Elena, Hannah and Alex

LEGAL INFORMATION – SERVICEPLAN AI COWORKERS

Elena

Privacy Notice for Elena

1. Controller and Contact

The controller responsible for the processing of personal data in connection with Elena is:

Plan.Net Studios GmbH & Co. KG
Friedenstraße 24, 81671 München
agentic@house-of-communication.com

You can contact our data protection officer at:

Dr. Georg F. Schröder, LL.M.
Serviceplan Group SE & Co. KG
Friedenstr. 24
81671 München
Deutschland
datenschutz@serviceplan.com

2. General Information on Data Processing

This privacy notice applies to the processing of personal data in connection with the use of Elena.

Elena is an Account and Project Management Partner that supports account management, project coordination, task management, scheduling, and internal communication. In order to provide this service, the following third-party services are used:

Microsoft 365 (email, documents, calendar access)
Anthropic Claude (AI model for analysis and content generation)

3. Categories of Personal Data

The following categories of personal data are processed by Elena:

User master data – e.g. name, account details, contact details
Content data – e.g. text entries, uploaded files, prompts, outputs
Usage data – e.g. logs of interactions, timestamps, frequency of use

4. Purposes, Legal Bases, Recipients and Retention Periods

The following provides an overview of the processing operations in our capacity as a controller. To the extent we process personal data in connection with your use of Elena, we process such data solely based on our instructions in our capacity as a processor. For further information, please see section 5 below:

User master data

Purpose: Provision and administration of user account, fulfilment of contractual obligations
Legal basis: Art. 6(1)(b) GDPR
Recipients: Internal departments, hosting providers
Retention period: For the duration of the contractual relationship and statutory retention periods

Usage data

Purpose: Ensuring IT security, prevention of misuse, service optimisation
Legal basis: Art. 6(1)(f) GDPR
Recipients: Internal IT, security service providers
Retention period: 6 months, unless longer storage is required for security incidents

5. Use of AI Agent

To the extent you (whether as a registered or unregistered User) provide personal data to us when you use our AI Agents (e.g. task assignment), we process such data – including your instructions, task parameters, and interaction metadata – solely as per your instructions as a processor based on a data processing agreement ("DPA").

To the extent you opt to use a third-party AI Agent, please note that:

If the Agent is provided by another third party, that third-party AI Agent provider is independently responsible for the data processing activities that occur in connection with the agent. In such cases, additional information about the processing may be made available by the third-party AI Agent Provider.

6. Source of Data

Where personal data are not collected directly from the end user, they originate from:

Publicly accessible sources (e.g. websites, social media)
Third parties who provide information for the use of the AI Agent

7. Recipients and Third-Country Transfers

Personal data are disclosed to processors and service providers who support the provision and operation of Elena (for example hosting providers, IT service providers, customer support). These recipients process personal data only on the basis of contractual agreements and in accordance with instructions.

8. Transfer based on Standard Contractual Clauses (SCC)

Personal data are transferred to recipients located in the United States. There is no adequacy decision by the European Commission for this country. To ensure an appropriate level of data protection, the transfer is carried out on the basis of Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 GDPR. A copy of these clauses can be obtained from us at any time.

9. Retention Period

Personal data are retained only for as long as necessary to achieve the purposes described in this privacy notice or as long as statutory retention obligations require. Where possible, the specific retention periods are set out in the table above. If exact periods cannot be specified, the criteria used to determine the retention period are applied, such as the expiry of statutory limitation periods (typically three years), statutory tax and accounting retention obligations (up to ten years), or the termination of the contractual relationship.

10. Automated Decision-Making and Profiling

Elena does not carry out automated decision-making within the meaning of Art. 22 GDPR.

11. Rights of Data Subjects

You have the following rights under the GDPR:

Right of access (Art. 15 GDPR) – to obtain confirmation as to whether personal data concerning you are being processed and to receive a copy of such data.
Right to rectification (Art. 16 GDPR) – to request the correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17 GDPR) – to request the deletion of personal data under the conditions set out in the GDPR.
Right to restriction of processing (Art. 18 GDPR) – to request that processing be limited in certain circumstances.
Right to object (Art. 21 GDPR) – to object to the processing of your personal data based on legitimate interests.
Right to data portability (Art. 20 GDPR) – to receive the personal data you have provided in a structured, commonly used and machine-readable format, and to transmit those data to another controller.

To exercise these rights, please contact us using the contact details provided above.

In addition, you have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR. You can usually contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement. A list of data protection supervisory authorities in the European Union, including contact details, is available here.

12. Obligation to Provide Data

The provision of certain personal data is necessary for the use of the AI Agent. Without these data, the service cannot be provided.

13. Amendments to this Privacy Notice

This privacy notice is updated whenever changes in the processing of personal data occur. The current version is always available within the Agent interface.

Agentic Service Terms

1. General Provisions

1.1 Plan.Net Studios GmbH & Co. KG, Friedenstraße 24, 81671 Munich (hereinafter "PNS") offers users (hereinafter "User") (PNS and the User hereinafter collectively referred to as the "Parties" and individually as a "Party") the opportunity to buy an agentic service (hereinafter "Agentic Service") on the Agentic Service Marketplace ("Marketplace") pursuant to the terms set out in these Agentic Service Terms. The Agentic Services are offered exclusively to merchants as defined in Section 1 para. 1 German Commercial Code (HGB).

1.2 These Agentic Service Terms apply to any Agentic Service that PNS offers on the Marketplace and is used by the User in exchange for virtual credits which are allocated to the User under a subscription plan, based on additional credit purchases or otherwise in accordance with the Marketplace Terms to Sell and Buy Agentic Services ("Marketplace Terms") which are available under https://www.sokosumi.com/de/terms-of-service. The use of the Agentic Services on the Marketplace is therefore subject to the User's agreement with the Marketplace Terms.

1.3 These Agentic Service Terms also apply to Agentic Services that PNS itself purchases from a third party ("Third Party Supplier") and resells to the User by making them available on the Marketplace. The use of any such Agentic Service provided by a Third Party Supplier shall be governed by these Agentic Service Terms which incorporate also the terms of the Third Party Supplier ("Third Party Terms"). The User has to agree to the Third Party Terms in addition to these Agentic Service Terms in order to use the Agentic Services. In the event of any conflict between the Agentic Service Terms and the Third Party Terms, the Agentic Service Terms shall prevail.

1.4 PNS may make Agentic Services available to the User for testing or demonstration purposes and free of charge prior to the conclusion of a subscription plan for the use of the Agentic Services through the Marketplace ("Pre-Contractual Use"). These Agentic Service Terms shall apply accordingly to any Pre-Contractual Use. Pre-Contractual Use is provided on a non-binding and availability-based ("as available") basis. PNS does not owe any specific scope of performance, any particular functionality, availability, quality, or any specific result of the Agentic Service. In particular, PNS shall have no obligations regarding error correction, maintenance, updates, support or reaction times. The User has no claim to be granted or to continue such Pre-Contractual Use. PNS' liability during Pre-Contractual Use shall be governed exclusively by Section 5; any further claims are excluded. Pre-Contractual Use does not create any obligation for either Party to subsequently enter into any subscription or other paid agreement.

2. Agentic Service

2.1 PNS shall make the Agentic Service available through the internet. PNS does not provide any maintenance, support or assistance services to the User under these Agentic Service Terms, unless expressly agreed otherwise. PNS is not obliged to deliver any enhancements, updates or similar changes for the Agentic Service to the User, but PNS may decide to do so if PNS considers this necessary to maintain the proper functioning or security of the Agentic Service. Agentic Service are performed as a contract for services according to Sections 611 et seqq. German Civil Code (BGB).

2.2 The Agentic Service is provided on an "as is" basis. This means that PNS does not provide any warranty or guarantee for the Agentic Service beyond any statutory warranty. The example displayed within the offering on the Marketplace is only an example and does not warrant a certain similarity or quality of output. PNS does in particular not make any representations or warranties regarding the quality, functionality, accuracy, usability, or reliability of the Agentic Service. All information and representations in marketing documents, on internet pages or other media outside of these Agentic Service Terms do not in any form constitute a warranty or guarantee. For any Pre-Contractual Use, PNS does not provide any warranties of any kind. The Agentic Service may be incomplete, erroneous, unavailable or unstable during such phase.

2.3 The Agentic Service is intended to be used according to the intended purpose described in the Agentic Service offering on the Marketplace. During Pre-Contractual Use, results generated by the Agentic Service may be inaccurate, incomplete, unavailable or unsuitable for the User's intended purpose. PNS assumes no responsibility that the Agentic Service or any output is fit for any particular purpose or use case.

2.4 The User agrees that PNS shall have the right to use subcontractors and purchase services from Third Parties in order to provide the Agentic Service.

2.5 PNS has the right, but is not obliged, to temporarily or permanently suspend or block the User's access to the Agentic Service if and to the extent that the User infringes its obligations under these Agentic Service Terms.

2.6 The User acknowledges that the proper functioning of the Agentic Services may require the User to provide certain information or may require the User to meet certain system requirements on its end, e.g., appropriate equipment, browser, internet connection, bandwidth or other resources, as may be specified in the documentation of the Agentic Service and updated from time to time. The User is responsible for implementing and maintaining such system requirements. PNS will have no liability for any delay or deficiency in the performance of the Agentic Service to the extent this results from the User's failure to meet the applicable system requirements or breach of its obligations under these Agentic Service Terms.

2.7 PNS will make the output of the Agentic Service available to the User within the 'Submit Results Time' described within the Agentic Service offering. The following events do not constitute a failure to meet the 'Submit Results Time': (a) emergency maintenances or (b) circumstances beyond PNS' reasonable control, such as force majeure, including, for example, an act of God, act of government, flood, fire, earthquake, civil unrest, epidemic, pandemic (e.g. Covid-19), act of terror, strike or other labor problem (other than one involving PNS' own employees), internet service provider failure or delay, cybersecurity or denial of service attacks which are not in PNS' responsibility.

2.8 If the User becomes aware of an outage, malfunction or degradation of the 'Submit Results Time' of the Agentic Service, the User shall promptly inform PNS and describe the symptoms of the issue in a detailed and reproducible manner, by sending an email to agentic@house-of-communication.com. PNS will use its best endeavors to analyze and respond to such faults with a reaction time of up to 4 hours during its normal business hours, 9:00 through 17:00 CET on working days in the State of Bavaria, Germany.

3. Rights and Obligations of the User and Restrictions on Use

3.1 The User does not have the right to download, install, or make copies of the Agentic Service, unless otherwise agreed. Subject to this Section 3.1, the User may not allow or tolerate any third party to use or access the Agentic Service. The User may allow access to and use of the Agentic Service to its affiliates or third-party contractors to the extent this is required to facilitate performance of a contract between such contractor and the User in connection with the User's use of Agentic Services; in such case, the User is fully responsible for any act or omission of the third party as if it was the User's own act or omission.

3.2 The User must adhere to the Acceptable Use Policy available under https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/acceptable-use.html.

3.3 The User is solely responsible for the selection, use, and results generated by its use of the Agentic Service (particularly the selection of an Agentic Service for a specific use case). The User is solely responsible for ensuring that its use of the Agentic Service complies with all applicable laws of a member state of the EU or any law applicable to these Agentic Service Terms ("Applicable Laws") and regulations, including any specific national or sectoral regulatory requirements applicable to the User. The Agentic Service is not a knowledge base, research tool or reference work. The output of the Agentic Service is calculated with artificial intelligence methods and is therefore a mathematical calculation of probabilities in the sense of the model, which is significantly based on the training data. The User understands and accepts that, given the probabilistic nature of AI, the use of the Agentic Service in some situations may produce erroneous results that do not accurately reflect real people, places, facts, or the desired output. The User therefore has the sole responsibility to evaluate the suitability of the output on a case-by-case basis, in particular by human verification of the results of the output. The User furthermore understands and acknowledges that artificial intelligence is a research and technology area that is rapidly evolving. It also cannot be ensured that output is unique compared to (i) the output of other customers and (ii) already existing works. The User must therefore ensure that a sufficient distance to already existing works is maintained when reusing the output. PNS is constantly working to improve its Agentic Services to make them more accurate, reliable, secure and useful.

4. Ownership, Intellectual Property and Third Party Content and Terms

4.1 Except for the rights explicitly granted to the User in these Agentic Service Terms, all rights, title and interest (including intellectual property rights) in the Agentic Service and the underlying technology remain with PNS and the Third Party Suppliers or licensors of PNS or the Third Party Suppliers respectively.

4.2 PNS grants the User a non-exclusive, non-transferable, non-sublicensable right to use the Agentic Service during the Term of these Agentic Service Terms, subject to the User's payment of the agreed fees.

4.3 PNS grants the User a non-exclusive, perpetual, non-transferable, non-sublicensable right to use the output of any Agentic Service, subject to the User's payment of the agreed fees.

4.4 The User grants PNS a non-exclusive, non-transferable, non-sublicensable right to use any and all information, data and content that the User processes in the Agentic Service to the extent this is required for the purpose of providing Agentic Service to the User. The User warrants that it owns or otherwise has secured all rights that are required to enable PNS to use such information, data and content for the performance of the Agentic Service without infringing the intellectual property rights or privacy rights of third parties.

