Version: 23.10.2026
between
the Customer – hereinafter the "Controller" –
the customer designated in the customer account or in the order
and
Sat-iTec – hereinafter the "Processor" –
Sat-iTec Systemhaus GmbH Heisinger Straße 21, 87437 Kempten (Allgäu) represented by Günther Löb (Managing Director)
– together the "Parties" –
The Processor provides services to the Controller via the "ChatiTec" platform (GDPR-compliant AI/LLM platform, hosted in Germany, Augsburg data centre). In the course of these services, the Processor processes personal data on behalf of and on the instructions of the Controller. This Agreement specifies the data protection obligations of the Parties pursuant to Art. 28 GDPR. It applies in addition to the underlying main agreement (terms of use/General Terms and Conditions).
(1) The subject matter of the processing is the provision and operation of the ChatiTec platform, including the AI/LLM processing of input content transmitted by the Controller or its users.
(2) The nature of the processing comprises in particular: collection, recording, storage, retrieval, use, anonymisation/pseudonymisation (PII tokenisation), transmission (to external sub-processors in anonymised form only), erasure and destruction.
(3) The purpose of the processing is the provision of the contractually agreed platform and AI services.
(4) Categories of data subjects: in particular clients/patients of the Controller, their representatives and third parties, employees and users of the Controller, as well as other persons named in the input content.
(5) Categories of personal data: master data, contact data, content data of the inputs (prompts/documents) and, where applicable, special categories of personal data pursuant to Art. 9 GDPR (in particular data concerning health) and data subject to professional secrecy (cf. the separate Supplementary Agreement on the Protection of Professional Secrecy).
(6) Duration: The processing takes place for the term of the main agreement. This DPA terminates automatically upon termination of the main agreement, without prejudice to continuing obligations (in particular § 9, § 10).
(1) The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which the Processor is subject (Art. 28(3)(a) GDPR). In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) The provision of the contractually agreed standard services via the platform is deemed to be a documented instruction. Individual instructions are given in text form; oral instructions must be confirmed in text form without undue delay.
(3) The Processor shall inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions (Art. 28(3), third sentence, GDPR). The Processor is entitled to suspend the execution of the instruction concerned until it is confirmed or amended.
(1) The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).
(2) The Processor additionally obliges the employees deployed to maintain data secrecy and – where applicable – to safeguard professional secrets (§ 203 StGB [German Criminal Code]; cf. the separate Supplementary Agreement on the Protection of Professional Secrecy).
(3) These obligations continue to apply after termination of the Agreement.
(1) The Processor implements the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures implemented are described in Annex 1 (Technical and Organisational Measures), which forms an integral part of this Agreement.
(2) The TOMs are subject to technical progress. The Processor is entitled to develop them further, provided that the agreed level of protection is not undercut. Material changes must be notified to the Controller.
(1) The Controller grants the Processor general written authorisation to engage other processors (sub-processors). The sub-processors engaged at the time of conclusion of the Agreement are exhaustively listed in Annex 2 (List of Sub-processors).
(2) The Processor shall inform the Controller in good time in advance, in text form, of any intended changes concerning the addition or replacement of sub-processors. The Controller may object to the change within 14 days for an important reason relating to data protection law (Art. 28(2) GDPR).
(3) The Processor imposes on each sub-processor, by way of a contract, the same data protection obligations as set out in this Agreement (Art. 28(4) GDPR), in particular sufficient guarantees to implement appropriate technical and organisational measures. Where the sub-processor fails to fulfil its data protection obligations, the Processor remains liable to the Controller for the performance of those obligations.
(4) Any transmission to external AI providers (sub-processors) takes place exclusively in anonymised form (PII tokenisation, enforced by default). Where purely local models are used, no external sub-processors are involved.
(1) Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights (Art. 12–23 GDPR; Art. 28(3)(e) GDPR).
(2) Taking into account the nature of the processing and the information available to the Processor, the Processor assists the Controller in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessment, prior consultation; Art. 28(3)(f) GDPR).
(3) If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay.
(1) The Processor shall notify the Controller in text form of any personal data breach that comes to its knowledge without undue delay, and in any event no later than 24 hours after becoming aware of it.
(2) The notification shall contain, to the extent available, at least the information pursuant to Art. 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and data records concerned, likely consequences, measures taken/proposed, contact point).
(3) The notification to the competent supervisory authority (Art. 33 GDPR) and, where applicable, the communication to the data subjects (Art. 34 GDPR) are the responsibility of the Controller. The Processor shall assist the Controller in this regard to a reasonable extent.
(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR (Art. 28(3)(h) GDPR).
(2) The Processor allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. Evidence may also be provided by means of suitable certifications, current attestations or audit reports from recognised bodies.
(3) On-site inspections take place after timely notice (notice period: 14 days in advance), during normal business hours, without disrupting business operations and while safeguarding confidentiality and security interests as well as the rights of third parties (in particular of other customers and professional secrets). The costs of an inspection initiated by the Controller shall be borne by the Controller – subject to any agreement to the contrary – unless a breach by the Processor is established.
(1) After the end of the provision of the processing services, the Processor shall, at the choice of the Controller, delete all personal data or return it and delete existing copies, unless Union or Member State law requires storage of the personal data (Art. 28(3)(g) GDPR).
(2) The return takes place in a common, machine-readable format (e.g. JSON, Markdown or PDF). The erasure shall be confirmed in text form upon request.
(3) Locally held, Fernet-encrypted mapping data of the PII tokenisation are likewise destroyed in the course of the erasure.
(1) The liability of the Parties is governed by Art. 82 GDPR. Otherwise, the liability provisions of the main agreement apply, insofar as they are compatible with mandatory data protection law.
(2) The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. In their internal relationship, each Party shall indemnify the other against claims based on a breach of duty for which it is responsible.
(1) In the event of conflicts between this DPA and the main agreement, the provisions of this DPA shall prevail with regard to data protection matters.
(2) Amendments and supplements require text form. This also applies to any waiver of this form requirement.
(3) Should any provision be invalid, the validity of the remaining provisions shall remain unaffected. The Parties shall replace the invalid provision with a valid provision that comes closest to its economic purpose.
(4) The law of the Federal Republic of Germany applies. The place of jurisdiction is – to the extent permissible – Kempten (Allgäu).
(5) Annexes:
Conclusion of the Agreement: This Agreement is concluded in electronic form (Art. 28(9) GDPR) by the Controller expressly accepting it upon registration or ordering; the time and version of acceptance are logged. A separate signature is not required. Upon request, Sat-iTec will provide a version signed by both Parties.
Version: 23.10.2026
The German version of this Agreement is legally binding; translations are provided for convenience only.