Legal
Data Processing Agreement
General annex to the Terms for nyxory platform customers · Version of 7 October 2026
Part A
Data Processing Agreement
1. Parties and applicability
This agreement applies between nyxory GmbH, c/o Tobias Nentwig, Gardeweg 1 A, 14624 Dallgow-Döberitz, Deutschland, registered with the Local Court (Amtsgericht) Potsdam under HRB 42303 P, and the customer named in the platform agreement. It governs the processing of personal data by nyxory on behalf of the customer pursuant to Art. 28 GDPR and is agreed together with the platform agreement. No separate signature of this annex is required.
The customer acts as controller. Where the customer is itself a processor, nyxory acts as a further processor; the customer warrants that it holds the necessary mandate and authorisation from its controller and communicates that controller's relevant instructions and additional obligations before commencement. Any necessary supplements are agreed. nyxory's own statutory obligations remain unaffected.
The constituent parts are this DPA, the agreed service description and the Platform Data Sheet incorporated for the booked services, with the processing profile, the technical and organisational measures (TOMs) and the sub-processors. For Enterprise customers, an individually agreed DPA annex specifies deviating operating conditions and, where applicable, the processing of sensitive data. Its expressly designated special provisions take precedence over the general information; otherwise this DPA continues to apply. In the event of conflicts under data protection law, this DPA takes precedence over the Terms; expressly agreed further-reaching protection requirements remain in force.
2. Subject matter and scope
The subject matter is processing on behalf of the customer in the provision and operation of the booked platform services in accordance with the service description.
Purpose, processing operations, types of data and categories of data subjects are determined by Chapter 1 of the incorporated Platform Data Sheet. The customer determines the business purposes and content within the booked services and protection requirement limits. Deviating categories of data subjects or types of data are agreed as a supplement before commencement. Processing lasts for the term of the booked service plus the necessary return and deletion phase under Section 9.
The standard SaaS platform is intended for data with normal protection requirements. For personal content data, this means that the nature, scope and context of processing do not give rise to increased protection requirements. Customary business contact and organisational data may fall within this; the specific context remains decisive. Special categories of personal data (Art. 9 GDPR), in particular health data, data under Art. 10 GDPR and other personal content data with increased protection requirements are excluded from the standard offering.
The processing of such sensitive personal data requires an Enterprise contract and an individual DPA annex agreed before processing begins. That annex specifies the types of data, purposes, operating environment, providers, processing locations and the necessary additional safeguards. An Enterprise contract alone does not permit this processing. Additional obligations, for example to protect professional secrecy, are likewise agreed before commencement.
If the customer detects processing of sensitive data that has not been agreed, it stops further transmissions and informs nyxory without undue delay. The parties agree on a secure return, deletion or migration to a suitable contractually agreed environment. Data protection and protective obligations for data already present remain unaffected.
Where nyxory processes personal data for its own purposes of platform account management and login, contract management, billing, product analytics or business correspondence, nyxory acts as controller outside this DPA; the Privacy Policy provides information on this. The actual purpose and data flow are decisive. Accounts, permissions and login data within the customer applications, as well as other processing bound by instructions, remain customer data processed on behalf (hereinafter “order data”). This delineation does not permit any own use of order data, in particular no blanket inclusion of customer content in product analytics.
3. Instructions and customer cooperation
nyxory processes order data only on documented instructions from the customer, including with regard to transfers of personal data to a third country. The contract, the service description and the intended use of the agreed functions constitute the initial instructions. The contact for data protection enquiries and data subject requests is privacy@nyxory.com, for further instructions and security notifications security@nyxory.com, for abuse reports abuse@nyxory.com; urgent verbal instructions are documented without undue delay. nyxory verifies the authorisation of the sender.
Where Union or Member State law requires nyxory to carry out processing, nyxory informs the customer in advance, unless that law prohibits such information on important grounds of public interest. If nyxory considers that an instruction infringes data protection law, nyxory informs the customer without undue delay and suspends its execution until it has been clarified with the customer. Unlawful instructions are not carried out.
The customer is responsible for the lawfulness of its processing, information provided to data subjects, its own user permissions and customer-side configurations. It keeps its contract, data protection and incident contacts up to date. nyxory remains responsible for its own services and safeguards.
