Data Processing Agreement
Last updated August 29, 2026
Art. 28 GDPR / AVV processing terms for Auroranexis business customers (version dpa-2026-08-29-v1).
Last updated August 29, 2026
Art. 28 GDPR / AVV processing terms for Auroranexis business customers (version dpa-2026-08-29-v1).
Document title: Data Processing Agreement (Art. 28 GDPR / AVV) Document version: dpa-2026-08-29-v1 Product: Auroranexis This Agreement forms part of the Terms of Service for business customers. It is offered as standard processing terms for self-serve and enterprise procurement review. Individually negotiated addenda may be executed via legal@auroranexis.com or sales@auroranexis.com where required.
Processor (Auftragsverarbeiter): Auroranexis AI Solutions Owner: István-Tamás Schneller Address: Im Malerwinkel 4, 71566 Althütte, Germany VAT ID: DE449657077 Contact: legal@auroranexis.com Controller (Verantwortlicher): the organization that enters into a Auroranexis subscription and determines the purposes and means of processing customer-uploaded personal data in the workspace. Where Auroranexis processes personal data as independent controller (for example account administration, billing, security, or its own marketing where consent applies), that processing is described in the Privacy Policy and is outside the processor mandate of this DPA.
Subject matter: hosting and operation of the Auroranexis multi-tenant B2B SaaS workspace, including storage, retrieval, display, export, support access where instructed, backups, security monitoring, audit logging, and optional features enabled by the Controller. Duration: for the term of the subscription and any post-termination retention period required by the contract or applicable law, after which personal data under this DPA is deleted or returned as set out below.
Nature: collection, storage, organization, structuring, retrieval, consultation, use, disclosure by transmission where instructed, restriction, erasure, and destruction — solely as needed to provide the Service. Purpose: to provide the Auroranexis platform to the Controller on documented instructions, including customer support, billing linkage to the Controller’s organization, security and abuse prevention for the Service, and optional AI-assisted features when explicitly enabled by the Controller.
Data subjects may include Controller staff and contractors, Controller clients and their personnel, authorized portal users, and other individuals whose data the Controller chooses to process in the workspace.
The Processor processes personal data only on documented instructions from the Controller, including this DPA, the Terms of Service, in-product configuration, and written instructions via support or legal channels — unless Union or Member State law requires otherwise. If an instruction appears to infringe GDPR or other data-protection law, the Processor will inform the Controller without undue delay.
The Controller warrants that it has a valid legal basis for processing and for instructing the Processor; that notices to data subjects are provided where required; and that instructions are lawful. The Controller remains responsible for the accuracy of data uploaded to the Service and for configuring access within its organization.
The Processor shall: (a) process personal data only as instructed under this DPA and applicable law; (b) ensure persons authorized to process personal data are bound by confidentiality; (c) implement appropriate technical and organisational measures (Annex II and Security Policy); (d) engage subprocessors only as authorized under Section 12 and Annex III; (e) assist the Controller with data-subject requests, taking into account the nature of processing; (f) assist with security, breach notification, DPIA, and prior consultation duties where applicable and reasonable given the Service; (g) delete or return personal data after end of processing as set out in Section 16; (h) make available information necessary to demonstrate compliance and allow audits as set out in Section 15.
The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Confidentiality obligations survive termination of this DPA for so long as the information remains confidential.
The Processor implements TOMs appropriate to the risk, as summarized in Annex II and described in the public Security Policy. Measures are improved over time; material degradations that reduce the overall security level of processing will not be introduced without assessing impact on this DPA.
The Controller provides general authorization for the Processor to engage subprocessors listed in Annex III (aligned with the public Sub-processors page, inventory version subprocessors-2026-09-02-v2, effective 2026-09-02). The Processor remains responsible for subprocessor performance under Art. 28(4) GDPR. Material changes: the Processor will give reasonable advance notice of intended additions or replacements of subprocessors (via workspace administrator communication and/or update of the public list). The Controller may object on reasonable data-protection grounds within the notice period; if no commercially reasonable resolution is reached, the Controller may terminate the affected Service as provided in the Terms. Operational change steps are documented for operators in the repository subprocessor change procedure.
Where personal data is transferred outside the EEA/UK in connection with the Service, the Processor uses appropriate safeguards such as Standard Contractual Clauses (SCCs) and supplementary measures where required. Transfer details for specific subprocessors are summarized in Annex IV and available on request at legal@auroranexis.com.
Taking into account the nature of processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising data-subject rights. The Processor assists with obligations under Arts. 32–36 GDPR (security, breach notification, DPIA, prior consultation) as reasonable for a multi-tenant SaaS provider, including relevant information from security monitoring and incident processes.
The Processor makes available information necessary to demonstrate compliance with Art. 28 GDPR and this DPA. Audits by the Controller or an mandated auditor are allowed upon reasonable written notice, during business hours, subject to confidentiality, security, and multi-tenant isolation constraints. Where available, the Processor may satisfy audit rights by providing third-party summaries or questionnaires covering the same scope.
After the end of provision of processing services, the Processor shall, at the choice of the Controller, delete or return all personal data processed under this DPA and delete existing copies, unless Union or Member State law requires storage. Workspace export/self-service tools may be used where available; otherwise contact support@auroranexis.com. Billing and accounting records retained under legal obligation are outside deletion of processor-held customer content where retention is mandatory.
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, and provides information reasonably available to assist the Controller with its own notification duties.
Liability and limitations are governed by the Terms of Service unless a signed enterprise addendum states otherwise. In case of conflict on data-protection processing terms for Controller-uploaded workspace data, this DPA prevails over general Terms wording on the same subject for that processing.
Governing law and venue follow the Terms of Service applicable to the subscription, unless a signed addendum provides otherwise.
