July, 2026
This data processing agreement including all attachments (hereinafter jointly referred toas the "DPA") specifies the data protection obligations of the Parties under the underlying Order Form or other agreed evaluation, testing, or demo arrangement.
We use “Pearl Diver” to allow us to conduct analysis of website visitors. Pearl Diver is a service of Black Pearl Group Limited, Level 1/60 Cuba Street Te Aro, Wellington 6011, NZ, Company Number 4064918.
Pearl Diver uses so-called "cookies" and web beacons. The information generated in relation to the use of this website is transferred by default to a Black Pearl server in the USA and stored there.
Pearl Diver only sets cookies with your consent (given for example by clicking “I agree” on the cookie consent banner). On behalf of the operator of this website, Pearl Diver will use this information to
analyse your use of the website and to generate reports on website activity and visitors. Pearl Diver also uses this information to provide other services related to the use of the website and the internet to the website operator.
The terms of use of Pearl Diver and information on data protection can be accessed via the following links:
https://pearldiver.io/privacy-policy/
You can prevent cookies from being saved by adjusting the settings of your browser software accordingly. However, we must point out that in this case you will not be able to use all functions of this website without restrictions. You can also prevent Pearl Diver from collecting the data generated by the cookie and
analysing your use of the website (including your IP address) and from processing
this data by Pearl Diver by not giving consent to their data use. (“Decline”)
(1) This DPA applies to Customer and, to the extent required under applicable data protection laws, to its affiliates that use the services. By entering into the Order Form or other agreed evaluation, testing, or demo arrangement, Customer enters into this DPA on its own behalf and, as applicable, on behalf of its authorized affiliates.
(2) The following provisions shall apply to all data processing services within the meaning of Art. 28 GDPR provided by HYPATOS to Customer on the basis of the Order Form and to all activities in which personal data may be processed by HYPATOS.
(3) Insofar as the term data processing is used in this DPA for the processing of orders, this is generally to be understood as the use of personal data. Data processing means any operation or set of operations carried out with or without the aid of automated processes relating to personal data, such as collection, recording, organisation, sorting, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or association, limitation, erasure or destruction.
(4) Reference is made to the other definitions in Art. 4 GDPR and, where applicable, in the Order Form.
(1) HYPATOS shall process personal data on behalf of and in accordance with instructions by Customer.
(2) The subject of this DPA is the digitisation, storage and further processing of documents, for example incoming invoices of Customer within the scope agreed with HYPATOS, whether in connection with the Order Form or for evaluation, testing or demonstration purposes.
(3) The duration of this DPA corresponds to the duration of the Order Form. If personal data is processed prior to the execution of an Order Form, this DPA shall apply for the duration of such processing.
The type and purpose of data processing include the following activities and purposes:
The categories of persons affected by the handling of personal data under the Order Form can include:
(1) The personal data are subject to two categories: personal data of Users (“Personal User Data”) and personal data of persons mentioned in the documents processed by means of the Services (“Personal Document Data”).
(2) The following data types are affected by data processing:
(1) Customer is the data controller within the meaning of Art. 4 No. 7 GDPR.
(2) Customer is entitled to issue instructions on the type, scope and procedure of data processing. Oral instructions shall be confirmed immediately by HYPATOS in writing or in text form (e.g. by e-mail) at Customer's request.
(3) Insofar as Customer deems it necessary, persons authorized to issue instructions may be named. Customer shall notify HYPATOS of this in text form. In the event that these persons authorized to issue instructions change at Customer, HYPATOS shall be notified thereof in text form, naming the new person in each case.
(4) Customer shall inform HYPATOS immediately if errors or irregularities are detected in connection with the processing of personal data by HYPATOS.
(1) Data processing
HYPATOS will process the personal data exclusively in accordance with this DPA and/or the underlying Order Form and in accordance with Customer's instructions, unless HYPATOS is legally required to do otherwise. In the latter case, HYPATOS will inform Customer of that legal requirement before processing.
(2) Confidentiality
HYPATOS shall ensure that any personnel entrusted with data processing services rendered to Customer are subject to a statutory confidentiality obligation or have undertaken to comply with the principle of data secrecy or confidentiality in accordance with applicable laws and have been duly instructed on the protective regulations of such laws.
