrypted at rest (AES-256); the media storage uses server-side encryption (AES-256). The orchestration infrastructure runs on servers in ISO 27001-certified data centres in Germany; processing data temporarily arising there is protected by access controls (no. 2) and regularly purged (no. 5, no. 7). Content data is not pseudonymised owing to the nature of the Service (personalised content creation); access restriction (no. 2) and tenant-based separation (no. 3) act as compensating measures. Access keys for the LinkedIn interface are additionally stored in encrypted form in the database.
2. Physical access, system access and data access control: Access to production systems only for authorised persons (CEO, COO and AI Product and Growth); two-factor authentication for hosting, database and orchestration; role-based access in the web application (login via one-time password sent by WhatsApp); access to customer data only for support and operational purposes.
3. Separation control: The data of all customers is processed in logically separated form through consistently account-based data storage (account-based assignment in all tables). Database access is secured by Row Level Security on all tables; there are no permissions for unauthenticated access, and API access to customer data is restricted to authorised internal users. The customer web application restricts all access on the server side to the account of the authenticated session. Mixing of data of different controllers is thus technically prevented, or reduced to an appropriate residual risk, by tenant-based assignment, Row Level Security and server-side access controls.
4. Transfer control: Transfers to sub-processors exclusively via their business-customer interfaces on the basis of concluded data processing agreements; no use of consumer services of the AI providers; no use of customer data to train models of external providers; training of the Provider's own models takes place exclusively with fully anonymised data in accordance with clause 6.4 of the Terms (Section 2.1).
5. Input control / logging: Essential processing steps are logged: message histories and delivery status, approvals and publications of posts, AI processing runs (metadata without content data), changes to system settings, and all write access via the internal dashboard (with user attribution). Contract-relevant consents of customers are logged with a timestamp and document version. Technical execution logs of the processing infrastructure are purged automatically after 7 days; documented retention periods apply to the other logs. Incidents involving special categories of personal data (Section 2.4) are logged with the time, data category and measures taken.
6. Availability control: The central data store is backed up automatically every day; the hosting infrastructure is backed up automatically every day by the hosting provider (encrypted backups). The workflow configuration of the processing infrastructure is additionally backed up externally with versioning. Recovery procedures are documented in an internal runbook. System availability is monitored by external uptime monitoring with alerting.
7. Deletion concept: After termination of the contract of use, the content data processed on the Customer's behalf (conversations, customer profile, posts, materials, access tokens) is removed in accordance with Section 10.1 within 90 days by an automated, logged deletion routine; a right to choose to have the data returned exercised beforehand is taken into account. Remaining account records are anonymised unless statutory retention obligations preclude this. Voice messages and PDF files are not stored permanently in the Provider's own active file storage; files temporarily present are discarded immediately after processing is complete. Transcripts and summaries are treated as content data. Image and video uploads are removed from the active media storage 30 days after upload. For LinkedIn performance data, reports and analyses derived from it, and their copies, the special deletion triggers and periods under Section 10.1 additionally apply. The deletion processes also cover caches and backup copies in accordance with Section 10.1; when data is restored, renewed active processing of data already deleted is prevented. Section 10.2 additionally applies to storage by sub-processors, subject, in the case of LinkedIn performance data, to the special requirements of Section 10.1. Technical execution logs are purged after 7 days (no. 5). Other metadata without content reference and documents subject to statutory retention are subject to the documented retention periods; these must not circumvent the special deletion requirements for LinkedIn performance data.
8. Organisational measures: All persons involved in the processing are bound to confidentiality in writing and instructed in the data-protection-compliant use of the systems; this includes the prohibition on entering customer data into consumer services of AI providers. The Provider maintains a record of processing activities, documented processes for notifying personal data breaches (Section 9) and for assisting with data subject requests (Section 8), and an internal incident runbook, and provides its customers with information material on how the AI system used works and on its limitations.
9. Technical and organisational measures for mobile working: For mobile working (remote work) and for data processing when working from home, the following mandatory protective measures additionally apply to minimise risk:
- Device security and storage prohibition: Data processing takes place exclusively on company-provided devices with hard-disk and storage-media encryption enabled. Storing or processing customer data on private devices (bring your own device) or in private cloud storage is strictly prohibited.
- Access protection and privacy screening: All access to production systems, databases and administration interfaces requires mandatory multi-factor authentication (MFA). The mobile workplace must be set up so that unauthorised third parties (e.g. in public or family members in the household) are prevented from viewing the screen by means of privacy filters, suitable room arrangements and automatic screen locks when away.
- Network security: Logging in to company systems and the electronic transmission of personal data from mobile environments take place without exception via secured, encrypted connections (TLS 1.2+ / VPN).
- Paperless processing and disposal: As a rule, no paper documents containing customer data are created in the course of mobile working. Should this be unavoidable in exceptional cases, the documents must be stored protected against unauthorised access and destroyed in a data-protection-compliant manner (in accordance with DIN 66399) once processing is complete.
