Back to Home
Data Processing

Data Processing Agreement (DPA)

Last updated:

Draft — external counsel review pending. This DPA is an internal draft, reviewed in-house against Scandora's actual data flows. It has not yet been reviewed by external legal counsel and may change before it is used to conclude a binding agreement.

For business customers. Where you use Scandora's managed AI to process your clients' or customers' data, Scandora acts as your processor within the meaning of Art. 28 GDPR. This page sets out the data-processing terms and lets you download a signable Data Processing Agreement (DPA / German "AVV").

Download the signable template: DPA template (PDF) · DPA template (DOCX). Sign and return one copy to [email protected] before processing client data on the managed AI path.

1. Scope & Roles

This DPA applies only to the managed AI path, where Scandora routes your document content to an AI model provider on your behalf. In BYOAI mode (your own API key), you are the controller and the AI provider processes under your own account — this DPA does not apply.

  • Controller: you (the business customer / your Steuerberater's client).
  • Processor: Scandora — Farhad Sanaei seresht (sole proprietor, trading as "Scandora"), Burgunderweg 19G, 22453 Hamburg, Germany. See our Imprint.
  • Sub-processors: Scandora's own AI gateway plus the underlying model provider (Google Gemini) — see section 5.

2. Subject, Nature & Purpose

The processor processes document content (images and extracted text) and prompts transiently to produce AI analysis results (e.g. titles, labels, extracted fields, answers). Document content is not retained by Scandora. Processing lasts for the duration of managed AI use and ends when the underlying contract ends.

3. Data Categories & Data Subjects

Categories of data: document images and extracted text, which may contain special categories of personal data (Art. 9 GDPR) where you submit such documents.

Categories of data subjects: persons you determine, whose data appears in the processed documents (e.g. your clients, customers, employees).

4. Processor Obligations

  • Process only on your documented instructions.
  • Bind authorised personnel to confidentiality.
  • Implement the technical and organisational measures in section 7.
  • Assist you with data-subject requests and with your obligations under Art. 32–36 GDPR.
  • Delete or return the data at your choice on termination.
  • Make available the information needed to demonstrate compliance and allow for audits.

5. Sub-Processors

You authorise the following sub-processors on the managed AI path. Because this DPA covers only that path (section 1), the list is a subset of section 7 of our Privacy Policy — section 7 additionally names the providers we use as controller for our own purposes, including email (see the note below this table). We inform you of intended changes and grant a right to object.

Sub-processorPurposeData processedRegion
Scandora AI Gateway (self-operated, first-party) Managed AI — routing & metering of AI requests to the model provider Document images & extracted text, prompts (transient) EU
Google (Gemini API) AI document analysis (model provider) Document images & extracted text, prompts (transient) USA / global

The model provider (Google) acts as Scandora's sub-processor only on the managed AI path. In BYOAI mode the provider processes under your own account and is not Scandora's sub-processor.

Outside this DPA's scope — email. Two email flows touch your data but sit outside this DPA, because there we act as controller for our own contract with you, not as your processor. Neither carries the document content processed under this DPA:

  • Mail we send you — order confirmations and account/lifecycle messages leave the domain through Brevo (Sendinblue SAS, France; sending and storage in the EU, with USA/India access inside Brevo's own chain under the EU Standard Contractual Clauses).
  • Mail you send us — messages to support@, privacy@ or [email protected] are routed by Cloudflare into an ordinary Google consumer mailbox, for which no Art. 28 processor agreement is available. A message you send through the website contact form reaches the same mailbox — our own server relays it to [email protected] through Brevo, and Cloudflare forwards it on. Our reply leaves through Brevo and normally quotes your message.

Both are listed in section 7 of our Privacy Policy. If you would rather not send contract or personal data by email, use the postal address in our Imprint.

6. International Transfers

Where a sub-processor processes data outside the EU/EEA (e.g. the USA), transfers are safeguarded by the EU Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework. Scandora's own gateway and OAuth components run in the EU (europe-west3, Frankfurt).

7. Technical & Organisational Measures (TOMs)

  • Encryption in transit (TLS) and at rest (AES-256).
  • Role-based access control and logging.
  • Pseudonymisation of the user identifier (Firebase UID).
  • No persistent storage of document content — transient processing only.
  • EU hosting of the OAuth/gateway components (europe-west3, Frankfurt).
  • Regular updates, recoverability and resilience of systems.
  • A process for regularly testing the effectiveness of the measures.

8. Controller & Data-Subject Rights

You remain in control of the data. Data subjects have the rights under Art. 15–22 GDPR (access, rectification, erasure, restriction, portability, objection). Scandora assists you in fulfilling them. To exercise rights or raise questions, contact [email protected].

9. Download & Conclude the DPA

Download the signable template, complete the party fields, sign, and return one copy to [email protected]:

The signable template includes the controller/processor party fields, a sub-processor annex, the TOMs, and signature blocks. Its Annex 1 names the same sub-processors as section 5 above — Scandora AI Gateway (EU) and Google (Gemini API) (USA/global) — and describes that list as a subset of section 7 of our Privacy Policy, on the same managed AI path. Both downloads are generated from one source file, so they always carry the same text.

10. Contact

Data protection contact

Email: [email protected]

Postal address and the responsible operator are listed in our Imprint.