4. Confidentiality and security
nyxory commits authorised persons to confidentiality before they are given access, unless they are under an appropriate statutory obligation of confidentiality.
nyxory takes all measures required under Art. 32 GDPR, taking into account the state of the art, the costs of implementation, the processing and the risks for data subjects. The specific technical and organisational measures are agreed in Chapter 2 of the Platform Data Sheet. Technical developments must not fall below the agreed level of protection; material changes are documented and communicated to the customer.
Order data is used neither for advertising nor for training AI models; the training exclusion also applies to the AI providers engaged. The deliberate use of agreed AI functions by the customer or its authorised users, including calls to the AI gateway from customer applications, constitutes a documented instruction. Functions, processing purposes, data scope and services used are agreed transparently before use; use is documented in a traceable manner. Any AI processing of customer content beyond this takes place only on separate documented instruction. Sections 7 and 8 apply to external providers.
5. Assistance and personal data breaches
Taking into account the nature of the processing, nyxory assists the customer by appropriate technical and organisational measures in fulfilling the data subject rights under Chapter III GDPR. Incoming requests are forwarded without undue delay and answered only on instruction. nyxory assists in particular with access, rectification, export, restriction and erasure.
Taking into account the information available, nyxory assists the customer with its obligations under Arts. 32 to 36 GDPR, including data protection impact assessments and prior consultation of the supervisory authority. Necessary information on data flows, measures, providers and risks is provided in good time.
nyxory notifies the customer of personal data breaches without undue delay, at the latest within 24 hours of becoming aware of them, via the designated incident contact or, failing that, the contract contact. The notification contains, where known, the nature, scope and time of the incident, the categories of data and data subjects concerned with approximate numbers, the likely consequences, the remedial measures taken or planned and a contact person. Missing information is provided subsequently without unreasonable delay. nyxory supports the investigation, containment and the customer's notification and communication obligations.
6. Evidence and audits
nyxory makes available all information necessary to demonstrate compliance with this DPA and Art. 28 GDPR and allows for audits, including inspections, by the customer or an auditor mandated by the customer. nyxory contributes to them.
Regular on-site audits are possible once a year with at least four weeks' prior notice in text form, during normal business hours and with the least possible disruption to operations. Additional necessary audits for a specific reason, in particular in the event of personal data breaches or substantiated indications of significant deficiencies, remain possible; in urgent cases, an appropriately shorter notice period applies. The provision and review of documents remain unaffected by this. Auditors are to be bound to confidentiality. In the event of justified conflicts of interest, a suitable alternative is agreed without preventing necessary audits. Other customers are to be protected. Current audit reports may be taken into account but do not replace any necessary own audits. The statutory powers of the supervisory authorities remain unaffected.
7. Sub-processors
The customer grants a general written authorisation, including in electronic form, for the sub-processors listed in the incorporated Platform Data Sheet. nyxory actively informs the customer at least 30 calendar days before any intended addition or replacement about the provider, activity, data, countries and safeguards. This also applies before the first activation of a provider designated as planned in the Data Sheet. A mere change to an online list is not sufficient.
The customer may object on data protection grounds before the planned engagement. The parties work out a suitable solution; until then, the provider objected to is not used for the processing concerned. If lawful continuation is not possible, either party may terminate the affected part of the services as of the intended changeover date. Return and deletion are governed by Section 9.
nyxory contractually binds sub-processors to the same data protection obligations, in particular to sufficient safeguards, assistance and audits, and verifies their compliance. nyxory remains fully responsible to the customer for the performance of their obligations. The list, including relevant further processing chains, is kept up to date.
In the event of outages or security incidents, fallback providers that have already been authorised may be used to the agreed extent. A new provider may be used before the notice period expires only with the customer's prior documented consent in an expedited procedure. Subsequent notification does not replace this consent.
The allocation of providers does not permit a blanket disclosure of all order data to every listed provider. If nyxory itself engages an IaaS provider selected by the Enterprise customer, that provider forms part of the sub-processor chain when processing order data.