Appendix B: Sub-processors (as at 3 November 2026)
1. Anthropic PBC
- Registered office: San Francisco, USA
- Service: AI text generation (draft posts, conducting conversations, document summarisation), AI-assisted support, error and operational analyses on a case-by-case basis and – exclusively to the extent permitted under clause 4.4 of the Terms – drafting of the weekly performance report and of optimisation suggestions from the aggregated weekly metrics required for this purpose. The Analytics processing serves to produce reports for the respective customer, not to train the sub-processor's models.
- Place of processing: USA / EEA infrastructure
- Transfer mechanism: Standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914, Module 2/3), supplemented by a completed transfer impact assessment (TIA) and supplementary technical measures (encryption in transit and at rest, prohibition of use for model training).
2. OpenAI Ireland Ltd (group: OpenAI OpCo, LLC, USA)
- Registered office: Dublin, Ireland
- Service: transcription of voice messages, image analysis, AI text generation (including failover, topic/question suggestions)
- Place of processing: EEA contracting party is OpenAI Ireland Ltd; processing also in the USA
- Transfer mechanism: EU standard contractual clauses (Implementing Decision (EU) 2021/914) in accordance with the OpenAI DPA (§ 4.1, version of 1 January 2026), including a transfer impact assessment; EEA contracting party is OpenAI Ireland Ltd. As the Provider is a processor vis-à-vis the Customer and OpenAI is engaged as a sub-processor, SCC Module 3 (processor-to-processor) applies (cf. Schedule 1 clause 8.1 of the OpenAI DPA: Module 2 where the customer is a controller, Module 3 where the customer is a processor). Not a DPF participant (register check 24 August 2026).
3. Meta Platforms Ireland Limited
- Registered office: Merrion Road, Dublin 4, D04 X2K5, Ireland
- Service: WhatsApp Business Platform Cloud API; hosting, transmission and receipt of customer messages (text, voice messages, images, metadata) and transmission of Analytics reports to the extent permitted under clause 4.4 of the Terms, otherwise of notifications about reports available in the web application.
- Place of processing: Meta data centres in the EU (Ireland, Sweden, Denmark) and the USA; messages for a maximum of 30 days, encrypted at rest
- Transfer mechanism: Onward transfer to Meta Platforms, Inc. (USA) on the basis of the EU-US Data Privacy Framework (actively certified), alternatively EU standard contractual clauses in accordance with the Meta Global Processor Terms
4. WhatsApp Ireland Limited
- Registered office: c/o Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, Ireland
- Service: WhatsApp Business Services (business account, message delivery in the WhatsApp network), including delivery of Analytics reports or notifications in accordance with clause 4.4 of the Terms.
- Place of processing: EU and USA (WhatsApp LLC / Meta data centres)
- Transfer mechanism: EU-US Data Privacy Framework (WhatsApp LLC: active, re-certification due 23 January 2027); alternatively EU standard contractual clauses Module 3 in accordance with the WhatsApp Business Data Transfer Addendum
5. Supabase Pte. Ltd.
- Registered office: 65 Chulia Street, OCBC Centre, Singapore 049513
- Service: managed PostgreSQL database, auth and storage (backend of the web app and the dashboard), including storage and provision of the Analytics performance data and reports in accordance with clause 4.4 of the Terms and Section 10.1 of this DPA.
- Place of processing: primarily AWS eu-west-3 (Paris, France); support/monitoring access by Supabase, Inc. (USA) and further US sub-processors possible
- Transfer mechanism: EU standard contractual clauses (Implementing Decision (EU) 2021/914) in conjunction with a transfer impact assessment (TIA). The compensating supplementary measures include: server-side encryption of data at rest with AES-256, strict access restrictions for support staff via bastion hosts with MFA, and time-based session logging.
6. ELESTIO LIMITED
- Registered office: 66 Fitzwilliam Square, Dublin 2, D02 AT27, Ireland (CRN 755058)
- Service: managed hosting of the orchestration and application infrastructure (VMs, backups, monitoring)
- Place of processing: provider region selected by the Provider: Germany; management infrastructure on AWS (Ireland) and Hetzner (Germany)
- Transfer mechanism: registered office and processing in the EU/EEA; for any third-country transfers, EU standard contractual clauses (processor-to-processor) in accordance with the Elestio DPA
7. Uploadcare Inc.
- Registered office: 2711 Centerville Road, Wilmington, DE 19808, USA
- Service: file upload, image processing and CDN delivery (media for posts)
- Place of processing: USA (AWS); delivery via a worldwide CDN (Akamai/CloudFront/Fastly); no EU storage option in the standard offering
- Transfer mechanism: EU-US Data Privacy Framework (active, including the UK and Swiss extensions, checked 24 August 2026; re-certification due 23 October 2026); additionally EU standard contractual clauses including the UK IDTA in the Uploadcare DPA