Data processing agreement

This data processing agreement under Art. 28 GDPR applies between the company that uses Swiftpilot (the customer, controller) and WSK Software GmbH, Wupperstr. 15, 42897 Remscheid, Germany (Swiftpilot, processor).

It is part of the contract for the use of Swiftpilot (main contract) and applies to every service in which Swiftpilot processes personal data on behalf of the customer. Where the main contract and this agreement contradict each other on a question of data protection, this agreement prevails.

This agreement does not apply to data whose processing Swiftpilot decides on itself, such as the Swiftpilot account, billing and requests through the website. The Swiftpilot privacy policy applies to those.

The German version of this agreement is binding; this English version is a translation.

(1) Swiftpilot provides Swiftpilot to the customer as a service over the internet. This agreement covers the personal data that the customer, its users and the visitors of its websites put into the customer’s workspaces, that arise there on behalf of the customer, or that the customer retrieves from connected systems.

(2) This agreement applies for as long as the main contract exists and beyond, until Swiftpilot has deleted the customer’s data under section 13.

(1) Swiftpilot runs workspaces for the customer, each with its own database, and provides the services of the main contract in them. These include in particular:

a) storing and backing up the workspace’s data: in its database and, for files such as documents in the knowledge and attachments in conversations, with the Pilot and in incoming emails, encrypted in object storage with a copy in a second location;

b) the website assistant, which answers visitors on the customer’s websites, takes contact requests and, if the customer wishes, moderates messages, with the option to block senders;

c) agents and the Pilot, which answer and carry out tasks with language models, also as steps in workflows, and background work such as summaries, translations, evaluations for dashboards and the answer check;

d) knowledge collections: storing documents and pages that Swiftpilot fetches from the customer’s websites at the customer’s request and keeps as text in the database, splitting the texts into sections and computing vector representations (embeddings) for search;

e) workflows and their runs, the work basket with approvals and contact requests, dashboards and the log of changes;

f) the connections to systems the customer connects, reading emails from mailboxes it connects, and the emails the workspace sends, such as notifications, invitations and, at a visitor’s request, the transcript of their conversation;

g) error analysis and support at the customer’s request.

(2) The processing comprises collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure to the subprocessors in Annex 2, alignment, restriction and erasure.

(3) Swiftpilot processes the data only to provide these services. Swiftpilot does not use it for its own purposes, for advertising or to train AI models. For billing and operation, a workspace sends Swiftpilot’s administration only figures without content, such as the number of conversations, the workflow runs counted and the AI budget used per model in the billing period, the number of users and of documents, and the identifier and size of stored files, not their names.

(1) The customer determines which data is processed: through what it and its users put into the workspaces, the systems it connects and the settings of its agents. Typically this is:

a) user data: name, username, email address, password as a hash, roles and permissions, language, notifications and their settings, times of sign-in;

b) conversations: messages from visitors and users, the agents’ answers, summaries, translations, ratings of answers and uploaded files;

c) contact requests: what visitors give in the conversation, such as name, email address, phone number and their concern;

d) visitors’ technical data: IP address and browser details (user agent) of each session, a hash of the random identifier of the browser, a session key, the path of the page on which the conversation started and, for a block, the IP address and session key of the blocked sender;

e) content of knowledge collections, workflows and dashboards, emails from connected mailboxes with their attachments, and data from connected systems, where it contains personal data;

f) log data: who changed what and when, with IP address, workflow runs and error reports.

(2) Special categories of personal data under Art. 9 GDPR are not part of the services. Visitors and users can, however, write such data into free text. Swiftpilot then processes it like any other content; whether the customer may process it is for the customer to assess.

a) employees and other users of the customer who have access to its workspaces;

b) visitors of the customer’s websites who use the website assistant;

c) customers, prospects, applicants, business partners and other persons whose data the customer puts into knowledge collections, workflows or connected systems;

d) contact persons in the systems the customer connects.

(1) Swiftpilot processes the data only on documented instructions from the customer, including with regard to transfers to a third country, unless Union or Member State law requires Swiftpilot to process it. In that case Swiftpilot informs the customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The customer’s instructions are set out in the main contract, in this agreement and in the settings the customer makes in its workspaces, such as retention, moderation, roles and permissions and connected systems. The administrators of the customer’s organisation give further instructions in text form to datenschutz@swiftpilot.ai.

(3) If Swiftpilot considers that an instruction infringes data protection law, Swiftpilot informs the customer without undue delay. Swiftpilot may suspend carrying it out until the customer confirms or changes it.

(1) Swiftpilot only uses persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and instructs them in data protection.

(2) These persons access the content of workspaces only as far as needed for operation, to resolve faults or for a request from the customer.

(1) Swiftpilot takes the technical and organisational measures under Art. 32 GDPR described in Annex 1.

(2) Swiftpilot may adapt the measures to the state of the art as long as the level of protection does not fall. Swiftpilot documents material changes in Annex 1.

(1) Swiftpilot assists the customer with appropriate technical and organisational measures in answering requests from data subjects under Chapter III GDPR, such as for access, rectification, erasure, restriction, data portability and objection.

