Data Processing Agreement
Version: 1
Effective date: {{dpaEffectiveDate}}
This Data Processing Agreement ("DPA") is concluded between Good Morning Technologies GmbH, Linienstr. 41, 10119 Berlin ("Provider"), and the customer identified in Annex 1 or the associated service agreement or acceptance record ("Customer"). It forms part of the agreement governing Customer's use of the Arc services ("Service Agreement"). The annexes form an integral part of this DPA. The parties' identity, authority and acceptance are recorded through {{dpaAcceptanceMechanism}}.
1. Definitions, scope and roles
"GDPR" means Regulation (EU) 2016/679. "Applicable Data Protection Law" means the GDPR and applicable EU Member State data-protection laws and, where applicable, the UK GDPR and associated UK legislation. Personal data, processing, controller, processor, data subject, supervisory authority and personal data breach have the meanings given by that law. "Customer Personal Data" means personal data processed by Provider on Customer's behalf under the Service Agreement. "Subprocessor" means another processor engaged by Provider to perform that processing.
This DPA applies to the activities described in Annex 2 where Customer is controller and Provider is processor. Where Customer is itself a processor, Provider acts as a subprocessor; Customer warrants that it is authorized to appoint Provider and give the relevant instructions on behalf of the upstream controller. References to Customer's controller obligations apply to the extent relevant to its role and do not remove either party's statutory obligations.
The DPA does not govern activities for which Provider independently determines the purposes and means, including its own account administration, platform billing, fraud prevention and support administration. Those activities are described in the Privacy Policy. Classification is activity-specific; the existence of a payment, diagnostic or hosting service does not by itself determine its role for every activity.
The subject matter, duration, nature, purposes, data categories and data subjects are specified in Annex 2. Processing must remain within that scope and the documented instructions. Neither this DPA nor a feature permission supplies Customer's lawful basis or replaces notices, consents or other safeguards required for Customer's own processing.
2. Documented instructions and Customer obligations
Provider shall process Customer Personal Data only on Customer's documented instructions, including instructions concerning international transfers, unless processing is required by Union or Member State law to which Provider is subject. In that case Provider shall inform Customer of the legal requirement before processing, unless that law prohibits notification on important grounds of public interest. Requirements under other laws do not of themselves authorize processing contrary to Applicable Data Protection Law.
The Service Agreement, this DPA and its completed annexes, enabled service settings, and requests submitted by Customer's authorized users constitute instructions within the agreed scope. They may include uploading, organizing, transforming, translating, annotating, storing, publishing, delivering email, exporting and deleting content. Automatic workflows, including publication-triggered translation, must be within the agreed instructions. Provider shall maintain a record of material instructions and shall not interpret use of the Services as authority for unrelated processing.
Additional or amended instructions shall be documented. If an instruction changes the service scope or requires additional measures, the parties shall agree its implementation; this does not permit Provider to refuse duties imposed by Applicable Data Protection Law or this DPA. Provider shall immediately notify Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and shall suspend the affected processing until lawful instructions are established.
Customer shall ensure that its instructions and intended uses are lawful, that it supplies necessary notices and permissions, and that its authorized users, publication audiences, subscriber preferences and data disclosures are appropriately controlled. Customer shall provide the information reasonably necessary for Provider to perform its obligations and shall assess whether the Services and agreed safeguards are suitable for its processing.
Intentional processing of Article 9 special-category data, Article 10 criminal-conviction/offence data or comparable highly sensitive information is outside the ordinary service scope unless specifically recorded in Annex 2 with the necessary instructions and safeguards. Photographs, text and contextual metadata can reveal sensitive information; they are not treated as non-personal or non-sensitive solely because of their format.
3. Personnel and confidentiality
Provider shall ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are subject to an appropriate statutory confidentiality duty. Access shall be restricted to persons who require it for the authorized tasks and shall be removed when no longer required. Provider shall give those persons appropriate instructions and training and shall ensure that confidentiality continues after their authorization or engagement ends.
4. Security of processing
Provider shall implement and maintain technical and organisational measures appropriate to the risk in accordance with Article 32 GDPR and the measures specified in Annex 3. The assessment shall take account of the state of the art, implementation costs, processing context and the likelihood and severity of risks to individuals, including accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.
