Data Processing Agreement

1. Parties and scope

1.1 This DPA is concluded between conclusia GmbH, Berlin, Germany (“conclusia”, the processor; company details at www.conclusia.io/imprint) and the business for which the conclusia service is used (the “Customer”, the controller). It is part of the Terms of Service at www.conclusia.io/legal/terms-of-services (the “Terms”). Terms defined there, in particular “Service”, “Authorised User”, “Customer Data”, “Company Database” and “Data Providers”, have the same meaning here.

1.2 The DPA is concluded electronically when the Terms are accepted at registration, and applies on every plan, including the free plan. The electronic form satisfies Art. 28(9) GDPR.

1.3 This DPA governs the personal data contained in Customer Data that conclusia processes on the Customer’s behalf when providing the Service. Processing that conclusia carries out as a controller is not covered; clause 13 describes it.

2. Roles and responsibilities of the Customer

2.1 The Customer is the controller of Customer Data and decides on the purposes and means of its processing. As processor, conclusia processes Customer Data only on the Customer’s behalf and in accordance with this DPA.

2.2 The Customer is responsible for the lawfulness of the processing it instructs. In particular, the Customer has a legal basis for it, meets its information obligations under Art. 13 and 14 GDPR towards the persons concerned, and may lawfully provide the personal data to conclusia.

2.3 The Customer has the rights set out in this DPA, in particular to give instructions (clause 4), to object to new sub-processors (clause 7), to receive assistance (clauses 9 and 10), to have Customer Data returned and deleted (clause 11) and to obtain information and carry out audits (clause 12).

3. Subject matter, nature, purpose and duration

3.1 Subject matter. The processing of Customer Data by conclusia in the course of providing the Service to the Customer.

3.2 Nature and purpose. Customer Data is processed to provide the Service as described in the Terms: to receive and store briefs, chat messages, lists, uploaded files and research columns; to identify, assess and classify companies for the Customer; to research public sources and, where the Customer chooses, to query Data Providers; to run the AI models that perform these steps; to make the results available in the web app and through the interface for AI assistants; and to provide support.

3.3 Duration. The processing lasts for the term of the contract under the Terms, followed by the retrieval and deletion periods in clause 11. This DPA applies for as long as conclusia processes Customer Data.

3.4 Types of personal data and categories of data subjects. These are set out in Annex 1.

4. Instructions

4.1 Customer Data is processed by conclusia only on the documented instructions of the Customer, including with regard to transfers of personal data to a country outside the European Economic Area, unless Union or Member State law to which conclusia is subject requires otherwise. In that case, conclusia informs the Customer of the legal requirement before processing, unless that law prohibits this on important grounds of public interest.

4.2 The Customer’s documented instructions are the Terms, this DPA and the Customer’s use of the Service: every brief, chat message, upload, list, research question, choice of source, setting and request made through the web app or an interface, including requests sent by an AI assistant that the Customer has connected.

4.3 Further instructions are given in text form to kontakt@conclusia.io. Where the Service does not support an instruction, or an instruction would require disproportionate effort, conclusia may decline it. The parties then seek a solution in good faith, and the Customer may terminate as provided in the Terms.

4.4 If conclusia considers that an instruction infringes the GDPR or other Union or Member State data protection law, it informs the Customer without undue delay and may suspend the instruction until the Customer confirms or changes it.

4.5 If a public authority requests access to Customer Data, conclusia refers the authority to the Customer where the law allows this, informs the Customer without undue delay unless the law prohibits it, and discloses no more than is legally required.

5. Confidentiality

Persons whom conclusia authorises to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The commitment continues after their engagement ends. They process Customer Data only on conclusia’s instructions and only as far as their tasks require.

6. Security of processing

6.1 The technical and organisational measures required by Art. 32 GDPR are implemented by conclusia and described in Annex 2.

6.2 The measures follow technical progress. Individual measures may be replaced by others, provided that the overall level of protection is not reduced.

7. Sub-processors

7.1 General authorisation. The Customer gives conclusia general authorisation to engage sub-processors. The sub-processors currently engaged are listed, with their service, location and transfer mechanism, at www.conclusia.io/legal/subprocessors (the “sub-processor page”).

