Data Processing Agreement

Last updated: October 2026

This template Data Processing Agreement ("DPA") is concluded between the Customer ("Controller") and DexterBee GmbH, Industriestraße 13, 63755 Alzenau, Germany ("Processor", "UIWeaver") and governs the processing of personal data by UIWeaver on behalf of the Customer in accordance with Art. 28 of Regulation (EU) 2016/679 (GDPR). It supplements the main agreement (Terms of Service, Statement of Work).

A version of this template DPA signed by the Processor will be provided on request to privacy@uiweaver.io.

§ 1 Subject matter and duration

(1) The subject matter of this DPA is the processing of personal data by UIWeaver in connection with the provision of the agreed services (AI-powered website creation, hosting, maintenance, transactional communication) and in connection with the operation of the AI features on the Customer's websites and channels (AI chatbot, knowledge base, appointment booking, AI enquiry manager, WhatsApp chatbot, AI automations, document AI, AI agents; § 2a).

(2) This DPA begins upon conclusion of the main contract and ends automatically upon its termination. § 12 (Termination, deletion of data) remains unaffected.

§ 2 Nature and purpose of processing

UIWeaver processes personal data solely for the following purposes:

  • Provision and operation of the website platform;
  • Generation of AI-powered design suggestions based on end-user input;
  • Hosting of created websites (if ordered);
  • Sending transactional emails to end-users of the Controller;
  • Technical maintenance, backups and security updates;
  • Operation of the AI features booked by the Controller (§ 2a).

§ 2a AI features

(1) Where the Controller has booked AI features as part of a care plan, UIWeaver processes personal data for this purpose solely on behalf of and on the instructions of the Controller. The Controller's configuration of the AI features (e.g. uploaded documents, configured availability, approval of drafts) constitutes a documented instruction. Answers are generated using the AI model Google Gemini.

Processing activityDataDefault retention
AI chatbot on the website — answering visitors' questions based on the website content Chat messages and answers, information voluntarily provided by the visitor, technical connection data (hashed IP address, timestamps) 90 days after the last message
Enquiry capture and appointment booking by the chatbot Name, contact data, request, requested appointment Forwarded to the Controller; deleted at UIWeaver 90 days after transmission or after the appointment
Knowledge base — answering questions based on documents uploaded by the Controller Document content, including any personal data of third parties contained therein; search indexes derived from it Until deleted by the Controller, at the latest in accordance with § 12
AI enquiry manager — analysing contact-form enquiries and preparing draft replies Name, contact data and content of the enquiry, analysis result (e.g. topic, urgency), draft reply, approval status 6 months after receipt of the enquiry, unless deleted earlier by the Controller
WhatsApp chatbot — answering messages via the WhatsApp Business Platform Phone number, WhatsApp profile name, message content, timestamps and delivery status 90 days after the last message; at Meta in accordance with Meta's terms
Document AI — reading and classifying documents (e.g. invoices, receipts) and preparing DATEV exports Uploaded documents; data extracted from them (e.g. invoice and receipt data, names and addresses of suppliers and customers, bank details, employee data contained in documents); classifications; DATEV export files Original documents: 30 days after processing; extracted data and classifications: 90 days after export or approval; DATEV export files: 90 days after being made available
AI automations — preparing quotes, follow-up messages and CRM entries Contact and company data of customers and prospects (CRM contacts), enquiry and quote content, communication history, drafts, approval status Drafts and intermediate results: 90 days after approval or discard; data transferred into the Controller's systems is subject to the Controller's control
AI agents — performing recurring tasks subject to approval by the Controller's team Data from connected systems required for the respective task; task and action logs including approvals (approving person, time) Task content: 90 days after completion of the task; action and approval logs: 12 months (traceability)

(2) Draft replies prepared by the AI enquiry manager are never sent automatically. They are sent only after review and approval by the Controller. Likewise, AI automations and AI agents act towards third parties (e.g. sending quotes or messages) and write to external systems (e.g. CRM, calendar, DATEV) only after approval by the Controller.