4.5 The Agentic Service may include or interact with third-party services that may be subject to separate license terms of the respective Third Party Suppliers or third-party licensors. The User shall comply with the then-current version of any Third Party Terms if and as applicable. These currently include, in particular: Microsoft, Anthropic.

5. Limitation of Liability

5.1 PNS shall be fully liable for damages (i) which are based on an intentional or grossly negligent breach of duty by PNS or on an intentional or grossly negligent breach of duty by a legal representative of PNS or a vicarious agent of PNS, (ii) which result from the breach of a guarantee assumed by PNS, (iii) from a fraudulently concealed defect, (iv) from injury to life, body or health resulting from a negligent breach of duty by PNS or an intentional or negligent breach of duty by a legal representative of PNS or a vicarious agent of PNS, and (v) under the Product Liability Act (ProdHaftG).

5.2 In case of a breach caused by ordinary negligence of obligations whose fulfillment is essential for the proper performance of these Agentic Service Terms, whose breach jeopardizes the achievement of the purpose of these Agentic Service Terms and on whose compliance the User regularly relies (Kardinalpflicht), PNS liability shall be limited to the typically foreseeable damage. Any other liability for damages caused by ordinary negligence is excluded.

5.3 The User agrees that the liability as set out in Section 5.2 shall moreover not exceed the total amount of remuneration paid by the User under these Agentic Service Terms in the contract year in which the claim arises. The liability of PNS for all damages under these Agentic Service Terms falling under Section 5.2 shall therefore be limited in aggregate to the aforementioned amounts.

5.4 Deviating from Section 5.3 above, the User agrees that damages or costs arising from the loss of revenue, profit or data shall furthermore be limited to 50% of the total amount of remuneration paid by the User under these Agentic Services Terms of the contract year in which the claim arises.

5.5 PNS is not liable for data protection violations committed by the User to the detriment of its own customers, employees or other third parties.

5.6 For any Pre-Contractual Use provided free of charge, PNS shall only be liable for damages caused by intent or gross negligence; Section 5.1 remains unaffected.

5.7 The above limitations of liability also apply to the personal liability of employees, representatives, organs and vicarious agents of PNS.

6. Confidential Information

6.1 Each Party shall treat Confidential Information confidentially, protect it from access by third parties by means of confidentiality measures appropriate to the circumstances and use it only for the purposes of these Agentic Service Terms. "Confidential Information" are all information which one Party discloses or makes available to the other Party orally, in writing or in any other (e.g. electronic) form and which are either labelled as confidential or which a recipient acting with the care of a prudent businessman would reasonably consider confidential, in particular technical and commercial information, such as, for example business and trade secrets, information of a scientific, industrial or commercial nature, in particular product and marketing plans and information about customers, suppliers and (development) clients, as well as processes, algorithms, software and source code, data, drawings, drafts, sketches, plans, descriptions, specifications, measurement results, calculations, experience, procedures, samples, secret technical know-how or as yet unpublished applications for technical property rights. Information is not Confidential Information if it demonstrably:

was already known to the receiving Party at the time of disclosure by the disclosing Party;
was already publicly known at the time of disclosure by the disclosing Party or becomes publicly known at a later date, unless this is due to a breach of these Agentic Service Terms by the receiving Party;
has been disclosed to the receiving Party by a third party without the third party having acted unlawfully in obtaining or disclosing the information concerned or having breached a confidentiality obligation in favor of the disclosing Party; or
has been created or developed by the receiving Party itself or was created or developed on behalf of the receiving Party independently of knowledge of the Confidential Information.

6.2 Each Party shall ensure that its employees and other third parties involved also maintain the confidentiality described above. Third parties do not include professional consultants of the Party who are subject to statutory or professional confidentiality obligations and who are involved in the establishment, assessment or implementation of the cooperation within the scope of these Agentic Service Terms on behalf of a Party.

6.3 The confidentiality and purpose limitation shall also apply to such Confidential Information that a company affiliated with one Party discloses directly to the other Party or to a company affiliated with this Party. Each Party shall ensure that the companies affiliated with it also keep such Confidential Information secret and use it solely for the permitted purpose.

6.4 The receiving Party also undertakes not to reverse engineer, decompile, disassemble or otherwise examine the composition and/or production of Confidential Information of a disclosing Party, unless the disclosing Party has expressly agreed to this in writing in advance.

6.5 The confidentiality obligation shall remain in force for 5 years after termination of these Agentic Service Terms.

7. Compliance

7.1 Each Party is responsible for compliance with the statutory obligations applicable to it (including tax obligations). PNS is in particular not responsible for the fulfillment of the User's industry-specific, statutory or regulatory requirements. The User shall review the suitability of the Agentic Service for use in accordance with the industry-specific, legal and regulatory requirements applicable to the User.

8. General Provisions

8.1 These Agentic Service Terms and any claim, dispute or controversy arising out of or relating to these Agentic Service Terms shall be governed by and construed in accordance with the laws of Germany, without giving effect to its conflict of law provisions. The courts of Munich, Germany shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Agentic Service Terms (including non-contractual disputes or claims). The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply.

8.2 The Agentic Service may not be used by a User based in any US, UK, EU or Japan embargoed country.

8.3 All notices, consents, waivers and other communications required or permitted under these Agentic Service Terms must be in English or German and in text form.

8.4 The Parties are independent contractors, and at no time will either party be deemed to be the agent or employee of the other party. No joint venture, partnership, agency, or other relationship will be created or implied between the Parties as a result of these Agentic Service Terms. Except as expressly set forth in these Agentic Service Terms, each Party will bear full and sole responsibility for its own expenses and costs of operation. Furthermore, neither Party will have the authority to, and will not purport to, enter into any contract on behalf of the other Party, or commit it to any obligation.

8.5 There are no third-party beneficiaries under these Agentic Service Terms.

8.6 If any provision of these Agentic Service Terms is found by a court of competent jurisdiction to be invalid or unenforceable, these Agentic Service Terms shall remain in full force and effect. It is the explicit intention of the Parties to maintain the validity of the remaining provisions under all circumstances. Section 139 German Civil Code (BGB) shall not apply.

8.7 Neither Party may assign its rights or obligations under these Agentic Service Terms without the prior written consent of the other Party.

8.8 General terms and conditions of the User shall not apply even if these Agentic Service Terms are concluded with knowledge of them and PNS does not separately object to their validity. Deviating or contradictory terms shall only apply if they have been expressly accepted by PNS in writing. The User acknowledges that in entering into these Agentic Service Terms, the User has not relied on any oral or written statements, securities, or other warranties, representations, or undertakings made by or on behalf of PNS at any time prior to the signing of these Agentic Service Terms with respect to the subject matter hereof, other than those set forth in these Agentic Service Terms.

8.9 If PNS processes personal data on behalf of User, the parties will conclude a data processing addendum based on the template in Elena's agent interface on the Marketplace.

Data Processing Agreement Terms

These Data Processing Agreement Terms ("DPA") form an integral part of the AGREEMENT to the extent PROVIDER processes personal data of the CUSTOMER based on CUSTOMER's instructions under the Agreement. As per this DPA, CUSTOMER is acting as the controller of personal data as defined in the General Data Protection Regulation ("CONTROLLER") whilst the PROVIDER is acting as the processor as stipulated in the General Data Protection Regulation ("PROCESSOR"). Both are hereinafter collectively referred to as the "PARTIES" and individually a "PARTY".

Unless otherwise defined in this DPA, the definitions of the AGREEMENT apply to this DPA.

1. General Provisions

1.1 The PROCESSOR shall process personal data only on behalf of and in accordance with the documented instructions of the CONTROLLER, under and for the purposes of the AGREEMENT and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable data protection laws.

1.2 The CONTROLLER has selected the PROCESSOR as a supplier in accordance with the duty of care under applicable data protection laws. This DPA constitutes the data processing agreement within the meaning of Art. 28 GDPR, governing the rights and obligations of the PARTIES with respect to data processing.

1.3 "PERSONAL DATA" or "DATA" means any information relating to an identified or identifiable natural person (hereinafter referred to as "DATA SUBJECT").

1.4 The term "PROCESSING" shall be understood in a broad sense. This includes any operation or series of operations carried out with or without the use of automated procedures in connection with PERSONAL DATA, such as collection, gathering, organization, arrangement, storage, adaptation or modification, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, matching or linking, restriction, deletion or destruction.

1.5 "INSTRUCTION" means an instruction by the CONTROLLER to the PROCESSOR, issued in a documented form, to perform a specific action regarding PERSONAL DATA (e.g. anonymization, blocking, deletion, disclosure). If necessary, an INSTRUCTION can be issued orally or by telephone; such INSTRUCTIONS shall be confirmed by the CONTROLLER without undue delay in a documented form.

1.6 The CONTROLLER retains all rights in the DATA. At the request or upon termination of the Agreement, PROCESSOR shall return or delete the DATA in accordance with this DPA. The PROCESSOR shall not assert any right of retention over the CONTROLLER's DATA, except where required by applicable law.

2. Scope and Purpose of Processing

2.1 The purpose of this DPA is to set out the scope, purpose and subject matter of the DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under the Agreement.

2.2 The PROCESSOR shall process PERSONAL DATA solely to the extent necessary for providing, administering, and operating the SOFTWARE under the Agreement and only in accordance with the CONTROLLER's INSTRUCTIONS.

2.3 The categories of DATA SUBJECTS and types of PERSONAL DATA processed are specified in Appendix 1.

2.4 The PROCESSING of special categories of PERSONAL DATA within the meaning of Art. 9 GDPR may occur where necessary for the provision of the services and where the CONTROLLER has lawfully collected such DATA and provided INSTRUCTIONS for their processing.

3. Controller's Rights and Obligations

3.1 The CONTROLLER is the controller in the meaning of applicable data protection laws with respect to PROCESSOR's PROCESSING of the DATA. The CONTROLLER will decide about the admissibility of the PROCESSING.

3.2 The CONTROLLER may at any time issue additional or amended INSTRUCTIONS regarding the purpose, type and scope of PROCESSING.

3.3 The CONTROLLER will be responsible for ensuring DATA SUBJECTS' rights. DATA SUBJECTS' rights are to be exercised towards the CONTROLLER.

3.4 The CONTROLLER may inform the PROCESSOR of any error of irregularity in the PROCESSING of the DATA by the PROCESSOR.

4. Processor's Obligations and Responsibilities

4.1 The PROCESSOR shall process DATA only within the scope of the Agreement and this DPA, including any INSTRUCTIONS issued by the CONTROLLER.

4.2 The PROCESSOR shall not make copies of PERSONAL DATA for its own purposes. Copies may be made only where necessary to provide the services, ensure proper PROCESSING (including backups and redundancy), or comply with legal obligations.

4.3 The PROCESSOR shall support the CONTROLLER in any inspections or information requests by competent supervisory authorities relating to the PROCESSING under this DPA and shall promptly inform the CONTROLLER of any such inquiries or measures that concern the CONTROLLER's DATA.

4.4 Where required by law, the PROCESSOR shall appoint a data protection officer and provide the CONTROLLER with the officer's contact details. If no DPO is required, the PROCESSOR shall designate a contact point for data protection matters.

4.5 The PROCESSOR shall, without undue delay, inform the CONTROLLER if and why the PROCESSOR deems certain INSTRUCTIONS unlawful.

4.6 The PROCESSOR shall, upon reasonable request, provide the CONTROLLER with the information necessary to enable the CONTROLLER to maintain accurate and up-to-date records of processing activities in accordance with Art. 30 GDPR and other applicable data protection laws.

4.7 The PROCESSOR shall, to the extent reasonably required, assist the CONTROLLER in fulfilling its obligations under Art. 32 to 36 GDPR, including data security, data protection impact assessments, and prior consultations with supervisory authorities. Such assistance shall consist of providing relevant documentation, technical information, or cooperation as reasonably necessary to demonstrate compliance, taking into account the nature of the PROCESSING and the information available to the PROCESSOR.

4.8 If the PROCESSOR is required to disclose the DATA or information about the PROCESSING or this DPA, the PROCESSOR shall inform the CONTROLLER in writing and prior to such disclosure about the recipients, the time and the content of the disclosure as well as the legal grounds.

4.9 The PROCESSOR shall, upon reasonable request, correct, delete or block DATA in accordance with the CONTROLLER's INSTRUCTIONS and applicable law. The PROCESSOR shall confirm completion upon request by the CONTROLLER. Legal data retention obligations remain unaffected.

4.10 The PROCESSOR shall implement and maintain procedures to ensure compliance with this DPA and applicable data protection laws. Upon reasonable request, the PROCESSOR shall provide evidence of compliance (e.g., ISO 27001, SOC 2, or equivalent documentation).

4.11 If the CONTROLLER's PERSONAL DATA stored by the PROCESSOR were to become endangered due to attachment or sequestration, insolvency or composition proceedings or other events or measures by third parties, the PROCESSOR shall inform the CONTROLLER hereof without undue delay. The PROCESSOR shall inform all persons responsible in this context without undue delay that the rights to and ownership of the DATA lie solely with the CONTROLLER.

5. Data Breach Notification

5.1 In the event of a breach of PERSONAL DATA, the PROCESSOR shall notify the CONTROLLER without undue delay, and in any case no later than 48 hours after becoming aware of the breach.

