As of: 15 July 2026 · Version 2026-07-15

Unofficial English translation. The German version is the authoritative legal text.

between the Customer as controller (“Controller”) and Parlant GmbH, Gürtelstraße 25/Etage 4, 10247 Berlin, Germany, as processor (“Parlant”).

This Agreement automatically supplements the contract for Parlant Agents where the Customer processes personal data as controller and Parlant processes that data on the Customer's behalf when providing the service. For processing matters, this Agreement prevails in the event of conflict; the main contract otherwise remains in effect.

1. Subject matter and duration

1. The subject matter is hosting, operation, transmission, backup, recovery, technical maintenance, and agreed support for an isolated Agent instance, including necessary infrastructure and security services.
2. Processing generally lasts for the term of the main contract. Duties concerning deletion, return, confidentiality, assistance, and evidence continue where their purpose requires.
3. No processing relationship exists for operations where Parlant determines its own purposes and means, especially contract administration, billing, fraud prevention, and compliance with law. The Privacy Policy applies to those operations.

2. Nature and purpose of processing

Operations may include collection, recording, organisation, storage, adaptation, technically necessary retrieval, transmission, encryption, backup, recovery, restriction, and erasure. The purposes are exclusively provision and protection of the booked Agent, transmission to services selected by the Controller, troubleshooting, and expressly commissioned support.

Parlant does not sell Customer data, use it for advertising, or train its own AI models with it.

3. Types of data and data subjects

Depending on use, processing may include:

• master, contact, communication, and identification data;
• content such as files, text, messages, prompts, model responses, images, audio, and documents;
• contract, case, usage, and log data;
• credentials, API keys, and technical configuration;
• location, device, IP, and metadata;
• special categories under Article 9 GDPR or criminal-conviction data under Article 10 GDPR only where the Controller lawfully instructs and appropriately safeguards their processing.

Data subjects may be the Controller, its family members, employees, customers, prospects, communication partners, website visitors, or others whose data the Controller or Agent lawfully processes.

4. Instructions

1. Parlant processes personal data only on documented instructions from the Controller unless Union or German law requires processing. Parlant informs the Controller of that requirement before processing unless important public-interest grounds prohibit notice.
2. The main contract, this Agreement, settings, and documented support requests form the initial instructions. Further instructions must be sent in text form to [email protected].
3. If Parlant believes an instruction violates data-protection law, Parlant promptly informs the Controller and may suspend execution until clarification. Parlant does not provide legal advice.
4. The Controller determines purposes, legal bases, data scope, retention, and permissions for its use. It ensures instructions and use are lawful and that data-subject information and required consent exist.

5. Parlant's obligations

Parlant undertakes to:

1. use only authorised persons who are bound to confidentiality and appropriately trained;
2. maintain and risk-appropriately develop the measures in Annex 1 without reducing the protection level;
3. limit access to Customer data to what is necessary; personnel generally may not inspect Customer Content without a documented support request, subject to mandatory security or legal duties;
4. assist the Controller, taking account of processing nature, as far as possible with data-subject rights and promptly forward data-subject requests concerning the processing;
5. reasonably assist with obligations under Articles 32 to 36 GDPR, particularly security, breach notifications, data-protection impact assessments, and prior consultation;
6. provide information required to demonstrate compliance with Article 28 GDPR and permit audits under section 10;
7. maintain records under Article 30(2) GDPR where required;
8. return or delete data under section 9 after the service ends.

6. Security and personal-data breaches

1. Both parties implement measures required under Article 32 GDPR within their responsibility. The Controller particularly protects accounts, end devices, credentials, connected services, and Agent instructions.
2. Parlant informs the Controller without undue delay after becoming aware of a breach of personal data processed on the Controller's behalf. Where available, the notice includes nature and scope, affected categories, likely consequences, measures taken, and contact details. Missing information is supplied without undue further delay.
3. Notifications to supervisory authorities or data subjects are the Controller's responsibility unless Parlant is itself legally obliged. Parlant provides reasonable assistance.

7. Sub-processors

1. The Controller gives general authorisation for the sub-processors listed in Annex 2 and necessary changes.
2. Parlant informs the Controller in text form or in the Customer area of an intended new or replacement sub-processor at least 30 days in advance. The period may be reasonably shortened for urgent security or availability reasons, with an explanation.
3. The Controller may object on comprehensible data-protection grounds within 14 days. The parties seek a reasonable solution. If none is possible, the Controller may extraordinarily terminate the affected service at the change date.
4. Parlant contractually binds sub-processors to essentially equivalent data-protection duties and remains responsible to the Controller for their obligations under Article 28(4) GDPR.
5. Model providers, APIs, messengers, or other services independently configured by the Controller or Agent are not Parlant sub-processors. The Controller assesses and commissions them. OpenRouter and downstream model providers are used only where managed AI access is selected; provider selection affects storage location and privacy terms.