(3) Connection of third-party systems: Third-party systems (e.g. CRM, calendar, email, DATEV) are connected via the Controller's own accounts and access credentials. The providers of these systems are in a contractual relationship with the Controller and are the Controller's processors, not sub-processors of UIWeaver within the meaning of § 6. UIWeaver accesses these systems only within the scope of the permissions granted by the Controller and only to carry out the commissioned automations.

(4) Retention obligations: UIWeaver does not archive accounting records. The Controller fulfils its statutory retention obligations (in particular §§ 147 AO, 257 HGB, GoBD) in its own systems; the default retention periods under para. 1 are not designed for this purpose.

(5) UIWeaver does not use data processed in the course of the AI features for its own purposes, in particular not for training AI models. The Gemini API is used on the paid tier; under Google's terms, inputs are not used there to train the models but may be stored for a limited period for abuse detection.

(6) The Controller may instruct shorter or — where required for the automation — longer retention periods. The knowledge base and the document AI are not intended for special categories of personal data (Art. 9 GDPR); processing such data requires a separate agreement.

(7) The chatbots inform data subjects at the start of the interaction that they are communicating with an AI system (Art. 50(1) Regulation (EU) 2024/1689). Informing data subjects pursuant to Art. 13 and 14 GDPR is the responsibility of the Controller.

§ 3 Types of personal data

  • Master data (name, company, address, VAT ID);
  • Contact data (email, phone number);
  • Usage data (IP address — hashed within 24 hours, browser information, timestamps);
  • Content data (business description and configuration provided by the end-user);
  • Contract and transaction data (order number, subscription status — excluding full payment data);
  • Communication data of the AI features (chat and WhatsApp messages, phone number and profile name on WhatsApp, enquiry content, draft replies, appointment data);
  • Content of knowledge-base documents provided by the Controller, to the extent they contain personal data;
  • Invoice and receipt data (e.g. invoice number, amounts, description of services, names and addresses of the parties) and bank details;
  • Data of the Controller's employees, customers and suppliers contained in documents;
  • CRM contact data (name, company, role, contact data, communication and quote history);
  • Task, action and approval logs of the AI agents.

§ 4 Categories of data subjects

  • End-users and visitors of websites operated by the Controller, including users of the AI chatbot;
  • Business partners, customers and prospects of the Controller, in particular senders of enquiries and appointment bookings;
  • Persons contacting the Controller via WhatsApp;
  • Persons named in documents of the knowledge base or the document AI, in particular customers and suppliers of the Controller;
  • Contacts of the Controller recorded in CRM and other connected third-party systems;
  • Employees and agents of the Controller who administer the system, review and approve drafts and actions, or are named in processed documents.

§ 5 Obligations of the Processor

UIWeaver undertakes to:

  • process personal data only on documented instructions of the Controller (Art. 28(3)(a) GDPR), including with regard to transfers to third countries, unless required to do so by law;
  • ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR);
  • take all measures required pursuant to Art. 32 GDPR (see § 7);
  • respect the conditions for engaging another processor pursuant to § 6;
  • assist the Controller in fulfilling its obligations under Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor (Art. 28(3)(f) GDPR);
  • make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections (Art. 28(3)(h) GDPR);
  • immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

§ 6 Engagement of further processors (sub-processors)

(1) By concluding this DPA, the Controller grants a general written authorisation pursuant to Art. 28(2) GDPR for the engagement of further processors to the necessary extent. UIWeaver will inform the Controller of any intended changes concerning the addition or replacement of further processors with a notice period of four weeks and grant a right of objection.

(2) Current sub-processors:

  • Stripe Payments Europe, Ltd., Dublin, Ireland — payment processing.
  • Supabase, Inc., Singapore (data hosted in AWS eu-central-1, Frankfurt) — database.
  • Vercel Inc., Covina, CA, USA — hosting and edge functions.
  • Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France (region fr-par, Paris; processing within the EU) — transactional email delivery.
  • Google LLC, Mountain View, CA, USA — Gemini API (paid tier) for design generation and for generating the answers, analyses and draft replies of the AI features; processing may also take place outside the EU (§ 11).
  • Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland — WhatsApp Business Platform for the WhatsApp chatbot (only if this feature is booked); transfers to Meta Platforms, Inc., USA, possible (§ 11).
  • Google Ireland Ltd., Dublin, Ireland — Google Analytics 4 (consent only).
  • Sanity, Inc., San Francisco, CA, USA — headless CMS (optional).

