Data Processing Agreement (DPA)

Art. 28 GDPR · version 1.0 · as of 2026-09-17 · review by IT counsel pending before public launch

between the customer who registers a Mignuti Chatbot account (the "Controller") and Mignuti Media — Eduard Ditler, Pfarrer-Mengesstr. 5, 56112 Lahnstein, Germany (the "Processor").

This agreement is concluded by acceptance during onboarding. The Processor records the time and the version (hash) of the acceptance. A countersigned PDF of this version is available on request from media@mignuti.com.

1. Subject matter, duration, precedence

The Processor operates the Mignuti Chatbot platform for the Controller under the Terms of Service (the main agreement) and in doing so processes personal data on the Controller's behalf. Subject matter, nature, purpose, categories of data and data subjects are set out in Annex 1. This agreement applies for the term of the main agreement and beyond it for as long as the Processor stores the Controller's personal data. In data-protection matters this agreement prevails over the main agreement.

2. Instructions

The Processor processes personal data only on the Controller's documented instructions. This agreement, the main agreement and the settings the Controller makes in the platform (in particular knowledge base, bot configuration, channels, lead capture and configured recipients under Annex 1a) count as instructions. Further instructions are given in text form to media@mignuti.com. If the Processor considers an instruction unlawful, it informs the Controller without delay and may suspend execution until the matter is clarified. Where Union or Member State law requires the Processor to process differently, it informs the Controller beforehand unless that law prohibits it.

3. Processor obligations

• Confidentiality. Only persons bound to confidentiality have access to the data; access is limited to what operating the service requires.
• Security. The Processor implements the technical and organisational measures described in Annex 2 (Art. 32 GDPR) and develops them further; changes must not reduce the level of protection.
• Data-subject rights. The Processor supports the Controller with requests under Art. 15 to 22 GDPR through the platform: data export per organisation, deletion of individual conversations, a deletion link for end users in the widget, deletion of the whole organisation. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay and does not answer itself unless instructed to.
• Personal data breaches. The Processor notifies the Controller of a breach affecting the Controller's data without undue delay and at the latest 48 hours after becoming aware, stating the nature of the breach, the categories and approximate number of data concerned, the likely consequences and the measures taken — as far as known, with follow-up without undue delay. Notification of the supervisory authority and of data subjects is the Controller's responsibility.
• Assistance under Art. 32 to 36. The Processor assists the Controller with data-protection impact assessments and prior consultations with the information available to it; the record of processing activities and a description of data flows are provided on request.
• No training. The Processor does not train AI models on the Controller's or its end users' data and uses only model providers that are contractually barred from doing so.
• Evidence. The Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement (section 5).

4. Subprocessors

The Controller gives general authorisation for the subprocessors listed in Annex 3. If the Processor intends to add or replace a subprocessor, it informs the Controller at least 30 days in advance by email to the account address and updates the list at /en/legal/subprocessors. The Controller may object in text form within 14 days on important data-protection grounds. If the parties find no solution, either side may terminate the main agreement with effect from the date the change takes effect. The Processor binds every subprocessor by contract (Art. 28(4) GDPR) to obligations equivalent to those in this agreement and is liable to the Controller for the subprocessor's conduct as for its own.

Recipients the Controller sets up itself in the platform (webhooks, exports to its own CRM or automation services) are not subprocessors of the Processor; Annex 1a applies to them.

5. Audit rights

The Controller may satisfy itself that this agreement is complied with. On request the Processor provides documentation: the measures under Annex 2, the record of processing activities, evidence of the contracts with subprocessors and the results of its own or external reviews. If that is insufficient, the Controller or an auditor appointed by it and bound to confidentiality may carry out an audit once per calendar year with four weeks' notice during normal business hours — and at short notice where there is a concrete reason (a data breach, an order by an authority). The Processor cooperates; the cost of an audit that finds no breach is borne by the Controller.

6. Return and deletion

The Controller can export its data at any time from the dashboard (a machine-readable ZIP with JSON and original files). When a paid plan ends, access and data remain within the free tier. If the Controller requests deletion of its organisation — in the dashboard or in text form — the Processor deletes all personal data within 30 days and confirms the deletion on request. Data the Processor must retain under statutory retention duties (in particular invoice data under § 147 AO and § 257 HGB, the audit log under Annex 2) is excepted; it is blocked and used only for that purpose. Backups are overwritten on a rolling basis and remain blocked until then.

7. Processing in third countries

Processing takes place in Germany (Annex 2). The exceptions are the subprocessors marked in Annex 3 as third-country recipients. Transfers to Anthropic PBC and OpenAI, L.L.C. (USA) rest on the EU Standard Contractual Clauses 2021/914 (Module 2 or 3, Art. 46(2)(c) GDPR); before every transfer the Processor masks personal data on a rule basis (Annex 2). The Controller can enable an EU-only mode per bot in which no language model outside the EU is used. The WhatsApp channel (Meta) is processed only if the Controller sets it up.

8. Liability

Liability follows the main agreement and Art. 82 GDPR. Between the parties, each is liable according to its share of responsibility.

9. Final provisions

Amendments to this agreement require text form. The Processor may adapt the agreement where changes in law, regulatory requirements or changes to the service require it; it announces changes 30 days in advance by email, and the Controller may object and terminate the main agreement with effect from the date the change takes effect. Every version is marked with date and version hash; the version accepted by the Controller is recorded. German law applies. Should a provision be invalid, the remainder of the agreement stands.

