Data Processing Agreement (DPA)

The processor is IonKon GmbH, Dessauer Straße 280, 06886 Lutherstadt Wittenberg, Germany. The controller is the customer who orders an individual language model from IonKon via the order portal; the customer's name and address are set out in the main contract (order).

The subject matter of this contract is the one-off processing of the documents uploaded by the customer to produce a customer-specific language model by IonKon, its delivery to the customer, and the subsequent deletion of the copies remaining at IonKon. After delivery, IonKon no longer carries out any ongoing processing of customer data; the delivered model runs entirely on the customer's own hardware, with no further connection to IonKon. This contract applies for the duration of the main contract and ends once IonKon has deleted all copies of the customer data created in the course of the processing. The deletion periods follow from the technical and organisational measures (Annex 1): deletion after the customer confirms receipt of the delivery, at the latest after the technical retention ceiling (default 30 days from delivery, absolute ceiling 180 days from the start of the order).

The processing serves exclusively to render the service described in the main contract: extraction and preparation of the documents uploaded by the customer, filtering of personal data, generation of synthetic training examples, the actual training of the customer-specific model, and its packaging for delivery. For data synthesis, IonKon uses exclusively software it operates itself, running on a GPU instance provisioned solely for the respective order in the EU or Switzerland and deleted afterwards. No external AI provider is ever given access to the customer's documents; this is technically enforced.

The subject matter of the processing is the documents uploaded by the customer as a ZIP file as part of the order, as well as the training and intermediate data derived from them (extracted text, synthetic training examples, model weights). Which personal data the documents contain in detail is determined by the customer through the choice of uploaded content; this may in particular include names, contact details and other information typical of business documents relating to the customer's employees, customers and business partners. Special categories of personal data under Art. 9 GDPR are contractually excluded: the customer does not upload any such data. If processing special categories is nonetheless intended in an individual case, a separate written agreement with additional safeguards is required before the upload. Categories of data subjects are the persons whose data is contained in the documents provided by the customer, in particular the customer's employees, customers and business partners.

IonKon processes the customer's data exclusively on documented instructions from the customer. The customer's order via the order portal and the content of this contract constitute an instruction. Further or deviating instructions must be given in text form and confirmed by IonKon. If IonKon considers that an instruction from the customer infringes the GDPR or other data protection provisions, IonKon informs the customer without undue delay.

IonKon ensures that the persons authorised to carry out the processing have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality, and that the customer's data is accessible to them only to the extent required for their respective role.

The technical and organisational measures taken by IonKon to ensure a level of security appropriate to the risk are set out in the technical and organisational measures (TOM) attached as Annex 1. The TOM form part of this contract.

IonKon engages the following sub-processors to perform this contract; the customer hereby grants general authorisation for their use. All providers named process the customer's data exclusively within the European Union or Switzerland; the European Commission has established an equivalent level of data protection for both. STRATO GmbH (Germany): operation of the web server and database, and encrypted object storage (STRATO HiDrive object storage) for the uploaded documents. DataCrunch Oy, cloud brand “Verda” (Finland): GPU compute for training and data synthesis, a dedicated instance per order, deleted afterwards; processed in Finland. Akenes SA, trading as “Exoscale” (Switzerland): GPU compute for training and data synthesis, a dedicated instance per order, deleted afterwards; processed in Frankfurt, Zagreb or Zurich. IonKon selects the region per order according to available capacity. BuchhaltungsButler GmbH (Germany): invoicing and payment reconciliation; receives only master data, no training documents. If IonKon intends to replace a sub-processor or engage an additional one, IonKon informs the customer in advance in text form; the customer may object to the change for good cause within 14 days of receiving the notice in text form. If the customer does not object within this period, the change is deemed approved. IonKon contractually obliges every sub-processor to the same data protection obligations as set out in this contract.

IonKon assists the customer, where possible, with appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects to exercise their rights under Chapter III of the GDPR (in particular access, rectification, erasure, restriction of processing, data portability and objection). If a data subject contacts IonKon directly with such a request, IonKon forwards the request to the customer without undue delay.

IonKon supports the customer with the security of processing, with notifying the supervisory authority and the data subject of a personal data breach, and with data protection impact assessments and prior consultation of the supervisory authority. If IonKon becomes aware of a breach of the protection of personal data affecting the customer's data, IonKon notifies the customer without undue delay, at the latest 48 hours after becoming aware of it, via the contact address info@ionkon.de; the notification includes at least the nature of the breach, the affected categories of data, the likely consequences and the measures taken, so the customer can meet its own 72-hour notification deadline under Art. 33 GDPR.

After the processing ends, IonKon deletes all copies of the customer data held by it (uploaded documents, training data generated from them and its own model copies) at the latest after the technical retention ceiling expires (default 30 days from delivery, absolute ceiling 180 days from the start of the order). Once deletion has taken place, IonKon automatically issues the customer with proof of deletion. Returning the source documents is not necessary, as the customer already holds the originals of the documents it uploaded.

On request, IonKon demonstrates to the customer that it complies with the obligations set out in this contract and enables the customer, or an auditor engaged by the customer, to carry out audits, in particular by providing suitable evidence. The customer may audit compliance with this contract once a year and on specific cause; the customer gives 14 days' notice of on-site audits. Audits take place during IonKon's usual business hours, while preserving IonKon's trade and business secrets and the confidentiality and security of other customers' data, without unreasonably disrupting IonKon's operations. IonKon may instead provide the required evidence through current certificates or audit reports. The customer bears the cost of an on-site audit, except where the audit finds a material breach by IonKon.

The liability provisions of the General Terms and Conditions apply, unless this contract provides otherwise. This contract begins upon its conclusion, at the latest before the customer's data upload, and ends once the customer data has been fully deleted. In the event of conflict between this contract and the main contract, this contract takes precedence in matters of data protection. The law of the Federal Republic of Germany applies.

Annex

The technical and organisational measures (Annex 1) form part of this contract.