5.2 The notification shall at least:

5.2.1 describe the nature of the breach of PERSONAL DATA including, where possible, the categories and approximate number of DATA SUBJECTS and data records concerned;

5.2.2 communicate the name and contact details of the PROCESSOR's data protection officer or other contact point;

5.2.3 describe the likely consequences of the breach of PERSONAL DATA; and

5.2.4 describe the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

5.3 The PROCESSOR shall cooperate fully with and assist the CONTROLLER in complying with the CONTROLLER's obligations under Art. 33 and 34 GDPR.

6. Data Subjects' Rights

6.1 If a DATA SUBJECT contacts the PROCESSOR directly for the purpose of access, correction, deletion or blocking, restriction of processing or objection with regard to DATA concerning him, the PROCESSOR shall immediately forward this request to the CONTROLLER. The PROCESSOR will not contact the DATA SUBJECT concerned, unless the CONTROLLER has instructed the PROCESSOR to do so. Information may only be provided upon prior instruction by the CONTROLLER.

6.2 Upon first request, the PROCESSOR shall support the CONTROLLER in fulfilling the claims of DATA SUBJECTS for access, correction, blocking or deletion, restriction of processing or objection. This includes in particular that the PROCESSOR informs the CONTROLLER within a reasonable timeframe, of the information required to fulfil the claim.

7. Sub-Processors

7.1 The CONTROLLER generally authorizes the PROCESSOR to engage with sub-processors for the purposes of data processing outlined in this DPA, provided the PROCESSOR complies with the obligations stipulated under this Clause 7. An overview of all currently used sub-processors is available at https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/legal-ai-coworkers/Subcontractors.html. The third-party AI Agents used (i.e. sub-processors in this context) are available at https://www.sokosumi.com/de. Depending on which additional third-party AI Agents the AI Agent engaged by the CONTROLLER on the platform decides to use, the sub-processor(s) engaged may vary, are specifically listed in each job summary report, and can be accessed via a link to https://www.sokosumi.com/de. Changes and/or updates to the third-party AI Agents used (sub-processors) are available at https://www.sokosumi.com/de, thereby allowing the CONTROLLER to opt which AI Agent to choose.

7.2 The PROCESSOR shall carefully select sub-processors and ensure that they provide sufficient guarantees to implement appropriate technical and organizational measures.

7.3 The PROCESSOR shall ensure that sub-processors are bound by written contracts imposing the same data protection obligations as set out in this DPA, in particular with respect to security and confidentiality. The PROCESSOR shall remain fully liable for the performance of sub-processors.

7.4 Upon request, the PROCESSOR shall provide the CONTROLLER with the main data protection terms agreed with the sub-processor.

7.5 The PROCESSOR shall exercise towards its sub-processors the same audit and control rights that the CONTROLLER has towards the PROCESSOR under this DPA. The PROCESSOR shall monitor its sub-processors' compliance on a regular basis and provide relevant evidence to the CONTROLLER upon request. Upon the CONTROLLER's request, the PROCESSOR shall provide copies of such audit documentation or other relevant evidence. The CONTROLLER's audit rights under Clause 9 remain unaffected and may also be exercised in relation to sub-processors through the PROCESSOR.

7.6 Insofar as the involvement of a sub-processor involves the transfer of data to third countries, this transfer is covered by the authorization pursuant to Clause 7.1 and requires appropriate safeguards in accordance with Art. 44 et seq. GDPR. The PROCESSOR shall ensure that appropriate safeguards (e.g., standard contractual clauses, adequacy decision of the EU Commission) are implemented for international data transfers and shall provide evidence of this upon request.

8. Audit Rights

8.1 Audits shall primarily be conducted remotely, and may include the review of existing certifications, audit reports, or equivalent documentation. On-site audits shall be permitted only where remote audits do not provide sufficient assurance or in case of a justified suspicion of non-compliance.

8.2 Audits may be carried out no more than once per year, unless required by a supervisory authority or justified by a specific incident.

8.3 The PROCESSOR shall make available to the CONTROLLER all information reasonably necessary to demonstrate compliance with this Agreement and Art. 28 GDPR.

8.4 The CONTROLLER may request relevant information from the PROCESSOR's data protection officer or another qualified privacy contact regarding data protection compliance and technical and organizational measures.

8.5 The CONTROLLER may engage third parties to exercise audit rights. The PROCESSOR must tolerate and support the actions of such a third party in the same way as actions by the CONTROLLER. Audits shall be carried out during regular business hours, upon reasonable notice, and in a manner that does not unreasonably disrupt the PROCESSOR's operations.

9. Data Secrecy

9.1 The PROCESSOR is under the obligation to protect data secrecy when PROCESSING DATA for the CONTROLLER.

9.2 The PROCESSOR shall ensure that all personnel authorized to process PERSONAL DATA are subject to appropriate confidentiality obligations and receive adequate data protection training.

10. Technical and Organizational Measures

10.1 The PROCESSOR shall implement technical and organizational measures necessary to ensure compliance with the applicable data protection law.

10.2 Since technical and organizational measures are subject to technological developments, the PROCESSOR shall be entitled to modifying the technical and organizational measures provided such modification does not decrease the level of data protection and data security beneath what is required by law and under this DPA.

10.3 Upon request, the PROCESSOR shall provide documentation demonstrating that appropriate technical and organizational measures are in place and kept up to date.

10.4 The PROCESSOR shall immediately inform the CONTROLLER in writing, without request, of any significant changes in the technical and organizational measures.

11. Term

11.1 This DPA automatically terminates upon expiration or termination of the AGREEMENT.

12. Destruction, Deletion and Return of Data

12.1 Upon termination of this DPA, the PROCESSOR is prohibited from collecting or using the CONTROLLER's DATA. Further storage of DATA collected during the term of the DPA is only permitted to the extent necessary for the purpose of deletion, destruction or return to the CONTROLLER.

12.2 Unless instructed otherwise, the PROCESSOR shall irretrievably delete or destroy PERSONAL DATA using industry-standard secure deletion methods (e.g., DIN 66399, NIST SP 800-88, or comparable).

12.3 The PROCESSOR shall inform the CONTROLLER prior to permanent deletion of PERSONAL DATA, unless otherwise instructed. The PROCESSOR shall document deletion or destruction and provide such documentation to the CONTROLLER upon request. Statutory retention obligations remain unaffected.

Appendix 1: Data Subjects and Data Categories

This Appendix describes the scope of the PERSONAL DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under this DPA.

1. Purpose of Processing

The PROCESSOR processes PERSONAL DATA solely for the purpose of performing, administering, and operating the SOFTWARE as defined in the AGREEMENT.

2. Categories of Data Subjects

The PROCESSING may concern the following categories of DATA SUBJECTS:

End users of the CONTROLLER who interact with the SOFTWARE (e.g., customers, clients, or website visitors);

Employees, contractors, or other representatives of the CONTROLLER who use or administer the SOFTWARE;

Employees or contractors of the PROCESSOR with authorized access, limited to what is necessary for operation, support, or maintenance;

Other individuals whose PERSONAL DATA are submitted to the PROCESSOR by or on behalf of the CONTROLLER through the SOFTWARE.

3. Categories of Personal Data

The PROCESSING may include the following categories of PERSONAL DATA:

User master data – e.g. name, account details, contact details

Content data – e.g. text entries, uploaded files, prompts, outputs

Usage data – e.g. logs of interactions, timestamps, frequency of use

Technical data – e.g. IP address, device type, browser information

Payment data – e.g. billing details, transaction IDs (if applicable)

4. Special Categories of Data

The PROCESSING of special categories of PERSONAL DATA within the meaning of Art. 9 GDPR (e.g. health, biometric, or other sensitive data) may occur only where such DATA are lawfully collected and provided by the CONTROLLER and where the CONTROLLER has instructed the PROCESSOR to process such DATA.

In such cases, the PROCESSOR shall implement appropriate technical and organizational measures to ensure a level of protection corresponding to the sensitivity of the DATA.

5. Nature and Purpose of Processing Activities

The PROCESSING includes, as necessary for the provision of the contracted SOFTWARE and related platform services, the collection, storage, transmission, and limited use of PERSONAL DATA, as well as related activities required for support, maintenance, and compliance with legal obligations. All PROCESSING is strictly limited to what is necessary for the operation and provision of the SOFTWARE and the underlying infrastructure as described in the AGREEMENT.

6. Duration of Processing

PERSONAL DATA shall be processed for the duration of the AGREEMENT, and shall be deleted or returned in accordance with Clause 12 of this DPA upon termination, unless longer retention is required by applicable law or agreed in writing by the Parties.

Appendix 3: Technical and Organizational Measures (TOMs)

This Appendix describes the technical and organizational measures implemented by the PROCESSOR for the agentic services provided under this DPA, pursuant to Art. 32 GDPR. It supplements the obligations in the main DPA; procedural obligations governed there (breach notification, sub-processor management, data deletion) are not repeated here.

Processing Overview

Elena (Account & Project Management Partner) processes data through the following chain: the agent receives task and project data from the CONTROLLER via Microsoft Teams, sends it to the Anthropic Claude API for LLM-based analysis, and delivers structured results back to the CONTROLLER. The agent services are hosted on a managed runtime environment and delivered via a secure marketplace platform. In addition, Elena maintains a persistent memory system for relationship management and project context continuity, as described in Section 3a.

Anthropic (Claude API)

Role: LLM processing

Key Security Facts: SOC 2 Type II, ISO 27001, ISO 42001. AES-256 at rest, TLS 1.2+ in transit. 7-day retention (ZDR available). No training on customer data.

Microsoft Corporation (Microsoft 365)

Role: Collaboration platform

Key Security Facts: SOC 2 Type II, ISO 27001. AES-256 at rest, TLS 1.2+ in transit. EU Data Boundary available. DPA under Microsoft Product Terms.

1. Access Control and User Management

Authentication
MFA for production access. API keys for service-to-service communication, stored in encrypted environment variables.

Authorization
Role-based access control with least-privilege principle. Agent components operate with minimal required permissions.

Access lifecycle
Quarterly access reviews. Immediate deprovisioning on role change or departure.

2. Physical and Environmental Security

All processing takes place on cloud infrastructure operated by certified providers (ISO 27001 / SOC 2). The PROCESSOR does not operate own data centers. Physical security of sub-processor infrastructure (Anthropic, data API providers) is governed by their respective certifications and DPAs.

3. Encryption and Pseudonymisation

In transit
TLS 1.2+ for all communications between agent components and external APIs.

At rest
AES-256 encryption on cloud storage. Anthropic encrypts all data at rest with AES-256.

Pseudonymisation
User input queries are pseudonymised through a two-layer architecture:

Layer 1 — Kodosumi Infrastructure (by Architecture)
The agent processing layer (Kodosumi/Ray cluster) stores only a technical session ID (user_id); no name, email address, or other directly identifying information is present at this layer. The mapping between user_id and the natural person is held exclusively by the Sokosumi platform and never flows into the agent infrastructure. As a result, input queries stored in the Kodosumi execution database are already pseudonymised at rest — they cannot be attributed to a specific individual without access to the Sokosumi user registry.

Layer 2 — Anthropic Claude API (Zero Data Retention)
Query content transmitted to the Anthropic Claude API is processed under Zero Data Retention (ZDR) terms. Anthropic does not persist query data beyond the duration of the API call and does not use it for model training. The query is effectively discarded after the response is returned.

Retention and Deletion
Execution records including input queries stored in the Kodosumi runtime database are automatically deleted after 6 months. This retention period reflects the minimum operationally required for support and auditability purposes. In the event that a query incidentally contains personal data of a natural person (e.g., a name included in a research request), this data is subject to the same 6-month retention limit and is not accessible outside the Kodosumi execution environment.

Layer 3 — Agent Memory (Persistent Storage)
Contact data including names and email addresses is stored in a dedicated PostgreSQL database with AES-256 encryption at rest (Azure-managed). Access is restricted to the specific agent instance (Elena) via agent_id isolation. Memory data is not transmitted to the LLM provider for persistent storage — it is loaded into the prompt context at runtime and processed by Anthropic under ZDR terms. After each API call, the prompt content is discarded by Anthropic.

3a. Agent Memory Layer

In addition to the platform-level processing described above, Elena maintains a persistent memory system for relationship management and project context continuity. This memory stores contact profiles, interaction summaries, and project-related observations in a dedicated PostgreSQL database under the PROCESSOR's direct control, separate from the Kodosumi execution environment.

Contact profiles
Name, email, company, role, project associations. Stored in PostgreSQL with AES-256 encryption at rest (Azure-managed). Access isolated per agent via agent_id. Not transmitted to Anthropic for storage; loaded into prompt context at runtime under ZDR terms.

Observations
Project-related insights, preferences, and context noted by the agent during interactions. Stored with vector embeddings (Voyage AI, 1024-dim) for semantic retrieval. Linked to contacts via junction table. Cascading deletion when contact is removed.

Reflections
End-of-interaction synthesis including project patterns and learnings. Stored with vector embeddings for semantic similarity search. Referenced by contact_id.

Activity log
Record of all agent responses and actions. Includes interface source (Teams, email) and timestamps. Referenced by contact_id.

Retention and Deletion: Memory data is retained for the duration of the business relationship. Contact profiles, observations, reflections, and activity records are deleted within 6 months of the last interaction or upon user request. Deletion of a contact record cascades to all linked observations. The CONTROLLER or data subject may request complete erasure of all memory data associated with their identity at any time.

