Art. 28 GDPR

Data Processing Agreement (DPA) for the AI Gateway

Version v1-2026-10-07 · As of 7 October 2026 · The German version prevails.

How the agreement is concluded. You use the PROMPTOPOLY AI gateway or the Brain Repository and process personal data for which you are the controller. In that case we conclude this agreement with you (section 18(5) of the Terms). Write to mail@promptopoly.com with your company name, address and legal representative. We confirm in text form; with our confirmation this agreement applies in its then-current version (Art. 28(9) GDPR). For a signature on paper use the signature line at the end. The text was reviewed by ma-kom agentur UG, not by a lawyer; it does not replace your own data protection assessment.

§ 1 Parties and subject matter

(1) The controller is the customer who concludes the agreement as described above. The processor is ma-kom agentur UG (haftungsbeschränkt), Merkelbach 12, 74541 Vellberg, Germany, represented by its managing director Pascal Sanwald, email mail@promptopoly.com.

(2) The subject matter is the processing of personal data on behalf of the controller when using the AI gateway (promptopoly.com/api/v1/proxy) and the Brain Repository: receiving requests (prompts), forwarding them to the model provider chosen by the controller or in its provider chain, returning the response, logging, budget checks and billing, and storing notes and templates in the Brain Repository.

(3) Not covered is data for which we are controller ourselves: your account and contract data, payment and invoice data (Stripe), consent records and the website server logs. Our privacy policy applies to them.

(4) Processing lasts as long as the main contract (use of the service under the Terms).

§ 2 Nature and purpose, data and data subjects

(1) Nature: collecting, storing, transmitting to sub-processors, logging, deleting. Purpose: providing the gateway to the controller, billing, troubleshooting, abuse prevention.

(2) Data categories: content the controller enters into prompts and notes (text, possibly including names, contact, contract or project data), the model responses, metadata per call (time, key, model, provider, token count, cost, status), IP addresses of the calling systems. Special categories (Art. 9 GDPR) are not intended; the controller submits them only after prior agreement with us.

(3) Data subjects: persons whose data the controller enters into prompts or notes, in particular its customers, prospects, employees and business partners.

§ 3 Obligations of the processor

1. We process the data only on documented instructions from the controller, including transfers to third countries, unless Union or Member State law requires otherwise; in that case we inform the controller beforehand unless the law prohibits it. Instructions are this agreement and the controller's configuration (keys, provider chain, model selection).
2. All persons with access are bound to confidentiality.
3. We take the measures required by Art. 32 GDPR (§ 4).
4. We assist with data subject rights, data protection impact assessments and notification duties as far as we are able.
5. We notify a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
6. We tell the controller if, in our view, an instruction infringes data protection law.
7. We do not use the data to train our own or third-party AI models (section 18(4) Terms) and only use providers that exclude this under their terms for paid API access.

§ 4 Technical and organisational measures

Only measures we can evidence are listed.

• Encryption: transmission over TLS (HTTPS) only. Stored provider keys sit in the gateway key vault, encrypted with AES-256-GCM.
• Access: access to the gateway only with a proxy key per tenant and project. Configurable per key: provider and model whitelist, IP allowlist, rate limit, content blocklist patterns. Two-factor sign-in (TOTP) can be set up for accounts.
• Tenant separation: budget, log and billing separated per tenant; cache hits are only served within the same tenant.
• Input control and traceability: every call is recorded in an HMAC-chained log.
• Availability: budget limit before every call; a provider outage is absorbed by the key's failover chain. Weekly backup of the Plesk server with rotation.
• Data minimisation: of the input we store only an excerpt (the first 200 characters), responses only briefly (§ 7).
• Hosting: server in Germany at Webspace-Verkauf.de ISP e.K. (§ 5), data processing agreement concluded.

There is currently no ISO 27001 certification and no independent external security report. We do not promise either.

§ 5 Sub-processors

(1) The controller authorises the following sub-processors:

(2) Order and choice. Which of these providers handles a request is determined by your key's provider chain (provider whitelist, failover). A change within this list needs no new authorisation.

(3) Your own provider keys. If you store your own key for a provider, your own contract with that provider applies to those calls. We only forward; responsibility for that contract and the third-country basis lies with you.

(4) Moonshot AI (Kimi, China). There is no contract with Moonshot and no adequacy decision. The gateway uses Moonshot only if the controller explicitly requests the model and confirms the notice about processing in China. For these calls Moonshot is not a sub-processor engaged by us; instruction, legal basis and risk lie with the controller. Personal and confidential content is excluded for it.

(5) Changes. We inform the controller in text form at least 30 days in advance of the engagement or replacement of a sub-processor. The controller may object on data protection grounds within that period. If the objection stands, either party may terminate the main contract extraordinarily as of the change; fees paid in advance for the time after that are refunded pro rata.

(6) We impose on every sub-processor the same data protection obligations as in this agreement and are liable for their performance (Art. 28(4) GDPR).

§ 6 Third-country transfers

We base transfers to OpenAI and Anthropic in the USA on the EU standard contractual clauses (Implementing Decision (EU) 2021/914, module 2 or 3; Art. 46(2)(c) GDPR). According to the official DPF participant list (checked 6 Oct 2026) neither provider is certified. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses. A transfer impact assessment exists for OpenAI and Anthropic and is provided to the controller on request.

§ 7 Deletion and return

(1) Ongoing operation (as in the privacy policy): excerpt of the input (first 200 characters) 90 days, model response 7 days; then deleted or made unreadable. Server logs of the interfaces about 8 days. Metadata per call (time, key, model, provider, token count, cost, status) remain as far as we need them for billing and evidence, at most until the statutory retention period for billing records ends (8 years, section 147 AO, section 257 HGB); they contain no prompt content.

(2) At provider level the model providers store content for a limited time under their terms for abuse detection (OpenAI at most 30 days; Google and Anthropic under their API terms). We have no influence on that.

(3) Brain Repository: the controller deletes notes, templates and versions itself and can retrieve and back them up through the interface at any time.

(4) After the contract ends we delete all personal data processed on behalf within 30 days or hand it over at the controller's choice (JSON export). Statutory retention duties remain unaffected. On request the controller receives a deletion record.

§ 8 Audit rights

The controller may request information about the nature and scope of the processing. We provide the available evidence on the measures and allow audits, including on-site inspections, after reasonable notice (Art. 28(3)(h) GDPR).

§ 9 Liability, final provisions

(1) Liability follows the main contract and Art. 82 GDPR. (2) Amendments to this agreement require text form. A new version applies to an existing agreement only once the controller agrees. (3) If a provision is invalid, the rest remains effective. (4) In case of conflict this agreement prevails over the Terms as far as personal data is concerned.

Signature on paper (only if desired)

Controller (company, address, legal representative): ______________________________
Place, date: ____________________    Signature controller: ____________________    Signature ma-kom agentur UG: ____________________