Data Processing Agreement (DPA)

Last Updated: March 4, 2026

This Data Processing Agreement ("DPA") pursuant to Art. 28 GDPR forms part of the Agreement between Art of X UG (haftungsbeschränkt) ("Processor", "we", "us") and the Customer ("Controller", "you") for the use of our services (the "Main Agreement").

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).
• Processing: Any operation performed on Personal Data, including collection, storage, use, and deletion (Art. 4(2) GDPR).
• Sub-processor: Any third party engaged by the Processor to process Personal Data.
• GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation).
• Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data (Art. 4(12) GDPR).

2. Scope and Duration of Processing

2.1 This DPA applies to all Processing of Personal Data by the Processor on behalf of the Controller in connection with the services.

2.2 The Processor shall process Personal Data only for the purposes of providing the services as described in the Main Agreement and in accordance with the Controller's documented instructions.

2.3 The duration of the Processing corresponds to the term of the Main Agreement, unless further obligations arise from the provisions of this DPA.

3. Data Processing Details

4. Instruction Rights

4.1 The Processor shall process Personal Data only on the basis of documented instructions from the Controller, including the instructions set out in this DPA and the Main Agreement, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information.

4.2 Instructions may be given in writing or in text form (including email). Oral instructions shall be confirmed in text form without undue delay.

4.3 The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes data protection law (Art. 28(3) sentence 3 GDPR). The Processor shall be entitled to suspend the execution of the relevant instruction until it is confirmed or amended by the Controller.

5. Processor Obligations

The Processor shall:

5.1 Process Personal Data only within the scope of the Controller's instructions and not for its own purposes.

5.2 Ensure that persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5.3 Implement and maintain appropriate technical and organizational measures (TOMs) pursuant to Art. 32 GDPR throughout the duration of this DPA. The current TOMs are described in Appendix 1 – Technical and Organizational Measures (TOM) of this DPA and available at https://getminds.ai/legal/tom.

5.4 Immediately inform the Controller if the Processor becomes aware of any violations of the GDPR or other data protection regulations in connection with the Processing.

5.5 Designate a Data Protection Officer where required by law. The current Data Protection Officer is:

Prof. Dr. Norman Uhlmann, h3ko Innovations GmbH, Pappelallee 64, 16359 Biesenthal, Germany. Email: [email protected]

6. Data Subject Rights

6.1 The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligations to respond to requests for exercising the data subjects' rights laid down in Chapter III of the GDPR (access, rectification, erasure, restriction of processing, data portability, objection).

6.2 If a data subject contacts the Processor directly with a request, the Processor shall forward the request to the Controller without undue delay.

7. Assistance with Data Protection Obligations

7.1 The Processor shall assist the Controller, taking into account the nature of the Processing and the information available to the Processor, in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, in particular:

• ensuring the security of Processing (Art. 32 GDPR);
• notifying Personal Data breaches to the supervisory authority (Art. 33 GDPR) and to data subjects (Art. 34 GDPR);
• carrying out Data Protection Impact Assessments (Art. 35 GDPR);
• prior consultation with the supervisory authority (Art. 36 GDPR).

7.2 The Processor shall assist the Controller with requests and investigations by data protection supervisory authorities relating to the commissioned Processing.

8. Sub-processors

8.1 The Controller hereby grants the Processor general written authorization to engage Sub-processors pursuant to Art. 28(2) GDPR, subject to the requirements of this section.

8.2 The current Sub-processors at the time of conclusion of this DPA are listed at https://getminds.ai/legal/subprocessors.

8.3 The Processor shall notify the Controller of any intended addition or replacement of Sub-processors at least 14 days before the planned change, giving the Controller the opportunity to object.

8.4 If the Controller raises objections within the notice period, the parties shall endeavor to reach an amicable solution. If this is not possible, the Controller shall have the right to terminate the Main Agreement with immediate effect.

8.5 The Processor shall contractually ensure that Sub-processors are bound by data protection obligations no less protective than those set out in this DPA (Art. 28(4) GDPR). The Processor shall be liable for the acts and omissions of its Sub-processors as for its own acts and omissions.