(3) UIWeaver ensures that the obligations under Art. 28 GDPR are contractually agreed in equivalent form with each sub-processor.

§ 7 Technical and organisational measures (Art. 32 GDPR)

UIWeaver implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

  • encryption in transit (TLS 1.3) and at rest (AES-256);
  • role-based access controls and multi-factor authentication for administrative accounts;
  • logging of security-relevant events and automated anomaly detection;
  • regular backups with documented recovery tests;
  • pseudonymisation (e.g. hashing of IP addresses);
  • logical separation of data per Controller (tenant isolation), in particular of knowledge bases, chat histories, documents and access credentials for third-party systems;
  • encrypted storage of access tokens for the Controller's third-party systems; requesting only the permissions required for the respective automation (least privilege); revocation or deletion of tokens upon termination of the care plan or on the Controller's instruction;
  • technical safeguards ensuring that actions towards third parties and write access to external systems are carried out only after approval by the Controller; logging of approvals;
  • procedures for regularly testing the effectiveness of the measures.

A detailed list of technical and organisational measures is available on request as Annex 1 to this DPA.

§ 8 Assistance with data subject rights

UIWeaver assists the Controller in fulfilling requests of data subjects pursuant to Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). Should a data subject contact UIWeaver directly, UIWeaver will forward the request to the Controller without undue delay.

§ 9 Notification of personal data breaches (Art. 33 GDPR)

UIWeaver shall notify the Controller of any personal data breach of which it becomes aware without undue delay, generally within 24 hours of becoming aware of it. The notification shall include a description of the breach, the categories of data concerned, the likely consequences and the measures already taken.

§ 10 Audit and inspection rights

(1) The Controller has the right, prior to the commencement of processing and thereafter at appropriate intervals, to verify compliance with the technical and organisational measures taken (Art. 28(3)(h) GDPR).

(2) Audits may take the form of inspection of self-assessments, certifications (e.g. SOC 2, ISO 27001) or audit reports of independent third parties. On-site audits shall be coordinated with 30 days' prior notice and limited to the necessary extent.

§ 11 International data transfers

Where personal data is processed outside the EU/EEA in the course of this DPA, UIWeaver bases the transfer primarily on the adequacy decision for the EU-US Data Privacy Framework (C(2023) 4745) and, additionally, on EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914. Additional technical and organisational measures (encryption, access controls) are implemented. This applies in particular to processing via the Gemini API (Google LLC) and to any transfers by Meta Platforms Ireland Ltd. to Meta Platforms, Inc., USA, in the course of the WhatsApp Business Platform.

§ 12 Termination, deletion of data

Upon termination of the main contract, UIWeaver shall — at the choice of the Controller — delete or return all personal data and delete existing copies, unless retention is required by law (in particular §§ 147 AO, 257 HGB). Return or deletion shall be carried out within 30 days of termination; the deletion process is documented on request. Where only the care plan ends, this applies accordingly to the data processed in the course of the AI features (§ 2a), including the knowledge base and data processed by the document AI; access tokens for third-party systems are revoked or deleted without undue delay.

§ 13 Liability

Liability of the parties is governed by Art. 82 GDPR and the provisions of the main contract. In the internal relationship between the parties, the limitation of liability agreed in the main contract applies accordingly, to the extent permitted by law.

§ 14 Final provisions

(1) In the event of any conflict between this DPA and the main contract, the provisions of this DPA shall prevail with regard to the protection of personal data.

(2) Should individual provisions be or become invalid, the validity of the remaining provisions shall not be affected.

(3) Governing law: the law of the Federal Republic of Germany. Place of jurisdiction: Aschaffenburg.

Contact

DPA inquiries: privacy@uiweaver.io
Provider information: Legal notice.