4. System and Network Security

Network isolation
Production systems deployed in isolated network segments. Traffic restricted to necessary ports and endpoints.

Vulnerability management
Regular patching of dependencies. Code review before deployment.

Monitoring
Centralised logging of agent executions. Anomaly alerting on error rates and unexpected behavior.

5. Incident Response and Business Continuity

Breach notification procedures and timelines are governed by Section 5 of the DPA.

Incident response
Documented incident response plan with defined roles and escalation paths. Post-incident root cause analysis.

Availability
Automatic scaling and failover capabilities of the hosting environment. Regular backups of persistent storage with tested recoverability. Execution data in the agent runtime is transient and subject to the standard retention cycle described in Section 3.

6. Data Protection by Design and by Default

Data minimisation
Agents request only the data needed for the specific task. Prompt engineering prohibits unnecessary collection of personal data. Memory observations are generated autonomously based on interaction patterns; system prompts instruct the agent to avoid storing unnecessary personal data in observations.

Privacy by default
Shortest available sub-processor retention periods selected. Results delivered only to authorised recipients. Memory data access is isolated per agent instance; cross-agent data visibility is prevented by design.

Output quality
Anti-hallucination validation against source data. Structured outputs with source attribution.

7. Personnel Measures

Confidentiality obligations are governed by Section 8 of the DPA. In addition, developers receive training on privacy-by-design for LLM-based systems, including prompt engineering for data minimisation and anti-hallucination techniques.

8. Review and Evaluation

These TOMs are reviewed at least annually and updated as needed. Material changes are notified to the CONTROLLER in advance.

Last reviewed: 02.03.2026

Hannah

Privacy Notice for Hannah

1. Controller and Contact

The controller responsible for the processing of personal data in connection with Hannah is:

Plan.Net Studios GmbH & Co. KG
Friedenstraße 24, 81671 München
agentic@house-of-communication.com

You can contact our data protection officer at:

Dr. Georg F. Schröder, LL.M.
Serviceplan Group SE & Co. KG
Friedenstr. 24
81671 München
Deutschland
datenschutz@serviceplan.com

2. General Information on Data Processing

This privacy notice applies to the processing of personal data in connection with the use of Hannah.

Hannah is a Marketing Research Partner that conducts market research, SEO analysis, audience profiling, competitive intelligence, social media research, and document creation. In order to provide this functionality, personal data of users and, where applicable, third parties are processed using the following third-party services:

GWI Spark, DataForSEO, Statista, Exa Labs (Exa.AI), Apify, X, Tavily, HybridAI, ScreenshotOne, Gamma (data research, web intelligence, and visual content)
Microsoft 365 (email, documents, calendar access), WordPress.com (blog publishing)
Anthropic Claude (AI model for analysis and content generation)

3. Categories of Personal Data

The following categories of personal data are processed by Hannah:

User master data – e.g. name, account details, contact details
Content data – e.g. text entries, uploaded files, prompts, outputs
Usage data – e.g. logs of interactions, timestamps, frequency of use
Third-party public data – e.g. publicly available social media profiles, handles, bios, posts, and engagement metrics

4. Purposes, Legal Bases, Recipients and Retention Periods

The following provides an overview of the processing operations. To the extent we process personal data in connection with your use of Hannah, we process such data solely based on our instructions in our capacity as a processor. For further information, please see section 5 below:

User master data

Purpose: Provision and administration of user account, fulfilment of contractual obligations
Legal basis: Art. 6(1)(b) GDPR
Recipients: Internal departments, hosting providers
Retention period: For the duration of the contractual relationship and statutory retention periods

Usage data

Purpose: Ensuring IT security, prevention of misuse, service optimisation
Legal basis: Art. 6(1)(f) GDPR
Recipients: Internal IT, security service providers
Retention period: 6 months, unless longer storage is required for security incidents

Third-party public data

Purpose: Social media research, competitive analysis, audience profiling based on publicly available information
Legal basis: Art. 6(1)(f) GDPR
Recipients: Internal systems, subcontracted processors (e.g. Apify, X)
Retention period: Deleted after 6 months or upon user request

5. Use of AI Agent

5.1 To the extent you (whether as a registered or unregistered User) provide personal data to us when you use our AI Agents (e.g. task assignment), we process such data – including your instructions, task parameters, and interaction metadata – solely as per your instructions as a processor based on a data processing agreement ("DPA").

5.2 To the extent you opt to use a third-party AI Agent, please note that:

6. Source of Data

Where personal data are not collected directly from the end user, they originate from:

Publicly accessible sources (e.g. websites, social media)
Third parties who provide information for the use of the AI Agent

7. Recipients and Third-Country Transfers

Personal data are disclosed to processors and service providers who support the provision and operation of Hannah (for example hosting providers, IT service providers, customer support). These recipients process personal data only on the basis of contractual agreements and in accordance with instructions.

Transfer based on Standard Contractual Clauses (SCC)

8. Retention Period

9. Automated Decision-Making and Profiling

Hannah does not carry out automated decision-making within the meaning of Art. 22 GDPR.

10. Rights of Data Subjects

You have the following rights under the GDPR:

Right of access (Art. 15 GDPR) – to obtain confirmation as to whether personal data concerning you are being processed and to receive a copy of such data.
Right to rectification (Art. 16 GDPR) – to request the correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17 GDPR) – to request the deletion of personal data under the conditions set out in the GDPR.
Right to restriction of processing (Art. 18 GDPR) – to request that processing be limited in certain circumstances.
Right to object (Art. 21 GDPR) – to object to the processing of your personal data based on legitimate interests.
Right to data portability (Art. 20 GDPR) – to receive the personal data you have provided in a structured, commonly used and machine-readable format, and to transmit those data to another controller.

To exercise these rights, please contact us using the contact details provided above.

11. Obligation to Provide Data

The provision of certain personal data is necessary for the use of the AI Agent. Without these data, the service cannot be provided.

12. Amendments to this Privacy Notice

This privacy notice is updated whenever changes in the processing of personal data occur. The current version is always available within the Agent interface.

Agentic Service Terms

1. General Provisions

2. Agentic Service

2.4 The User agrees that PNS shall have the right to use subcontractors and purchase services from Third Parties in order to provide the Agentic Service.

3. Rights and Obligations of the User and Restrictions on Use

3.2 The User must adhere to the Acceptable Use Policy available under https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/acceptable-use.html.

4. Ownership, Intellectual Property and Third Party Content and Terms

4.3 PNS grants the User a non-exclusive, perpetual, non-transferable, non-sublicensable right to use the output of any Agentic Service, subject to the User's payment of the agreed fees.

5. Limitation of Liability

5.5 PNS is not liable for data protection violations committed by the User to the detriment of its own customers, employees or other third parties.

5.6 For any Pre-Contractual Use provided free of charge, PNS shall only be liable for damages caused by intent or gross negligence; Section 5.1 remains unaffected.

5.7 The above limitations of liability also apply to the personal liability of employees, representatives, organs and vicarious agents of PNS.

6. Confidential Information

(1) was already known to the receiving Party at the time of disclosure by the disclosing Party;
(2) was already publicly known at the time of disclosure by the disclosing Party or becomes publicly known at a later date, unless this is due to a breach of these Agentic Service Terms by the receiving Party;
(3) has been disclosed to the receiving Party by a third party without the third party having acted unlawfully in obtaining or disclosing the information concerned or having breached a confidentiality obligation in favor of the disclosing Party; or
(4) has been created or developed by the receiving Party itself or was created or developed on behalf of the receiving Party independently of knowledge of the Confidential Information.

6.5 The confidentiality obligation shall remain in force for 5 years after termination of these Agentic Service Terms.

7. Compliance

8. General Provisions

8.2 The Agentic Service may not be used by a User based in any US, UK, EU or Japan embargoed country.

8.3 All notices, consents, waivers and other communications required or permitted under these Agentic Service Terms must be in English or German and in text form.

8.5 There are no third-party beneficiaries under these Agentic Service Terms.

8.7 Neither Party may assign its rights or obligations under these Agentic Service Terms without the prior written consent of the other Party.

8.9 If PNS processes personal data on behalf of User, the parties will conclude a data processing addendum based on the template of PNS available in Hannah's agent interface on the Marketplace.

Data Processing Agreement Terms

Unless otherwise defined in this DPA, the definitions of the AGREEMENT apply to this DPA.

1. General Provisions

The PROCESSOR shall process personal data only on behalf of and in accordance with the documented instructions of the CONTROLLER, under and for the purposes of the AGREEMENT and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable data protection laws.

The CONTROLLER has selected the PROCESSOR as a supplier in accordance with the duty of care under applicable data protection laws. This DPA constitutes the data processing agreement within the meaning of Art. 28 GDPR, governing the rights and obligations of the PARTIES with respect to data processing.

"PERSONAL DATA" or "DATA" means any information relating to an identified or identifiable natural person (hereinafter referred to as "DATA SUBJECT").

The term "PROCESSING" shall be understood in a broad sense. This includes any operation or series of operations carried out with or without the use of automated procedures in connection with PERSONAL DATA, such as collection, gathering, organization, arrangement, storage, adaptation or modification, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, matching or linking, restriction, deletion or destruction.

"INSTRUCTION" means an instruction by the CONTROLLER to the PROCESSOR, issued in a documented form, to perform a specific action regarding PERSONAL DATA (e.g. anonymization, blocking, deletion, disclosure). If necessary, an INSTRUCTION can be issued orally or by telephone; such INSTRUCTIONS shall be confirmed by the CONTROLLER without undue delay in a documented form.

The CONTROLLER retains all rights in the DATA. At the request or upon termination of the Agreement, PROCESSOR shall return or delete the DATA in accordance with this DPA. The PROCESSOR shall not assert any right of retention over the CONTROLLER's DATA, except where required by applicable law.

2. Scope and Purpose of Processing

The purpose of this DPA is to set out the scope, purpose and subject matter of the DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under the Agreement.

The PROCESSOR shall process PERSONAL DATA solely to the extent necessary for providing, administering, and operating the SOFTWARE under the Agreement and only in accordance with the CONTROLLER's INSTRUCTIONS.

The categories of DATA SUBJECTS and types of PERSONAL DATA processed are specified in Appendix 1.

The PROCESSING of special categories of PERSONAL DATA within the meaning of Art. 9 GDPR may occur where necessary for the provision of the services and where the CONTROLLER has lawfully collected such DATA and provided INSTRUCTIONS for their processing.

3. Controller's Rights and Obligations

The CONTROLLER is the controller in the meaning of applicable data protection laws with respect to PROCESSOR's PROCESSING of the DATA. The CONTROLLER will decide about the admissibility of the PROCESSING.

The CONTROLLER may at any time issue additional or amended INSTRUCTIONS regarding the purpose, type and scope of PROCESSING.

The CONTROLLER will be responsible for ensuring DATA SUBJECTS' rights. DATA SUBJECTS' rights are to be exercised towards the CONTROLLER.

The CONTROLLER may inform the PROCESSOR of any error of irregularity in the PROCESSING of the DATA by the PROCESSOR.

4. Processor's Obligations and Responsibilities

The PROCESSOR shall process DATA only within the scope of the Agreement and this DPA, including any INSTRUCTIONS issued by the CONTROLLER.

The PROCESSOR shall not make copies of PERSONAL DATA for its own purposes. Copies may be made only where necessary to provide the services, ensure proper PROCESSING (including backups and redundancy), or comply with legal obligations.

The PROCESSOR shall support the CONTROLLER in any inspections or information requests by competent supervisory authorities relating to the PROCESSING under this DPA and shall promptly inform the CONTROLLER of any such inquiries or measures that concern the CONTROLLER's DATA.

Where required by law, the PROCESSOR shall appoint a data protection officer and provide the CONTROLLER with the officer's contact details. If no DPO is required, the PROCESSOR shall designate a contact point for data protection matters.

The PROCESSOR shall, without undue delay, inform the CONTROLLER if and why the PROCESSOR deems certain INSTRUCTIONS unlawful.

The PROCESSOR shall, upon reasonable request, provide the CONTROLLER with the information necessary to enable the CONTROLLER to maintain accurate and up-to-date records of processing activities in accordance with Art. 30 GDPR and other applicable data protection laws.

The PROCESSOR shall, to the extent reasonably required, assist the CONTROLLER in fulfilling its obligations under Art. 32 to 36 GDPR, including data security, data protection impact assessments, and prior consultations with supervisory authorities. Such assistance shall consist of providing relevant documentation, technical information, or cooperation as reasonably necessary to demonstrate compliance, taking into account the nature of the PROCESSING and the information available to the PROCESSOR.

If the PROCESSOR is required to disclose the DATA or information about the PROCESSING or this DPA, the PROCESSOR shall inform the CONTROLLER in writing and prior to such disclosure about the recipients, the time and the content of the disclosure as well as the legal grounds.

The PROCESSOR shall, upon reasonable request, correct, delete or block DATA in accordance with the CONTROLLER's INSTRUCTIONS and applicable law. The PROCESSOR shall confirm completion upon request by the CONTROLLER. Legal data retention obligations remain unaffected.

The PROCESSOR shall implement and maintain procedures to ensure compliance with this DPA and applicable data protection laws. Upon reasonable request, the PROCESSOR shall provide evidence of compliance (e.g., ISO 27001, SOC 2, or equivalent documentation).