8. Third-country transfers

1. Under the current configuration, permanent live files and encrypted backups are held by Hetzner in Germany. Cloudflare processes network traffic; optionally, OpenRouter and model providers process content outside the EEA.
2. Transfers to third countries occur only on documented instruction or under Articles 44 et seq. GDPR. Parlant relies particularly on adequacy decisions under Article 45 GDPR, including the EU-US Data Privacy Framework for certified recipients, or Standard Contractual Clauses and required supplementary measures under Article 46 GDPR.
3. On request, Parlant supplies information about safeguards. The Controller remains responsible for the lawfulness of transfers caused by its selection of an external service or model provider.

9. Return and deletion

1. During the contract, the Controller can export live data through provided interfaces and request backups.
2. After contract end, Parlant deletes live data when the instance is destroyed. Where technically possible and legally permissible, a current encrypted backup may be provided for the agreed export period. Retained backups are ordinarily deleted seven days after the paid period ends.
3. Copies may remain only where Union or German law requires retention, a legal hold exists, or data remains technically bound in rotating backups until scheduled overwriting. Processing is restricted to the relevant purpose during that period.
4. On request, Parlant confirms deletion in accordance with the contract.

10. Evidence and audits

1. Parlant primarily provides current certificates, audit reports, technical descriptions, and answers to reasonable questionnaires.
2. If objectively insufficient, the Controller may conduct an audit no more than annually and additionally after a material incident, through an independent qualified auditor bound to confidentiality. Timing, scope, and protection of other customers, security information, and trade secrets must be agreed in advance.
3. Audits take place during ordinary business hours without disproportionate operational disruption. The Controller bears its costs; where a proven material breach caused the audit, Parlant bears the reasonable necessary costs.

11. Liability and final provisions

1. Article 82 GDPR governs liability to data subjects. Internally, the liability rules of the main contract apply unless mandatory data-protection law provides otherwise.
2. Changes to this Agreement require text form. Mandatory changes resulting from data-protection law may be implemented with reasonable advance notice; the protection level must not be unreasonably reduced.
3. German law applies. Mandatory consumer protections and statutory places of jurisdiction remain unaffected.

Annex 1 – Technical and organisational measures

Site access and physical security

• Hetzner operates the data centres; its physical security, site access, power, fire, and environmental controls apply additionally.
• Parlant operates no Customer servers in its own offices.

System and data access control

• personal, role-based administration access; no routine staff permission for Customer Content;
• strong randomly generated Customer credentials and time-limited login tokens;
• encrypted storage of managed instance credentials;
• administrative server access only through Cloudflare Access/Tunnel and approved keys; no publicly reachable SSH port;
• firewall with no incoming public server ports by default;
• support access only after documented approval or narrowly limited security or legal necessity.

Separation and tenant isolation

• separate virtual compute instance and persistent volume for each Agent subscription;
• logically separate database records associated with user and instance;
• unique hostnames and tunnels;
• private, key-specific objects in backup storage.

Transmission and storage security

• TLS for browser, API, and email transport where supported by the receiving system;
• Cloudflare Tunnel instead of directly open application ports;
• backup archives encrypted on the Customer instance before transfer to Hetzner Object Storage;
• cryptographic digests and limited signed URLs for backup transfer and recovery;
• secrets not knowingly written to source code or public logs.

Availability, integrity, and recovery

• persistent volumes and daily and manual encrypted backups;
• integrity-checked recovery process;
• security updates and reproducible versioned server images;
• status and error monitoring for provisioning, backup, and billing;
• controlled destruction and recovery processes.

Procedures and organisation

• data-protection and confidentiality commitments for authorised persons;
• need-to-know principle and regular permission review;
• documented security and data-protection incidents;
• privacy-friendly defaults, data minimisation, and separate acceptance evidence without IP address;
• review of key providers and processing agreements;
• regular risk- and state-of-the-art-based review and adjustment of measures.

Annex 2 – Approved sub-processors

Provider	Location	Service and data	Third-country basis
Hetzner Online GmbH	Germany	Control application, database, isolated Customer servers/volumes, network, encrypted backups; account, infrastructure, connection data, and Customer Content	no planned third-country transfer for configured German locations
Cloudflare, Inc. and affiliates	United States/EU	DNS, TLS, DDoS protection, Access, and tunnel; connection, security, and transmitted content data	EU-US DPF where applicable, supplemented by Standard Contractual Clauses
rapidmail GmbH	Germany	Transactional email; recipients, message content, sending and delivery data	no planned third-country transfer for German SMTP infrastructure; sub-providers under rapidmail terms
OpenRouter, Inc.	United States	optional managed model access; prompts, responses, model selection, and usage data	Standard Contractual Clauses or safeguards identified by OpenRouter
model providers selected by Controller through OpenRouter	depends on selection	optional inference; transmitted prompts, attachments, and responses	depends on provider; selected and instructed by Controller

Stripe processes payment and contract data outside the processing of Customer Content and is therefore not listed in this Annex as a sub-processor for the Customer instance. Its roles are described in the Privacy Policy.