The measures shall address, as appropriate, pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; timely restoration of access following an incident; and regular testing, assessment and evaluation. Provider shall restrict processing to necessary data and apply segregation, access control, secure development and operational safeguards appropriate to the Services.
Provider may improve or replace individual measures if the agreed level of protection is not materially reduced and the DPA remains fulfilled. A material reduction or change requiring Customer instructions shall be agreed in advance. Annex 3 identifies the measures and assistance arrangements applicable to the actual deployment.
5. Subprocessors
Customer grants general written authorization for the subprocessors identified in the completed, accepted Annex 4, for the specified activities only. Optional services may receive Customer Personal Data only when included in the agreed instructions and enabled or requested by Customer. Inclusion of a supplier's commercial name or a link to its standard terms does not authorize an unidentified entity, unlisted activity or incompatible service.
Before adding or replacing a subprocessor, Provider shall notify Customer in writing using the method and advance notice period in Annex 4. The notice shall identify the entity, function, locations, relevant data, safeguards and intended start date so Customer can object on reasonable data-protection grounds before processing begins. Provider shall supply reasonably requested information about the proposed appointment.
If Customer objects, the parties shall seek a resolution, such as an alternative arrangement or discontinuation of the affected function. Provider shall not begin the disputed processing before the agreed objection procedure has been completed. If no suitable resolution is available, Customer may terminate the affected service without a termination penalty; payment for services already delivered remains governed by the Service Agreement.
Provider shall enter into a binding written contract with each subprocessor imposing materially equivalent data-protection duties for the delegated processing, including instructions, confidentiality, security, assistance, breach notice, deletion and audit/compliance information. Provider shall verify that sufficient guarantees exist and shall remain fully liable to Customer for the subprocessor's performance of those duties. Provider shall provide the relevant contractual information or a copy on request, with proportionate redaction protecting unrelated confidential information while leaving the data-protection obligations ascertainable.
Provider shall secure an arrangement enabling Customer, if Provider disappears, ceases to exist legally or becomes insolvent, to terminate the relevant subprocessing and instruct return or deletion of Customer Personal Data, to the extent required by the applicable contractual safeguards.
6. International transfers and access
Provider shall transfer Customer Personal Data to a third country or international organisation, including through relevant remote access or onward transfers, only on documented instructions and in compliance with Chapter V GDPR. Annex 4 shall identify the processing locations and applicable transfer arrangement for each relevant activity.
Where a transfer requires contractual safeguards, the parties or relevant exporter and importer shall execute and complete the applicable transfer clauses, including the correct module, parties, data description, security measures and competent authority. Where required they shall assess the transfer circumstances and adopt supplementary measures. UK transfers shall use a valid UK mechanism where applicable.
This DPA is an individually drafted Article 28 agreement. It does not purport to reproduce or adopt unchanged the Commission's standard clauses and does not itself constitute the international-transfer clauses under Decision (EU) 2021/914. Linking supplier terms does not execute a transfer mechanism. Applicable mandatory transfer clauses prevail over inconsistent terms.
Provider shall promptly inform Customer, where legally permitted, of legally binding requests for access to Customer Personal Data affecting the processing, assess their validity, pursue available appropriate protections, and disclose only what it is lawfully required to disclose. Provider shall notify Customer if it can no longer maintain the required transfer safeguards and suspend the affected transfers while the parties establish a lawful solution.
7. AI functions and Customer-directed recipients
Authorized AI functions may require transmitting unpublished text, photographs, contextual metadata and instructions to the relevant authorized AI subprocessor. The permitted workflows and inputs are described in Annexes 2 and 4. Provider shall limit inputs to those reasonably necessary for the function and shall not authorize independent general-purpose model training using Customer Personal Data. Before processing, Provider shall ensure that the applicable contract and settings support those restrictions; an incompatible workflow is not authorized under this DPA.
Service delivery, safety/security processing, search grounding, logging and provider retention shall be identified for the applicable activity in Annex 4. A response-storage setting or a general statement about model training does not replace that specification. AI outputs saved by Customer as photographs or story content follow the customer-content lifecycle; ancillary prompts, results and operational records follow Annex 2.
A recipient engaged directly by Customer, such as Customer's own connected application account, is not automatically Provider's subprocessor. Customer may instruct Provider to disclose or return specified content to that recipient, subject to a lawful instruction and applicable transfer requirements. Provider remains responsible for the transmission and processing it performs. Separate-controller activities and directly engaged recipients shall be identified separately in Annex 4. Customer shall review generated or transformed content before publishing it.