If the CONTROLLER's PERSONAL DATA stored by the PROCESSOR were to become endangered due to attachment or sequestration, insolvency or composition proceedings or other events or measures by third parties, the PROCESSOR shall inform the CONTROLLER hereof without undue delay. The PROCESSOR shall inform all persons responsible in this context without undue delay that the rights to and ownership of the DATA lie solely with the CONTROLLER.

5. Data Breach Notification

In the event of a breach of PERSONAL DATA, the PROCESSOR shall notify the CONTROLLER without undue delay, and in any case no later than 48 hours after becoming aware of the breach.

The notification shall at least:

describe the nature of the breach of PERSONAL DATA including, where possible, the categories and approximate number of DATA SUBJECTS and data records concerned;
communicate the name and contact details of the PROCESSOR's data protection officer or other contact point;
describe the likely consequences of the breach of PERSONAL DATA; and
describe the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

The PROCESSOR shall cooperate fully with and assist the CONTROLLER in complying with the CONTROLLER's obligations under Art. 33 and 34 GDPR.

6. Data Subjects' Rights

If a DATA SUBJECT contacts the PROCESSOR directly for the purpose of access, correction, deletion or blocking, restriction of processing or objection with regard to DATA concerning him, the PROCESSOR shall immediately forward this request to the CONTROLLER. The PROCESSOR will not contact the DATA SUBJECT concerned, unless the CONTROLLER has instructed the PROCESSOR to do so. Information may only be provided upon prior instruction by the CONTROLLER.

Upon first request, the PROCESSOR shall support the CONTROLLER in fulfilling the claims of DATA SUBJECTS for access, correction, blocking or deletion, restriction of processing or objection. This includes in particular that the PROCESSOR informs the CONTROLLER within a reasonable timeframe, of the information required to fulfil the claim.

7. Sub-Processors

The CONTROLLER generally authorizes the PROCESSOR to engage with sub-processors for the purposes of data processing outlined in this DPA, provided the PROCESSOR complies with the obligations stipulated under this Clause 7. An overview of all currently used sub-processors is available at https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/legal-ai-coworkers/Subcontractors.html. The third-party AI Agents used (i.e. sub-processors in this context) are available at https://www.sokosumi.com/de. Depending on which additional third-party AI Agents the AI Agent engaged by the CONTROLLER on the platform decides to use, the sub-processor(s) engaged may vary, are specifically listed in each job summary report, and can be accessed via a link to https://www.sokosumi.com/de. Changes and/or updates to the third-party AI Agents used (sub-processors) are available at https://www.sokosumi.com/de, thereby allowing the CONTROLLER to opt which AI Agent to choose.

The PROCESSOR shall carefully select sub-processors and ensure that they provide sufficient guarantees to implement appropriate technical and organizational measures.

The PROCESSOR shall ensure that sub-processors are bound by written contracts imposing the same data protection obligations as set out in this DPA, in particular with respect to security and confidentiality. The PROCESSOR shall remain fully liable for the performance of sub-processors.

Upon request, the PROCESSOR shall provide the CONTROLLER with the main data protection terms agreed with the sub-processor.

The PROCESSOR shall exercise towards its sub-processors the same audit and control rights that the CONTROLLER has towards the PROCESSOR under this DPA. The PROCESSOR shall monitor its sub-processors' compliance on a regular basis and provide relevant evidence to the CONTROLLER upon request. Upon the CONTROLLER's request, the PROCESSOR shall provide copies of such audit documentation or other relevant evidence. The CONTROLLER's audit rights under Clause 9 remain unaffected and may also be exercised in relation to sub-processors through the PROCESSOR.

Insofar as the involvement of a sub-processor involves the transfer of data to third countries, this transfer is covered by the authorization pursuant to Clause 7.1 and requires appropriate safeguards in accordance with Art. 44 et seq. GDPR. The PROCESSOR shall ensure that appropriate safeguards (e.g., standard contractual clauses, adequacy decision of the EU Commission) are implemented for international data transfers and shall provide evidence of this upon request.

8. Audit Rights

Audits shall primarily be conducted remotely, and may include the review of existing certifications, audit reports, or equivalent documentation. On-site audits shall be permitted only where remote audits do not provide sufficient assurance or in case of a justified suspicion of non-compliance.

Audits may be carried out no more than once per year, unless required by a supervisory authority or justified by a specific incident.

The PROCESSOR shall make available to the CONTROLLER all information reasonably necessary to demonstrate compliance with this Agreement and Art. 28 GDPR.

The CONTROLLER may request relevant information from the PROCESSOR's data protection officer or another qualified privacy contact regarding data protection compliance and technical and organizational measures.

The CONTROLLER may engage third parties to exercise audit rights. The PROCESSOR must tolerate and support the actions of such a third party in the same way as actions by the CONTROLLER. Audits shall be carried out during regular business hours, upon reasonable notice, and in a manner that does not unreasonably disrupt the PROCESSOR's operations.

9. Data Secrecy

The PROCESSOR is under the obligation to protect data secrecy when PROCESSING DATA for the CONTROLLER.

The PROCESSOR shall ensure that all personnel authorized to process PERSONAL DATA are subject to appropriate confidentiality obligations and receive adequate data protection training.

10. Technical and Organizational Measures

The PROCESSOR shall implement technical and organizational measures necessary to ensure compliance with the applicable data protection law.

Since technical and organizational measures are subject to technological developments, the PROCESSOR shall be entitled to modifying the technical and organizational measures provided such modification does not decrease the level of data protection and data security beneath what is required by law and under this DPA.

Upon request, the PROCESSOR shall provide documentation demonstrating that appropriate technical and organizational measures are in place and kept up to date.

The PROCESSOR shall immediately inform the CONTROLLER in writing, without request, of any significant changes in the technical and organizational measures.

11. Term

This DPA automatically terminates upon expiration or termination of the AGREEMENT.

12. Destruction, Deletion and Return of Data

Upon termination of this DPA, the PROCESSOR is prohibited from collecting or using the CONTROLLER's DATA. Further storage of DATA collected during the term of the DPA is only permitted to the extent necessary for the purpose of deletion, destruction or return to the CONTROLLER.

Unless instructed otherwise, the PROCESSOR shall irretrievably delete or destroy PERSONAL DATA using industry-standard secure deletion methods (e.g., DIN 66399, NIST SP 800-88, or comparable).

The PROCESSOR shall inform the CONTROLLER prior to permanent deletion of PERSONAL DATA, unless otherwise instructed. The PROCESSOR shall document deletion or destruction and provide such documentation to the CONTROLLER upon request. Statutory retention obligations remain unaffected.

Appendix 1: Data Subjects and Data Categories

This Appendix describes the scope of the PERSONAL DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under this DPA.

Purpose of Processing

The PROCESSOR processes PERSONAL DATA solely for the purpose of performing, administering, and operating the SOFTWARE as defined in the AGREEMENT.

Categories of Data Subjects

The PROCESSING may concern the following categories of DATA SUBJECTS:

End users of the CONTROLLER who interact with the SOFTWARE (e.g., customers, clients, or website visitors);
Employees, contractors, or other representatives of the CONTROLLER who use or administer the SOFTWARE;
Employees or contractors of the PROCESSOR with authorized access, limited to what is necessary for operation, support, or maintenance;
Other individuals whose PERSONAL DATA are submitted to the PROCESSOR by or on behalf of the CONTROLLER through the SOFTWARE.

Categories of Personal Data

The PROCESSING may include the following categories of PERSONAL DATA:

User master data – e.g. name, account details, contact details
Content data – e.g. text entries, uploaded files, prompts, outputs
Usage data – e.g. logs of interactions, timestamps, frequency of use
Technical data – e.g. IP address, device type, browser information
Payment data – e.g. billing details, transaction IDs (if applicable)

Special Categories of Data

In such cases, the PROCESSOR shall implement appropriate technical and organizational measures to ensure a level of protection corresponding to the sensitivity of the DATA.

Nature and Purpose of Processing Activities

Duration of Processing

Appendix 3: Technical and Organizational Measures (TOMs)

Processing Overview

Hannah (Marketing Research Partner) processes data through the following chain: the agent retrieves data from third-party APIs (DataForSEO, Exa, Apify, GWI, Statista, Tavily, X/Twitter, WordPress.com, Gamma, ScreenshotOne), sends it to the Anthropic Claude API for LLM-based analysis, and delivers structured results to the CONTROLLER. The agent services are hosted on a managed runtime environment and delivered via a secure marketplace platform. In addition, Hannah maintains a persistent memory system for relationship management and research context continuity, as described in Section 3a.

Anthropic (Claude API)

Role: LLM processing
Key Security Facts: SOC 2 Type II, ISO 27001, ISO 42001. AES-256 at rest, TLS 1.2+ in transit. 7-day retention (ZDR available). No training on customer data.

Third-party data APIs (see Appendix 2 for full list)

Role: Data retrieval
Key Security Facts: Licensed providers under separate DPAs. Data transmitted over TLS-encrypted connections only.

1. Access Control and User Management

Authentication
MFA for production access. API keys for service-to-service communication, stored in encrypted environment variables.

Authorization
Role-based access control with least-privilege principle. Agent components operate with minimal required permissions.

Access lifecycle
Quarterly access reviews. Immediate deprovisioning on role change or departure.

2. Physical and Environmental Security

3. Encryption and Pseudonymisation

In transit
TLS 1.2+ for all communications between agent components and external APIs.

At rest
AES-256 encryption on cloud storage. Anthropic encrypts all data at rest with AES-256.

Pseudonymisation
User input queries are pseudonymised through a two-layer architecture:

Layer 3 — Agent Memory (Persistent Storage)
Contact data including names and email addresses is stored in a dedicated PostgreSQL database with AES-256 encryption at rest (Azure-managed). Access is restricted to the specific agent instance (Hannah) via agent_id isolation. Memory data is not transmitted to the LLM provider for persistent storage — it is loaded into the prompt context at runtime and processed by Anthropic under ZDR terms. After each API call, the prompt content is discarded by Anthropic.

3a. Agent Memory Layer

In addition to the platform-level processing described above, Hannah maintains a persistent memory system for relationship management and research context continuity. This memory stores contact profiles, interaction summaries, and behavioural observations in a dedicated PostgreSQL database under the PROCESSOR's direct control, separate from the Kodosumi execution environment.

Contact profiles
Name, email, company, role, interests, interaction history. Stored in PostgreSQL with AES-256 encryption at rest (Azure-managed). Access isolated per agent via agent_id. Not transmitted to Anthropic for storage; loaded into prompt context at runtime under ZDR terms.

Observations
Behavioural insights, preferences, and patterns noted by the agent during interactions. Stored with vector embeddings (Voyage AI, 1024-dim) for semantic retrieval. Linked to contacts via junction table. Cascading deletion when contact is removed.

Reflections
End-of-interaction synthesis including patterns and learnings. Stored with vector embeddings for semantic similarity search. Referenced by contact_id.

Activity log
Record of all agent responses and actions. Includes interface source (Teams, email, Twitter, etc.), content summary, and timestamps. Referenced by contact_id.

Research tasks
Full task data including user briefings, hypotheses, execution plans, and job results. Stored as structured JSONB. Manual deletion available to users.

Retention and Deletion: Memory data is retained for the duration of the business relationship. Contact profiles, observations, reflections, and activity records are deleted within 6 months of the last interaction or upon user request. Research task data is deleted upon task completion plus 6 months, or upon user request. Deletion of a contact record cascades to all linked observations. The CONTROLLER or data subject may request complete erasure of all memory data associated with their identity at any time.

4. System and Network Security

Network isolation
Production systems deployed in isolated network segments. Traffic restricted to necessary ports and endpoints.

Vulnerability management
Regular patching of dependencies. Code review before deployment.

Monitoring
Centralised logging of agent executions. Anomaly alerting on error rates and unexpected behavior.

5. Incident Response and Business Continuity

Breach notification procedures and timelines are governed by Section 5 of the DPA.

Incident response
Documented incident response plan with defined roles and escalation paths. Post-incident root cause analysis.

6. Data Protection by Design and by Default

Output quality
Anti-hallucination validation against source data. Structured outputs with source attribution.

7. Personnel Measures

8. Review and Evaluation

These TOMs are reviewed at least annually and updated as needed. Material changes are notified to the CONTROLLER in advance.

Last reviewed: 02.03.2026

Alex

Privacy Notice for Alex

1. Controller and Contact

The controller responsible for the processing of personal data in connection with Alex is:

Plan.Net Studios GmbH & Co. KG
Friedenstraße 24, 81671 München
agentic@house-of-communication.com

You can contact our data protection officer at:

Dr. Georg F. Schröder, LL.M.
Serviceplan Group SE & Co. KG
Friedenstr. 24
81671 München
Deutschland
datenschutz@serviceplan.com

2. General Information on Data Processing

This privacy notice applies to the processing of personal data in connection with the use of Alex.