(3) Data Subject Rights
a. HYPATOS shall support Customer in fulfilling the rights of the parties concerned, in particular with regard to access, object, rectification, restriction of processing and deletion, notification and provision of information, within the scope of its capabilities in accordance with Article 28 (3) (e) GDPR. The obligation to provide support shall only apply in the case of enquiries by data subjects with regard to the data processed on behalf of the Customer as specified in this DPA.
b. If HYPATOS collects the personal data specified in this DPA on behalf of Customer and if this data is the subject of a justified claim to data portability pursuant to Art. 20 GDPR and if the person concerned is identified within the meaning of Art. 12 GDPR, HYPATOS shall support Customer, upon instruction, by making the data available to Customer in a structured, common and machine-readable format within a reasonable time, insofar as technically possible.
c. At the instruction of Customer, HYPATOS shall correct, delete or restrict the processing of the personal data on behalf of Customer. The same shall apply ifthis DPA provides for the correction, deletion or limitation of the processing of data.
d. If a data subject contacts HYPATOS directly for the purpose of correcting, deleting or restricting the processing of the personal data, HYPATOS shall forward this request to Customer immediately upon receipt.
(4) Control obligations
a. HYPATOS shall ensure by means of appropriate controls that the personal data collected, processed or used on behalf of Customer are processed exclusively in accordance with this DPA and/or the Order Form and/or the corresponding instructions.
b. HYPATOS shall set up its operating procedures in such a way that the data which it processes on behalf of Customer are secured to the extent necessary and protected from unauthorised access by third parties.
c. HYPATOS confirms that it has appointed a data protection officer and will monitor compliance with data protection and data security regulations, including the data protection officer.
(5) Duty to provide information
a. HYPATOS shall immediately draw Customer's attention to any instructions issued by Customer which, in its opinion, violate statutory provisions. HYPATOS is entitled to suspend the execution of the corresponding instruction until it has been confirmed or changed by the responsible person at Customer's.
b. HYPATOS shall assist Customer in complying with the obligations set out in Articles 32 to 36 GDPR, taking into account the type of processing and the information available to it.
(6) Place of data processing
The data processing takes place in principle on the territory of the Federal Republic of Germany or within the European Union or the states of the European Economic Area. Processing in other states is only permitted with the prior consent of the Customer and only if the special requirements of Art. 44, 45, 46 or 49 GDPR are fulfilled. The consent may only be refused for compelling reasons of data privacy law.
(7) Deletion or return of personal data after completion of the order
Upon termination of the Order Form or completion of the evaluation, testing or demo activities, HYPATOS shall, at the choice of Customer, either return all personal data, documents and processing and usage results that have come into its possession and that are connected with the contractual relationship or delete/destory them within thirty (30) days following such termination or completion in accordance with data protection regulations, unless statutory storage obligations requiretheir retention. The return, deletion or destruction of such data must be documented and confirmed to Customer upon request.
(1) Customer shall be entitled, after timely prior registration during normal business hours and without disrupting the business operations of HYPATOS or endangering the security measures for other customers and at his own expense, to ensure compliance with the provisions on data protection and the contractual agreements in the necessary scope itself or by third parties. The controls can also be carried out by accessing existing HYPATOS certifications customary in the industry, current certificates or reports from an independent body (e.g. auditor, external data protection officer, auditor or external data protection auditor) or self-disclosure. HYPATOS will provide the necessary support to carry out the controls.
(2) HYPATOS’ current high-level security controls, practices, and certifications are documented in the Security Trust Report, available at https://trust.hypatos.ai/. The Report is updated periodically and is for informational purposes only; contractual obligations remain governed by this DPA unless otherwise agreed in writing.
(3) HYPATOS shall inform Customer about the implementation of control measures by the supervisory authority, insofar as the measures or data processing which HYPATOS provides for Customer may be affected.
(1) Customer authorizes HYPATOS to make use of further data processors in accordance with this § 9. This authorization constitutes a general written approval within the meaning of Art. 28 para. 2 GDPR.
(2) HYPATOS currently cooperates with the subprocessors named in Appendix 2. Customer agrees to their assignment.
