Skip to content

Data Processing Agreement (DPA)

Download the DPA

Section titled “Download the DPA”

The Data Processing Agreement (DPA) governs, pursuant to Art. 28 GDPR, the processing of personal data by 9brains GmbH within the 9brains platform. It takes effect automatically upon account registration, without forms or waiting times.

Download DPA as PDF

What does the DPA contain?

Section titled “What does the DPA contain?”

The DPA covers:

  • Preamble: takes effect with the main contract, no separate signature required
  • Standard contractual clauses (clauses 1 to 10): obligations of both parties, right to issue instructions, purpose limitation, security of processing, use of AI systems, sub-processors, international data transfers, data breaches, audit rights and liability
  • Annex I: List of contracting parties
  • Annex II: Description of the processing (data categories, data subjects, purposes, duration)
  • Annex III: Technical and organizational measures (TOMs)
  • Annex IV: Reference to the list of approved sub-processors, which is kept as a separate contract document

List of sub-processors

Section titled “List of sub-processors”

The list of sub-processors (Annex IV) is part of the DPA but kept in a separate document, so that it can be updated with a new version whenever it changes. It contains all sub-processors with address, purpose, server location and DPA status, and in its appendix detailed information on data processing by each AI provider (contractual basis, assurances regarding data use, storage location, third-country transfer).

Download the list of sub-processors as PDF

Frequently asked questions

Section titled “Frequently asked questions”

Do you support us with a data protection impact assessment?

Section titled “Do you support us with a data protection impact assessment?”

Yes. The annexes of the DPA provide the technical basis for your data protection impact assessment under Art. 35 GDPR: the description of the processing, the technical and organisational measures and the list of sub-processors with processing location and third-country relevance. You carry out the assessment yourselves as the controller; we help with any questions from your data protection officer.

Contact

Section titled “Contact”

For questions about the DPA or data protection:

Further information: Data protection & data sovereignty