Alex is a Coding Partner that creates interactive data visualizations, dashboards, and data analysis deliverables. In order to provide this functionality, personal data of users and, where applicable, third parties are processed using the following third-party services:

Anthropic (AI model for content generation and analytics)
Microsoft 365 (email, documents, calendar access)

3. Categories of Personal Data

The following categories of personal data are processed by Alex:

User master data (e.g. name, account details, contact details)
Usage data (e.g. logs of interactions, timestamps, frequency of use)

4. Purposes, Legal Bases, Recipients and Retention Periods

The following table provides an overview of the processing operations in our capacity as a controller. To the extent, we process personal data in connection with your use of Alex, we process such data solely based on our instructions in our capacity as a processor. For further information, please see section 5 below:

User master data
Purpose of processing: Provision and administration of user account, fulfilment of contractual obligations
Legal basis: Art. 6(1)(b) GDPR
Recipients: Internal departments, hosting providers
Retention period: For the duration of the contractual relationship and statutory retention periods

Usage data
Purpose of processing: Ensuring IT security, prevention of misuse, service optimisation
Legal basis: Art. 6(1)(f) GDPR
Recipients: Internal IT, security service providers
Retention period: 6 months, unless longer storage is required for security incidents

5. Use of AI Agent

5.1 To the extent you (whether as a registered or unregistered User) provide personal data to us when you use our AI Agents (e.g. task assignment), we process such data – including your instructions, task parameters, and interaction metadata – solely as per your instructions as a processor based on a data processing agreement ("DPA").

5.2 To the extent you opt to use a third-Party AI Agent, please note that:

6. Source of Data

Where personal data are not collected directly from the end user, they originate from:

Publicly accessible sources (e.g. websites, social media)
Third parties who provide information for the use of the AI Agent

7. Recipients and Third-Country Transfers

Personal data are disclosed to processors and service providers who support the provision and operation of Alex (for example hosting providers, IT service providers, customer support). These recipients process personal data only on the basis of contractual agreements and in accordance with instructions.

Variant B2 – Transfer based on Standard Contractual Clauses (SCC)

8. Retention period

9. Automated Decision-Making and Profiling

Alex does not carry out automated decision-making within the meaning of Art. 22 GDPR.

1 0. Rights of Data Subjects

You have the following rights under the GDPR:

Right of access (Art. 15 GDPR): to obtain confirmation as to whether personal data concerning you are being processed and to receive a copy of such data.
Right to rectification (Art. 16 GDPR): to request the correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17 GDPR): to request the deletion of personal data under the conditions set out in the GDPR.
Right to restriction of processing (Art. 18 GDPR): to request that processing be limited in certain circumstances.
Right to object (Art. 21 GDPR): to object to the processing of your personal data based on legitimate interests.
Right to data portability (Art. 20 GDPR): to receive the personal data you have provided in a structured, commonly used and machine-readable format, and to transmit those data to another controller.

To exercise these rights, please contact us using the contact details provided above.

11. Obligation to Provide Data

The provision of certain personal data is necessary for the use of the AI Agent. Without these data, the service cannot be provided.

12. Amendments to this Privacy Notice

This privacy notice is updated whenever changes in the processing of personal data occur. The current version is always available within the Agent interface.

Agentic Service Terms

1. General Provisions

1.1 Plan.Net Studios GmbH & Co. KG, Friedenstraße 24, 81671 Munich (hereinafter „PNS“) offers users (hereinafter „User“) (PNS and the User hereinafter collectively referred to as the “Parties” and individually as a “Party”) the opportunity to buy an agentic service (hereinafter “Agentic Service”) on the Agentic Service Marketplace (“Marketplace”) pursuant to the terms set out in these Agentic Service Terms. The Agentic Services are offered exclusively to merchants as defined in Section 1 para. 1 German Commercial Code (HGB).

1.2 These Agentic Service Terms apply to any Agentic Service that PNS offers on the Marketplace and is used by the User in exchange for virtual credits which are allocated to the User under a subscription plan, based on additional credit purchases or otherwise in accordance with the Marketplace Terms to Sell and Buy Agentic Services (“Marketplace Terms”) which are available under https://www.sokosumi.com/de/terms-of-service. The use of the Agentic Services on the Marketplace is therefore subject to the User’s agreement with the Marketplace Terms.

1.3 These Agentic Service Terms also apply to Agentic Services that PNS itself purchases from a third party ("Third Party Supplier") and resells to the User by making them available on the Marketplace. The use of any such Agentic Service provided by a Third Party Supplier shall be governed by these Agentic Service Terms which incorporate also the terms of the Third Party Supplier ("Third Party Terms"). The User has to agree to the Third Party Terms in addition to these Agentic Service Terms in order to use the Agentic Services. In the event of any conflict between the Agentic Service Terms and the Third Party Terms, the Agentic Service Terms shall prevail.

1.4 PNS may make Agentic Services available to the User for testing or demonstration purposes and free of charge prior to the conclusion of a subscription plan for the use of the Agentic Services through the Marketplace (“Pre-Contractual Use”). These Agentic Service Terms shall apply accordingly to any Pre-Contractual Use. Pre-Contractual Use is provided on a non-binding and availability-based (“as available”) basis. PNS does not owe any specific scope of performance, any particular functionality, availability, quality, or any specific result of the Agentic Service. In particular, PNS shall have no obligations regarding error correction, maintenance, updates, support or reaction times. The User has no claim to be granted or to continue such Pre-Contractual Use. PNS’ liability during Pre-Contractual Use shall be governed exclusively by Section 5; any further claims are excluded. Pre-Contractual Use does not create any obligation for either Party to subsequently enter into any subscription or other paid agreement.

2. Agentic Service

2.1 PNS shall make the Agentic Service available through the internet. PNS does not provide any maintenance, support or assistance services to the User under these Agentic Service Terms, unless expressly agreed otherwise. PNS is not obliged to deliver any enhancements, updates or similar changes for the Agentic Service to the User, but PNS may decide to do so if PNS considers this necessary to maintain the proper functioning or security of the Agentic Service. Agentic Service are performed as a contract for services according to Sections 611 et seqq. German Civil Code (BGB).

2.2 The Agentic Service is provided on an “as is” basis. This means that PNS does not provide any warranty or guarantee for the Agentic Service beyond any statutory warranty. The example displayed within the offering on the Marketplace is only an example and does not warrant a certain similarity or quality of output. PNS does in particular not make any representations or warranties regarding the quality, functionality, accuracy, usability, or reliability of the Agentic Service. All information and representations in marketing documents, on internet pages or other media outside of these Agentic Service Terms do not in any form constitute a warranty or guarantee. For any Pre-Contractual Use, PNS does not provide any warranties of any kind. The Agentic Service may be incomplete, erroneous, unavailable or unstable during such phase.

2.3 The Agentic Service is intended to be used according to the intended purpose described in the Agentic Service offering on the Marketplace. During Pre-Contractual Use, results generated by the Agentic Service may be inaccurate, incomplete, unavailable or unsuitable for the User’s intended purpose. PNS assumes no responsibility that the Agentic Service or any output is fit for any particular purpose or use case.

2.4 The User agrees that PNS shall have the right to use subcontractors and purchase services from Third Parties in order to provide the Agentic Service.

2.5 PNS has the right, but is not obliged, to temporarily or permanently suspend or block the User’s access to the Agentic Service if and to the extent that the User infringes its obligations under these Agentic Service Terms.

2.6 The User acknowledges that the proper functioning of the Agentic Services may require the User to provide certain information or may require the User to meet certain system requirements on its end, e.g., appropriate equipment, browser, internet connection, bandwidth or other resources, as may be specified in the documentation of the Agentic Service and updated from time to time. The User is responsible for implementing and maintaining such system requirements. PNS will have no liability for any delay or deficiency in the performance of the Agentic Service to the extent this results from the User’s failure to meet the applicable system requirements or breach of its obligations under these Agentic Service Terms.

2.7 PNS will make the output of the Agentic Service available to the User within the ‘Submit Results Time’ described within the Agentic Service offering. The following events do not constitute a failure to meet the ‘Submit Results Time’: (a) emergency maintenances or (b) circumstances beyond PNS’ reasonable control, such as force majeure, including, for example, an act of God, act of government, flood, fire, earthquake, civil unrest, epidemic, pandemic (e.g. Covid-19), act of terror, strike or other labor problem (other than one involving PNS’ own employees), internet service provider failure or delay, cybersecurity or denial of service attacks which are not in PNS’ responsibility.

2.8 If the User becomes aware of an outage, malfunction or degradation of the ‘Submit Results Time’ of the Agentic Service, the User shall promptly inform PNS and describe the symptoms of the issue in a detailed and reproducible manner, by sending an email to agentic@house-of-communication.com PNS will use its best endeavors to analyze and respond to such faults with a reaction time of up to 4 hours during its normal business hours, 9:00 through 17:00 CET on working days in the State of Bavaria, Germany.

3. Rights and obligations of the User and restrictions on use

3.1 The User does not have the right to download, install, or make copies of the Agentic Service, unless otherwise agreed. Subject to this Section 3.1, the User may not allow or tolerate any third party to use or access the Agentic Service. The User may allow access to and use of the Agentic Service to its affiliates or third-party contractors to the extent this is required to facilitate performance of a contract between such contractor and the User in connection with the User’s use of Agentic Services; in such case, the User is fully responsible for any act or omission of the third party as if it was the User’s own act or omission.

3.2 The User must adhere to the Acceptable Use Policy available under https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/acceptable-use.html.

3.3 The User is solely responsible for the selection, use, and results generated by its use of the Agentic Service (particularly the selection of an Agentic Service for a specific use case). The User is solely responsible for ensuring that its use of the Agentic Service complies with all applicable laws of a member state of the EU or any law applicable to these Agentic Service Terms (“Applicable Laws”) and regulations, including any specific national or sectoral regulatory requirements applicable to the User. The Agentic Service is not a knowledge base, research tool or reference work. The output of the Agentic Service is calculated with artificial intelligence methods and is therefore a mathematical calculation of probabilities in the sense of the model, which is significantly based on the training data. The User understands and accepts that, given the probabilistic nature of AI, the use of the Agentic Service in some situations may produce erroneous results that do not accurately reflect real people, places, facts, or the desired output. The User therefore has the sole responsibility to evaluate the suitability of the output on a case-by-case basis, in particular by human verification of the results of the output. The User furthermore understands and acknowledges that artificial intelligence is a research and technology area that is rapidly evolving. It also cannot be ensured that output is unique compared to (i) the output of other customers and (ii) already existing works. The User must therefore ensure that a sufficient distance to already existing works is maintained when reusing the output. PNS is constantly working to improve its Agentic Services to make them more accurate, reliable, secure and useful.

4. Ownership, Intellectual Property and Third Party Content and Terms

4.1 Except for the rights explicitly granted to the User in these Agentic Service Terms, all rights, title and interest (including intellectual property rights) in the Agentic Service and the underlying technology remain with PNS and the Third Party Suppliers or licensors of PNS or the Third Party Suppliers respectively.

4.2 PNS grants the User a non-exclusive, non-transferable, non-sublicensable right to use the Agentic Service during the Term of these Agentic Service Terms, subject to the User’s payment of the agreed fees.

4.3 PNS grants the User a non-exclusive, perpetual, non-transferable, non-sublicensable right to use the output of any Agentic Service, subject to the User’s payment of the agreed fees.

4.4 The User grants PNS a non-exclusive, non-transferable, non-sublicensable right to use any and all information, data and content that the User processes in the Agentic Service to the extent this is required for the purpose of providing Agentic Service to the User. The User warrants that it owns or otherwise has secured all rights that are required to enable PNS to use such information, data and content for the performance of the Agentic Service without infringing the intellectual property rights or privacy rights of third parties.

4.5 The Agentic Service may include or interact with third-party services that may be subject to separate license terms of the respective Third Party Suppliers or third-party licensors. The User shall comply with the then-current version of any Third Party Terms if and as applicable. These currently include, in particular: Microsoft, Anthropic.

5. Limitation of liability

5.1 PNS shall be fully liable for damages (i) which are based on an intentional or grossly negligent breach of duty by PNS or on an intentional or grossly negligent breach of duty by a legal representative of PNS or a vicarious agent of PNS, (ii) which result from the breach of a guarantee assumed by PNS, (iii) from a fraudulently concealed defect, (iv) from injury to life, body or health resulting from a negligent breach of duty by PNS or an intentional or negligent breach of duty by a legal representative of PNS or a vicarious agent of PNS, and (v) under the Product Liability Act (ProdHaftG).

5.2 In case of a breach caused by ordinary negligence of obligations whose fulfillment is essential for the proper performance of these Agentic Service Terms, whose breach jeopardizes the achievement of the purpose of these Agentic Service Terms and on whose compliance the User regularly relies (Kardinalpflicht), PNS liability shall be limited to the typically foreseeable damage. Any other liability for damages caused by ordinary negligence is excluded.

5.3 The User agrees that the liability as set out in Section 5.2 shall moreover not exceed the total amount of remuneration paid by the User under these Agentic Service Terms in the contract year in the contract year of these Agentic Service Terms in which the claim arises. The liability of PNS for all damages under these Agentic Service Terms falling under Section 5.2 shall therefore be limited in aggregate to the aforementioned amounts.

5.4 Deviating from Section 5.3 above, the User agrees that damages or costs arising from the loss of revenue, profit or data shall furthermore be limited to 50% of the total amount of remuneration paid by the User under these Agentic Services Terms of the contract year in which the claim arises.

5.5 PNS is not liable for data protection violations committed by the User to the detriment of its own customers, employees or other third parties.

5.6 For any Pre-Contractual Use provided free of charge, PNS shall only be liable for damages caused by intent or gross negligence; Section 5.1 remains unaffected.