(3) HYPATOS shall be entitled to commission further subprocessors or to replace those already commissioned. HYPATOS shall inform Customer in advance of any intended change.
(4) Customer may object to an intended change. The objection to the intended change must be made to HYPATOS within two (2) weeks of receipt of the information about the change. In the event of an objection, HYPATOS may, at its own discretion, provide the service without the intended change or - if the provision of the service without the intended change is not reasonable for HYPATOS, e.g. due to disproportionate expenses for HYPATOS associated therewith – extraordinarily terminate this DPA and the Order Form.
(5) HYPATOS is obliged to conclude agreements in accordance with Art. 28 para. 4 GDPR with the subprocessors.
(6) At the request and instruction of Customer, HYPATOS will exercise all rights against a subprocessor, including but not limited to audit rights, which HYPATOS itself is entitled to under the respective data processing agreement and which concern the processing for Customer. HYPATOS is not entitled to any scope of assessment; HYPATOS exercises such rights as if they were Customer's rights.
(1) The technical and organisational measures described in Appendix 1 shall be agreed. HYPATOS may update and modify these measures provided that such updates and/or modifications do not significantly reduce the level of protection and are documented.
(2) HYPATOS shall observe the principles of proper data processing pursuant to Art. 32 in connection with Art. 5 para. 1 GDPR. It is obliged to the contractually agreed and legally prescribed data security measures. It will take all necessary, appropriate technical and organizational measures to secure the data and/or the security of the processing, in particular also taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of Customer data as well as to mitigate possible adverse consequences for data subjects. The measures to be taken include in particular measures to protect the confidentiality, integrity, availability and resilience of the systems and measures to ensure the continuity of the processing after incidents. HYPATOS will regularly evaluate the implemented measures and make any necessary adjustments in order to be able to guarantee an appropriate level of processing security at all times.
Hypatos shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data and provide reasonable information in its possession to assist Customer to meet Customer's obligations to report a personal data breach as required under data protection law. Any such notification shall not be treated as an admission of fault or liability
Technical and organizational measures to ensure the security of data processing
HYPATOS warrants that it has taken the following technical and organizational measures:
A. Encryption measures
Measures or processes in which a clearly readable text/information is converted into an illegible, i.e. not easily interpretable, character string (ciphertext) with the aid of an encryption procedure (cryptosystem):
Hypatos has implemented encryption measures in accordance with ISO 27001:2022 Annex A, specifically control A.8.24 (Use of Cryptography). These measures are documented in Hypatos’ Information Security Management System (ISMS) under the Cryptography Policy and include:
- All web traffic transmitted over the Internet between Hypatos and its Customers is encrypted using TLS 1.2 or higher
- Customer data stored at Cloud Infrastructure as a Service (IaaS) providers, documented as sub-processors in Appendix 2 to this DPA, is encrypted at rest using AES-256
- Hard drives of company-managed end-user devices are encrypted using AES-256
- Encryption keys and secrets are stored in secure cloud services with strict access controls, limited to authorized engineering personnel based on least-privilege and need-to-know principles
- Implemented encryption measures are continuously monitored by automated security tooling,and alerts are sent to relevant Hypatos stakeholders if misconfigurations or violations are detected
B. Measures to ensure confidentiality (Art. 32 para. 1 lit. b GDPR)
1. Physical access control
Measures physically preventing unauthorised persons from gaining access to IT systems and data processing equipment processing personal data and to confidential files and data carriers:
Description of the access control system:
The Cloud Infrastructure as a Service (IaaS) providers, documented as sub-processors in Appendix 2 to this DPA, maintain physical access control over the cloud infrastructure data processing facilities. Independent external audits review the respective physical security mechanisms in relation to ISO/IEC 27001, SOC 2, PCI DSS and other applicable standards and regulations.
