Data processing agreement (DPA)
Last updated: October 28, 2026
This English version is provided for convenience. The German version is legally binding.
This data processing agreement ("DPA") supplements the contract for services of Nickle AI ("main contract") insofar as Nickle AI processes personal data on behalf of the customer.
1. Parties and conclusion
(1) The parties are Nickle AI – Oreshin, Platon und Scheffler, Daniel GbR, Ludwig-Erhard-Straße 10, 34131 Kassel, Germany, email: info@nickle.ai ("Nickle AI", processor), and the customer who concludes a main contract with Nickle AI ("customer", controller).
(2) This DPA is concluded in electronic form (Art. 28(9) GDPR). It is concluded as soon as the customer accepts a main contract, an offer or any other agreement that refers to this DPA or to Nickle AI's GTC, or otherwise confirms its validity in text form.
(3) The version in force at the conclusion of the contract applies (date above). Nickle AI records the date and version accepted and provides earlier versions in text form on request.
2. Scope
(1) This DPA applies only insofar as Nickle AI processes personal data within the meaning of Art. 28 GDPR on behalf of and on the instructions of the customer.
(2) It does not apply where Nickle AI processes data for its own purposes as a controller, in particular for initiating and managing the contractual relationship, billing, its own evidence and retention obligations, IT security and abuse prevention, and legally required disclosures. The same applies where Nickle AI itself determines the purposes and essential means of processing in the course of consulting or conception.
(3) If the customer is itself a processor for a third party, Nickle AI is a subprocessor and this DPA applies accordingly. The customer ensures that the third party has authorised the use of Nickle AI.
(4) Terms have the meaning given to them in the GDPR.
3. Subject matter, nature, purpose and duration
(1) The subject matter, nature and purpose of processing, the types of data and the categories of data subjects are set out in the main contract and Appendix 1.
(2) Processing lasts as long as Nickle AI processes data on behalf of the customer, at most until deletion or return under section 12.
4. Instructions
(1) Nickle AI processes personal data only on documented instructions from the customer – including with regard to transfers to third countries – unless required to do so by Union or Member State law. In that case, Nickle AI informs the customer of that legal requirement before processing, unless the law prohibits this.
(2) Instructions are the main contract, this DPA and individual instructions in text form (e.g. email, ticket, approvals, project documents). The customer confirms oral instructions in text form without delay.
(3) If Nickle AI considers that an instruction infringes data protection law, it informs the customer without delay and may suspend its execution until it is confirmed or changed.
(4) Nickle AI does not use the data for its own purposes. The use of fully anonymised information remains unaffected.
5. Customer obligations
(1) The customer is responsible for the lawfulness of the processing, the legal basis, informing data subjects and safeguarding their rights.
(2) The customer introduces only data whose processing is permissible. It introduces special categories of personal data (Art. 9 GDPR) and professional secrets only if agreed in advance.
(3) The customer is itself responsible under data protection law for third-party providers, integrations or interfaces that it selects or connects itself and that are not listed in Appendix 3.
6. Confidentiality
Nickle AI only uses persons who are committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and limits access to what is necessary (need-to-know).
7. Technical and organisational measures
(1) Nickle AI takes the measures required under Art. 32 GDPR. The current measures are described in Appendix 2.
(2) Nickle AI may develop the measures further provided the level of protection is not reduced. Special security requirements of the customer apply only if agreed.
8. Subprocessors
(1) The customer grants Nickle AI general authorisation to use subprocessors. The subprocessors used at the conclusion of the contract are listed in Appendix 3.
(2) Nickle AI informs the customer in text form at least 14 days in advance of any intended addition or replacement. Within this period, the customer may object in text form for an important data protection reason. If the parties cannot find a reasonable solution, the customer may terminate the affected service extraordinarily.
(3) Nickle AI imposes on each subprocessor by contract the same data protection obligations as set out in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). Nickle AI remains liable to the customer for the performance of the subprocessor's obligations.
(4) Ancillary services without regular access to customer data, such as telecommunications, postal or transport services, are not subprocessing.