8. Data-subject rights and regulatory assistance
Provider shall promptly notify Customer of requests it receives concerning Customer Personal Data and shall not respond substantively except on documented instructions or where legally required. Taking into account the nature of processing, Provider shall assist Customer through appropriate technical and organisational measures in fulfilling Chapter III GDPR obligations, including access, correction, erasure, restriction, portability, objection and applicable automated-decision rights.
Taking into account the nature of processing and available information, Provider shall assist Customer in complying with Articles 32–36 GDPR, including security assessments, breach reporting and communication, data-protection impact assessments and prior consultation with supervisory authorities. Provider shall notify Customer when it becomes aware that relevant data is inaccurate or outdated and provide the assistance necessary for correction or deletion within the agreed processing.
Provider shall maintain the records required of it under Article 30 GDPR, cooperate with competent authorities, and provide information concerning its own processing necessary for Customer's compliance. Assistance shall be timely enough for Customer to meet applicable deadlines. The contacts, procedures and agreed extent of assistance are set out in Annexes 1 and 3. Commercial arrangements must not prevent effective performance of mandatory assistance or delay urgent breach handling.
9. Personal data breaches
Provider shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice shall be sent to the designated contact in Annex 1. Provider shall not delay initial notice until an investigation is complete, all details are known or fault has been established.
The notification shall include, insofar as known, the nature of the breach; the affected categories and approximate numbers of data subjects and records; a contact for further information; likely consequences; and containment, mitigation and remedial measures taken or proposed. Unavailable information shall be supplied in stages without undue further delay. Provider shall document the relevant facts, effects, response and notifications, preserve necessary evidence and keep Customer informed of material developments.
Provider shall promptly contain and remediate the breach and cooperate with Customer and relevant subprocessors. Customer determines notifications to authorities and affected individuals for its controller processing; Provider shall support those decisions and satisfy any independent statutory duty. Provider shall not notify individuals on Customer's behalf without instructions unless required by law.
10. Return, deletion and retention
At the end of the applicable processing services, Provider shall, at Customer's choice, return Customer Personal Data in the agreed usable format or delete it, and delete existing copies unless Union or Member State law requires retention. Requests and export/deletion arrangements are specified in Annex 2. Deletion instructions given during the service shall be executed within the applicable agreed and legal requirements; ending an integration alone does not necessarily erase the customer's underlying media library or published content.
Active customer content shall be retained only for the instructed service duration. Ancillary records shall be retained only for their necessary authorized purpose and for no longer than six calendar months from the applicable event in the completed retention schedule, unless a shorter period applies or an identified lawful exception requires otherwise. This maximum does not authorize keeping temporary data longer than needed, delaying an erasure request, or retaining active content contrary to Customer's instructions.
Necessary post-termination processing shall be restricted to return, deletion, recovery protection or an identified legal requirement. Backup copies awaiting scheduled expiry shall be protected and excluded from ordinary use. The schedule shall identify their expiry and any restrictions; if restored, applicable deletion instructions shall be reapplied before ordinary processing resumes. Provider shall bind subprocessors to corresponding return/deletion arrangements, confirm completion on request, and identify any legally retained data, its basis and retention period.
This DPA remains effective while Provider or its subprocessors retain Customer Personal Data within its scope. Confidentiality, protection, return/deletion and compliance-information duties survive termination for as long as necessary to fulfil them.
11. Information and audits
Provider shall make available information necessary to demonstrate compliance with this DPA and Article 28 GDPR and shall allow and contribute to audits, including inspections, by Customer or an auditor mandated by Customer. Provider shall supply relevant security, processing, subprocessor and deletion information and cooperate in addressing findings.
The parties may use independent reports or certifications to avoid unnecessary duplication, but they do not replace an effective audit right where further verification is reasonably required. Reasonable notice, confidentiality, scheduling and security arrangements may protect other customers and systems without preventing meaningful verification, an urgent investigation, a regulator's powers or performance of legal obligations. Audits are not restricted to an arbitrary annual limit where a breach, material concern or authority requires further examination.
12. Non-compliance, suspension and termination
Provider shall promptly inform Customer if it is unable to comply with this DPA. Customer may require suspension of the affected processing until compliance is restored or the affected agreement is terminated. Provider shall protect the data during suspension and shall not resume processing contrary to Customer's lawful instructions.
