Change history (7 entries)

20/10/2026Editorial clarification of the relationship between § 9(2) and § 10(2). The word 'conclusively' removed from § 9(2).
17/09/2026§ 4(4) added: the Controller's role as deployer under the AI Act and its responsibility for AI notices under Art. 50(1) AI Act when adapting or deactivating the notices that are enabled by default. Liability restated (§ 9): separation of external and internal relationship, priority of the Main Agreement’s liability provisions including recourse under Art. 82(5) GDPR, with a matching carve-out in § 10(2). § 2 extended with sub-processing and a limit on instructions. Term ‘Main Agreement’ defined. Terminology aligned with the German version (LoyJoy Platform, AI agents); term, return and deletion aligned with the provisions on data portability and exit.
02/09/2026Editorial corrections. No substantive changes.
15/07/2026§ 3(1) extended with the Processor's duty to inform the Controller of legally mandated processing outside its instructions (Art. 28(3), second sentence, (a) GDPR).
24/06/2026§ 3 extended with an explicit exclusion of AI training, own-purpose use, and cross-tenant aggregation of personal data (paragraphs 12-14).
05/05/2026Preamble and § 1 extended to cover the Phone Agent and telephony: new data types (telephony metadata, call recordings, transcripts), new purposes, and deletion period rules for phone conversations.
05/02/2026Initial publication of the Data Processing Agreement.

Between

______________________________
______________________________
______________________________
______________________________

– Controller –

and

LoyJoy GmbH
Kapuzinerstraße 20
48149 Münster

– Processor –

the following Data Processing Agreement is entered into pursuant to Art. 28(3) of the General Data Protection Regulation (GDPR).

Preamble

The Processor provides the Controller with the LoyJoy Platform in the contractually agreed version for the creation and use of AI agents for chat and phone as well as live chats, including generative AI features, for interaction with the Controller’s customers via chat, messenger, web widget, telephone and other connected communication channels.

This Data Processing Agreement (“DPA”) governs the resulting data protection obligations of the parties.

This DPA applies in addition to the agreement concluded between the parties on the LoyJoy Platform, including the incorporated General Terms and Conditions (GTC) of LoyJoy GmbH (together, the “Main Agreement”).

§ 1 Subject, Duration, and Specification of Data Processing

This contract defines the subject matter and duration of the order, as well as the type and purpose of processing. In particular, the following data are subject to processing (please strike out what is not applicable and add further data if necessary):

Type of Data	Type and Purpose of Data Processing	Categories of Data Subjects
IP addresses, email addresses, first name, last name, telephone numbers, telephony metadata, call recordings, transcripts, postal address, logs of interactions with an AI agent or live chat of the Controller	Provision of AI agents for chat and phone as well as live chat functions for consultation on the Controller’s products and services, receiving and handling customer enquiries, conducting telephony and text-based dialogues, provision and processing of audio streams, generation and processing of transcripts, obtaining marketing consent, conducting surveys, competitions and registration processes, forwarding customer enquiries, handling complaint requests	Customers, prospects, website visitors, callers, employees

Depending on the process and database, the Controller may configure deletion periods, ranging from 7 to 720 days. An overview of processes and databases is contained in the document Data Protection in the version applicable at the time the contract is concluded.
For conversations with AI agents by phone, transcripts and call recordings are stored as part of the conversation. The default deletion period is 30 days, unless the Controller has configured a different permissible deletion period. Telephony metadata and audio streams are only processed to the extent technically required for the provision of the telephony service. Audio streams are not permanently stored by LoyJoy.
Upon request, the Controller may have individual databases deactivated if they are not required.
The term of this agreement corresponds to the term of the agreement on the LoyJoy Platform. It shall continue to apply during any agreed transition and retrieval period and until the personal data has been fully returned or deleted, to the extent that continuing obligations arise from this agreement or from the provisions on data portability and exit.

§ 2 Scope and Responsibility

The Processor processes personal data on behalf of the Controller. This includes activities specified in the service description. The Controller is solely responsible, under this agreement, for compliance with the legal requirements of data protection laws, in particular for the lawfulness of the disclosure of data to the Processor and the lawfulness of data processing (“Controller” within the meaning of Art. 4 No. 7 GDPR).
Instructions are issued by the Controller upon conclusion of an agreement on the LoyJoy Platform and may thereafter be modified, supplemented, or replaced in text form to the contact designated by the Processor (individual instruction). Oral instructions must be promptly confirmed and documented in text form.
Instructions that go beyond the scope of services agreed in the Main Agreement require a separate agreement. The Processor may refuse to implement them to the extent they are technically unfeasible or economically unreasonable.
Where the Controller itself acts as a processor for a third party, the Processor provides the services as a further processor (sub-processor) within the meaning of Art. 28(4) GDPR. The Controller warrants that it is entitled to engage the Processor and shall issue to the Processor only such instructions as it has itself received from the controller. The provisions of this agreement shall apply accordingly.