9. Transfers to third countries
Transfers to a country outside the EU/EEA take place only if the requirements of Art. 44 et seq. GDPR are met – in particular on the basis of an adequacy decision (e.g. the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses, with supplementary measures where necessary. Nickle AI explains the applicable basis on request.
10. Assistance to the customer
(1) Taking into account the nature of the processing and the information available, Nickle AI assists the customer in responding to requests from data subjects (Art. 12–23 GDPR) and with the obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation).
(2) If data subjects or authorities contact Nickle AI directly, Nickle AI forwards the request to the customer without delay and does not comment on the substance without coordination, unless legally required to do so.
11. Personal data breaches
(1) Nickle AI notifies the customer without undue delay after becoming aware of a breach of the security of data processed on the customer's behalf (Art. 33(2) GDPR).
(2) As far as available, the notification describes the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact person. Information not yet available is provided without undue delay as it becomes available.
12. Deletion and return
(1) After the end of the services, Nickle AI deletes or returns the data processed on the customer's behalf, at the customer's choice, unless there is a legal obligation to store it. If the customer does not choose within 30 days after the end of the contract, Nickle AI deletes the data.
(2) Copies in backups are deleted at the end of the regular backup cycle (currently 30 days) and are not processed productively until then.
(3) On request, Nickle AI confirms the deletion in text form.
13. Evidence and audits
(1) Nickle AI makes available to the customer all information necessary to demonstrate compliance with this DPA, such as documentation, self-assessments, or certificates and reports of the subprocessors.
(2) If this is not sufficient in an individual case, Nickle AI allows for and contributes to audits, including inspections, by the customer or an auditor mandated by it who is bound to confidentiality – with reasonable advance notice, during business hours, without disproportionate disruption of operations and while preserving confidentiality towards other customers; as a rule no more than once per calendar year, unless a special reason (e.g. a personal data breach or an order by an authority) justifies a further audit.
(3) Each party bears its own costs of the audit. Nickle AI may charge for support beyond the statutory cooperation on the basis of reasonable effort.
14. AI functions
(1) For AI-supported functions, Nickle AI processes the inputs, files, context information and outputs solely to provide the commissioned function.
(2) Customer data is not used to train third-party AI models unless expressly agreed otherwise. AI functions that Nickle AI operates for the customer (e.g. chatbots) use AI providers in the EU region unless expressly agreed otherwise. AI tools that Nickle AI uses internally to provide the services (Appendix 3, level 0) may process data outside the EU; this takes place under section 9 on the basis of the standard contractual clauses.
15. Remuneration and liability
(1) Services under this DPA are covered by the remuneration under the main contract unless this DPA provides otherwise.
(2) Liability is governed by the main contract or the GTC. Art. 82 GDPR remains unaffected.
16. Term, changes and precedence
(1) This DPA applies as long as Nickle AI processes personal data on behalf of the customer.
(2) Changes to subprocessors are governed by section 8. Any other change to this DPA requires an agreement in text form.
(3) In the event of conflict, this DPA takes precedence over the main contract and the GTC with regard to processing on the customer's behalf.
(4) If the parties conclude an individual data processing agreement, it takes precedence over this DPA.
17. Final provisions
(1) The customer addresses statements under this DPA (instructions, objections, audit requests, deletion instructions) to the contact persons named in the main contract or to info@nickle.ai.
(2) German law applies. The place of jurisdiction follows the main contract.
(3) Should a provision be invalid, the remainder of this DPA remains valid; the invalid provision is replaced by a valid one that comes closest to its data protection purpose.
Appendix 1 – Details of processing
Subject matter and purpose (depending on the order): conception, development, hosting, operation, maintenance and support of websites, contact forms, chatbots, automations, integrations and AI functions for the customer, including processing content in customer systems.
Nature of processing: collection, storage, transmission, retrieval, use, alteration and erasure, including by means of AI models.
Categories of data subjects (depending on the order): visitors and users of the customer's websites and applications; persons contacting the customer via forms or chatbots; the customer's employees and contact persons; customers, prospects and other persons whose data the customer has processed in the project.