Customer may terminate the affected processing where a material or persistent breach occurs, where compliance cannot be restored within a reasonable agreed period, or where an authority or binding legal requirement requires termination. Provider may terminate the affected processing where Customer insists on an unlawful instruction after being informed of its illegality. Return/deletion and surviving duties under clause 10 apply in each case.
13. Precedence, amendments and general provisions
This DPA takes precedence over inconsistent Service Agreement provisions concerning Customer Personal Data, subject to mandatory law and applicable international-transfer clauses. No term shall restrict a data subject's statutory rights, either party's direct statutory duties or a supervisory authority's powers. Responsibility to Customer for subprocessors and mandatory liabilities under Applicable Data Protection Law remain unaffected.
The governing law and dispute arrangements in the Service Agreement apply insofar as compatible with mandatory data-protection law and applicable transfer clauses. If a provision is unenforceable, the remaining provisions continue to apply and the parties shall replace it with a lawful provision preserving its intended protection.
Material changes to accepted obligations, scope or annexes require a documented agreement, except authorized subprocessor updates completed under clause 5. Publishing a revised webpage alone does not amend an accepted DPA. The accepted version and completed annexes shall remain available to the parties. Additional parties may join only through documented agreement identifying their role, processing and acceptance.
Annex 1. Parties, contacts and acceptance
| Item | Details |
|---|---|
| Provider | Good Morning Technologies GmbH, Linienstr. 41, 10119 Berlin. Privacy and DPA contact: [email protected]. |
| Customer and role | The customer legal name, address, registration where applicable, authorized signatory and controller/processor role are identified in the Service Agreement or associated DPA acceptance record. |
| Upstream controller, where applicable | Identified in Customer's instructions or acceptance record, with Customer's authority to appoint Provider as subprocessor recorded there. |
| Customer contact and breach destination | {{dpaCustomerPrivacyContact}} |
| Acceptance and effective date | {{dpaAcceptanceMechanism}}. Accepted version: 1. Effective date: {{dpaEffectiveDate}}. The associated record identifies the parties, signatory authority and accepted annexes. |
Annex 2. Processing description and retention schedule
| Item | Details |
|---|---|
| Subject matter and purpose | Delivery of Customer's selected creation, private media storage, hosting, publishing, audience and commerce functions, and their necessary technical operation. |
| Nature and operations | Collection, upload, organisation, storage, retrieval, editing, transformation, image processing, authorized AI annotation/caption assistance/proofreading/cover or carousel preparation, publication-triggered subscriber-language translation within enabled workflows, publication under Customer's access settings, authorized messaging, visitor measurement, export and deletion. Only functions agreed and performed on Customer's behalf are covered. |
| Data subjects | People depicted or mentioned in Customer content; visitors, subscribers, customers, recipients, collaborators and other contacts whose personal data Customer supplies or collects through the Services. |
| Data categories | Names/contact details; subscriber preferences, delivery/activity records; order/delivery details; photographs, captions, story text, drafts and revisions; capture time, camera and location metadata where supplied; visitor technical/pseudonymous identifiers; authorized AI inputs/results and related operational records. |
| Sensitive data and safeguards | No intentional Article 9 or Article 10 processing is authorized by the ordinary scope. Any agreed exception must identify the categories, purpose, legal conditions, access restrictions, onward disclosures and additional safeguards in a recorded annex amendment before processing. |
| Frequency and duration | Continuous instructed hosting/storage and event-based processing through enabled workflows during the service term and necessary agreed return/deletion period. Active content is not automatically deleted merely because it is six months old. |
| Return and active-system deletion | {{dpaReturnAndDeletionProcedure}}. Account/content deletion deadlines and exceptions: {{accountAndContentDeletionSchedule}}. |
| Temporary uploads | {{temporaryUploadRetention}}. Identify cleanup of failed/abandoned uploads, raw bytes, local files and unused derivatives separately from stored customer media. |
| Publishing and AI records | Publication/action history: {{publicationAndActionRetention}}. Ancillary AI prompts/results/errors: {{aiOperationRetentionSchedule}}. Saved generated content follows the content lifecycle. |
| Audience, analytics and logs | Customer messaging/audience records: {{supportAndEmailRetention}}. Analytics: {{analyticsRetentionSchedule}}. Processor security/operational logs: {{securityAndOperationalLogRetention}}. This schedule concerns only activities within this DPA. |
| Backup and required retention | Backup expiry, isolation and restored-data deletion: {{backupRetentionAndDeletionSchedule}}. Any applicable legally required retention, identified basis and exceptions: {{statutoryRecordRetention}}. |
| Six-month ancillary maximum | Unless a shorter limit applies or an identified lawful exception requires otherwise, ancillary personal-data records must expire within six calendar months of the event specified in the applicable schedule. Each schedule identifies the start event, deletion deadline, affected stores and exceptions. Provider-side processing and retention are specified separately in Annex 4. |
Annex 3. Technical and organisational measures and assistance
- Application authorization and segregation: authenticated access, account/content ownership checks, function-scoped integration permissions and controlled private-media access. Publication and recipient settings limit instructed disclosures.