8. Processing locations and external services
nyxory processes order data exclusively within the European Economic Area (EEA) and in Switzerland. This covers storage, backup and access, including administration and remote maintenance, by nyxory and the sub-processors engaged. Transfers to Switzerland take place on the basis of the European Commission's valid adequacy decision under Art. 45 GDPR.
The specifically agreed countries of storage, backup and access are set out in the Platform Data Sheet. The general geographical framework does not automatically extend these specifications; changes are governed by Sections 7 and 10. If an adequacy decision ceases to apply, nyxory informs the customer without undue delay and suspends the affected transfers and access; further processing is agreed with the customer within the permissible framework. Statutory obligations under Section 3 remain unaffected.
External integrations requested by the customer are documented before activation with regard to recipient, role, data scope and countries. A provider engaged directly by the customer does not become a sub-processor of nyxory solely by virtue of the technical connection. Where the provider is engaged by nyxory, Section 7 applies. The connection remains limited to the agreed customer context; nyxory is responsible for secure integration within the scope of services it has assumed. Transfers by nyxory to such services are also limited to the geographical framework above.
Administrative access by staff is limited to the regions specified in the Platform Data Sheet. During stays outside these regions, such access is to be prevented by appropriate measures. Customer-specific stricter location requirements remain decisive.
9. Return and deletion
After the end of processing, nyxory, at the customer's choice, returns the order data and deletes existing copies, or deletes all order data. The return takes place at the request of an authorised customer contact via the instruction contact under Section 3 without undue delay, at the latest within 30 calendar days of receipt of the request; any necessary queries are raised without undue delay. Structured data is provided in a common machine-readable format, files in their existing format including the necessary mapping metadata. nyxory determines and communicates the format and the secure delivery method in accordance with the safeguards of the Platform Data Sheet; data of other customers remains excluded. At the end of the contract, nyxory enables a return requested in good time before deletion and communicates the retrieval period and the deletion date.
During the term, nyxory deletes or restricts order data in accordance with documented instructions and the retention periods set out in Chapter 3 of the Platform Data Sheet. Deletion instructions are implemented for active systems within no more than 30 calendar days of receipt and, including backup copies, within no more than 60 calendar days in total. After the end of the contract, all order data, including log and support data and backup copies, is completely deleted without unreasonable delay, at the latest within 90 calendar days in total. Deletion is confirmed.
All periods are maximum periods. If the data ceases to be necessary earlier, it is deleted earlier; shorter periods required by law or bindingly agreed take precedence. Return requests, the end of the contract and restorations neither extend running periods nor cause them to start again.
All protective obligations continue to apply until deletion. After the end of the contract, remaining data serves exclusively for return and secure wind-down. Remaining backup copies are excluded from regular access; after a restoration, existing deletion instructions are implemented again. Statutory storage obligations under Union or Member State law remain unaffected. In such cases, nyxory documents the legal basis, scope and duration, blocks any other use and deletes the data once the obligation ceases to apply.
10. Liability, additional services and amendments
Liability under Art. 82 GDPR remains unaffected. Otherwise, the liability provisions of the Terms apply, to the extent that mandatory law does not preclude this.
Services going beyond the statutory and agreed assistance and audit obligations may be remunerated separately after prior agreement on scope and costs. The fulfilment of these obligations and the exercise of audit rights are not made conditional on an additional remuneration agreement.
If nyxory cannot comply with this agreement, the customer is informed without undue delay. The customer may have the affected processing suspended until the issue is remedied and, in the event of material or persistent infringements, terminate the affected part of the services for cause. Statutory rights remain unaffected.
The versions incorporated at the conclusion of the contract remain verifiable. Amendments to the content of the contract are made by effective agreement; publication of a new version is not sufficient. Permissible technical developments under Section 4 and changes of provider under Section 7 remain possible. The DPA continues to apply until the order data has been completely wound down.
Part B
Platform Data Sheet
Annex to the DPA for platform customers · Version of 7 October 2026
1. Processing profile
Processing profile of the booked platform services within the scope of Section 2 of the DPA.
Purpose: Provision and secure operation of the customer applications and projects on the platform, including hosting, user management on behalf of the customer, administration, maintenance, support, data backup, restoration and security monitoring, as well as the agreed AI functions.