Physical access to Hypatos’ office facilities is managed in accordance with ISO 27001:2022 Annex A, specifically the A.7 Physical Security controls. Hypatos’ Physical Security Policy (part of the ISMS) defines the measures implemented, which include:
- Entrance to office facilities (main entrance, designated office space) only accessible either with keycard or PIN-code in combination with transponder system for authorized employees or freelancers and service staff (for example cleaning personnel);
- External Security Service regularly controls building and premise
- Central administration and documentation of issue and withdrawal of key cards to employees, contractors and service providers
- Check-in/registration of visitors with office management and documentation of the check-in, access to office premises only possible if employees invite and accompany visitor for the duration of the visit
2. Logical access control
Measures ensuring that only authorized individuals can access personal data, and that such data cannot be read, copied, altered, or removed without authorization during processing, use, or storage.
Description of the access control system:
Logical access to Hypatos systems is governed by Hypatos’ Access Control Policy, part of the ISMS and aligned with ISO 27001:2022 Annex A controls (including A.5 Identity and Access Management, A.8.2 Privileged Access Rights, and A.8.3 Authentication).
Key measures include:
- Least privilege and need-to-know: Access (including privileged access) is granted strictly according to role, business need, and the principle of least privilege
- Strong authentication: All systems use unique user credentials; strong password requirements are enforced. MFA and/or SSO is used where supported (mandatory for high-risk and administrative systems)
- Centralized identity management: User account provisioning, modification, and deprovisioning follow a documented authorization workflow. Access rights are revoked promptly when employment or engagement ends
- Access reviews: User access rights for all critical systems are reviewed on a regular, defined schedule
- Password management: A company-wide password manager is used for storing and managing credentials securely
- Monitoring and logging: Authentication attempts, privileged actions, and access to systems processing personal data are logged and monitored. Accounts may be locked temporarily after repeated unsuccessful login attempts
- Authorization records: Access decisions, permission sets, and changes to user rights are documented and retained in accordance with internal policies.
3. Separation requirement
Measures to ensure that data collected for different purposes are processed separately and are separated from other data and systems in such a way as to prevent unplanned use of such data for other purposes.
Description of the separation control process:
- Software-side user separation
- Logical separation of Customers
- Ensuring compliance with separate extinguishing periods through extinguishing concept
- Separation of development, test and production environments
- Ensuring the separation of data for the training of AI models
C. Measures to safeguard integrity (Art. 32 para. 1 lit. b GDPR)
1. Data integrity
Measures to ensure that stored personal data is not damaged by system malfunctions:
Description of data integrity:
Testing of new releases and patches to verify correctness of changed component. Components that fail these tests are not deployed to production environments
- Changes performed on production systems are planned, scheduled, documented and subject to prior approval
- Changes to production databases and other data storage locations are logged
- Hypatos maintains a documented backup and recovery process aligned with ISO 27001:2022 Annex A controls (including A.8.13 Backup). Backups are taken regularly, encrypted, retained for defined periods, and tested to ensure recoverability.
- Production systems are monitored for operational anomalies or integrity issues that may indicate corruption or malfunction.
2. Transmission control
Measures to ensure that it is possible to verify and establish to which bodies personal data have been or may be transmitted or made available by means of data transmission facilities:
Description of the transmission control:
- Data transmission is governed by a process with individual responsibilities
3. Transport control
Measures to ensure that the confidentiality and integrity of personal data are protected during electronic transmission and any transport of data media:
Description of the transport control:
Hypatos implements transport security measures aligned with ISO 27001:2022 Annex A controls (including A.8.21 Secure Communication and A.8.24 Use of Cryptography). These measures are documented within the Information Security Management System (ISMS) under the Network Security and Cryptography Policies.
Key measures include:
- Encryption in transit: Sensitive data, including personal data, is transmitted only via encrypted communication channels (TLS 1.2 or higher).
- Secure handling of data media: If data media must be transported, it is encrypted and transferred using secure, traceable methods; decryption keys are shared separately and securely.
- Protection against interception: Network configurations and security controls ensure protection against unauthorized access, eavesdropping, or tampering during data transfer.
- Cloud-only architecture: Personal data is not transported on physical media
4. Input control
Measures ensuring that it is possible to verify retrospectively whether, when, and by whom personal data has been entered, modified, or deleted in IT systems.
Description of the input control process:
- Activities performed by privileged users are logged and monitored
- Installation of software on production system is only performed by authorized IT personnel
- Logs are protected against unauthorized alteration and retained for defined periods in accordance with internal policies.
