Data Processing Agreement

1. Roles by scenario

1.1 Customer API content (Controller / Processor)

For prompts, files, business data, and model outputs that you submit to or receive through the ZWIMA API:

• You (the customer) are the Data Controller.
• Zwima Technologie GmbH is the Data Processor.
• ZWIMA processes such data only on your documented instructions.

1.2 Platform operations data (ZWIMA as independent Controller)

Zwima Technologie GmbH is an independent Data Controller for:

• User account and contact information
• Subscription, order, payment, and invoice information
• Security logs, abuse prevention, fraud/risk controls, and audit records
• Legal compliance and tax retention data

Account and billing data are not controlled by the customer under this DPA.

1.3 Sub-processors

Upstream model providers, cloud hosting, email, identity authentication, and database vendors are managed in principle as ZWIMA's sub-processors. See the public draft list: Sub-processors. Binding annexes and transfer mechanisms remain subject to LEGAL review before Production.

2. Topics this DPA covers

1. Subject matter, duration, nature, and purpose of processing
2. Types of personal data and categories of data subjects
3. Processing only on documented customer instructions
4. Confidentiality obligations
5. Technical and organisational security measures (TOMs)
6. Sub-processor list and change notification
7. Assistance with data subject requests
8. Personal data breach notification
9. Deletion or return of data
10. Audit and compliance evidence
11. International data transfer mechanisms
12. Processing after contract termination

Full contractual clauses, annexes (TOMs, sub-processors, SCCs), and signatures are pending legal counsel. See also the draft file in the repository under docs/legal-drafts/DPA.DRAFT.md.

3. Related pages

• Cookies
• Sub-processors
• Privacy Policy