Processing operations: Collection, organisation, storage, retrieval, display, alteration, agreed transmission, restriction and erasure.
Categories of data subjects: Users and administrators of the customer projects; end users of the customer applications; employees and other persons engaged by the customer; customers, prospects, suppliers and business partners of the customer, including their contact persons, as well as other persons whose data the customer processes in its applications or projects within the agreed processing framework.
Types of data: Personal data that the customer processes in its applications and projects within the agreed processing framework. This includes, for example, master, contact and organisational data; account, role, permission and authentication data of the customer applications; business communication, document, case and contract data, as well as technical usage, support and security data such as IP addresses, timestamps and error messages. Such data is also covered where it is contained in repositories, container images, volumes, databases and application logs, as well as in agent histories and inputs and outputs of the AI gateway. The delineation of nyxory's own processing is governed by Section 2 of the DPA.
The categories apply to the extent that they actually arise in the specific use.
2. Technical and organisational measures (TOMs)
Technical measures
| Measure | Description |
|---|---|
| Personal accounts and MFA | Staff use personal accounts with multi-factor authentication for administrative access to production. |
| Encryption | Stored customer data, including backup copies, is encrypted by the cloud providers used (data at rest). Transport encryption is enabled by default for transmission. |
| Data backup and restoration | Platform data is backed up daily in a storage project separated from production at a different location. The backup copies serve to restore the data and access to it in the event of data loss or operational disruptions. |
| Operational monitoring | The availability and operational status of the platform are monitored in order to detect outages and disruptions. |
| Capacity management | Resource utilisation is monitored and capacity is adjusted when bottlenecks are detected. |
| Separation of development and production | Development and production environments are operated separately. Changes are reviewed before production use. |
| Secure development and source code reviews | In the established release process, source code changes are automatically checked for security flaws. Mandatory checks are a prerequisite for release; changes and check results are documented in a traceable manner. |
| Vulnerability management | Platform components are checked for known vulnerabilities. Findings are assessed and treated on a risk basis; their handling is documented. |
| Security monitoring | Security-relevant events of the production platform are collected centrally and analysed for anomalies. Transmission is encrypted and authenticated; access is restricted to authorised administrators with multi-factor authentication. |
| Alerting | Critical security events are reported automatically; severity and handling status are traceable. |
| Tenant separation | Customer environments and the data processed in them are logically separated from one another. Access permissions limit access to the respective authorised customer environment. |
| Network security | Network rules separate customer environments and allow only specifically approved connections. External access and administrative access points are restricted. |
Organisational measures
| Measure | Description |
|---|---|
| Security responsibility | Management bears overall responsibility; the CISO coordinates information security. Assigned humans remain responsible for AI agents. |
| Control of security requirements | Security requirements are maintained with ownership, version status and evidence of approval and are updated in a controlled manner. |
| Classification and sharing | Documents are classified according to their protection requirements. Their sharing depends on the classification and the permitted group of recipients. |
| Supplier management and physical protection | Data centre providers hold ISO/IEC 27001 certification. The physical protection of the processed data is ensured by their data centre measures; the scope of certification and security evidence are taken into account in supplier management. |
| Risk management | Binding criteria govern the assessment, treatment and acceptance of security risks, including their impact on customers and data subjects. |
| Continual improvement (CIP) | The effectiveness of the technical and organisational protective measures is reviewed regularly and as occasion requires. Identified improvements are implemented and their effectiveness is tracked. |
| Patch and change management | Security updates are prioritised on a risk basis. Changes are assessed and reviewed before implementation and documented in a traceable manner. |
| Segregation of duties | Responsibilities and authorities are defined. Incompatible tasks are separated or secured by additional controls. |