- Access traceability: Each user has unique credentials, ensuring that system actions can be traced back to a specific individual.
D. Measures to ensure availability and resilience (Art. 32 para. 1 lit. b GDPR)
1. Availability control
Measures to ensure that personal data are protected against accidental destruction or loss.
Description of the availability control system:
Hypatos implements availability and resilience controls in accordance with ISO 27001:2022 Annex A (including A.5.29 Business Continuity, A.5.30 ICT Readiness for Business Continuity, and A.8.13 Backup). These measures are documented in the ISMS under the Business Continuity and Disaster Recovery Policy.
- Established backup and recovery process that ensures regular backups of critical systems and data. Backups are encrypted, retained for defined periods, and periodically tested to verify integrity and recoverability.
- Hypatos relies on cloud Infrastructure-as-a-Service (IaaS) providers listed in Appendix 2 of this DPA to host production environments. These providers maintain robust physical and technical availability controls, including redundancy, failover capabilities, and disaster recovery procedures.
- The availability and resilience mechanisms of these cloud providers are regularly assessed through independent external audits (e.g., ISO/IEC 27001, SOC 2, PCI DSS), ensuring compliance with internationally recognized standards.
2. Rapid recoverability
Measures to ensure the ability to restore rapidly the availability of and access to personal data in the event of a physical or technical incident.
Description of the measures taken to ensure rapid recoverability:
- Established security incident management process aligned with ISO 27001:2022 Annex A controls (including A.5.25–A.5.28). This process ensures timely detection, escalation, and remediation of incidents affecting system availability.
- Backup and recovery processes are documented, automated where possible, and tested at regular intervals to ensure that systems and personal data can be restored within defined recovery time objectives (RTOs) and recovery point objectives (RPOs)
3. Reliability
Measures to ensure that all functions of the system are available and that any malfunctions are reported:
Description of reliability measures:
Automated notifications in case production systems behave outside of defined normal conditions. In case malfunctions are reported, standardized communication and incident management processes are triggered.
E. Data protection through technology design and through data protection-friendly presettings
Privacy by Design means translated "data protection through technology design". The aim should be to ensure that suitable technical measures are implemented as early as the development of processing operations in order to make the planned processing operations compliant with data protection regulations.
Privacy by Default means translated "data protection through data protection-friendly default settings". This means that even the factory settings of a programme/software should be designed in a data protection-friendly manner. This is intended above all to protect the data of the user.
Compliance with data protection requirements and effective data structures in the selection and development of software.
F. Measures for the regular evaluation of the security of data processing (Art. 32 para. 1 lit. d GDPR; Art. 25 para. 1 GDPR)
1. Review procedure
Measures to ensure that processing complies with data protection regulations and is secure.
Description of the verification procedures:
- Data protection management and data protection concept
- ISO 27001-certified Information Security Management System (ISMS)
- Formalised security risk management process
- Formalised order management
- Formalised processes for data protection incidents
- Regular control and, if necessary, adjustment of the technical and organisational measures on the basis of the state of the art
- External auditing service that regularly verifies compliance with data protection regulations.
2. Organisational control
Measures to ensure that employees are informed and sensitised to the requirements of data protection and that they are committed to compliance with data protection.
Description of organisational control measures:
- Obligation of all employees to maintain confidentiality
- Regular data protection training for employees
- Exclusion of business use of private equipment
- Written agreements on the use of the Internet and e-mail
- Written agreements on working from the home and mobile office
3. Order control
Measures to ensure that personal data processed on behalf of the Customer can only be processed in accordance with the instructions of the Customer:
Description of order control measures:
- Conclusion of commissioned processing contracts with contract processors in accordance with Art. 28 GDPR
- Keeping a register of Customers and processors
- Formalised order management
- Documentation of the Customers’ written instructions
- Examination of technical and organisational measures prior to the conclusion of processing contracts with contract processors
- Ensuring the deletion/destruction of data after completion of the order by contractual agreement
HYPATOS currently cooperates with the following subcontractors in the fulfilment of the order, with whose assignment the Customer agrees.
