Data Processing Agreement (DPA)

§ 1 Contracting Parties

Controller (Client): The user of the PII pseudonymization service (hereinafter "Client")

§ 2 Subject Matter and Duration of Processing

The Processor processes personal data on behalf of the Client within the scope of the PII pseudonymization service.

• Purpose: Automated detection and pseudonymization of personal data in texts before they are transmitted to AI language models (LLMs).
• Duration: Texts are processed only for the duration of an individual API call and are not stored. Mapping tables are held in memory and automatically deleted 30 minutes after their last use, at the latest 8 hours after their first use.
• Nature of processing: Automated text recognition, pattern matching, AI-based Named Entity Recognition, pseudonymization in two modes: tagged mode for API outputs (clearly recognizable markers such as [PERSON:abc12345]) and faker mode for internal AI pipelines (plausible pseudonyms; server-side reverse resolution before delivery to end users). In both modes, original data never leaves the processing pipeline as plaintext, neither to cloud AI services nor to external consumers.

§ 3 Types of Personal Data

The following categories of personal data may be affected during processing:

• Full names, first and last names
• Email addresses, phone numbers
• Postal addresses (street, postal code, city)
• IBANs, credit card numbers, cryptocurrency wallets
• ID card numbers, tax numbers, social security numbers (EU-wide)
• Dates of birth
• IP addresses
• Profile URLs on social media and developer platforms (35+ platforms, username part only)

§ 4 Categories of Data Subjects

Data subjects are those natural persons whose personal data is contained in texts transmitted by the Client. These may include:

• Employees and staff of the Client
• Customers and business partners of the Client
• Contact persons and points of contact
• Other natural persons mentioned in texts

§ 5 Obligations of the Processor

The Processor undertakes to:

• Bound by instructions: Processing is carried out exclusively on the basis of the Client's documented instructions. Use of the API constitutes such an instruction.
• Confidentiality: All persons entrusted with processing are bound by confidentiality.
• Security of processing: The Processor implements the technical and organizational measures described in the TOM annex (Art. 32 GDPR).
• Sub-processors: The service runs on rented servers of dataforest GmbH, Taunusstraße 52, 65830 Kriftel, Germany (also trading as PHP-Friends), in data centres in the Frankfurt am Main area. Because the texts reside there during processing, dataforest GmbH is a sub-processor. The service uses no other sub-processors: it stores no files, sends no emails and passes no texts to other services. The processor informs the controller in advance of any intended change, and the controller may object to it.
• Support: The Processor assists the Client in fulfilling their obligations under Art. 32-36 GDPR.
• Deletion: Original texts are not stored. Mapping tables are automatically deleted 30 minutes after their last use, at the latest 8 hours after their first use. Log entries without plain text are deleted after 7 days.
• Accountability: The Processor provides the Client with all information necessary to demonstrate compliance with their obligations.

§ 6 Obligations of the Client

The Client is responsible for ensuring that:

• the transmission of personal data to the Processor is lawful
• the rights of data subjects are guaranteed
• the service is only used for texts whose processing the Client is authorized to carry out

§ 7 Technical and Organizational Measures

The specific technical and organizational measures are described in a separate TOM document:

→ View TOM document

Summary of key measures:

• ✓ Encryption and access: TLS for all transmissions. The service issues and signs the session ID, or it is bound to the API key.
• ✓ Local processing: All servers in Germany, no data transfer to third countries
• ✓ Data minimization: No storage of original texts, mapping tables only in memory with no copy on disk
• ✓ No plain-text logs: Time, a hashed session ID, the number of detected values and checksums of them made with a secret key (HMAC-SHA256) are logged, for 7 days
• ✓ Automatic deletion: Mapping tables 30 minutes after their last use, at the latest 8 hours after their first use

§ 8 Data Transfers to Third Countries

No transfer of personal data to third countries or international organizations takes place. All processing is carried out exclusively on servers in Germany. The AI models used (GLiNER NER, PII-specialised) run locally on the same servers.

§ 9 Data Breach Notification

The Processor shall inform the Client without undue delay of any personal data breach pursuant to Art. 33 GDPR. Contact: info@schiller-partners.de

§ 10 Termination

Upon termination of use of the service, all temporary data is automatically deleted. Since mapping tables are deleted 30 minutes after their last use, at the latest 8 hours after their first use, and log entries without plain text after 7 days, no separate deletion or return obligation applies.

§ 11 Liability

Liability is governed by Art. 82 GDPR. The Processor is liable for damages caused by processing that does not comply with the Client's instructions or by violations of their obligations under this agreement.

§ 12 Final Provisions

• German law applies.
• Place of jurisdiction is Dortmund, Germany.
• Amendments and supplements require written form.
• This DPA takes effect with the first use of the PII pseudonymization service by the Client.