7.2 Notice of changes. Before a new or replacement sub-processor starts processing Customer Data, conclusia informs the Customer in text form, by email to the address of the account, at least 30 days in advance and updates the sub-processor page. Where a change is urgently needed for security reasons, the notice period is 14 days, and the notice explains the urgency. Removing a sub-processor requires no notice.

7.3 Objection. The Customer may object to a change within the notice period, in text form to kontakt@conclusia.io, on reasonable grounds relating to data protection. The parties then seek a solution in good faith. If none is found before the change takes effect, the Customer may terminate the affected Service with effect from the date of the change, and fees paid in advance for the period after termination are refunded. If the Customer does not object within the notice period, the change is deemed accepted.

7.4 Obligations passed on. A sub-processor may be engaged only under a contract that imposes on it, in substance, the same data protection obligations as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures, and that does not allow it to use Customer Data to train its own models. Where a sub-processor fails to fulfil its data protection obligations, conclusia remains fully liable to the Customer for the performance of those obligations (Art. 28(4) GDPR).

7.5 Not sub-processors. Data Providers (clause 15), providers of AI assistants connected by the Customer (clause 16), providers that conclusia uses only for its own controller processing (clause 13), and third parties from which the Authorised User’s browser loads content directly, such as website icons and map tiles, are not sub-processors. They are listed separately on the sub-processor page for transparency. The Customer instructs conclusia to offer the browser-side functions as part of the Service.

8. Transfers outside the EU

8.1 Customer Data is processed in the European Union and in the United States. Individual sub-processors may also use other locations of their infrastructure outside the European Economic Area, and AI inference may be routed between the hosting provider’s regions in the EU and the USA. The sub-processor page states the location and the transfer mechanism for each sub-processor. The Customer instructs conclusia to make the transfers described there.

8.2 Personal data is transferred to a country outside the European Economic Area only in compliance with Art. 44 to 49 GDPR. Where the recipient is certified under the EU-US Data Privacy Framework and the transfer falls within its certification, the transfer relies on the European Commission’s adequacy decision. In all other cases, Customer Data is transferred only on the basis of the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, agreed between conclusia and the sub-processor (module 3, processor to processor) or between the sub-processor and its onward recipient, and subject to the assessment of the transfer that those clauses require.

9. Requests of data subjects

9.1 Taking into account the nature of the processing, conclusia assists the Customer by appropriate technical and organisational measures, as far as possible, in responding to requests of data subjects under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection).

9.2 The Service lets the Customer view, correct and, within its plan, export its data. Where the Customer cannot fulfil a request itself, conclusia carries out the necessary steps on the Customer’s instruction to kontakt@conclusia.io without undue delay, as a rule within ten working days, or tells the Customer within that time why this is not possible and when the steps will be completed.

9.3 Where a data subject contacts conclusia directly about Customer Data, conclusia forwards the request to the Customer without undue delay, if the Customer can be identified, and does not answer on the merits without the Customer’s instruction.

10. Assistance with security, breaches and impact assessments

10.1 Taking into account the nature of the processing and the information available to it, conclusia assists the Customer in complying with its obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation), in particular with the information in this DPA and, on request, with further information the Customer needs.

10.2 After becoming aware of a personal data breach affecting Customer Data, conclusia notifies the Customer without undue delay, aiming at a first notice within 48 hours, by email to the address of the account. The notice contains the information listed in Art. 33(3) GDPR as far as it is known; further information follows as it becomes available. The measures needed to contain the breach and limit its effects are taken by conclusia, which also documents the breach.

10.3 A notification is not an acknowledgement of fault or liability.

11. Deletion and return

11.1 Return. After the end of the contract, the Customer may retrieve its data for 30 days, as described in the Terms on switching and data export, through the export functions of its plan or by request to support@conclusia.io or kontakt@conclusia.io.

11.2 Deletion at the end. All Customer Data is deleted at the latest 44 days after the end of the contract (the 30-day retrieval period plus 14 days), including archived lists and copies in caches and search indexes, unless Union or Member State law requires conclusia to keep it. Data that must be kept by law is restricted to that purpose and deleted when the obligation ends. On request, conclusia confirms the deletion in text form.