§ 3 Obligations of the Processor

The Processor may process data of data subjects only within the scope of the order and the Controller’s instructions, except in cases under Article 28 (3)(a) GDPR. If the Processor is required by Union or Member State law to which it is subject to carry out processing beyond the Controller’s instructions, it shall inform the Controller of that legal requirement before processing, unless the law in question prohibits such information on important grounds of public interest. The Processor shall immediately inform the Controller if it believes that an instruction violates applicable law. In this case, the Processor may suspend execution of the instruction until it has been confirmed or amended by the Controller.
The Processor undertakes, in accordance with Art. 28 GDPR, to structure its internal organization within its area of responsibility to comply with the specific requirements of data protection. It shall implement technical and organizational measures to adequately protect the Controller’s data, meeting the requirements of Art. 32 GDPR. The Processor shall ensure confidentiality, integrity, availability, and resilience of systems and services related to processing on a lasting basis. The specific technical and organizational measures are attached as Annex 1 to this agreement. The Controller is responsible for ensuring these provide an adequate level of protection in relation to the risks of the processed data. The Processor reserves the right to modify security measures, provided that the agreed level of protection is not reduced.
The Processor shall support the Controller, to the extent possible, in fulfilling requests and claims of data subjects pursuant to Chapter III GDPR, and in complying with obligations under Articles 32 to 36 GDPR.
The Processor shall ensure that employees and other persons working for it and engaged in processing the Controller’s data are prohibited from processing the data outside of instructions. The Processor shall also ensure that persons authorized to process personal data are committed to confidentiality or are subject to an appropriate statutory obligation of secrecy. This confidentiality obligation shall continue after termination of the agreement on the LoyJoy Platform.
The Processor shall notify the Controller without undue delay of any personal data breach affecting the Controller’s data. The Processor shall take necessary measures to secure the data, mitigate possible adverse effects for data subjects, and coordinate with the Controller immediately.
The Processor shall designate a contact person for data protection matters under this agreement.
The Processor shall ensure the implementation of a process for regularly testing the effectiveness of technical and organizational measures to ensure processing security (Art. 32 (1)(d) GDPR).
Upon completion of the contractually agreed processing, the Processor shall, at the choice of the Controller, delete all personal data processed on behalf of the Controller or return it to the Controller and delete existing copies. Where a transition or retrieval period is agreed under the provisions on data portability and exit or is provided for by law, the return or deletion shall take place after that period has expired. A statutory obligation to continue storing the data remains unaffected. The Processor shall confirm the deletion upon request.
The Controller may request the handover and export of the data covered by the contract in accordance with the provisions on data portability and exit. The data categories, formats, deadlines and security measures described there also apply to personal data. The Controller’s instructions and the requirements of the GDPR remain authoritative.
In case of claims against the Controller by a data subject under Art. 82 GDPR, the Processor undertakes to assist the Controller in defending the claim, within its capabilities.
Processing of the Controller’s data shall take place exclusively in the Federal Republic of Germany, in a Member State of the European Union, or in another state party to the Agreement on the European Economic Area. Any transfer to a third country requires the Controller’s prior written consent and may only occur if the special conditions of Articles 44 to 49 GDPR are fulfilled.
The Processor and the sub-processors engaged by it shall process the Controller’s personal data exclusively for the purpose of providing the contractually agreed services and on the Controller’s documented instructions. Processing for the Processor’s or its sub-processors’ own purposes shall not take place.
In particular, the Controller’s personal data shall not be used for the training, development, fine-tuning, or other further development of AI or machine learning models.
Cross-tenant aggregation of the Controller’s personal data for the Processor’s own purposes shall not take place.

§ 4 Obligations of the Controller

The Controller must promptly and fully inform the Processor if it identifies errors or irregularities in the order results regarding data protection provisions.
In the event of claims against the Controller by a data subject under Art. 82 GDPR, § 3(10) shall apply accordingly.
The Controller shall designate a contact person for data protection matters under this agreement.
The Controller is the deployer of the AI agents created with the LoyJoy Platform within the meaning of Art. 3(4) of Regulation (EU) 2024/1689 (AI Act). The LoyJoy Platform provides the notices required under Art. 50(1) AI Act informing users that they are interacting with an AI system, enabled by default for chat and telephone. If the Controller adapts or deactivates these notices, the Controller is solely responsible for ensuring that the persons concerned are informed in an appropriate manner that they are interacting with an AI system. The Processor points out this obligation in the LoyJoy Platform when the notices are deactivated.