| Identity and access management | Identities and permissions are granted in a controlled manner, reviewed, and adjusted or revoked when changes occur or the need ceases. Access by persons and systems is limited to the necessary rights and information (least privilege and need-to-know). |
| Security incident and disruption management | Defined procedures cover the reporting, assessment, containment and resolution of security incidents and operational disruptions, as well as their documentation and follow-up. Section 5 of the DPA applies to notifications to customers. |
3. Operational retention periods
| Data set | Purpose and retention period |
|---|---|
| General log data | Access, application, system and error logs for operational monitoring, error analysis and troubleshooting: by default no more than 30 days from collection. Where there is a documented need, in particular to investigate a security incident, the log data required for this purpose may be retained for no more than 90 days from collection. The separate period for SIEM alerts remains decisive. |
| SIEM alerts | Detection, investigation and defence against security incidents: no more than 90 days from collection, insofar as necessary for this purpose. |
| Operational backup copies | Data backup and restoration by nyxory: no more than 30 days from creation of the respective backup copy. |
| Customer-managed backups | Storage in accordance with documented customer instructions until deletion by the customer or until expiry of a retention period set by the customer. Deletion instructions and the end of the contract are governed by Section 9 of the DPA. |
| Agent histories | Provision of the conversation and processing histories in customer projects: no more than 90 days from collection. |
| Stored gateway content | Storage of AI inputs and outputs only if activated by the customer per application; deactivated by default. The retention period is determined by the customer. Deletion instructions and the end of the contract are governed by Section 9 of the DPA. |
| Customer exports | Provision for the return of data under Section 9 of the DPA. Download links are valid for seven days; this validity does not determine the storage period of the export files. The retrieval period and deletion date are communicated upon provision. |
| Support and diagnostic data | Customer content in support cases, error analyses and diagnostic exports for handling the case: no more than 30 days after its closure. |
The periods for log, SIEM, agent, gateway, export and support data apply to the active data sets. Residual copies in operational backups are deleted when the backup copy expires, at the latest 30 days after its creation; once the active retention period has expired, no new backups of these residual copies are created. Customer-managed backups are separate from this. The selection of logged data and the necessity of the periods are documented and reviewed regularly. The overall periods for deletion instructions and the end of the contract under Section 9 of the DPA remain decisive without change; they are not extended by backup copies.
4. Sub-processors and processing locations
The allocation depends on the services booked; Section 4 of the DPA applies to AI processing.
| Provider | Task and relation to processing |
|---|---|
| Infomaniak Infomaniak Network AG Rue Eugène Marziano 25, 1227 Les Acacias (GE), Schweiz | Hosting of the standard SaaS platform and storage of the backup copies in a separate project; processing location: Switzerland (adequacy decision of the EU Commission). |
| STACKIT Schwarz Digits Cloud GmbH & Co. KG Am Campus 1, 74177 Bad Friedrichshall, Deutschland | Hosting of internal support and operations tools and AI processing as a fallback provider of the AI gateway for customer applications. Processing of personal contact, ticket, documentation and diagnostic data, insofar as necessary to provide the commissioned platform services. Processing location: Germany. |
| UpCloud UpCloud Oy Aleksanterinkatu 15 B, 7. Stock, 00100 Helsinki, Finnland | Prospectively, hosting of the internal support and operations tools. Processing of personal contact, ticket, documentation and diagnostic data, insofar as necessary to provide the commissioned platform services. Processing locations: Frankfurt (Germany) and Helsinki (Finland). |
| IONOS IONOS Cloud GmbH Elgendorfer Straße 57, 56410 Montabaur, Deutschland | Primary model provider of the AI gateway for customer applications; processing location: Germany. |
| TensorX TensorX Ltd Unit 25, Classon House, Dundrum Business Park, Dublin 14, Irland | Active model provider of the AI gateway for customer applications; processing locations: Dublin (Ireland) and Helsinki (Finland). |
| Lyceum Lyceum Technology Germany GmbH Alte Jakobstr. 86, TH7, 3. Stock, 10179 Berlin, Deutschland | Prospectively, additional model provider of the AI gateway for customer applications via serverless inference; processing locations: Paris (France) and Finland. |
| Hetzner Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Deutschland | Security monitoring (SIEM) as sub-processor for security-relevant events of the platform. Agreed processing locations: Nürnberg and Falkenstein (Germany) and Helsinki (Finland). The SIEM server is operated in Nürnberg. |
Administrative access regions of staff: European Economic Area (EEA) and Switzerland. Section 8 of the DPA applies.