11.3 Deletion on request. Where an administrator of the account asks conclusia to delete the account and its Customer Data, this is done within 30 days of the request. Removing a list in the Service archives it; its content is permanently deleted within 30 days of a request. Shorter standard retention periods for individual kinds of data are set out in Annex 1.

11.4 Backups. Deleted data remains in backups until they are overwritten on their regular cycle. Deleted Customer Data is restored from a backup only to recover from a fault and is then deleted again.

12. Information and audits

12.1 On request, conclusia makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer.

12.2 This obligation is met first through documentation: this DPA with its annexes, answers to a reasonable questionnaire, and certifications or audit reports of sub-processors. An inspection takes place where the Customer reasonably considers the documentation insufficient, after a personal data breach, or where a supervisory authority requires it.

12.3 The Customer announces an audit in text form at least 30 days in advance, unless a supervisory authority or a personal data breach requires a shorter period. Inspections take place during normal business hours, without undue disruption, and at most once per calendar year unless there is a specific cause. An auditor must be bound to confidentiality and must not be a competitor of conclusia. Data of other customers is not accessible.

12.4 Each party bears its own costs of an audit.

13. Processing by conclusia as controller

The following processing is carried out by conclusia as a controller for its own purposes. It is described in the Privacy Policy at www.conclusia.io/legal/privacy-policy and is not processing on the Customer’s behalf under this DPA:

(a) account and operation: registration, sign-in and administration of accounts and users, security and abuse prevention, usage metering, billing, contacting users for onboarding and support, and support messages, feedback and problem reports sent to conclusia, even where they contain Customer Data;

(b) the seat check on paid plans and free trials, which records limited sign-in metadata, never content, to review whether the agreed number of seats is respected. Records about individual users are not given to the Customer;

(c) the Company Database, including public company websites that become known through the Service, for example when an Authorised User adds a company to a list. They are added without any link to the Customer, its Authorised Users or the list;

(d) usage statistics about how the Service is used and performs.

14. Use of data by conclusia

14.1 The Customer instructs conclusia that authorised conclusia staff, bound to confidentiality under clause 5, may access Customer Data where this is needed for support, for troubleshooting and fixing defects, and for the security of the Service.

14.2 By accepting the Terms, the Customer instructs conclusia to anonymise Customer Data. The anonymised data may be used by conclusia for its own purposes to improve the Service, including to develop, train and evaluate models. Data is anonymised only if no Customer, Authorised User, project or other person can be identified from it.

14.3 Customer Data that has not been anonymised is not used to train AI models, neither by conclusia nor by its providers. Apart from clauses 13 and 14, conclusia does not use Customer Data for its own purposes.

15. Research columns and Data Providers

15.1 A research column answers a question formulated by the Customer for every company on a list, from public web sources and, where the Customer selects them, from Data Providers. The Customer is the controller of the questions and of the results. Each question and each choice of source is an instruction under clause 4. The lawfulness of questions is not reviewed by conclusia.

15.2 The Customer uses research columns only for companies and the professional role of the people acting for them. The Customer shall not use them, or any other function of the Service, to obtain or infer special categories of personal data (Art. 9 GDPR) or data on criminal convictions and offences (Art. 10 GDPR), or to research or profile natural persons in their private capacity. Where there are concrete indications of a breach, conclusia may suspend the research column concerned and informs the Customer.

15.3 Results are generated automatically and are not verified by conclusia. They are visible to every Authorised User who has access to the list.

15.4 Data Providers are optional and are queried only where the Customer’s plan or its purchased research credits include them and the Customer selects them. They are independent controllers of the data they hold and disclose, not sub-processors, and are listed on the sub-processor page. Only data identifying the company concerned, such as its name, web domain or register number, is sent to a Data Provider. Once retrieved, the data is Customer Data under this DPA. The Customer’s responsibilities for using it are set out in the Terms.