Data-protection and DPA: legal@auroranexis.com Support: support@auroranexis.com Security: security@auroranexis.com
Service: Auroranexis B2B SaaS platform for client operations, reporting, risk/incident tracking, automation, integrations, monitoring, and related workspace features. Processing operations: storage and hosting of Controller content; user authentication and authorization within the tenant; application logging and security monitoring; backups; support access when requested; optional AI features when enabled. Retention: for the subscription term plus any contractual or statutory retention applicable to specific record types (accounting records may be retained longer under law).
Measures currently described for the Service include: • Encryption in transit (TLS) for application access • Logical tenant isolation and role-based access controls within the application • Authentication requirements for administrative and user access • Access limited to authorized personnel on a need-to-know basis • Audit logging of relevant security and administrative events • Monitoring and incident-response procedures, including customer breach notification where required • Vulnerability intake via security@auroranexis.com / published vulnerability disclosure policy • Backups and recovery processes appropriate to the hosting architecture The public Security Policy provides additional operational detail. Auroranexis does not claim formal ISO/SOC certification on this page unless a current attestation is separately published.
Inventory version: subprocessors-2026-09-02-v2 Effective date: 2026-09-02 Supabase — Database, authentication, file storage, and related backend services. Role: Processor. Activation: ACTIVE. Usage: Always used for the Service. Location/region: EU-capable regions (as configured for the production project). Data: Account, workspace, operational, and authentication data. Vercel — Application hosting, edge delivery, and deployment runtime. Role: Processor. Activation: ACTIVE. Usage: Always used for the Service. Location/region: As configured for the production deployment. Data: Request metadata, application runtime data, logs as configured. Mollie — Payment processing for subscription billing (PSP only; not Merchant of Record). Role: Payment service provider (transparency listing). Activation: ACTIVE. Usage: Always used for the Service. Location/region: EEA (Mollie as payment service provider). Data: Payment and billing transaction data necessary to process charges. Note: Auroranexis remains the contractual seller for SaaS subscriptions. SMTP / STRATO (transactional email) — Primary transactional product and billing email delivery when SMTP is configured. Role: Processor. Activation: ACTIVE. Usage: Always used for the Service. Location/region: As configured for the production SMTP provider (e.g. STRATO). Data: Email addresses and message content for transactional mail. Note: Production path prefers native SMTP; alternate providers below are optional. Resend — Transactional email delivery when Resend is configured instead of / in addition to SMTP. Role: Conditional processor. Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the Resend project. Data: Email addresses and message content for transactional mail. Postmark — Transactional email delivery (code-supported provider adapter). Role: Conditional processor. Activation: CODE-SUPPORTED / NOT ACTIVE. Usage: Conditional / optional. Location/region: As configured if enabled. Data: Email addresses and message content for transactional mail. Note: Adapter/support may exist in codebase; not treated as an active production dependency unless configured. Mailgun — Transactional email delivery (code-supported provider adapter). Role: Conditional processor. Activation: CODE-SUPPORTED / NOT ACTIVE. Usage: Conditional / optional. Location/region: As configured if enabled. Data: Email addresses and message content for transactional mail. Amazon SES — Transactional email delivery (code-supported provider adapter). Role: Conditional processor. Activation: CODE-SUPPORTED / NOT ACTIVE. Usage: Conditional / optional. Location/region: As configured if enabled. Data: Email addresses and message content for transactional mail. Sentry — Application error monitoring when configured. Role: Conditional processor. Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the monitoring project. Data: Error reports, stack traces, limited request context (PII scrubbing applied). Google Analytics 4 (GA4) — Consent-gated marketing / conversion analytics when Measurement ID is configured. Role: Optional analytics (consent-gated). Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the GA4 property. Data: Pseudonymous usage / conversion events under marketing consent. Note: Client tags and server Measurement Protocol require marketing consent (fail-closed). PostHog — Consent-gated product analytics when configured. Role: Optional analytics (consent-gated). Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured (EU host preferred when set). Data: Pseudonymous product usage events under analytics consent. Plausible — Consent-gated website analytics when configured. Role: Optional analytics (consent-gated). Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the Plausible site. Data: Pseudonymous pageview / interaction data under analytics consent. Microsoft Clarity — Consent-gated session analytics when configured. Role: Optional analytics (consent-gated). Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the Clarity project. Data: Pseudonymous interaction / session data under analytics consent. OpenAI — Generative AI features when explicitly enabled and configured. Role: Conditional processor. Activation: OPTIONAL / CONFIGURABLE. Usage: Conditional / optional. Location/region: As configured for the AI provider integration. Data: Prompts and related content submitted to optional AI features. Note: Not used unless AI features are enabled for the workspace / platform configuration. Anthropic — Optional generative AI provider path when configured. Role: Conditional processor. Activation: CODE-SUPPORTED / NOT ACTIVE. Usage: Conditional / optional. Location/region: As configured if enabled. Data: Prompts and related content submitted to optional AI features. Note: Provider path may exist; treat as not active unless production credentials are configured. Azure OpenAI — Optional generative AI provider path when configured. Role: Conditional processor. Activation: CODE-SUPPORTED / NOT ACTIVE. Usage: Conditional / optional. Location/region: As configured if enabled. Data: Prompts and related content submitted to optional AI features. Sub-processor and DPA inquiries: legal@auroranexis.com. Support: support@auroranexis.com. The live public list is also published at /subprocessors.
Transfers outside the EEA may occur depending on subprocessor configuration (for example certain analytics, error monitoring, or optional AI providers). Safeguards: Standard Contractual Clauses and supplementary measures where required. Specific SCC modules, transfer impact assessments, and current subprocessor DPA links are available to Controllers on request at legal@auroranexis.com. This Annex does not invent data-centre locations beyond what is stated in Annex III.