(2) In the workspaces the customer can view, export and delete conversations with their contact requests and files for this, and set after how many days conversations are deleted automatically. Where that is not enough, Swiftpilot helps on request.

(3) If a data subject contacts Swiftpilot about the customer’s data, Swiftpilot forwards the request to the customer without undue delay and does not answer it itself, unless the customer instructs Swiftpilot to.

Taking into account the nature of the processing and the information available to it, Swiftpilot assists the customer with the security of processing, with notifying personal data breaches to the supervisory authority and to data subjects, with data protection impact assessments and with prior consultation of the supervisory authority. In particular, Swiftpilot provides the information in this agreement and its annexes and answers questions.

(1) Swiftpilot notifies the customer of a personal data breach affecting the customer’s data without undue delay after becoming aware of it.

(2) As far as known, the notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. Swiftpilot provides what is not yet known as soon as it is available.

(3) Swiftpilot sends notifications and other notices under this agreement to the email addresses of the administrators of the customer’s organisation in the Swiftpilot account.

(1) The customer gives Swiftpilot general authorisation to engage subprocessors. The subprocessors Swiftpilot engages when this agreement is concluded are listed in Annex 2; the customer agrees to their engagement.

(2) Swiftpilot informs the customer at least 30 days in advance if Swiftpilot intends to add or replace a subprocessor, and updates Annex 2 on this page. The customer may object to the change within this period for an important reason of data protection. If Swiftpilot cannot address the objection with reasonable effort, either party may terminate the affected services as of the time of the change.

(3) Swiftpilot imposes the data protection obligations of this agreement on every subprocessor by contract, in particular sufficient guarantees for appropriate technical and organisational measures. If a subprocessor fails to fulfil its obligations, Swiftpilot is liable to the customer as for its own conduct.

(4) Providers whose services the customer itself connects to its workspaces, such as HubSpot, Slack, Microsoft Teams, Calendly, Webex, the customer’s own databases, mailboxes, mail servers and calendars, webhooks or own tools, are not subprocessors under this agreement. Data flows to them only if the customer sets up the connection; the customer arranges its relationship with these providers itself. Providers Swiftpilot uses for its own purposes, such as Stripe for payment, are not subprocessors either.

(1) Swiftpilot stores the workspaces’ data, their files and their backups in data centres in Germany (Nuremberg and Falkenstein).

(2) Data is transferred to a country outside the European Union or the European Economic Area only if the conditions of Art. 44 to 49 GDPR are met. The transfers and their basis are listed in Annex 2. The language models that write answers and the services for embeddings and moderation process the data sent to them in the USA.

(1) During the term, the customer deletes data itself in its workspaces or sets after how many days conversations are deleted automatically. What it deletes remains for up to 90 days in the database backups and, for files, for 30 days as a previous version in the object storage; it is deleted afterwards.

(2) When the main contract, including a trial without a booking, or a workspace ends, Swiftpilot keeps the workspace’s data for another 90 days so that the customer can resume the workspace or get its data back. At the customer’s request, Swiftpilot hands over a copy of the workspace’s database within this period and, while it is paused, of its files; the customer downloads the files of a workspace it removes itself beforehand. 14 days before deletion, Swiftpilot reminds the administrators of the organisation by email.

(3) When the period ends, Swiftpilot deletes the workspace’s data together with its backups and its files, with all previous versions in both storage locations. At the customer’s request, Swiftpilot deletes it earlier.

(4) Data that Swiftpilot must keep under Union or Member State law is deleted only when that obligation ends.

(1) On request, Swiftpilot makes available to the customer all information needed to demonstrate compliance with the obligations under Art. 28 GDPR and this agreement.

(2) The customer, or an auditor it appoints who is bound to confidentiality, may audit compliance, including on site. The customer announces an audit with reasonable notice and takes into account operations and the confidentiality of other customers’ data. Swiftpilot may also provide proof through current audit reports or certificates from independent bodies.

(1) The customer is responsible for the processing being lawful, in particular for the legal basis, for informing data subjects and for the rights it gives users in its workspaces.

(2) If the customer uses the website assistant on its website, it informs visitors about it in its privacy policy. The website assistant stores a random identifier of the browser in the visitor’s browser and, for the lifetime of the browser tab, the session key of the conversation; whether this requires consent is for the customer to assess.

(3) The customer informs Swiftpilot without undue delay if it finds errors or irregularities in the processing.

(1) Liability is governed by Art. 82 GDPR. Otherwise the liability rules of the main contract apply.

(2) Changes and additions to this agreement must be made in text form.

(3) If a provision of this agreement is invalid, the rest of the agreement remains valid.

(4) The law of the Federal Republic of Germany applies.

Swiftpilot takes the following measures under Art. 32 GDPR.

Physical access: the servers, the storage for files and the storage for backups are in data centres of Hetzner Online GmbH in Germany, which controls physical access to the data centres.

Access to the servers and the administration: signing in to the servers is possible only with SSH keys, not with passwords. Staff reach Swiftpilot’s administration only with their own account, a code from an authenticator app as a second factor and the permissions of their role; sign-ins there are logged with the IP address.

