GDPR & data processing agreement (DPA)
Admin⚖️ Not legal advice. Plain-language summary; what is binding are evanto’s legal documents (DPA, privacy policy, License terms).
Who is responsible under data protection law for the data processed in CompanyWizard depends on the operating model. The decisive factor is whether you run it self-hosted or have evanto run your Site instance in Managed operation. Independently of that, the Managed AI add-on makes evanto a processor for model access.
Self-hosted (Free, Pro, Site without Managed operation)
Section titled “Self-hosted (Free, Pro, Site without Managed operation)”You run the application in your own environment. You are the controller for all content you enter; evanto has no access to it and is not a processor. evanto processes only its own license data (as its own controller). AI model providers you connect (bring your own key) are your responsibility.
Exception Managed AI: if you book the Managed AI add-on, evanto provides the model access and is a processor for that processing; the DPA applies in addition. For this, evanto engages the aggregator Cortecs GmbH (Vienna) as a sub-processor. → Managed AI: what it covers
Managed operation (Site only)
Section titled “Managed operation (Site only)”In Managed operation, evanto operates your Site instance dedicated per customer, from tier L additionally with its own vector database (Qdrant) and PII detection (Presidio). For this processing, evanto is a processor; a data processing agreement (DPA) under Art. 28 GDPR additionally applies. Operation takes place exclusively in the EU/EEA (R-KOM data center, Regensburg); subprocessors are disclosed there. → Data sovereignty · License & edition model
At a glance
Section titled “At a glance”| Aspect | Self-hosted | Managed operation |
|---|---|---|
| Controller | You | You |
| evanto role | not a processor | processor (DPA) |
| evanto access to content | no | dedicated, instruction-bound |
| Hosting | your environment | EU/EEA (R-KOM) |
| BYO model providers | your responsibility | your responsibility |
| Managed AI | evanto processor for model access (DPA) | evanto processor for model access (DPA) |
Limits & notes
Section titled “Limits & notes”- In both cases, you remain responsible for the legal basis, data subject rights and, where applicable, a data protection impact assessment.