DPA

Data Processing Agreement

MAD Tech GmbH · blankmile · Version 4.0 · Last updated 12 October 2026

pursuant to Article 28(3) of the General Data Protection Regulation (GDPR)

This Data Processing Agreement (‘DPA’) is concluded between the respective customer as controller (‘Customer’) and MAD Tech GmbH, Volksfeststraße 16, 4910 Ried im Innkreis, Austria, company registration number FN 581762 h, as processor (‘MAD Tech’). The Customer’s identity is set out in the relevant offer, order form or main agreement.

This DPA supplements the respective agreement for the use of blankmile (‘Main Agreement’). It becomes binding through express incorporation into an offer, order form or other Main Agreement accepted by the Customer; a separate signature of this DPA is not required. In the event of conflicts concerning processing on behalf of the Customer, this DPA takes precedence; mandatory data protection law remains unaffected.

§ 1 Subject matter and duration

1. MAD Tech processes personal data on behalf of the Customer to provide, operate, maintain and secure the cloud-based blankmile communication platform, including the contractually agreed functions, interfaces, API functions and integrations with existing systems and applications. The nature, purpose, data categories and data subjects are described in Annex 1.

2. Processing begins when the agreed services are provided and generally continues for the term of the Main Agreement and any subsequent return and deletion phase carried out in accordance with instructions. Legally permissible retention and technically necessary backup rotation remain unaffected subject to § 11.

§ 2 Roles and instructions

1. The Customer is the controller within the meaning of Article 4(7) GDPR; MAD Tech acts as processor for the activities described in Annex 1. MAD Tech’s independent processing, for example for its own contract and invoice administration, is not covered by this DPA.

2. MAD Tech processes personal data only on documented instructions from the Customer, including transfers to third countries, unless processing is required by law. In that case, MAD Tech informs the Customer in advance to the extent legally permissible.

3. Documented instructions include, in particular, the contractually agreed service, customer-side administration and deletion settings, and instructions in text form to the designated support contact. Instructions outside the agreed service scope may require a separate agreement on remuneration and implementation.

4. If MAD Tech considers an instruction to breach data protection law, it promptly informs the Customer and may suspend execution pending clarification to the extent legally required.

5. Where the Customer uses contractually agreed interfaces, APIs or integrations, MAD Tech may receive personal data from connected systems, transfer it to them or exchange it with them within the Customer’s documented instructions. The Customer’s configuration and activation of these functions and the contractually agreed setup of an integration constitute documented instructions to the extent that the relevant data flows and purposes are sufficiently defined. The Customer is responsible for the lawfulness of the data transfers it initiates and for selecting and establishing the data protection arrangements for connected systems. Where MAD Tech uses its own subprocessors to carry out an integration, § 6 applies. MAD Tech’s own statutory and contractual data protection obligations remain unaffected.

§ 3 Customer obligations

1. The Customer is responsible for the lawfulness, transparency, legal bases, purpose specification and storage limitation of the processing it initiates, including the processing of employee and end-customer data and the use of activated AI functions.

2. The Customer provides the required information and, where applicable, checks consent or other legal bases for audio transmission, transcription, translation, storage and other processing. Applicable national criminal and employment law must be observed.

3. The Customer manages user permissions, deliberately activates optional functions, and configures retention and deletion in accordance with its legal obligations.

§ 4 Confidentiality and personnel

1. MAD Tech ensures that persons authorised to process data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality and access personal data only to the extent necessary. Access permissions are assigned and reviewed on a role-based basis.

2. The parties keep confidential all non-public business, technical and organisational information of the other party learned in connection with this DPA. This includes security concepts, technical and organisational measures documentation, technical infrastructure details, access information, customer data and trade secrets. Disclosure is permitted only where necessary to perform the contract or required by law; recipients must be appropriately bound to confidentiality. This obligation continues after the contract ends for as long as a legitimate confidentiality interest exists. Statutory information, audit and disclosure obligations remain unaffected. The confidentiality provisions of the Main Agreement also apply.

§ 5 Technical and organisational measures

1. MAD Tech implements appropriate technical and organisational measures under Article 32 GDPR and maintains them throughout the contract term. The protection level takes account of the confidentiality, integrity, availability and resilience of systems, risks, the state of the art, implementation costs, and the nature, scope, context and purposes of processing. Measures include role-based access restrictions, tenant separation, encryption in transit and at rest, backups, logging and security monitoring.

2. The specific measures are described in separate documentation maintained by MAD Tech. MAD Tech provides the current version to the Customer on request, including before processing begins, so the Customer can assess the protection level. This documentation does not form part of the annexes to this agreement.

3. MAD Tech may adjust, supplement or replace measures with equivalent or better measures provided the overall assured protection level is not reduced. Material changes with potentially adverse effects on the security of processing are communicated to the Customer in an appropriate form in good time. Such changes do not require a new version or renewed signature of this DPA. Statutory information, evidence and audit rights remain unaffected.

