This is a convenience translation. In case of doubt, the authoritative German version prevails.
This data processing agreement pursuant to Art. 28 GDPR applies exclusively to Managed Operation, where evanto operates CompanyWizard on behalf of the Customer and, in doing so, processes personal data that the Customer uses within the Software (chats, documents, knowledge base), and to Managed AI, where evanto forwards the Customer's inputs to AI models. For self-hosted use without Managed AI, evanto processes no content data; in that case this DPA does not apply. The processing of registration and license data is governed by the separate privacy notice.
As of: 25 September 2026
1. Contracting Parties
Controller (client): the Customer pursuant to the order/contract.
Processor (contractor): evanto media GmbH, Brunnstraße 25, 93053 Regensburg, Germany · Email: datenschutz@evanto.de · Local Court (Amtsgericht) Regensburg, HRB 18746; VAT ID DE209538293; Managing Directors: Dipl.-Ing. Ralf Manschewski, Dr. Sven von Känel.
2. Subject Matter and Duration
The subject matter is the processing of personal data by evanto exclusively for the provision and operation of CompanyWizard under Managed Operation and for the provision of Managed AI. The duration corresponds to the term of the main contract (Managed entitlement); this DPA ends upon its termination.
3. Nature, Scope and Purpose of Processing
evanto processes the data exclusively for the purpose of hosting, providing, maintaining and securing the Software for the Customer and, for Managed AI, of forwarding inputs to AI models — bound by instructions and not for its own purposes. The content data is not used to train AI models.
Managed AI: evanto transmits the Customer's inputs (prompts including the context added from the knowledge base, as well as texts for embeddings and for re-ranking search results) to the aggregator Cortecs GmbH and returns the responses to the Customer. Inputs and responses are not stored for any purpose other than answering the respective request, neither by evanto nor by the aggregator; evanto stores only usage metrics without content for budget control and billing. The aggregator routes requests exclusively to model providers with a retention period of zero days (zero data retention) that do not use the data for training. Managed AI does not include operating the instance: if it runs at the Customer's premises, the content stored in it remains within the Customer's responsibility.
4. Type of Data and Categories of Data Subjects
- Data categories: content processed within the Software (chat histories, uploaded documents, knowledge-base content, prompt/skill configurations), usage and log data, account/login data of the end users.
- Data subjects: the Customer's employees and authorized persons (users of the Software) as well as persons whose data is contained in the content provided by the Customer.
5. Instructions
evanto processes the data exclusively within the scope of the Customer's documented instructions. If evanto considers an instruction to be unlawful, evanto informs the Customer without undue delay and may suspend execution until confirmation.
6. Technical and Organizational Measures (Art. 32 GDPR)
evanto maintains appropriate technical and organizational measures (TOMs), in particular: encryption of stored API keys and of transmission (TLS), role-based access control (admin/user), tenant separation per Managed instance (dedicated database/isolation), automatic PII redaction in the processing pipeline, logging of security-relevant events, regular data backups, and recovery and availability measures. The measures are updated in line with the state of the art.
7. Sub-Processors
The Customer consents to the use of the following sub-processors:
| Service provider | Service | Location |
|---|---|---|
| R-KOM GmbH | Data center / hosting of the Managed instance | Regensburg, EU |
| Sentry (EU region) | Error and availability monitoring | EU |
| Brevo | Email dispatch (system notifications) | EU |
| Cortecs GmbH, Vienna (Managed AI only) | Brokering of AI inference (aggregator); in turn engages model providers as further sub-processors | EU/EEA |
evanto provides the current list of model providers used via Cortecs, with region, on request. Agreements pursuant to Art. 28 GDPR are in place with all sub-processors. evanto informs the Customer of intended changes; the Customer may object to a change for an important data-protection reason.
8. Transfers to Third Countries
Processing generally takes place within the EU/EEA. A transfer to a third country occurs only on the basis of Art. 44 et seq. GDPR (adequacy decision or appropriate safeguards).
9. Assistance to the Controller
evanto assists the Customer, to the extent reasonable, in fulfilling data-subject rights (Art. 12–22), notification obligations and data protection impact assessments (Art. 32–36), and forwards data-subject requests addressed to evanto to the Customer without undue delay.
10. Notification of Personal Data Breaches
evanto notifies the Customer of personal data breaches without undue delay after becoming aware of them, providing the information required under Art. 33(3) GDPR, so that the Customer can fulfil its notification obligations within the applicable deadlines.
11. Confidentiality
evanto obliges the persons involved in the processing to maintain confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR), insofar as they are not already subject to an appropriate statutory duty of confidentiality.
12. Evidence and Audits
evanto makes available to the Customer the information necessary to demonstrate compliance and enables reasonable audits — including by mandated auditors — with reasonable prior notice and while safeguarding business operations and the security of other tenants.
13. Deletion and Return (Offboarding)
After Managed Operation ends, evanto deletes the processed content data or, at the Customer's choice, returns it, unless a statutory retention obligation applies. Deletion takes place within the period agreed in the main contract; deletion is confirmed on request. For Managed AI, inputs and responses are not stored permanently; the aggregator processes them exclusively in volatile memory and deletes them once the respective request is completed. Usage metrics without content are subject to the retention periods under commercial and tax law.
14. Liability and Final Provisions
The law of the Federal Republic of Germany applies. In relation to the provisions of the main contract, this DPA takes precedence for the processing of personal data. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.
This document is the standard version of the evanto DPA for Managed Operation and Managed AI embedded in the application. The legally binding, signed version forms part of the respective Managed contract.