5.7 The above limitations of liability also apply to the personal liability of employees, representatives, organs and vicarious agents of PNS.

6. Confidential Information

6.1 Each Party shall treat Confidential Information confidentially, protect it from access by third parties by means of confidentiality measures appropriate to the circumstances and use it only for the purposes of these Agentic Service Terms. “Confidential Information” are all information which one Party discloses or makes available to the other Party orally, in writing or in any other (e.g. electronic) form and which are either labelled as confidential or which a recipient acting with the care of a prudent businessman would reasonably consider confidential, in particular technical and commercial information, such as, for example business and trade secrets, information of a scientific, industrial or commercial nature, in particular product and marketing plans and information about customers, suppliers and (development) clients, as well as processes, algorithms, software and source code, data, drawings, drafts, sketches, plans, descriptions, specifications, measurement results, calculations, experience, procedures, samples, secret technical know-how or as yet unpublished applications for technical property rights. Information is not Confidential Information if it demonstrably

(1) was already known to the receiving Party at the time of disclosure by the disclosing Party;

(2) was already publicly known at the time of disclosure by the disclosing Party or becomes publicly known at a later date, unless this is due to a breach of these Agentic Service Terms by the receiving Party;

(3) has been disclosed to the receiving Party by a third party without the third party having acted unlawfully in obtaining or disclosing the information concerned or having breached a confidentiality obligation in favor of the disclosing Party; or

(4) has been created or developed by the receiving Party itself or was created or developed on behalf of the receiving Party independently of knowledge of the Confidential Information.

6.2 Each Party shall ensure that its employees and other third parties involved also maintain the confidentiality described above. Third parties do not include professional consultants of the Party who are subject to statutory or professional confidentiality obligations and who are involved in the establishment, assessment or implementation of the cooperation within the scope of these Agentic Service Terms on behalf of a Party.

6.3 The confidentiality and purpose limitation shall also apply to such Confidential Information that a company affiliated with one Party discloses directly to the other Party or to a company affiliated with this Party. Each Party shall ensure that the companies affiliated with it also keep such Confidential Information secret and use it solely for the permitted purpose.

6.4 The receiving Party also undertakes not to reverse engineer, decompile, disassemble or otherwise examine the composition and/or production of Confidential Information of a disclosing Party, unless the disclosing Party has expressly agreed to this in writing in advance.

6.5 The confidentiality obligation shall remain in force for 5 years after termination of these Agentic Service Terms.

7. Compliance

7.1 Each Party is responsible for compliance with the statutory obligations applicable to it (including tax obligations). PNS is in particular not responsible for the fulfillment of the User’s industry-specific, statutory or regulatory requirements. The User shall review the suitability of the Agentic Service for use in accordance with the industry-specific, legal and regulatory requirements applicable to the User.

8. General provisions

8.1 These Agentic Service Terms and any claim, dispute or controversy arising out of or relating to these Agentic Service Terms shall be governed by and construed in accordance with the laws of Germany, without giving effect to its conflict of law provisions. The courts of Munich, Germany shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Agentic Service Terms (including non-contractual disputes or claims). The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply.

8.2 The Agentic Service may not be used by a User based in any US, UK, EU or Japan embargoed country.

8.3 All notices, consents, waivers and other communications required or permitted under these Agentic Service Terms must be in English or German and in text form.

8.4 The Parties are independent contractors, and at no time will either party be deemed to be the agent or employee of the other party. No joint venture, partnership, agency, or other relationship will be created or implied between the Parties as a result of these Agentic Service Terms. Except as expressly set forth in these Agentic Service Terms, each Party will bear full and sole responsibility for its own expenses and costs of operation. Furthermore, neither Party will have the authority to, and will not purport to, enter into any contract on behalf of the other Party, or commit it to any obligation.

8.5 There are no third-party beneficiaries under these Agentic Service Terms.

8.6 If any provision of these Agentic Service Terms is found by a court of competent jurisdiction to be invalid or unenforceable, these Agentic Service Terms shall remain in full force and effect. It is the explicit intention of the Parties to maintain the validity of the remaining provisions under all circumstances. Section 139 German Civil Code (BGB) shall not apply.

8.7 Neither Party may assign its rights or obligations under these Agentic Service Terms without the prior written consent of the other Party.

8.8 General terms and conditions of the User shall not apply even if these Agentic Service Terms are concluded with knowledge of them and PNS does not separately object to their validity. Deviating or contradictory terms shall only apply if they have been expressly accepted by PNS in writing. The User acknowledges that in entering into these Agentic Service Terms, the User has not relied on any oral or written statements, securities, or other warranties, representations, or undertakings made by or on behalf of PNS at any time prior to the signing of these Agentic Service Terms with respect to the subject matter hereof, other than those set forth in these Agentic Service Terms.

8.9 If PNS processes personal data on behalf of User, the parties will conclude a data processing addendum based on the template in Elena’s agent interface on the Marketplace.

Data Processing Agreement Terms

These Data Processing Agreement Terms ("DPA") form an integral part of the AGREEMENT to the extent PROVIDER processes personal data of the CUSTOMER based on CUSTOMER's instructions under the Agreement. As per this DPA, CUSTOMER is acting as the controller of personal data as defined in the General Data Protection Regulation ("CONTROLLER") whilst the PROVIDER is acting as the processor as stipulated in the General Data Protection Regulation ("PROCESSOR"). Both are hereinafter collectively referred to as the "PARTIES" and individually a "PARTY".

Unless otherwise defined in this DPA, the definitions of the AGREEMENT apply to this DPA.

1. General Provisions

1.1 The PROCESSOR shall process personal data only on behalf of and in accordance with the documented instructions of the CONTROLLER, under and for the purposes of the AGREEMENT and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable data protection laws.

1.2 The CONTROLLER has selected the PROCESSOR as a supplier in accordance with the duty of care under applicable data protection laws. This DPA constitutes the data processing agreement within the meaning of Art. 28 GDPR, governing the rights and obligations of the PARTIES with respect to data processing.

1.3 "PERSONAL DATA" or "DATA" means any information relating to an identified or identifiable natural person (hereinafter referred to as "DATA SUBJECT").

1.4 The term "PROCESSING", term shall be understood in a broad sense. This includes any operation or series of operations carried out with or without the use of automated procedures in connection with PERSONAL DATA, such as collection, gathering, organization, arrangement, storage, adaptation or modification, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, matching or linking, restriction, deletion or destruction.

1.5 "INSTRUCTION" means an instruction by the CONTROLLER to the PROCESSOR, issued in a documented form, to perform a specific action regarding PERSONAL DATA (e.g. anonymization, blocking, deletion, disclosure). If necessary, an INSTRUCTION can be issued orally or by telephone; such INSTRUCTIONS shall be confirmed by the CONTROLLER without undue delay in a documented form.

1.6 The CONTROLLER retains all rights in the DATA. At the request or upon termination of the Agreement, PROCESSOR shall return or delete the DATA in accordance with this DPA. The PROCESSOR shall not assert any right of retention over the CONTROLLER's DATA, except where required by applicable law.

2. Scope and Purpose of PROCESSING

2.1 The purpose of this DPA is to set out the scope, purpose and subject matter of the DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under the Agreement.

2.2 The PROCESSOR shall process PERSONAL DATA solely to the extent necessary for providing, administering, and operating the SOFTWARE under the Agreement and only in accordance with the CONTROLLER's INSTRUCTIONS.

2.3 The categories of DATA SUBJECTS and types of PERSONAL DATA processed are specified in Appendix 1.

2.4 The PROCESSING of special categories of PERSONAL DATA within the meaning of Art. 9 GDPR may occur where necessary for the provision of the services and where the CONTROLLER has lawfully collected such DATA and provided INSTRUCTIONS for their processing.

3. CONTROLLER's Rights and Obligations

3.1 The CONTROLLER is the controller in the meaning of applicable data protection laws with respect to PROCESSOR's PROCESSING of the DATA. The CONTROLLER will decide about the admissibility of the PROCESSING.

3.2 The CONTROLLER may at any time issue additional or amended INSTRUCTIONS regarding the purpose, type and scope of PROCESSING.

3.3 The CONTROLLER will be responsible for ensuring DATA SUBJECTS' rights. DATA SUBJECTS' rights are to be exercised towards the CONTROLLER.

3.4 The CONTROLLER may inform the PROCESSOR of any error of irregularity in the PROCESSING of the DATA by the PROCESSOR.

4. PROCESSOR's Obligations and Responsibilities

4.1 The PROCESSOR shall process DATA only within the scope of the Agreement and this DPA, including any INSTRUCTIONS issued by the CONTROLLER.

4.2 The PROCESSOR shall not make copies of PERSONAL DATA for its own purposes. Copies may be made only where necessary to provide the services, ensure proper PROCESSING (including backups and redundancy), or comply with legal obligations.

4.3 The PROCESSOR shall support the CONTROLLER in any inspections or information requests by competent supervisory authorities relating to the PROCESSING under this DPA and shall promptly inform the CONTROLLER of any such inquiries or measures that concern the CONTROLLER's DATA.

4.4 Where required by law, the PROCESSOR shall appoint a data protection officer and provide the CONTROLLER with the officer's contact details. If no DPO is required, the PROCESSOR shall designate a contact point for data protection matters.

4.5 The PROCESSOR shall, without undue delay, inform the CONTROLLER if and why the PROCESSOR deems certain INSTRUCTIONS unlawful.

4.6 The PROCESSOR shall, upon reasonable request, provide the CONTROLLER with the information necessary to enable the CONTROLLER to maintain accurate and up-to-date records of processing activities in accordance with Art. 30 GDPR and other applicable data protection laws.

4.7 The PROCESSOR shall, to the extent reasonably required, assist the CONTROLLER in fulfilling its obligations under Art. 32 to 36 GDPR, including data security, data protection impact assessments, and prior consultations with supervisory authorities. Such assistance shall consist of providing relevant documentation, technical information, or cooperation as reasonably necessary to demonstrate compliance, taking into account the nature of the PROCESSING and the information available to the PROCESSOR.

4.8 If the PROCESSOR is required to disclose the DATA or information about the PROCESSING or this DPA, the PROCESSOR shall inform the CONTROLLER in writing and prior to such disclosure about the recipients, the time and the content of the disclosure as well as the legal grounds.

4.9 The PROCESSOR shall, upon reasonable request, correct, delete or block DATA in accordance with the CONTROLLER's INSTRUCTIONS and applicable law. The PROCESSOR shall confirm completion upon request by the CONTROLLER. Legal data retention obligations remain unaffected.

4.10 The PROCESSOR shall implement and maintain procedures to ensure compliance with this DPA and applicable data protection laws. Upon reasonable request, the PROCESSOR shall provide evidence of compliance (e.g., ISO 27001, SOC 2, or equivalent documentation).

4.11 If the CONTROLLER's PERSONAL DATA stored by the PROCESSOR were to become endangered due to attachment or sequestration, insolvency or composition proceedings or other events or measures by third parties, the PROCESSOR shall inform the CONTROLLER hereof without undue delay. The PROCESSOR shall inform all persons responsible in this context without undue delay that the rights to and ownership of the DATA lie solely with the CONTROLLER.

5. Data Breach Notification

5.1 In the event of a breach of PERSONAL DATA, the PROCESSOR shall notify the CONTROLLER without undue delay, and in any case no later than 48 hours after becoming aware of the breach.

5.2 The notification shall at least:

5.2.1 describe the nature of the breach of PERSONAL DATA including, where possible, the categories and approximate number of DATA SUBJECTS and data records concerned;

5.2.2 communicate the name and contact details of the PROCESSOR's data protection officer or other contact point;

5.2.3 describe the likely consequences of the breach of PERSONAL DATA; and

5.2.4 describe the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

5.3 The PROCESSOR shall cooperate fully with and assist the CONTROLLER in complying with the CONTROLLER's obligations under Art. 33 and 34 GDPR.

6. DATA SUBJECTS' Rights

6.1 If a DATA SUBJECT contacts the PROCESSOR directly for the purpose of access, correction, deletion or blocking, restriction of processing or objection with regard to DATA concerning him, the PROCESSOR shall immediately forward this request to the CONTROLLER. The PROCESSOR will not contact the DATA SUBJECT concerned, unless the CONTROLLER has instructed the PROCESSOR to do so. Information may only be provided upon prior instruction by the CONTROLLER.

6.2 Upon first request, the PROCESSOR shall support the CONTROLLER in fulfilling the claims of DATA SUBJECTS for access, correction, blocking or deletion, restriction of processing or objection. This includes in particular that the PROCESSOR informs the CONTROLLER within a reasonable timeframe, of the information required to fulfil the claim.

7. Sub-Processors

7.1 The CONTROLLER generally authorizes the PROCESSOR to engage with sub-processors for the purposes of data processing outlined in this DPA, provided the PROCESSOR complies with the obligations stipulated under this Clause 7. An overview of all currently used sub-processors is available at https://www.house-of-communication.com/de/en/brands/plan-net/landingpages/agentic-services/legal-ai-coworkers/Subcontractors.html. The third-party AI Agents used (i.e. sub-processors in this context) are available at https://www.sokosumi.com/de. Depending on which additional third-party AI Agents the AI Agent engaged by the CONTROLLER on the platform decides to use, the sub-processor(s) engaged may vary, are specifically listed in each job summary report, and can be accessed via a link to https://www.sokosumi.com/de. Changes and/or updates to the third-party AI Agents used (sub-processors) are available at https://www.sokosumi.com/de, thereby allowing the CONTROLLER to opt which AI Agent to choose.