§ 6 Subprocessors

1. The Customer gives general authorisation to engage the subprocessors listed in Annex 3. MAD Tech ensures that the required contractual obligations under Article 28(4) GDPR are in place and remains responsible to the Customer for their fulfilment of data protection obligations in accordance with the law.

2. Intended additions or replacements of subprocessors are generally communicated at least 30 calendar days in advance through an agreed communication channel. The Customer may object within this period on objectively justified data protection grounds.

3. If an objection is raised, the parties seek a reasonable alternative. If none is possible, the Customer may terminate the affected part of the service for good cause before the change takes effect where continuation would be unreasonable. Emergency changes needed to ensure security or continuity may exceptionally be made at shorter notice; MAD Tech informs the Customer promptly.

4. Further subcontracting by approved providers is permitted where the necessary data protection and transparency obligations are observed throughout the subcontracting chain.

§ 7 Transfers to third countries

1. According to the documented technical information, regular persistent storage of production blankmile customer data takes place in Microsoft Azure data centres within the EU. This does not guarantee that every real-time transmission, provider processing operation or technically necessary access takes place exclusively within the EU.

2. Transfers to third countries, including relevant remote access, take place only where there is a permissible basis under Chapter V GDPR, particularly an adequacy decision (including the EU–US Data Privacy Framework where valid certification applies) or appropriate standard contractual clauses together with any required supplementary measures.

3. Subprocessors and their services are listed in Annex 3. MAD Tech ensures compliance with the Chapter V GDPR requirements applicable to each transfer and provides suitable information about the safeguards used upon a justified request.

§ 8 Assistance and data subject rights

1. Taking into account the nature of processing and available information, MAD Tech provides appropriate assistance to the Customer with data subject rights under Chapter III GDPR, data protection impact assessments, consultations and obligations under Articles 32 to 36 GDPR.

2. Requests from data subjects received by MAD Tech in its role as processor are forwarded to the Customer to the extent legally permissible. MAD Tech does not independently provide substantive responses unless instructed or legally required to do so.

3. Assistance beyond the usual service scope may be subject to reasonable remuneration by prior agreement; mandatory statutory cooperation obligations remain unaffected.

§ 9 Personal data breaches

1. MAD Tech informs the Customer without undue delay after becoming aware of a personal data breach within the meaning of Article 4(12) GDPR. To the extent available at that time, the notification includes the nature and scope of the incident, affected data and persons, possible consequences, measures taken or planned, and a contact for enquiries.

2. Missing details are supplied without undue delay. MAD Tech assists the Customer in assessing and fulfilling any reporting and notification duties; decisions on the controller’s notifications to supervisory authorities are the Customer’s responsibility.

§ 10 Evidence and audits

1. MAD Tech provides the information necessary to demonstrate compliance with Article 28 GDPR and permits reasonable audits by the Customer or an auditor appointed by it and bound by confidentiality.

2. Current suitable audit reports, certifications, security documentation and questionnaire responses may be used first. If these are insufficient in the specific case, further audits may take place during normal business hours with reasonable prior notice. A shorter notice period may be necessary where there is a justified suspicion of serious breaches of duty or data protection incidents.

3. Audits must preserve security, operations, trade secrets and the rights of other customers. The parties agree the scope and effort in advance. Regular individual audits initiated by the Customer generally take place no more than once in twelve months. Additional audits remain permissible where there is a specific data protection reason, particularly significant security incidents, justified doubts about compliance with this DPA, or statutory or supervisory requirements. Statutory evidence and audit rights under Article 28(3)(h) GDPR remain entirely unaffected.

§ 11 Return, deletion and retention

1. Within the available product functions, the Customer determines the retention period for stored session and case content and may set deletion intervals or have authorised users delete content manually. Without automatic deletion enabled, content may remain until manual deletion or contract termination. Compliance with the storage limitation principle is the Customer’s responsibility.

2. After the contract ends, MAD Tech returns personal data in a technically customary format or deletes it, at the Customer’s choice, unless a statutory retention obligation prevents this. The Customer must be able to arrange a data export within a reasonable transition period specified by contract.

3. Deleted production data may temporarily remain in encrypted backups with restricted access and is overwritten according to the documented backup rotation cycle. MAD Tech provides the relevant details on request in the current technical and organisational measures documentation.

4. Technically necessary security and audit logs and processing data held by subprocessors are subject to separate, purpose-specific retention rules. The separate technical and organisational measures documentation and Annex 3 must be observed; no further assurances may be inferred where specific periods have not been verified.

§ 12 AI-assisted functions

1. The AI functions described in Annex 2 are used only within the features commissioned and activated by the Customer. MAD Tech transparently describes the respective data flows and subprocessors.

2. According to MAD Tech, use of submitted customer data to train general AI models is disabled for the OpenAI API. MAD Tech has disabled voluntary data sharing under ‘Sharing’ and additional API call logging. These settings are maintained during operation unless the parties agree otherwise.

