Data Processing Agreement (DPA)

Controller: the Customer using the HOVIGuard service under the Terms of Service.

Processor:

Ing. Dipl.-Ing. (FH) Karl J. Pilz, sole proprietorship
Sagmüllerweg 8, 5081 Anif-Niederalm, Salzburg, Austria
VAT-ID: ATU 66845907
Data protection email: datenschutz@hoviguard.eu

HOVIGuard processes personal data exclusively on behalf of the Customer for the operation of the AI Security and Governance Gateway. Processing covers:

• Receiving, security-checking and forwarding user prompts to AI models
• Content inspection (PII detection, content safety using Qwen3Guard, NSFW filter)
• Management of user accounts, roles and access rights within the tenant
• Storage of conversations, uploaded files and configurations
• Token and usage metering for billing
• Audit logging for compliance evidence

Processing starts upon registration of the tenant and ends with deletion of the tenant account. After contract end, all personal data in the database and object storage is deleted within 30 days (encrypted backup archives rotate per the retention plan, at most six months, see 6.6), unless statutory retention obligations apply (§ 132 BAO, 7 years), in which case data is pseudonymised/blocked.

See the German master version (§3 — Art und Zweck der Verarbeitung) for the full table of processing activities.

• Master data: name, business email, language
• Access data: scrypt password hash (RFC 7914, N=16384, r=16, p=1, 64-byte derived key, 16-byte random per-password salt, NFKC-normalised), session tokens, optional 2FA seeds
• Usage data: prompt content, AI responses, token consumption, model selection
• File content: documents and images uploaded by end users, plus metadata
• Communication data: IP address (pseudonymised after 7 days), user-agent, device ID
• Billing data: company/billing address, VAT-ID, Stripe customer ID, tokenised payment instruments (no card numbers)
• Audit data: action logs, security decisions, policy violations

• Employees and agents of the Customer registered as end users of the tenant
• Persons whose data may be contained in prompts or uploaded files (third parties)
• Billing and contract contacts of the Customer

Bound by documented instructions; written confidentiality of staff (Art. 28(3)(b), Art. 29 GDPR); TOMs per Annex A; sub-processor list per Annex B with 30 days' prior change notice; assistance with data subject rights, DPIAs and breach notifications; data export and deletion within 30 days after contract end; Art. 30(2) records.

Lawful basis vis-à-vis own end users; tenant configuration of security and content policies; observance of retention; Art. 13/14 information of own end users; ensure no Art. 9 special categories without legal basis; prompt notification of breaches involving HOVIGuard.

Self-service audit log access at any time; one free TOM report per calendar year; on-site or remote audit once per year with 30 days' notice (Customer cost unless triggered by a substantiated breach); third-party certificates accepted in lieu.

Primary processing within EU/EEA. Third-country transfers limited to the technical minimum and listed in Annex B: Requesty Ltd. (UK adequacy decision per Art. 45 GDPR + SCCs Modules 2/3 + UK International Transfer Addendum, processing in AWS Frankfurt), OpenAI Ireland (EU endpoint, SCCs Module 2/3, zero data retention), Google Cloud EMEA (Vertex AI EU multi-region, SCCs Module 2/3), xAI USA (SCCs Module 2/3, EU region eu-west-1, zero retention), Amazon Web Services EMEA SARL (Bedrock Frankfurt, SCCs Module 2/3) and Stripe USA (SCCs Modules 1+2 + EU-US DPF). The AI model sub-processors mostly have US parent companies; Requesty Ltd. is UK-based (adequacy decision). Data never technically leaves the EU processing region. Provider DPAs incorporate the SCCs in Module 2 and Module 3; for customer content that HOVIGuard forwards as a processor, Module 3 applies ("Module 2/3").

A Transfer Impact Assessment (EDPB Recommendations 01/2020) has been performed. Mitigations: tokenisation, transport encryption with TLS 1.3 preferred and TLS 1.2 as the minimum version, AES-256-GCM encrypted storage of operational secrets and fully encrypted backups (BorgBackup, repokey-blake2), no AI conversation content sent to Stripe, OpenAI processing forced to the EU endpoint (eu.api.openai.com) and Vertex AI to EU multi-region, xAI processing forced to EU region (eu-west-1) with contractual zero retention, IP pseudonymisation after 7 days, complaint rights with the Austrian DPA and the US Data Protection Review Court (EO 14086).

AI inference and image generation run exclusively on EU-hosted endpoints by default. Models without an EU endpoint are blocked at catalogue level and become visible only if a company admin explicitly enables them for their tenant (confirmation dialog, audit entry) — the data-protection responsibility for that lies with the customer (footnote ⁴). Customers who have agreed exclusive EU operation do not use this enablement; it is deemed contrary to instructions.

Prompts and responses are not used for training or fine-tuning by HOVIGuard or any sub-processor. Primary aggregator Requesty does not train ML models on your data (Logging = Disabled = zero data retention); OpenAI (EU endpoint) and Google Vertex AI contractually exclude customer data from training. Direct routes (e.g. xAI Grok, AWS Bedrock per Service Terms §50.3) only via enterprise/zero-retention endpoints; Eden AI (active EU gateway for chat, image and video models) is contractually configured for zero retention.

Strict logical separation by tenant_id, separate MinIO buckets per tenant, application row-level filters, tenant-specific policies, alerting on cross-tenant attempts.

