Data Processing Agreement

This is a courtesy translation. The binding version of this agreement is the German text at Auftragsverarbeitung. If this translation and the German text differ, the German text prevails.

§ 1 Subject, parties, duration

This agreement gives concrete form to the duties of Art. 28 GDPR for institutional licences: BlueAgent as its own deployment, run by us for your institution. The controller is the institution concluding the institutional agreement; the processor is the business named in the imprint (“we”). This agreement lasts as long as the institutional agreement does; a signed copy belongs to it.

Whoever buys seats for third parties through the shop and needs a data processing agreement for that gets this same contract on request.

§ 2 What is processed

The purpose of the processing is running the deployment: storing, serving and processing what your users create in it — including AI inference when they use the agent.

Categories of data

Account data (name, email address, password as a hash). Content data (reactor designs, CAD models and plots, files, knowledge-base notes, conversations with the agent). Log and usage data (IP addresses in server logs; per interaction the time, the model and the token count — not the content).

Data subjects

The users your institution creates or invites: students, researchers, staff.

§ 3 Instructions

We process only on documented instructions. The institutional agreement together with this contract is the first; further ones need text form. If we consider an instruction to infringe data protection law, we say so before carrying it out.

§ 4 Confidentiality

On our side exactly one person works with your data: the person named in the imprint, committed to confidentiality (Art. 28(3)(b) GDPR). Should anyone ever join, they are committed the same way before their first access.

§ 5 Security

The technical and organisational measures under Art. 32 GDPR are in the annex. We may evolve them as long as the level of protection does not drop.

§ 6 Subprocessors

You give general authorisation for the subprocessors listed below. We announce changes to this list by email at least 30 days in advance; if you object on data-protection grounds, you may terminate the institutional agreement effective when the change takes effect. We impose the duties of this contract on every subprocessor (Art. 28(4) GDPR).

netcup GmbH

Hosting. Daimlerstraße 25, 76185 Karlsruhe, Germany.

Scaleway SAS

Delivery of our emails, account and transactional mail only. France.

Anthropic PBC

AI inference, only where it runs on our key: the message and the relevant project context are sent to Anthropic (USA) to generate the reply. The transfer rests on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Anthropic’s Data Processing Addendum; per Anthropic’s API terms this data is not used to train models. Where your institution brings its own Anthropic key, Anthropic is its own contracting party and not a subprocessor of ours.

§ 7 Rights of data subjects

If a data subject turns to us, we forward the request to your institution without delay and do not answer it ourselves. For access, rectification, erasure, restriction and data portability we assist with what the deployment provides: export, correction and real deletion of the stored data.

§ 8 Notifications and assistance

We notify your institution of a personal data breach without undue delay after becoming aware of it — with what Art. 33(3) GDPR names, as far as known to us at that time. For notification, communication, data protection impact assessment and consultation (Art. 32 to 36 GDPR) we assist with what we know and have.

§ 9 Deletion and return

When the institutional agreement ends, we first export the content data in common formats if you wish. After that we delete all personal data of the engagement within 30 days; server logs expire on their own cycle (annex). Our own records — the invoices to your institution — we keep for seven years (§ 132 BAO); for those we are the controller, not the processor.

§ 10 Evidence and audits

We make available the information necessary to demonstrate the duties of Art. 28 GDPR — this page and its annex are the start. Audits, including on site, are possible after reasonable notice at usual times; no audit extends to the data of other tenants. Where meaningful documentation suffices, we may demonstrate compliance with it.

§ 11 Final provisions

Austrian law applies. The contract language is German. Translations of this agreement — currently an English and a French version — serve comprehension only; only the German text is binding. In all other respects the institutional agreement applies.

Annex: technical and organisational measures

Transport

TLS on every connection.

Separation

One tenant per institution. Files, threads and designs are separated at tenant level; another group’s work does not touch yours.

Access

Exactly one person has access to servers and database. User passwords are stored only as hashes, deposited API keys encrypted.

Executed code

Python that users run executes in an isolated sandbox without network access; nothing leaves it except the geometry and plots the user produces.

Logs

Rotated daily and deleted after 90 days. Passwords, tokens and keys are removed before a line reaches the disk.

No third parties in the browser

No CDN, no analytics, no fonts fetched from anywhere — the pages load nothing but themselves.