§ 5 Requests of Data Subjects

If a data subject contacts the Processor with requests for rectification, erasure, or access, the Processor shall refer the data subject to the Controller, provided assignment to the Controller is possible based on the data subject’s information. The Processor shall promptly forward the request to the Controller. The Processor shall support the Controller to the extent possible upon instruction. The Processor shall not be liable if the Controller fails to respond, fails to respond correctly, or fails to respond in time to the data subject’s request.

§ 6 Demonstration of Compliance

The Processor shall demonstrate compliance with obligations under this agreement to the Controller by appropriate means.
If, in individual cases, inspections by the Controller or an auditor appointed by the Controller are required, they shall be conducted during regular business hours, without disrupting business operations, upon prior notice with reasonable lead time. The Processor may make such inspections subject to prior notice with reasonable lead time and to the signing of a confidentiality agreement regarding the data of other clients and implemented technical and organizational measures. If the auditor appointed by the Controller is in a competitive relationship with the Processor, the Processor shall have a right of objection. Inspections shall be limited for the Processor to one day per calendar year.
If a data protection authority or other supervisory authority of the Controller carries out an inspection, paragraph 2 shall apply accordingly. Signing a confidentiality agreement is not required if the authority is subject to professional or statutory confidentiality obligations where violations are punishable under criminal law.

§ 7 Sub-processors (Further Processors)

General Authorization: The Controller grants the Processor general written authorization to engage further processors (sub-processors) to provide the contractually agreed services or to replace existing sub-processors.
Duty of Care in Selection: The Processor undertakes to select sub-processors with professional diligence. The Processor shall ensure that the engaged sub-processors provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of the GDPR and ensures the high data protection standards of this Agreement.
Contractual Safeguards: The Processor is obliged to conclude a contract with each sub-processor in accordance with Art. 28 GDPR, imposing data protection obligations on the sub-processor that are equivalent to those set out in this Agreement.
Duty to Inform about Changes: The Processor shall inform the Controller in a timely manner (at least 4 weeks in advance) of any intended change concerning the addition or replacement of sub-processors. This information may be provided via email or via a notification within the user account (dashboard).
Right to Object: The Controller has the right to object to the intended change. The objection must be submitted to the Processor in text form (e.g., email) within 2 weeks of receipt of the notification and must be based on legitimate, documented data protection grounds.
Deemed Consent: If the Controller does not object within the specified period, the change shall be deemed accepted. The Processor shall specifically point out the right to object and the legal consequences of remaining silent in the notification of change.
Consequences of an Objection: In the event of a justified objection, the parties will attempt to find a mutually agreeable solution (e.g., providing the service without the sub-processor in question). If this is technically impossible or economically unreasonable for the Processor, both parties shall have a special right of termination to end the Agreement as of the effective date of the intended change.

§ 8 Duty to Inform

If the Controller’s data at the Processor is endangered by seizure, confiscation, insolvency or composition proceedings, or other events or measures by third parties, the Processor shall inform the Controller immediately. The Processor shall immediately notify all relevant parties that ownership and control of the data lie exclusively with the Controller as the “Controller” within the meaning of the GDPR.

§ 9 Liability and Damages

Externally, vis-à-vis data subjects, Controller and Processor shall be liable in accordance with Art. 82 GDPR.
In the relationship between the parties, the liability provisions of the Main Agreement, including the incorporated General Terms and Conditions of LoyJoy GmbH, shall apply. This also applies to rights of recourse and contribution under Art. 82(5) GDPR.
Mandatory statutory liability shall remain unaffected.

§ 10 Final Provisions

Amendments and supplements to this agreement and all its components – including any assurances by the Processor – must be made in text form, with explicit reference to the fact that these are amendments or supplements to these terms. This also applies to any waiver of this form requirement.
In the event of any contradictions, the provisions of this data protection agreement shall take precedence over provisions of the Main Agreement. This does not apply to liability in the relationship between the parties under § 9(2). If individual provisions of this agreement are invalid, the validity of the remaining provisions shall not be affected.
German law shall apply.

LoyJoy GmbH – Processor –

Place, Date: ________________________ Signature: ________________________

Controller

Place, Date: ________________________ Signature: ________________________

Annex 1

This DPA includes an annex with the technical and organizational measures pursuant to Art. 32 GDPR.

Annex 2

This DPA includes an annex with the sub-processors of LoyJoy GmbH.

Decision and evaluation

Knowledge

Company

DPA (Data Processing Agreement) LoyJoy GmbH GDPR