Data processing agreement
Last updated: 4 November 2026 · Hevia is a product of evioe studio.
This version has been checked against Vela’s actual technical architecture. A review by a lawyer is still pending.
1. Parties and application
This agreement governs the processing of personal data by evioe · Web & IT Studio, owner Mahsum Kavak, Schwarzwaldstr. 61, 79539 Lörrach, Germany (“processor”) on behalf of the customer (“controller”) under Art. 28 GDPR. It forms part of the terms and conditions and applies upon their acceptance at sign-up. We will send a signed copy on request to hey@evioe.de.
2. Subject matter, nature and purpose
| Subject matter | Operation of the Hevia AI chat on the controller’s website and of the associated dashboard |
|---|---|
| Nature of processing | Collecting, storing, querying, transmitting to the AI model to formulate the answer, displaying in the dashboard, exporting, deleting |
| Purpose | Answering visitors’ questions, taking and forwarding requests, statistics for the controller |
| Data subjects | Visitors to the controller’s website who use the chat; the controller’s staff with dashboard access, insofar as they appear in content |
| Types of data | Chat messages and answers with time and language; page address; details from forms (e.g. name, email, phone, preferred date, request); clicks on booking links; knowledge entries insofar as they relate to persons |
| Special categories | Not intended; the controller does not request them, and visitors are asked before the chat not to enter them |
| Duration | Term of the main contract, then until deletion under section 9 |
3. Instructions
We process the data only on documented instructions from the controller, including with regard to transfers to third countries, unless we are required to do so by law; in that case we inform the controller beforehand, unless the law prohibits this. Instructions are the settings in the dashboard (such as retention, pause, deletion) and instructions in text form. If we consider an instruction unlawful, we point this out without delay.
The controller instructs us to derive anonymised, aggregated metrics from the data processed on its behalf, insofar as this is necessary for the anonymous statistics under the terms and conditions. Anonymisation is carried out in such a way that the link to a person cannot be restored. The resulting metrics are not personal data and are not subject to the deletion and return obligations of this agreement.
4. Obligations of the processor
- Everyone with access to the data is bound to confidentiality.
- We take the measures under Art. 32 GDPR described in Annex 1 and adapt them to the state of the art without lowering the level of protection.
- We do not use the data for our own purposes and do not train AI models with it.
- We support the controller with data protection impact assessments and prior consultations (Art. 35, 36 GDPR).
5. Subprocessors
The controller agrees to the use of the subprocessors listed in Annex 2. We announce new or replaced subprocessors at least 30 days in advance by email or in the dashboard. The controller may object within this period on important data protection grounds; if we cannot resolve the objection, the controller may terminate the contract with effect from the date the change takes effect. We contractually bind subprocessors to an equivalent level of protection.
6. Transfers to third countries
The database and backups are located in Frankfurt. Some subprocessors are US companies or process parts of the data in the USA (Annex 2). The basis is the adequacy decision on the EU-US Data Privacy Framework where the provider is certified, plus EU standard contractual clauses (Art. 45, 46 GDPR).
7. Data subject rights
We support the controller in responding to requests under Art. 15 to 22 GDPR. The dashboard allows conversations and requests to be viewed, exported and deleted. If data subjects contact us directly, we forward the request to the controller without delay.
8. Personal data breaches
We notify the controller of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as available, and support the controller in meeting its notification obligations.
9. Deletion and return
The controller can export its data at any time. After the end of the contract we delete all data after 30 days, or immediately if the controller deletes its business in the dashboard. Encrypted backups are overwritten after 30 days; until then, deleted data is not restored from them except to recover from an outage. Statutory retention obligations remain unaffected.
10. Evidence and audits
On request we provide the controller with all information needed to demonstrate compliance with Art. 28 GDPR. On-site audits are possible during normal business hours after timely notice and without disrupting operations; written information and the subprocessors’ evidence take precedence.
11. Liability and final provisions
Liability is governed by Art. 82 GDPR; otherwise the terms and conditions apply. In the event of conflict, this agreement takes precedence over the terms and conditions insofar as the protection of personal data is concerned. German law applies.
Annex 1: Technical and organisational measures (Art. 32 GDPR)
| Area | Measure |
|---|---|
| Encryption | Encrypted transmission (TLS); stored data and backups encrypted; the backup key is kept separately from the hosting |
| Access to systems | Dashboard only after sign-in; minimum password length, passwords stored only in encrypted (hashed) form; sessions expire and end when the password is changed; limits on sign-in attempts |
| Access to data | Roles per business (owner, member); export, team and deletion for owners only; operator access only for support and troubleshooting |
| Separation | Access protection between businesses: one business’s data cannot be reached by others and is not used for others; tested automatically |
| Data minimisation | No IP address or browser identifier stored in conversations; IP addresses used for abuse protection only as an irreversible, encrypted value, deleted after 2 days; logs without conversation text, shortened and with contact details masked |
| Input and transfer control | Only the question, the latest messages of the conversation and matching entries go to the AI service, no form details, IP addresses or page addresses; AI processing in the EU and EFTA countries, no training with the data |
| Availability | Daily encrypted backup, regularly checked by test restores; retention 30 days; limited operation without AI during an outage |
| Resilience | Daily limits on AI answers per business and limits on requests per visitor; public chat can be paused per business |
| Deletion | Configurable period for conversations and requests (30 to 730 days or manual), applied automatically; deletion of individual conversations and of the business with all data |
| Review | Automated tests of the protective measures, privacy flows and backups before every release; check of the live system afterwards |
| Organisation | Everyone with access is bound to confidentiality; two-factor sign-in for the providers’ administrative accounts will be set up before customer launch |
The separation of businesses is tested automatically. More on the measures under Security.
Annex 2: Subprocessors
The current list with seat, purpose, location and contractual basis is published under Subprocessors. It forms part of this agreement.
This English version is provided for convenience. If the two versions differ, the German version prevails.