Annex 1 — Description of processing

• Subject matter: operation of the Mignuti Chatbot platform for the Controller.
• Nature and purpose: storage and retrieval of the Controller's knowledge base; generation of AI-assisted answers to end-user requests; forwarding of end-user requests to the Controller (handover, lead capture, notifications); provision of analytics; abuse prevention; optional WhatsApp channel.
• Categories of data subjects: end users of the Controller's website and channels; the Controller's team members; persons whose data is contained in the knowledge base.
• Categories of personal data: chat messages and the details end users enter in them; session ID; hashed IP address and hashed user agent; contact details end users provide voluntarily (lead capture, handover); phone number and message content where the WhatsApp channel is active; name and email of team members; knowledge-base content insofar as it contains personal data. Special categories (Art. 9) are not the subject of processing; the Controller does not use the service in a way that makes them arise systematically.
• Duration and retention: messages 90 days, then content anonymised; conversations 90 days, then contact details and summary removed; session data (IP hash, user-agent hash) 90 days; the team's test runs 90 days; rate-limit counters 2 days; export archives until they expire; audit log 2 years, 7 years where compliance-related. The Controller can bring about shorter periods by deleting data itself (section 6).

Annex 1a — Controller warranties

• Lawfulness. The Controller ensures a legal basis for the processing, informs end users under Art. 13 GDPR about the use of the chatbot and enters the address of its privacy policy in the platform, which the widget links to.
• Minors (Art. 8 GDPR). The Controller does not direct the chat widget at persons under 16 and — where nevertheless relevant in an individual case — obtains the consent of the holders of parental responsibility. The Processor does not direct the service at children and processes children's data only within the Controller's instructions.
• Knowledge base. The Controller feeds in only content it is entitled to process and checks whether it contains third-party personal data.
• Configured recipients. Where the Controller sets up webhooks, exports or connections to its own services (CRM, automation), the Processor transmits personal data solely on that instruction, over HTTPS and signed. The legal basis, information of data subjects, the Controller's own data processing agreements with those recipients and the lawfulness of any third-country transfer rest solely with the Controller.

Annex 2 — Technical and organisational measures (TOMs)

• Hosting and location. Database, file storage, application and processing functions run on our own infrastructure at netcup GmbH in Germany; no managed database provider.
• Encryption in transit. All connections are TLS-encrypted.
• Tenant isolation. Row-level security at database level with default-deny policies; every query is bound to the organisation and project, including semantic search.
• Access control. Role-based permissions in five levels; sign-in by time-limited magic link; two-factor authentication (TOTP) available for all accounts; permission changes are logged and protected against self-elevation by database triggers.
• Pseudonymisation. End users' IP addresses and user agents are stored only as SHA-256 hashes with a daily-changing component and a server salt. A clear-text IP is recorded solely when the Controller concludes the contract, as evidence of acceptance.
• Redaction before model calls. Before every forwarding to a language model and before storage, personal details are detected and replaced on a rule basis: email addresses, phone numbers, IBANs, card, ID and tax numbers, IP addresses; street addresses and names combined with a salutation are matched by pattern. Free-standing names without a salutation are not detected by the rule.
• Abuse prevention. Rate limiting on three levels (key, IP, session), message quotas per plan with a hard cap, domain binding of widget keys, detection of prompt-injection attempts.
• Logging. Append-only audit log of security-relevant events, protected against modification and deletion by database triggers; deleted after two years, seven years where compliance-related.
• Backups. Daily encrypted backup of the database at Cloudflare R2 in the EU, overwritten on a rolling basis.
• Deletion routines. Automated anonymisation and deletion according to the periods in Annex 1 (daily jobs), deletion of export archives on expiry, self-service deletion for end users and Controllers.
• Model providers. Requests to language models only under the providers' API terms without training on the data; fallback model in the EU (Azure OpenAI, Sweden); EU-only mode per bot.
• Transparency towards end users. A non-removable notice in the widget that an AI system is answering (Art. 50 EU AI Act). The chat starts only after the end user's consent — through the widget's own gate, which links to the Controller's privacy policy, or through hand-over from the Controller's consent tool.

Annex 3 — Subprocessors

As of this version; the current list with role and transfer basis is at /en/legal/subprocessors.

• netcup GmbH, Karlsruhe (Germany) — server hosting of the whole platform.
• Anthropic PBC, San Francisco (USA) — language model for answers and spell-check; third country, EU SCCs 2021/914, data masked beforehand.
• OpenAI, L.L.C., San Francisco (USA) — text embeddings for semantic search; third country, EU SCCs 2021/914, data masked beforehand.
• Microsoft Ireland Operations Ltd. — Azure OpenAI (Sweden) as fallback and EU-only model.
• Stripe Payments Europe Ltd., Dublin — payment processing and invoices.
• Cloudflare, Inc., San Francisco (USA) — DNS, proxy, delivery of the interfaces, encrypted database backup (EU region); DPF-certified, EU SCCs.
• Resend, San Francisco (USA) — transactional email; DPF-certified, EU SCCs.
• WhatsApp Ireland Ltd. (Meta), Dublin — WhatsApp channel, only when set up by the Controller; parent Meta Platforms, Inc. (USA) DPF-certified, EU SCCs.

Language

This English text is a translation for convenience. In the event of discrepancies, the German version at chatbot.mignuti.com/rechtliches/avv prevails.

This version is a qualified draft. The final version will be reviewed and released by admitted IT counsel before public launch.