9. International Transfers

9.1 Processing of Personal Data in a third country or by an international organization shall only take place where the specific conditions of Articles 44 et seq. GDPR are met.

9.2 For Sub-processors located in the United States, transfers are carried out on the basis of:

• The EU-US Data Privacy Framework (DPF), where the Sub-processor is certified
• Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914

9.3 For Sub-processors in the United Kingdom, the European Commission's adequacy decision (Decision 2021/1772) applies.

9.4 The Processor monitors the status of applicable adequacy decisions and transfer mechanisms and shall inform the Controller if changes require an adjustment to the transfer basis.

10. Personal Data Breach Notification

10.1 The Processor shall notify the Controller without undue delay, and in any event within 48 hours, upon becoming aware of a Personal Data breach.

10.2 The notification shall include at a minimum:

• a description of the nature of the breach, including where possible the categories and approximate number of data subjects and data records concerned;
• the name and contact details of the Data Protection Officer or other point of contact;
• a description of the likely consequences of the breach;
• a description of the measures taken or proposed to address the breach and to mitigate its effects.

10.3 The Processor shall assist the Controller in fulfilling the notification obligations pursuant to Articles 33 and 34 GDPR.

11. Audit Rights

11.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.

11.2 The Controller shall be entitled to conduct audits, including inspections, at the Processor's premises or have them conducted by an appointed auditor. Such audits shall take place upon reasonable notice (at least 14 days) during normal business hours and shall not unreasonably disrupt the Processor's business operations.

11.3 The Processor may present current audit reports, certifications, or extracts thereof to demonstrate compliance.

11.4 Appointed third-party auditors must be bound by confidentiality obligations in advance. Audit costs shall be borne by the Controller, unless a breach by the Processor is established.

12. Deletion and Return of Personal Data

12.1 Upon termination of the Main Agreement, the Processor shall delete all Personal Data processed on behalf of the Controller within 30 days, unless the Controller requests the return of the data in a common, machine-readable format.

12.2 Deletion shall be carried out in accordance with the current state of the art and shall be confirmed to the Controller in writing upon request.

12.3 Where retention is required under Union or Member State law, the Processor shall inform the Controller of the retention obligation and the data concerned.

13. Liability

13.1 The parties' liability shall be governed by Art. 82 GDPR.

13.2 The Processor shall be liable to the Controller for damages attributable to Processing that does not comply with the GDPR or the Controller's instructions.

13.3 The Processor shall be liable for the acts and omissions of its Sub-processors as for its own acts and omissions.

13.4 Liability is otherwise subject to the limitations set forth in the Main Agreement, insofar as this is compatible with the mandatory provisions of the GDPR.

14. Final Provisions

14.1 This DPA shall be governed by the laws of the Federal Republic of Germany.

14.2 The exclusive place of jurisdiction for all disputes arising from or in connection with this DPA shall be Berlin, to the extent legally permissible.

14.3 Amendments and supplements to this DPA must be made in writing.

14.4 Should any provision of this DPA be or become invalid, the validity of the remaining provisions shall not be affected.

14.5 In the event of conflicts between this DPA and the Main Agreement, this DPA shall prevail with respect to the protection of Personal Data.

Art of X UG (haftungsbeschränkt) Goethestr. 59, 10625 Berlin, Germany Managing Directors: Friedrich von Borries and Alexander Doudkin

For questions regarding this DPA, contact: [email protected]

Appendix 1: Technical and Organizational Measures (TOM)

Last Updated: February 20, 2026

Art of X UG (haftungsbeschränkt) ("Minds AI") implements the following technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk involved in the processing of personal data.

1. Access Control

Physical Access Control

Minds AI infrastructure is hosted exclusively with certified cloud providers:

• DigitalOcean – Frankfurt, Germany data center (EU). Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018.
• Supabase – Stockholm, Sweden data center (EU), hosted on AWS. Certifications: SOC 2 Type II.

Physical security (biometric access controls, 24/7 surveillance, access logging) is fully managed by the cloud providers.

