Data Processing Agreement

1. Subject matter and roles

The Processor processes personal data on behalf of the Controller solely to provide the PaperHero service. The Controller remains responsible for the lawfulness of the processing and for the content it uploads.

2. Duration

This DPA applies for as long as the Processor processes personal data on behalf of the Controller, i.e. for the term of the underlying contract.

3. Nature of processing, types of data and data subjects

• Nature and purpose: storage, text recognition (OCR), indexing for search, AI-assisted analysis, sharing and related document-management operations.
• Types of personal data: any personal data contained in the documents, files, metadata and AI inputs that the Controller uploads or generates (which may include names, contact details, contract and financial data and other content).
• Categories of data subjects: as determined by the Controller's content — typically the Controller, its family members, customers, contractual partners or other individuals referenced in the documents.

4. Obligations of the Processor

• Process personal data only on the documented instructions of the Controller (which include the use of the Service's features); inform the Controller if an instruction infringes data-protection law.
• Ensure that persons authorized to process the data are bound to confidentiality.
• Implement the appropriate technical and organizational measures set out in section 7.
• Assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations under Art. 32–36 GDPR.
• At the Controller's choice, delete or return the personal data after the end of the provision of services, unless storage is required by law.
• Make available the information necessary to demonstrate compliance and allow for and contribute to audits.
• Notify the Controller without undue delay of a personal data breach affecting the Controller's data.

5. Sub-processors

The Controller grants general authorization for the engagement of sub-processors. The Processor currently engages the sub-processors listed in its Privacy Policy. For hosting and storage this is Hetzner Online GmbH (Germany). Text recognition and the AI assistant run in three hosting tiers: PaperHero Hosting on the Processor's own servers in Germany; German Hosting at AKI.IO GmbH, Marienburger Str. 1, 10405 Berlin, Germany, which engages AIME GmbH at the same address as its own sub-processor for the GPU infrastructure, and with which the Processor has a data processing agreement including a supplementary agreement for members of professions bound by professional secrecy under section 203 of the German Criminal Code (§ 203 StGB); and EU Hosting at Mistral AI SAS in France, whose API the Processor calls directly. The Processor engages no further AI sub-processors. Search indexes (embeddings) are computed on the Processor's own infrastructure in every tier and are not passed to any AI sub-processor.

If a hosting tier is temporarily unavailable, processing may fall back one level for the duration of the disruption: PaperHero Hosting to German Hosting, and German Hosting to EU Hosting. Processing never falls back to a sub-processor outside the EU, and every such substitution is recorded in the processing log of the document concerned.

The Processor will inform the Controller of any intended changes concerning the addition or replacement of sub-processors and will give the Controller the opportunity to object on reasonable data-protection grounds. If the Controller objects, the Processor may terminate the affected service or contract.

The Processor imposes data-protection obligations on its sub-processors that are equivalent to those in this DPA.

6. Data-subject rights and assistance

The Processor supports the Controller, as far as possible and with appropriate technical and organizational measures, in fulfilling data-subject requests. PaperHero provides self-service export and deletion functions for this purpose.

7. Technical and organizational measures

• End-to-end encryption of documents; encryption keys protected by the user's password; optional device-only key storage.
• Encryption in transit (TLS) and password hashing with scrypt.
• Logical isolation of each customer's data in a separate database and storage area (multi-tenancy separation).
• Access controls, role-based permissions and optional two-factor authentication.
• Hosting within the EU (Germany) on access-controlled infrastructure, with backups and logging.
• Documented processes for incident response and deletion.

8. International transfers

Processing under this DPA takes place within the EU. The Processor does not transfer the Controller's document data to third countries. AI processing takes place within the EU in every hosting tier - on the Processor's own infrastructure in Germany, at a provider in Germany or at a provider in France - and this also holds where a tier temporarily falls back one level, because a fallback only ever moves to another EU tier. None of the service providers involved in storing or processing the document data is subject to the US CLOUD Act.

9. Liability and order of precedence

Liability is governed by the underlying contract and the GDPR. In the event of conflict between this DPA and the Terms of Use regarding data protection, this DPA prevails.

10. Deletion and return

Upon termination, the Processor deletes the Controller's personal data in accordance with its Privacy Policy (access disabled immediately, erasure within 30 days), unless a legal retention obligation applies.

Contact

To request a counter-signed copy of this DPA or for data-protection questions:

privacy@paperhero.io

blaumedia GmbH
Friedrich-Ebert-Hof 6
22763 Hamburg
Germany