Access to Swiftpilot: every user signs in with their own access. Passwords are stored only as a hash (BCrypt). After five failed attempts, sign-in is blocked for 15 minutes. A code from an authenticator app can be required after the password; the organisation can require it of its administrators and of all users of its workspaces. Sign-ins to workspaces last 60 minutes and are then renewed with a key that is stored only as a hash. The session of the Swiftpilot account is held in a cookie that scripts in the browser cannot read and that is sent only over encrypted connections and only to the account.

Access control: the customer determines with roles and permissions what a user may see and change in a workspace. The Pilot can do only what the user may do. If the customer wishes, a second person approves changes to agents, workflows and knowledge. Swiftpilot connects the customer’s databases read only and only with the tables and columns the customer approves.

Access by Swiftpilot: Swiftpilot’s staff do not sign in to workspaces as the customer’s users. They hand out a copy of a workspace’s database or files only on the request of an administrator of the organisation. The organisation’s Swiftpilot account lists every such copy with the time, the staff member and the request, so does a running workspace’s log, and the organisation’s administrators receive an email.

Separation: every workspace runs in its own area (namespace) of the cluster with its own database and its own storage. Network rules allow incoming connections to a workspace only through the cluster’s entrance; only the workspace’s application and Swiftpilot’s administration, for backups, reach the database. The files of all workspaces are kept in a shared, non-public object storage, each in the area of its workspace; Swiftpilot’s administration gives a workspace access to its own files only.

Encryption: every connection to Swiftpilot is encrypted with TLS. Each workspace stores credentials for the customer’s systems encrypted, with a key of its own, which in turn is encrypted with a certificate of the workspace. Each workspace encrypts its files with AES-256-GCM before they leave it, each file with a key of its own that the workspace’s key ring protects. Only Swiftpilot’s administration holds the key to the object storage, no workspace; it permits each upload and read of a file individually and only for a few minutes and deletes files itself.

Transfer: data leaves the servers only to the subprocessors in Annex 2, over encrypted connections, and to the systems the customer connects.

Input control: changes in a workspace are logged with person and time; the customer can view and export the log. Automatic deletions after the retention period are logged too.

Protection against abuse: the website assistant accepts messages only from the websites the customer approves for it, limits the number of requests, and can moderate messages before answering and block senders.

Backups: Swiftpilot backs up every workspace’s database every night into non-public storage (Hetzner Object Storage, Falkenstein data centre), separate from the servers in Nuremberg. Only Swiftpilot’s administration holds the key to this storage, no workspace. Every backup is deleted after 90 days.

Files: Swiftpilot copies every new file within an hour into a second, non-public object storage in the Falkenstein data centre, so that losing one location loses no file. Both storages keep the previous version of a replaced or deleted file for 30 days so that mistakes can be undone; it is deleted afterwards.

Recovery: there is a documented procedure for restoring, which Swiftpilot tests after changes to the backups.

Monitoring: Swiftpilot checks the state of every workspace every five minutes and is notified of faults. Metrics of the servers and applications are collected on Swiftpilot’s servers, not by third parties.

Resilience: every workspace has fixed limits for computing power and storage, so that one workspace does not affect the others.

Deletion: the customer sets after how many days (30 to 1,095) conversations with their messages, summaries, contact requests and files, conversations with the Pilot and finished workflow runs are deleted automatically; it deletes individual entries at any time. Swiftpilot deletes the workspace’s audit log after one year, ended sender blocks with their IP addresses 90 days after they ended, and webhook deliveries with their content 30 days after they were sent. What is deleted remains for up to 90 days in the database backups and, for files, for 30 days as a previous version. After a workspace ends, section 13 applies.

Data minimisation: the website assistant sends only the path of the page visited, without parameters, and sets no cookies.

Review: every change to Swiftpilot passes automated tests before it is shipped. Swiftpilot reviews the measures in this annex regularly and adapts them.

Swiftpilot engages the following subprocessors.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Purpose: servers, storage and network for Swiftpilot and all workspaces (Nuremberg data centre), object storage for the workspaces’ files (Nuremberg data centre) with its copy (Falkenstein data centre), and storage of backups (Falkenstein data centre). Place of processing: Germany.

Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, with processing by Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Purpose: language models for the answers of the agents and the website assistant, for the Pilot, for agent steps in workflows and for background work such as summaries, translations, evaluations for dashboards and the answer check. For this, the agent’s instructions, the course of the conversation with the text and images of uploaded files, and matching excerpts from the knowledge go to the model. Place of processing: USA. Transfer basis: standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, with processing by OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA. Purpose: embeddings of the texts in knowledge collections and of the messages for which an agent looks up matching knowledge, and, where moderation is on (the default), checking website visitors’ messages before answering. Place of processing: USA. Transfer basis: standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: sending the emails that Swiftpilot and the workspaces send through Swiftpilot’s mail server, through Google Workspace. Emails sent through the customer’s own mail server are not affected. Place of processing: EU and USA (Google LLC). Transfer basis: the EU Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified, and standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).