Categories of personal data (depending on the order): contact and communication data; form and chat content; IP addresses, device and usage data; access and administration data; files, documents, texts, images and audio; AI inputs, context data and outputs; other data provided by the customer.
Special categories (Art. 9 GDPR): only if expressly agreed.
Duration: see section 3(2).
Appendix 2 – Technical and organisational measures
Confidentiality
- servers in certified data centres of the subprocessors (Appendix 3); no server rooms of our own
- authentication for all administrative access, multi-factor authentication where available, strong passwords
- role-based permissions following the need-to-know and least-privilege principles; permissions withdrawn on change of role or departure
- media stored without a publicly reachable endpoint; read access only via a server-side controlled path
- logical separation of customer data; separation of development and production environments where appropriate
Integrity
- transport encryption (TLS/HTTPS) for all transmissions
- credentials and endpoints of backend systems are held server-side only and never delivered to browsers
- rate limiting and abuse defence on all interfaces reachable from the internet
- logging of administrative changes where technically provided; controlled release of production changes
Availability and resilience
- daily database backups, stored encrypted in the EU (retained for 30 days)
- monitoring of essential systems, error detection and recovery procedures
- network-level attack protection by the hosting provider
Deletion and data minimisation
- automatic deletion of processing records after 14 days and of chat histories after 14 days, unless another period is agreed with the customer
- IP addresses are not passed on to automation systems or AI providers
Review and organisation
- regular review of the measures; patch and update management
- documentation and handling of security events
- confidentiality commitment of all persons involved
- careful selection and monitoring of subprocessors
Appendix 3 – Subprocessors
The offer specifies which levels apply. If it does not, the levels whose services have been commissioned apply. A data processing agreement under Art. 28 GDPR is in place with each subprocessor.
Level 0 – all projects
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: email, calendar and document storage (Google Workspace) for project communication and documents provided by the customer.
Transfer basis: processing by Google LLC in the USA possible – EU-US Data Privacy Framework and standard contractual clauses.
Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland
Purpose: AI assistant (Claude) for project work, e.g. software development, handling content and project communication. Inputs are not used for training.
Transfer basis: storage by Anthropic, PBC in the USA, processing in other countries possible – standard contractual clauses.
Level 1 – all websites
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
Purpose: hosting and delivery of the website, DNS, storage of media files, attack defence and IP-based rate limiting.
Transfer basis: media files are stored within the EU jurisdiction; otherwise EU-US Data Privacy Framework and standard contractual clauses.
Level 2 – with a contact form
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre: Helsinki, Finland)
Purpose: servers for the automation that processes and delivers form entries.
Transfer basis: no third-country transfer.
Brevo (Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France
Purpose: delivery of form entries to the customer by email.
Transfer basis: no third-country transfer.
Cloudflare, Inc. (see level 1)
Purpose: storage of database backups (EU jurisdiction, 30 days).
Level 3 – with a chatbot
Hetzner Online GmbH (see level 2)
Purpose: servers for the chatbot backend, chat history and knowledge base.
Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Purpose: AI inference for the chatbot (Azure OpenAI), Sweden Central region (EU) unless agreed otherwise. Inputs are not used for training.
Transfer basis: no third-country transfer; where a non-EU region is expressly agreed, standard contractual clauses.
Google Ireland Limited (see level 0)
Purpose: AI inference as an alternative to Microsoft where the customer requires it (EU region unless agreed otherwise); storage of the source documents of the knowledge base.
Transfer basis: no third-country transfer for inference in the EU region; for document storage, processing by Google LLC in the USA possible – EU-US Data Privacy Framework and standard contractual clauses.
Cloudflare, Inc. (see level 1)
Purpose: storage of database backups (EU jurisdiction, 30 days).
Level 4 – with analytics tools
Google Ireland Limited (see level 0)
Purpose: Google Tag Manager and Google Analytics.
Transfer basis: EU-US Data Privacy Framework and standard contractual clauses.
Note: as controller, the customer accepts Google's data processing terms in its own Analytics or Tag Manager account before these services go live.
Further providers at the customer's request
If the customer requests additional tools, interfaces or services, Nickle AI lists them as project-specific subprocessors in the offer or project documents.