- Infrastructure and encryption: {{dpaInfrastructureAndEncryptionMeasures}}. Specify the dedicated Hetzner infrastructure, Google Cloud storage regions, network protection, TLS, at-rest protection, key management and applicable physical/remote-access controls.
- Personnel and privileged access: {{dpaPersonnelAndAccessMeasures}}. Specify administrator access, authentication, access review/revocation, training, confidentiality and separation of duties where relevant.
- Secure operation, testing and incident response: {{dpaMonitoringAndIncidentMeasures}}. Include patching, secure changes, risk-based tests, necessary audit trails, diagnostic redaction and escalation/notification procedures.
- Availability, recovery and deletion: {{dpaRecoveryAndDeletionMeasures}}. Include backup protection/expiry, restoration testing, secure media disposal and reapplication of deletion instructions after restore.
- External processing: server-side provider credentials, function-specific AI inputs, authorization of provider calls and restricted access to operation records. Optional and automatic functions must remain within the recorded instructions.
- Assistance: {{dpaAssistanceProcedure}}. Specify rights-request routing, timely export/correction/deletion/restriction, security and breach information, DPIA/prior-consultation support and audit information. Provider contact: [email protected]; Customer contact: {{dpaCustomerPrivacyContact}}.
Annex 4. Subprocessors, locations and transfer arrangements
The completed register identifies the actual contracted entities, authorized activities, processing locations, retention and safeguards. Entries containing uncompleted fields are not a complete authorization record. Supplier documents linked below provide contractual references; their applicability and acceptance must be recorded for the relevant account and service. They do not replace Provider's obligations to Customer.
| Service | Activity and reference terms | Entity, locations, retention and safeguards |
|---|---|---|
| Hetzner dedicated infrastructure | Private dedicated application server administered by Provider. The applicable hosting/support processing and access arrangements determine the recorded role. Hetzner DPA; data-protection and acceptance information. | {{dpaHetznerDetails}} |
| Google Cloud | Processor for private image storage and any authorized infrastructure/media delivery. Data includes uploaded images and associated object/technical metadata. Cloud Data Processing Addendum. | {{dpaGoogleCloudDetails}} |
| Postmark / configured email provider | Authorized customer newsletters/messaging: addresses, message content/links, delivery/suppression records and authorized activity data. Postmark DPA; confirm the version applicable to the account. Other SMTP providers require their own recorded terms. | {{dpaEmailProviderDetails}} |
| OpenAI API | Authorized annotation, captions, proofreading/translation, cover analysis, carousel preparation and other agreed AI functions. OpenAI Data Processing Addendum. | {{dpaOpenAiDetails}} |
| Google Gemini API | Authorized cover/image generation, scene preparation and any specifically instructed search grounding. Gemini API terms, Google processor addendum; these are service-specific and not automatically the Cloud Storage agreement. | {{dpaGeminiDetails}} |
| Other processor activities | Any diagnostics, SMS, address, payment or fulfilment processing performed on Customer's behalf must identify the actual service/entity and task. Relevant references include Twilio's addendum and Stripe's activity-specific DPA. | {{dpaAdditionalSubprocessorDetails}} |
Separate controllers and Customer-engaged services: {{dpaSeparateRecipientDetails}}. These entries identify the entity, activity, data and applicable terms and are distinct from the authorized-subprocessor register.
Subprocessor change procedure: {{dpaSubprocessorNoticeProcedure}}. Record the written notice channel, advance period, objection destination, response process and affected-service termination arrangements.