Data Processing Agreement

Parties

Processor:

Kaufmann Elsner GbR

Controller: The natural or legal person holding an account with Workshop Weaver who determines the purposes and means of processing the data entered into the platform.

1. Subject matter and duration

The subject matter is our processing of personal data in the course of providing the Workshop Weaver platform. The duration corresponds to the term of the underlying service contract. This agreement ends automatically when the account is terminated; the deletion obligations under Section 11 survive.

2. Nature and purpose of the processing

We process the data solely to deliver the contractually agreed service: storing and displaying workshop content, AI-assisted generation and revision of agendas, analysis of uploaded documents, speech-to-text conversion, sending service emails, providing sharing and collaboration features, and operating, securing and troubleshooting the platform.

3. Types of personal data

The following categories of data are processed in particular:

• Account and contact data of users (name, email address, language preference)
• Workshop content (goals, agendas, notes, descriptions, location and scheduling data)
• Chat histories with the AI companion
• Contents of uploaded files including the text extracted from them
• Details left by guests via share links (name, optionally email address, comment text)
• Usage, log and billing data

4. Categories of data subjects

Data subjects are the controller's users (for example its employees), the recipients of share links, and any natural person whose data the controller enters into or uploads to the platform.

5. Instructions

We process the data exclusively on documented instructions from the controller. Use of the platform in accordance with its features, together with the arrangements set out in the Terms of Service and this agreement, constitutes such instructions. Further individual instructions are to be sent in text form to [email protected]; we implement them insofar as this is technically possible and reasonable, and will inform the controller without delay if, in our view, an instruction infringes data protection law.

6. Confidentiality

All persons who have access to personal data in the performance of this agreement are bound to confidentiality. That obligation continues after their engagement ends.

7. Technical and organisational measures (Art. 32 GDPR)

We implement and maintain the following measures for the term of this agreement:

• TLS encryption of all transmissions and encryption of stored data
• Passwords held only as cryptographic hashes; deposited keys stored encrypted
• Access control via individual accounts, a role model and restriction of access to authorised personnel
• Protection of registration and sign-in against automated attacks (rate limiting, account lockout, bot detection)
• Separation of production, test and preview environments
• Server location and file storage within the European Union
• Regular database backups and regular updates of the components in use
• Logging of security-relevant events and automated error monitoring

8. Sub-processors

The controller grants general authorisation for the engagement of sub-processors. The current list is available on our "Sub-processors" page and forms part of this agreement. We give at least 30 days' notice of intended changes; the controller may object within that period. If an objection prevents us from continuing to provide the service as agreed, either party may terminate on that ground. We bind sub-processors to a level of protection equivalent to this agreement.

9. Assistance with data subject rights

We assist the controller, so far as reasonable, in responding to requests from data subjects under Art. 15 to 22 GDPR. If data subjects approach us directly, we forward the request to the controller without delay. Access, rectification, export and deletion can also be requested through the application itself.

10. Assistance with security and notification duties

We assist the controller in complying with Art. 32 to 36 GDPR. We report personal data breaches to the controller without undue delay, and at the latest within 48 hours of becoming aware of them, stating the known circumstances, the likely consequences and the measures taken.

11. Deletion and return

On termination of this agreement we delete the personal data processed within 30 days, unless a statutory retention obligation applies. Before deletion, the controller may request an export of its data in a common, machine-readable format. Data subject to statutory retention obligations is restricted from further processing and deleted once the period expires.

12. Evidence and audits

On request we provide the controller with the information necessary to demonstrate compliance with these obligations. Audits are possible after reasonable notice, during normal business hours and without disrupting operations; they may be satisfied by meaningful evidence or certifications.

13. Third-country transfers

Where sub-processors process data outside the European Economic Area, this takes place on the basis of an adequacy decision or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The applicable basis is stated in the list of sub-processors.

14. Governing language

The German version of this agreement is authoritative. Versions in other languages are provided for convenience only; in the event of discrepancies, the German wording prevails.

Concluding the agreement

To conclude this agreement, send us an email with the full name and address of your company and the name of its authorised representative. You will receive the agreement back as a signed copy. If your company uses its own template, we are happy to review it.

Email: [email protected]