3. Non-use for model training does not mean that the AI provider retains no data temporarily for operational, abuse-prevention or security purposes. Such retention is governed by the agreed and documented terms.

4. Roles under the GDPR and roles under Regulation (EU) 2024/1689 (AI Act) must be determined independently. Each party fulfils its applicable statutory obligations. No blanket classification of all customer use scenarios as non-high-risk is agreed.

§ 13 Liability

1. Mandatory statutory provisions, particularly Article 82 GDPR, apply to claims by data subjects. Between the parties, the validly agreed liability provisions of the Main Agreement apply to the extent compatible with mandatory data protection law. Statutory rights of recourse remain unaffected.

2. The Customer is responsible for the lawfulness of the processing it initiates and its instructions. If the Customer culpably breaches its data protection or contractual obligations, it indemnifies MAD Tech against justified third-party claims and associated reasonable costs to the extent arising from that breach. This does not apply to the extent MAD Tech caused or contributed to the damage through its own breach. Mandatory statutory liability and recourse provisions, particularly Article 82 GDPR, remain unaffected.

§ 14 Incorporation, applicable version and amendments

1. This DPA may be agreed through an express reference in the offer, order form or Main Agreement, including an electronic link accessible before the contract is concluded. Where validly incorporated, acceptance of the offer or electronic confirmation of the order also includes this DPA. The version identified or provided when the contract is concluded is authoritative; MAD Tech archives published versions and their periods of applicability.

2. MAD Tech may update this DPA prospectively for objective reasons, particularly to reflect changed legal requirements, supervisory requirements, security standards or technical development of the services. MAD Tech notifies the Customer of intended amendments in text form at least 30 calendar days before the intended effective date, for example by email to the recorded contractual contact address, specifying the amendment date and providing access to the full new text. A change to the website alone does not amend the contract.

3. Amendments that are solely editorial, clarify the text or do not adversely affect the Customer’s legal position may take effect after the notice period if the Main Agreement provides a valid corresponding amendment procedure. Other amendments to this DPA require the Customer’s express consent in text form or through a documented electronic consent process. Silence, continued use or failure to object does not constitute consent to such amendments.

4. Adjustments to technical and organisational measures under § 5 and changes to subprocessors under § 6 remain permissible without amending this DPA, subject to the conditions and information obligations specified there. Mandatory rights and obligations under Article 28 GDPR must not be restricted by an amendment procedure.

§ 15 Final provisions

1. Where an individual agreement for a particular customer contains differing data protection provisions, those provisions take precedence to the extent validly agreed. Amendments and additions require at least text form unless a procedure set out in this DPA applies or mandatory law requires a stricter form.

2. If a provision is invalid, the remaining provisions remain effective. The statutory rule replaces the invalid provision.

3. The law and jurisdiction validly agreed in the Main Agreement apply unless mandatory data protection provisions prevent this.

Annex 1 – Description of processing

Live audio and video are transmitted through Twilio Programmable Video but are not, by default, permanently recorded by blankmile as a complete live stream. Individual media may be deliberately captured and stored in Azure Blob Storage. Activated transcriptions may be generated from live audio and stored.

Annex 2 – AI processing and the EU AI Act

The following description documents the functions known when the contract was prepared. Applicable obligations under the GDPR and AI Act depend on the role, intended purpose, actual implementation and specific use context.

Purpose limitation and data use

MAD Tech sends each provider only the data needed for the activated function. According to the confirmed organisation configuration, voluntary sharing of OpenAI API data for model training and additional API call logging are disabled. Further use of customer data by MAD Tech to train its own models is not part of the commissioned processing.

Transparency and responsibilities

The Customer is responsible for the lawfulness of activation and specific use, informing data subjects and, where applicable, employee participation rights under employment law. MAD Tech provides information on essential functionality, providers, available controls and known limitations, and assists the Customer to a reasonable extent.

Quality, human review and prohibited uses

Automated transcripts, translations, OCR results and summaries may be incomplete or incorrect and must be appropriately reviewed before decisions with significant legal or practical effects. The functions are not intended as an independent basis for automated decisions with legal or similarly significant effects. Prohibited AI practices are not permitted; any high-risk classification for particular customer use cases must be assessed separately.

Changes

Material changes to AI data flows, subprocessors or contractually assured data protection controls are communicated under the relevant provisions of this DPA. A model-version change alone, without a relevant change to protection, purpose or data flow, does not require a separate contractual amendment unless the Main Agreement provides otherwise.

Annex 3 – Subprocessors and third-country transfers

The following overview identifies the provider groups and functions used. Third-country transfers are governed by the current processing terms and transfer mechanisms of the specific entities involved; selecting an EU region does not exclude remote access.

Transfer mechanisms

Where personal data is transferred outside the EEA or accessed from third countries, the applicable instruments under Chapter V GDPR are used. Any DPF certification must be checked for the specific US recipient entity and relevant processing scope; otherwise, appropriate standard contractual clauses and, where necessary, supplementary safeguards must be used.