If the data processing takes place outside the European Economic Area, the following overview also lists the measures and guarantees which ensure an adequate level of data protection in the processing in accordance with Art. 44 et seq. of the European Data Protection Act. GDPR (e.g. EU standard contract clauses, or adequacy decision of the EU Commission).
Hypatos GmbH and Hypatos Inc. each process personal data as necessary to support the other, and such intra-group processing and transfers of personal data are governed by the Hypatos Group Data Transfer Framework Agreement, which incorporates appropriate safeguards for international transfers in accordance with Articles 44–49 GDPR (e.g., EU Standard Contractual Clauses).
For Customers of Hypatos GmbH:
Name/Company: Hypatos Inc.
Function/activity: Provision of support, maintenance, and operational services necessary for the delivery of the Hypatos Services
Headquarters: The Corporation Trust Center, 1209 Orange Street, Wilmington, 19801 Delaware, USA
Type of data: Personal User Data, Personal Document Data
Location of data processing: USA
Measures/guarantees to ensure an adequate level of data protection: Intra-Group Data Transfer Framework Agreementincorporating the European Commission’s Standard Contractual Clauses (SCCs) pursuant to Articles 46 and 47 GDPR, together with technical and organizational measures implemented by Hypatos
Name/Company: Amazon Web Services EMEA SARL
Function/activity: Cloud Infrastructure as a Service (IaaS) Provider which offers cloud computing services including computing power, storage, and databases, necessary to deliver and maintain Hypatos’ SaaS; Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: 38 avenue John F. Kennedy, L-1855 Luxembourg
Type of data: Personal User Data, Personal Document Data
Location of data processing: European Union
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: Microsoft Corporation
Function/activity: Processing of customer document email uploads via Microsoft Exchange (part of Microsoft 365); Customer file storage and sharing via Microsoft SharePoint (part of Microsoft 365); Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: One Microsoft Way, Redmond, WA 98052, U.S.A.
Type of data: Personal User Data, Personal Document Data
Location of data processing: European Union
Measures/guarantees to ensure an adequatelevel of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: Google Ireland Limited
Function/Activity: Provider of cloud-based artificial intelligence services, including optical character recognition (OCR) and large language model processing used for document analysis and text generation
Headquarters: Gordon House, Barrow Street Dublin 4, Ireland
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: OpenAI Ireland Limited
Function/Activity: Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: The Liffey Trust Centre 117-126, Sheriff Street, Upper, Dublin 1, Ireland, D01 YC43
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: MongoDB Limited
Function/Activity: Managed database service within Hypatos’AWS environment, ensuring secure and scalable data storage and retrieval
Headquarters: MongoDB Limited, Building Two, Number One Ballsbridge Shellbourne Road, Ballsbridge, Dublin 4, Ireland
Location of data processing: European Union
Type of data: Personal User Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: Atlassian. Pty Ltd
Function/Activity: Service desk for customer support, processing the data that customers enter and attach to tickets, as well as all information related to such tickets
Headquarters: Level 6, 341 George Street, Sydney, NSW, 2000 Australia
Location of data processing: European Union
Type of data: Personal User Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: ClickHouse, Inc.
Function/Activity: Provision ofcloud-based database and analytics services for storage, processing, and querying of structured data related to customer document processing workflows.
Headquarters: 575 Market Street, Suite 2700, San Francisco, CA 94105, USA
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
For Customersof Hypatos, Inc.:
Name/Company: Hypatos GmbH
Function/activity: Provision of support, maintenance, and operational services necessary for the delivery of the Hypatos Services.
Headquarters: c/o Office Club, Am Neuen Markt 9 E-F, 14467 Potsdam, Germany
Type of data: Personal User Data, Personal Document Data
Location of data processing: European Union
Measures/guarantees to ensure an adequate level of data protection: Intra-Group Data Transfer Framework Agreement incorporating the European Commission’s Standard Contractual Clauses (SCCs) pursuant to Articles 46 and 47 GDPR, together with technical and organizational measures implemented by Hypatos
Name/Company: Amazon Web Services, Inc.