16. Third-party AI assistants

AI assistants of third parties that the Customer connects to the Service are the Customer’s own tools, and their providers are not sub-processors of conclusia. The Customer decides what an assistant sends to and receives from the Service. The processing by conclusia begins when a request reaches the Service and ends when the response leaves it.

17. Liability, precedence, changes and final provisions

17.1 Liability. The liability of the parties to each other under this DPA follows the liability provisions of the Terms. This does not limit the liability of either party towards data subjects under Art. 82 GDPR.

17.2 Precedence. Data protection terms that the parties have agreed individually, in an order or in a separately signed data processing agreement, prevail over this DPA. For questions of data protection, this DPA prevails over the Terms.

17.3 Changes. This DPA may be changed under the change mechanism of the Terms. Such a change must not reduce the level of data protection. Changes of sub-processors follow clause 7 only.

17.4 Records and contact. A record of the processing carried out on the Customer’s behalf is kept by conclusia under Art. 30(2) GDPR. The contact for all matters under this DPA is kontakt@conclusia.io.

17.5 Law and validity. This DPA is governed by the law of the Federal Republic of Germany; the place of jurisdiction follows the Terms. If a provision of this DPA is or becomes invalid, the remaining provisions stay valid.

Annex 1: Details of the processing

Data subjects: Authorised Users of the Customer; contact persons and representatives of the companies researched; persons named in public sources or in content the Customer enters or uploads

Personal data: Authorised Users: name, business email address, and their briefs, chat messages, votes, comments, uploads and research runs. Persons at researched companies: name, position or role, business contact details, links to professional profiles, register data, and the source. Any other personal data the Customer includes in briefs, chat messages, uploaded files, research questions or lists. No special categories of personal data (Art. 9 GDPR) and no data under Art. 10 GDPR

Purposes: Providing the Service as described in clause 3.2, including support and the access and anonymisation instructed in clause 14

Duration: Lists, research results and notes that the Service derives from conversations: until the Customer asks for deletion or the contract ends. Conversations: 90 days. Uploaded files: 180 days. Export files created through the interface for AI assistants: 2 days. Cached responses of Data Providers: no longer used after 30 days (register identifiers 90 days) and deleted at the latest with the Customer Data. Technical logs that may contain fragments of Customer Data: as a rule 30 days, security and audit logs 90 days. At the end of the contract: clause 11. Retention by sub-processors for the current processing step follows their contracts with conclusia

Annex 2: Technical and organisational measures

These measures describe the current state. They are reviewed regularly and after significant changes to the Service.

1. Hosting. The Service runs on the infrastructure of established cloud providers. No data centre is operated by conclusia itself; physical security is provided by those providers under their certified security programmes.

2. Sign-in. Authorised Users sign in with a personal account. Access tokens expire, are checked on every request and can be revoked.

3. Administrative access. Access to production systems is limited to the members of conclusia’s team who need it, with personal credentials, and is withdrawn when the need ends.

4. Least privilege. Services and functions run with roles limited to the permissions they need.

5. Separation of Customers. Customer Data is logically separated by account. On every request, the Service checks that the user belongs to the account whose data is requested.

6. Encryption in transit. Data sent over public networks, between users and the Service and between the Service and its sub-processors, is encrypted with TLS.

7. Encryption at rest. Encryption at rest is used for many, but not all, of the data stores. The other stores are protected by the access and network controls in this annex.

8. Network protection. Databases and internal services are reachable only through authenticated interfaces or restricted network rules.

9. Logging. Access and changes are logged as far as needed for security, error analysis and abuse detection.

10. Backups and monitoring. The databases are backed up regularly, and the Service is monitored with alarms to conclusia’s team.

11. Data minimisation. Identifiers are pseudonymous where possible, retention periods apply as set out in Annex 1, and Data Providers receive only data identifying the company concerned.

12. People and providers. Everyone with access to Customer Data is bound to confidentiality and instructed on data protection. Sub-processors are selected with regard to their security measures and engaged in accordance with clause 7.

Annex 3: Sub-processors

The sub-processors authorised under clause 7, with their service, the data concerned, their location and the transfer mechanism, are listed at www.conclusia.io/legal/subprocessors. That page, as updated in accordance with clause 7, forms this Annex 3.