Data processing agreement
If we process personal data on your behalf, we sign a DPA under Art. 28 GDPR beforehand. You receive the draft together with the offer.
SECURITY & DATA PROTECTION
What happens to your data. In writing, before we start.
For every pilot we agree before the start which data is processed, where, by whom and for how long. This page shows what you can expect from us and what we do not have.
Contracting party: M2D GmbH, Siegburg
BEFORE THE START
Four documents before any data flows.
Technical and organisational measures
We describe the measures for access, encryption in transit, logging, backup and deletion as an annex to the DPA, specific to your project.
Data flow and providers
Which systems and providers are involved, where they process data, who has access and when data is deleted is agreed in writing. Sub-processors are listed in the DPA.
Confidentiality for professional secrecy holders
For law and tax firms, medical practices and other professional secrecy holders, we and our contributors additionally commit to confidentiality under Section 203 of the German Criminal Code.
WHERE DATA IS PROCESSED
Location and providers, named openly.
Projects in the EU
We process personal data of customers in the EU in data centres in the EU. The location is recorded in the DPA.
This website
The website runs on Timeweb Cloud in a data centre in Amsterdam (Netherlands). It uses no analytics or tracking services.
On request at your site or in Germany
If you require it, we run the system with a provider in Germany or on your own servers. The effort is stated in the offer.
AI models
For language models we prefer European providers such as Mistral AI (France). External models only if they are listed in the DPA. Where technically possible, we work locally without transfer to third parties, for example for object detection or transcription.
EMPLOYEES AND DATA SUBJECTS
Clear rules for cameras, phone and AI.
Cameras
If employees are affected, we involve the works council and data protection before the start. We provide the technical details for your data protection impact assessment.
Phone
The voice AI identifies itself as AI at the start of the call. No recording by default, only a structured note of the request. Recording and transcripts only at your request and with notice to callers. Call analyses concerning employees only with a works agreement.
Decisions
The AI prepares and suggests. Anything that goes out or has consequences is approved by a person.
IN ALL HONESTY
What we do not have.
We are a small engineering team and hold no ISO 27001 certification and no C5 attestation. Instead, we disclose our measures, answer your IT security questionnaire in writing and talk to your IT and data protection officers before the start.
Do you need support with data protection and AI rules yourself, even without a project? Data protection & AI compliance ↗
FAQ
Before we start.
Do we receive a DPA in advance?
Yes. You receive the draft with the offer; it is signed before the first data transfer.
Where is our data stored?
In a data centre in the EU. The exact location and all providers involved are stated in the DPA. On request we run the system in Germany or at your site.
Is our data used to train AI models?
We do not train models for other customers with your data. With external providers we choose terms without training on customer data and record this in the DPA.
How does the AI understand the call without recording?
During the call, speech recognition continuously turns what is said into text, and the AI works with that text. We do not store an audio file. We use external speech services with no-storage settings where the provider offers them; if a provider retains data for a period, the provider and the period are listed in the DPA. For law firms, medical practices and other professional secrecy holders, speech recognition can run on your server or on a server in Germany. The spoken audio then does not leave that server; only the recognised text goes to the language model.
What happens after the project?
We delete or return your data as agreed in the DPA and confirm the deletion in writing.
Will you answer our security questionnaire?
Yes, in writing. Send it with your enquiry or after the initial call.
NEXT
Related to this page.
Who it is for
Solutions
Trust
THE NEXT STEP
What should work better in your business?
Tell us about a process that takes up your team’s time. We discuss where automation could help and what is needed to define the next step.
Useful details: the current workflow, frequency and the outcome you need.
HEINRICH SCHNEIDER / DDC
heinrich@ddc.companyPrefer email? Write to us directly.
Contracting party: M2D GmbH, Am Turm 11, 53721 Siegburg · initial call free of charge · Pricing · Security & data protection