Data processing agreement

Service provider

Service provider: Union Finance GmbH, Elsenfelder Straße 32, 63906 Erlenbach am Main, Deutschland
Contact for this document: billing@aivrom.com

Parties and application

This agreement forms an annex to the AIVROM terms between Union Finance GmbH (processor) and the account holder acting as controller. It applies only to processing personal data on your behalf through the agreed AIVROM services. Account administration, billing, fraud prevention and the provider’s own legal duties remain separate controller activities. The service order and accepted account details identify the controller; the imprint identifies the processor.

Hetzner processes hosting data in Germany and AWS handles backups and email in Stockholm, Sweden. Cloudflare processes DNS and proxy data through its global network, including the US. Mistral AI processes in the EU. OpenAI Ireland and Anthropic may process AI requests in the US or globally. Agreed SCCs apply to relevant third-country transfers, with the EU–US DPF where the US recipient and processing are covered.

Subject, duration, data and people

Processing covers receiving, storing, retrieving, analyzing, transforming and deleting content and producing the outputs you request, for the service period and subsequent agreed deletion phase. Depending on your instructions, data may include names, contact and business details, correspondence, documents, images and platform identifiers about your customers, contacts, staff, suppliers or other people in your submitted content. Do not submit unnecessary special-category or criminal-offence data. The specific scope follows your selected services and documented jobs.

Instructions and confidentiality

AIVROM processes this data only on your documented instructions, including transfers, unless applicable law requires otherwise; where permitted, you are informed of that requirement. Account settings, selected connections, submitted tasks and confirmed actions form instructions. Authorized personnel are bound to confidentiality and limited access. AIVROM informs you if an instruction appears to infringe data protection law and can suspend the affected instruction pending clarification.

Technical and organizational measures

Measures include HTTPS transport, customer-scoped access and database policies, separate service roles, authenticated administrative actions, encrypted connector credentials, approval gates for external changes and backups. Access is limited to the service purpose; credentials are not sent to model prompts. Measures are maintained and adapted to risk without materially reducing protection. These commitments do not assert encryption of all stored content or a specific certification. On request, AIVROM provides information reasonably needed to assess the relevant measures.

Subprocessors and international transfers

You grant general authorization for necessary subprocessors: Hetzner for hosting, Amazon Web Services for backups and delivery, and the selected Mistral AI, OpenAI or Anthropic API for requested AI tasks. Connected platforms are used only as instructed and subject to their respective roles. AIVROM imposes equivalent Article 28 obligations on subprocessors and remains responsible for their processing obligations. AIVROM gives at least 30 days’ notice of additions or replacements. You may object on data protection grounds before the change. If the parties cannot agree a workable alternative, you may terminate the affected service when the change takes effect. Transfers outside the EEA require Chapter V safeguards; details are available through privacy@aivrom.com.

Assistance and incidents

Taking account of the nature of processing and available information, AIVROM assists with data-subject requests, security obligations, breach notifications, impact assessments and prior consultation. It forwards requests concerning your controlled data rather than deciding them on your behalf. It notifies you without undue delay after becoming aware of a personal-data breach, provides available information on its nature, affected data, likely consequences and mitigation, and supplies updates as information becomes available.

Evidence and audits

AIVROM provides information necessary to demonstrate compliance with this agreement and allows and contributes to proportionate audits, including inspections by you or an independent auditor bound to confidentiality. Agree reasonable arrangements to protect other customers, security and service continuity. Urgent supervisory requirements and statutory rights are not limited by advance scheduling.

Return, deletion and precedence

After the service ends, at your choice AIVROM returns or deletes the controlled personal data and deletes existing copies unless retention is required by law. Request return before account deletion. Deletion requests are reapplied when restoring backups. Statutorily retained records are isolated and used only for that duty. This agreement prevails over conflicting general terms for processing on your behalf; mandatory GDPR rights and obligations remain unaffected.

Last updated: 12 November 2026

Download agreement (.txt)

Your contact for this document

Questions about privacy and deletion: privacy@aivrom.com. Cancellation, withdrawal and billing: billing@aivrom.com. Human support: support@aivrom.com, Monday–Friday 10:00–16:00 Europe/Berlin; reply within two business days.

Annex 1 · Technical and organisational measures

AIVROM associates data with accounts and projects and checks access on the server. Administration is authenticated and role-based. Public services use HTTPS. Backups are stored encrypted and restores are tested. Previously recorded erasure requests are applied again after a restore. Security incidents are recorded and assessed, and personal data breaches are reported to the controller without undue delay. Privacy contact: privacy@aivrom.com.

Annex 2 · Subprocessors

Hetzner Online GmbH provides hosting infrastructure in Germany. Amazon Web Services provides backup storage and email delivery in the EU. Cloudflare protects and delivers hosted websites through DNS and proxy services. Depending on the task, Mistral AI processes requests through its EU service, or OpenAI Ireland Ltd. or Anthropic through global API endpoints. Contact privacy@aivrom.com for details of safeguards and the processing in use.

Data processing agreement (AVV)