Function/activity: Cloud Infrastructure as a Service (IaaS) Provider which offers cloud computing services including computing power, storage, and databases, necessary to deliver and maintain Hypatos’ SaaS; Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: 410 Terry Avenue North, Seattle, WA 98109, USA
Type of data: Personal User Data, Personal Document Data
Location of data processing: USA
Measures/guarantees to ensure an adequate level of data protection: Data Processing Addendum in accordance with applicable data protection laws
Name/Company: Microsoft Corporation
Function/activity: Processing of customer document email uploads via Microsoft Exchange (part of Microsoft 365); Customer file storage and sharing via Microsoft SharePoint (part of Microsoft 365); Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: One Microsoft Way, Redmond, WA 98052, USA
Type of data: Personal User Data, Personal Document Data
Location of data processing: USA
Measures/guarantees to ensure an adequate levelof data protection: Data Processing Agreement in accordance with applicable data protection laws
Name/Company: Google LLC
Function/Activity: Provider of cloud-based artificial intelligence services, including optical character recognition (OCR) and large language model processing used for document analysis and text generation
Headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Location of data processing: USA
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Addendum in accordance with applicable data protection laws
Name/Company: OpenAI OpCo, LLC
Function/Activity: Provider of cloud-based artificial intelligence services, including large language model processing used for document analysis and text generation
Headquarters: 3180 18th Street, San Francisco, CA 94110, USA
Location of data processing: USA
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Addendum in accordance with applicable data protection laws
Name/Company: MongoDB, Inc.
Function/Activity: Managed database service within Hypatos’ AWS environment, ensuring secure and scalable data storage and retrieval.
Headquarters: 1633 Broadway, 38th Floor, New York, NY 10019, USA
Location of data processing: USA
Type of data: Personal User Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement in accordance with applicable data protection laws
Name/Company: Atlassian, Inc.
Function/Activity: Service desk for customer support, processing the data that customers enter and attach to tickets, as well as all information related to such tickets
Headquarters: 350 Bush Street, Floor 13, San Francisco, CA 94104, USA
Location of data processing: USA
Type of data: Personal User Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Addendum in accordance with applicable data protection laws
Name/Company: ClickHouse, Inc.
Function/Activity: Provision of cloud-based database and analytics services for storage, processing, and querying of structured data related to customer document processing workflows
Headquarters: 575 Market Street, Suite 2700, San Francisco, CA 94105, USA
Location of data processing: USA
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Addendum in accordance with applicable data protection laws
Optional:
Name/Company: CenterDevice GmbH
Function/Activity: Cloud document management system (DMS) for GOBD archive service
Headquarters: Rheinwerkallee 3, 53227 Bonn, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: EY GmbH & Co. KG Wirtschaftsprüfungsgesellschaft
Function/Activity: Implementation Partner
Headquarters: Graf-Adolf-Platz 15, 40213 Düsseldorf, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: EKPMG Advisory N.V.
Function/Activity: Implementation Partner
Headquarters: (1186 DS) Laan van Langerhuize 1, Amstelveen, the Netherlands
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: Hicron Deutschland GmbH
Function/Activity: Implementation Partner
Headquarters: c/o Digitales Zentrum Schwaben (DZ.S), IT Gründerzentrum GmbH, Werner-von-Siemens Straße 6, Halle 17, 86159 Augsburg
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: T4YourBusiness Consulting GmbH
Function/Activity: Implementation Partner
Headquarters: Auf den Steinen 12c, 40667 Meerbusch, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: KEYE Advisory GmbH
Function/Activity: Implementation Partner
Headquarters: Christinenstr. 1, 40880 Ratingen, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: friendWorks GmbH
Function/Activity: Implementation Partner
Headquarters: Pfarrplatz 16, 94315 Straubing, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
Name/Company: xSuite GmbH
Function/Activity: Implementation Partner
Headquarters: Hamburger Str. 12, 22926 Ahrensburg, Germany
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28GDPR
Name/Company: PricewaterhouseCoopers GmbH
Function/Activity: Implementation Partner
Headquarters: Friedrich-Ebert-Anlage 35-37, 60327 Frankfurt am Main
Location of data processing: European Union
Type of data: Personal User Data, Personal Document Data
Measures/guarantees to ensure an adequate level of data protection: Data Processing Agreement according to Art. 28 GDPR