HOVIGuard notifies the Customer of any personal data breach without undue delay, in any case within 72 hours of becoming aware of it, in text form. Target: ≤ 24 hours on business-day detection; on weekend/holiday detections up to 48–72 hours. The notification contains all Art. 33(3) GDPR information available and is updated continuously. Process per legal/INCIDENT_RESPONSE_PLAYBOOK.md.

Per Art. 82 GDPR. Contractual liability limited as agreed in §10 of the Terms of Service. Statutory liability for intent, gross negligence and under the GDPR remains unaffected.

Standard tenants (self-service, Pro plan): acceptance of the Terms of Service constitutes acceptance of this DPA. Current version at hoviguard.eu/en/avv.

Enterprise tenants: separately signable PDF (handwritten or qualified electronic signature) on request via datenschutz@hoviguard.eu.

Order of precedence: in case of conflict between Terms of Service, Privacy Policy and this DPA, the DPA prevails on data processing matters.

Amendments with 30 days' prior notice; material amendments to the Customer's detriment trigger an extraordinary right of termination.

Form: text form (email) suffices for special instructions, audit requests, terminations and objections.

Final: Austrian law, Salzburg jurisdiction. Supervisory authority: Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

See German version §A — Anhang A. Full description in legal/TOMS.md.

See German version §C — Anhang C. Standard instructions deemed issued by the Customer upon DPA acceptance.

v1.0 (2026-03-23) initial; v1.1 (2026-05-04) Schrems II / TIA section, explicit acceptance clause, Annexes A–D; v1.2 (2026-05-04) removed Cloudflare again (not actually used in operations); v1.3 (2026-05-04) added xAI, Inc. as 3rd sub-processor (direct Grok API, EU region enforced, zero retention, SCCs Module 2); v1.4 (2026-05-04) counsel re-review findings: §12 breach-notification window relaxed from 24h to 72h target 24h; §14.1 acceptance clause reinforced with notice of separate Stripe-checkout checkbox in Q3 2026; Annex B footnote ¹ refined (personal-union Karl Pilz, economic-substance doctrine); v1.5 (2026-06-02) provider stack updated: Requesty Ltd. (London/UK, processing in AWS Frankfurt) added as primary aggregator for text LLMs; OpenAI Ireland, Google Cloud EMEA (Vertex AI EU multi-region) and AWS EMEA SARL (Bedrock Frankfurt) added as direct EU routes in Annex B + §9 Schrems II table; Eden AI downgraded from primary gateway to image generation only; Annex B from 5 to 9 sub-processors; per-provider training guarantees in §10; Requesty aggregator chain (footnote ⁴, UK adequacy decision, EU-only endpoint, Logging=Disabled) documented; v1.6 (2026-09-08) all security representations aligned with the actual system state: scrypt instead of Argon2id password hashing; TLS 1.3 preferred with TLS 1.2 as minimum; encryption at rest scoped honestly; audit retention corrected from 7 years to 365/180/90/30 days; full AI request audit including prompt and response text disclosed and described as switchable per tenant; Eden AI restored as an active EU gateway (Villeurbanne, processing Paris); EU endpoints corrected to api.eu.edenai.run and router.eu.requesty.ai; Hetzner Storage Box BX11 added as off-site backup destination; transparency section on services without personal-data access (GitHub, api.frankfurter.app) added. Backup representation corrected to the practice actually operated: daily encrypted BorgBackup full backup (PostgreSQL, Redis, MinIO, Caddy data, application and configuration directories), retention 30 daily / 4 weekly / 6 monthly, off-site destination Hetzner Storage Box (DE) — the previously stated PITR/WAL backups and MinIO replication are removed without replacement; access control refined: key authentication (SSH public key) is supported and used, password login is not disabled but is protected by Fail2Ban (lockout after five failed attempts) and the default-deny firewall; Eden AI endpoint in §8.5 stated without API path (api.eu.edenai.run); v1.7 (2026-09-15) gateway roles clarified and aligned with the model catalogue: Requesty Ltd. is the primary gateway (priority 1) for EU models (chat models plus the main image model), Eden AI SAS is used in addition as a second active EU gateway — the wording "replacing Eden AI for text LLMs" removed (footnote ⁴); §8.5 extended by the Requesty and AWS Bedrock EU endpoints; models without an EU endpoint described as blocked by default and enabled only by the company admin for their tenant ("permanently blocked" removed); xAI scope narrowed to actual use (currently chat/text; §8.2, Annex B); §6.6 deletion commitment aligned with backup practice (database and object storage within 30 days, backup archives rotate per retention plan, at most six months); footnote ³ ("image generation currently disabled") aligned with the contract text (image generation runs exclusively on EU-hosted models); no change to the sub-processor list; v1.8 (2026-09-15) sub-processor xAI, Inc. operates as SpaceXAI LLC according to its Enterprise Terms (14 Aug 2026) and DPA (24 Aug 2026), name updated in §8.2, §8.4 and Annex B; no new sub-processor, no change of location, scope or guarantees; v1.9 (2026-09-15) deletion commitment in §2 aligned with 6.6 (database and object storage within 30 days, backup archives per retention plan, at most six months); SCC module wording refined to "Module 2/3" with the note that Module 3 applies to customer content forwarded as a processor; customers who agreed exclusive EU operation do not use the non-EU model enablement (deemed contrary to instructions); no change to the sub-processor list.