7.2 The PROCESSOR shall carefully select sub-processors and ensure that they provide sufficient guarantees to implement appropriate technical and organizational measures.

7.3 The PROCESSOR shall ensure that sub-processors are bound by written contracts imposing the same data protection obligations as set out in this DPA, in particular with respect to security and confidentiality. The PROCESSOR shall remain fully liable for the performance of sub-processors.

7.4 Upon request, the PROCESSOR shall provide the CONTROLLER with the main data protection terms agreed with the sub-processor.

7.5 The PROCESSOR shall exercise towards its sub-processors the same audit and control rights that the CONTROLLER has towards the PROCESSOR under this DPA. The PROCESSOR shall monitor its sub-processors' compliance on a regular basis and provide relevant evidence to the CONTROLLER upon request. Upon the CONTROLLER's request, the PROCESSOR shall provide copies of such audit documentation or other relevant evidence. The CONTROLLER's audit rights under Clause 9 remain unaffected and may also be exercised in relation to sub-processors through the PROCESSOR.

7.6 Insofar as the involvement of a sub-processor involves the transfer of data to third countries, this transfer is covered by the authorization pursuant to Clause 7.1 and requires appropriate safeguards in accordance with Art. 44 et seq. GDPR. The PROCESSOR shall ensure that appropriate safeguards (e.g., standard contractual clauses, adequacy decision of the EU Commission) are implemented for international data transfers and shall provide evidence of this upon request.

8. Audit Rights

8.1 Audits shall primarily be conducted remotely, and may include the review of existing certifications, audit reports, or equivalent documentation. On-site audits shall be permitted only where remote audits do not provide sufficient assurance or in case of a justified suspicion of non-compliance.

8.2 Audits may be carried out no more than once per year, unless required by a supervisory authority or justified by a specific incident.

8.3 The PROCESSOR shall make available to the CONTROLLER all information reasonably necessary to demonstrate compliance with this Agreement and Art. 28 GDPR.

8.4 The CONTROLLER may request relevant information from the PROCESSOR's data protection officer or another qualified privacy contact regarding data protection compliance and technical and organizational measures.

8.5 The CONTROLLER may engage third parties to exercise audit rights. The PROCESSOR must tolerate and support the actions of such a third party in the same way as actions by the CONTROLLER. Audits shall be carried out during regular business hours, upon reasonable notice, and in a manner that does not unreasonably disrupt the PROCESSOR's operations.

9. Data Secrecy

9.1 The PROCESSOR is under the obligation to protect data secrecy when PROCESSING DATA for the CONTROLLER.

9.2 The PROCESSOR shall ensure that all personnel authorized to process PERSONAL DATA are subject to appropriate confidentiality obligations and receive adequate data protection training.

10. Technical and Organizational Measures

10.1 The PROCESSOR shall implement technical and organizational measures necessary to ensure compliance with the applicable data protection law.

10.2 Since technical and organizational measures are subject to technological developments, the PROCESSOR shall be entitled to modifying the technical and organizational measures provided such modification does not decrease the level of data protection and data security beneath what is required by law and under this DPA.

10.3 Upon request, the PROCESSOR shall provide documentation demonstrating that appropriate technical and organizational measures are in place and kept up to date.

10.4 The PROCESSOR shall immediately inform the CONTROLLER in writing, without request, of any significant changes in the technical and organizational measures.

11. Term

11.1 This DPA automatically terminates upon expiration or termination of the AGREEMENT.

12. Destruction, Deletion and Return of Data

12.1 Upon termination of this DPA, the PROCESSOR is prohibited from collecting or using the CONTROLLER's DATA. Further storage of DATA collected during the term of the DPA is only permitted to the extent necessary for the purpose of deletion, destruction or return to the CONTROLLER.

12.2 Unless instructed otherwise, the PROCESSOR shall irretrievably delete or destroy PERSONAL DATA using industry-standard secure deletion methods (e.g., DIN 66399, NIST SP 800-88, or comparable).

12.3 The PROCESSOR shall inform the CONTROLLER prior to permanent deletion of PERSONAL DATA, unless otherwise instructed. The PROCESSOR shall document deletion or destruction and provide such documentation to the CONTROLLER upon request. Statutory retention obligations remain unaffected.

Appendices:

Appendix 1: DATA SUBJECTS and Data Categories

Appendix 2: Technical and Organizational Measures

Appendix 1: Data Subjects and Data Categories

This Appendix describes the scope of the PERSONAL DATA PROCESSING carried out by the PROCESSOR on behalf of the CONTROLLER under this DPA.

1. Purpose of Processing

The PROCESSOR processes PERSONAL DATA solely for the purpose of performing, administering, and operating the SOFTWARE as defined in the AGREEMENT.

2. Categories of DATA SUBJECTS

The PROCESSING may concern the following categories of DATA SUBJECTS:

End users of the CONTROLLER who interact with the SOFTWARE (e.g., customers, clients, or website visitors);
Employees, contractors, or other representatives of the CONTROLLER who use or administer the SOFTWARE;
Employees or contractors of the PROCESSOR with authorized access, limited to what is necessary for operation, support, or maintenance;
Other individuals whose PERSONAL DATA are submitted to the PROCESSOR by or on behalf of the CONTROLLER through the SOFTWARE.

3. Categories of PERSONAL DATA

The PROCESSING may include the following categories of PERSONAL DATA:

User master data (e.g. name, account details, contact details);
Content data (e.g. text entries, uploaded files, prompts, outputs);
Usage data (e.g. logs of interactions, timestamps, frequency of use);
Technical data (e.g. IP address, device type, browser information);
Payment data (e.g. billing details, transaction IDs – if applicable)

4. Special Categories of DATA

In such cases, the PROCESSOR shall implement appropriate technical and organizational measures to ensure a level of protection corresponding to the sensitivity of the DATA.

5. Nature and Purpose of PROCESSING Activities

6. Duration of Processing

Appendix 2: Technical and Organizational Measures (TOMs)

Processing Overview

Alex (Coding Partner) processes data through the following chain: the agent receives task and project data from the CONTROLLER via Microsoft Teams, sends it to the Anthropic Claude API for LLM-based analysis, and delivers structured results back to the CONTROLLER. The agent services are hosted on a managed runtime environment and delivered via a secure marketplace platform. In addition, Alex maintains a persistent memory system for relationship management and project context continuity, as described in Section 3a.

Anthropic (Claude API)
Role: LLM processing
Key Security Facts: SOC 2 Type II, ISO 27001, ISO 42001. AES-256 at rest, TLS 1.2+ in transit. 7-day retention (ZDR available). No training on customer data.

Microsoft Corporation (Microsoft 365)
Role: Collaboration platform
Key Security Facts: SOC 2 Type II, ISO 27001. AES-256 at rest, TLS 1.2+ in transit. EU Data Boundary available. DPA under Microsoft Product Terms.

1. Access Control and User Management

Authentication
MFA for production access. API keys for service-to-service communication, stored in encrypted environment variables.

Authorization
Role-based access control with least-privilege principle. Agent components operate with minimal required permissions.

Access lifecycle
Quarterly access reviews. Immediate deprovisioning on role change or departure.

2. Physical and Environmental Security

3. Encryption and Pseudonymisation

In transit
TLS 1.2+ for all communications between agent components and external APIs.

At rest
AES-256 encryption on cloud storage. Anthropic encrypts all data at rest with AES-256.

Pseudonymisation
User input queries are pseudonymised through a two-layer architecture:

Layer 1 — Kodosumi Infrastructure (by Architecture)
The agent processing layer (Kodosumi/Ray cluster) stores only a technical session ID (user_id); no name, email address, or other directly identifying information is present at this layer. The mapping between user_id and the natural person is held exclusively by the Sokosumi platform and never flows into the agent infrastructure. As a result, input queries stored in the Kodosumi execution database are already pseudonymised at rest — they cannot be attributed to a specific individual without access to the Sokosumi user registry.

Layer 2 — Anthropic Claude API (Zero Data Retention)
Query content transmitted to the Anthropic Claude API is processed under Zero Data Retention (ZDR) terms. Anthropic does not persist query data beyond the duration of the API call and does not use it for model training. The query is effectively discarded after the response is returned.

Retention and Deletion
Execution records including input queries stored in the Kodosumi runtime database are automatically deleted after 6 months. This retention period reflects the minimum operationally required for support and auditability purposes. In the event that a query incidentally contains personal data of a natural person (e.g., a name included in a research request), this data is subject to the same 6-month retention limit and is not accessible outside the Kodosumi execution environment.

Layer 3 — Agent Memory (Persistent Storage)
Contact data including names and email addresses is stored in a dedicated PostgreSQL database with AES-256 encryption at rest (Azure-managed). Access is restricted to the specific agent instance (Alex) via agent_id isolation. Memory data is not transmitted to the LLM provider for persistent storage — it is loaded into the prompt context at runtime and processed by Anthropic under ZDR terms. After each API call, the prompt content is discarded by Anthropic.

3a. Agent Memory Layer

In addition to the platform-level processing described above, Alex maintains a persistent memory system for relationship management and project context continuity. This memory stores contact profiles, interaction summaries, and project-related observations in a dedicated PostgreSQL database under the PROCESSOR's direct control, separate from the Kodosumi execution environment.

Reflections
End-of-interaction synthesis including project patterns and learnings. Stored with vector embeddings for semantic similarity search. Referenced by contact_id.

Activity log
Record of all agent responses and actions. Includes interface source (Teams, email) and timestamps. Referenced by contact_id.

Retention and Deletion: Memory data is retained for the duration of the business relationship. Contact profiles, observations, reflections, and activity records are deleted within 6 months of the last interaction or upon user request. Deletion of a contact record cascades to all linked observations. The CONTROLLER or data subject may request complete erasure of all memory data associated with their identity at any time.

4. System and Network Security

Network isolation
Production systems deployed in isolated network segments. Traffic restricted to necessary ports and endpoints.

Vulnerability management
Regular patching of dependencies. Code review before deployment.

Monitoring
Centralised logging of agent executions. Anomaly alerting on error rates and unexpected behavior.

5. Incident Response and Business Continuity

Breach notification procedures and timelines are governed by Section 5 of the DPA.

Incident response
Documented incident response plan with defined roles and escalation paths. Post-incident root cause analysis.

6. Data Protection by Design and by Default

Output quality
Anti-hallucination validation against source data. Structured outputs with source attribution.

7. Personnel Measures

8. Review and Evaluation

These TOMs are reviewed at least annually and updated as needed. Material changes are notified to the CONTROLLER in advance.

Last reviewed: 02.03.2026

Google invented classic search – ChatGPT is redefining it

Mediaplus Between International Expansion, AI Boom, and Industry Disruption

Rügenwalder & Serviceplan Give Pop Fans €100K Media Space

Serviceplan Group named Independent Network & Agency 2025

Serviceplan

Mediaplus

Plan.Net

Elena, Hannah and Alex

Elena

Privacy Notice for Elena

1. Controller and Contact

2. General Information on Data Processing

3. Categories of Personal Data

4. Purposes, Legal Bases, Recipients and Retention Periods

5. Use of AI Agent

6. Source of Data

7. Recipients and Third-Country Transfers

8. Transfer based on Standard Contractual Clauses (SCC)

9. Retention Period

10. Automated Decision-Making and Profiling

11. Rights of Data Subjects

12. Obligation to Provide Data

13. Amendments to this Privacy Notice

Agentic Service Terms

1. General Provisions

2. Agentic Service

3. Rights and Obligations of the User and Restrictions on Use

4. Ownership, Intellectual Property and Third Party Content and Terms

5. Limitation of Liability

6. Confidential Information

7. Compliance

8. General Provisions

Data Processing Agreement Terms

1. General Provisions

2. Scope and Purpose of Processing

3. Controller's Rights and Obligations

4. Processor's Obligations and Responsibilities

5. Data Breach Notification

6. Data Subjects' Rights

7. Sub-Processors

8. Audit Rights

9. Data Secrecy

10. Technical and Organizational Measures

11. Term

12. Destruction, Deletion and Return of Data

Appendix 1: Data Subjects and Data Categories

1. Purpose of Processing

2. Categories of Data Subjects

3. Categories of Personal Data

4. Special Categories of Data

5. Nature and Purpose of Processing Activities

6. Duration of Processing

Appendix 3: Technical and Organizational Measures (TOMs)

Processing Overview

1. Access Control and User Management

2. Physical and Environmental Security

3. Encryption and Pseudonymisation

3a. Agent Memory Layer

4. System and Network Security

5. Incident Response and Business Continuity

6. Data Protection by Design and by Default

7. Personnel Measures

8. Review and Evaluation

Hannah

Privacy Notice for Hannah

1. Controller and Contact

2. General Information on Data Processing

3. Categories of Personal Data

4. Purposes, Legal Bases, Recipients and Retention Periods

5. Use of AI Agent

6. Source of Data

7. Recipients and Third-Country Transfers

Transfer based on Standard Contractual Clauses (SCC)

8. Retention Period

9. Automated Decision-Making and Profiling

10. Rights of Data Subjects

11. Obligation to Provide Data

12. Amendments to this Privacy Notice

Agentic Service Terms

1. General Provisions