Logical Access Control

• Role-based access control (RBAC) for all internal systems and administration interfaces.
• Multi-factor authentication (MFA) required for all employee access to production systems.
• Individual user accounts – no shared credentials.
• Regular review and revocation of access rights following the principle of least privilege.
• API keys and credentials are managed in encrypted secrets managers.

2. Encryption

Encryption in Transit

• All data transmissions are secured via TLS 1.2 or higher.
• HSTS (HTTP Strict Transport Security) is enabled for all public endpoints.
• Internal service-to-service communication is also encrypted.

Encryption at Rest

• Databases (Supabase/PostgreSQL) use AES-256 encryption for data at rest.
• File storage (DigitalOcean Spaces / Supabase Storage) uses server-side AES-256 encryption.
• Backups are stored in encrypted form.

3. Data Separation (Tenant Isolation)

• Strict logical separation of customer data at the database level through tenant isolation (Row-Level Security in PostgreSQL).
• Each customer can only access their own data – enforced at both the database and API level.
• Automated tests ensure no cross-tenant data leakage occurs.

4. Availability and Resilience

Hosting Architecture

• Application runs on DigitalOcean App Platform with automatic scaling and health checks.
• Database on Supabase with high-availability configuration.

Backup and Recovery

• Daily automatic database backups with a retention period of at least 7 days.
• Point-in-Time Recovery (PITR) for the PostgreSQL database.
• Regular testing of recovery procedures.
• Recovery Time Objective (RTO): as defined in SLA.
• Recovery Point Objective (RPO): maximum 24 hours.

5. Incident Response

• Documented incident response process for security incidents.
• Notification of the Controller (customer) within 48 hours of becoming aware of a personal data breach, in accordance with the Data Processing Agreement (DPA).
• Logging and tracking of all security-relevant incidents.
• Regular review and update of the incident response plan.

6. Confidentiality and Employee Obligations

• All employees and contractors are bound by confidentiality agreements (NDAs).
• Regular data protection training for all employees.
• Obligation to maintain data secrecy in accordance with GDPR.
• Access to personal data is granted only on a need-to-know basis.

7. Subprocessor Management

• Careful selection of sub-processors based on data protection and security criteria.
• Contractual obligation of all sub-processors to GDPR-compliant data processing.
• Regular review of sub-processors.
• Current list of sub-processors is available at Subprocessors.
• Advance notice to customers of any changes as per the DPA.

8. Logging and Monitoring

• Centralized logging of system events and access.
• Langfuse for monitoring and tracing AI model interactions (hosted in the EU).
• PostHog for product analytics – used only with explicit user consent (consent-based).
• Monitoring of critical system metrics with automated alerts.
• Regular review of logs for anomalies.

9. Data Minimization and Pseudonymization

Data Minimization

• Collection and processing of only those personal data that are necessary for the respective processing purpose.
• Regular review of processed data categories for necessity.
• Automatic deletion of data no longer needed in accordance with defined retention periods.

Pseudonymization

• Where technically feasible and appropriate, personal data is processed in pseudonymized form.
• Internal processing primarily uses UUIDs rather than real names.
• Analytical evaluations are performed on an aggregated or pseudonymized basis.

10. Regular Review and Assessment

• Regular security assessments of infrastructure and applications.
• Dependencies are regularly checked for known vulnerabilities (dependency scanning).
• Review and update of these TOMs at least annually or upon significant changes to processing activities.
• Continuous improvement of security measures based on current threat landscape.

11. Additional Measures

Input Control

• Logging of changes to personal data (audit trail).
• Traceability of who entered, modified, or deleted which data and when.

Transfer Control

• Data transfers are exclusively encrypted.
• No transfer of personal data to third countries without an adequate level of protection (adequacy decision or Standard Contractual Clauses).

Processing Control

• Processing of personal data exclusively in accordance with the Controller's instructions.
• Contractual regulation of commissioned processing in the DPA.

These technical and organizational measures are reviewed regularly and updated as necessary to ensure a level of protection consistent with the current state of the art.