Data Processing Agreement (Art. 28 GDPR)

Version of 2026-10-27.

This Data Processing Agreement (“DPA”) is concluded between the business customer using Alpenware Inference (“Customer”) and Nikolay Kopylov, trading as Nikolay Kopylov Softwareentwicklung (alpenware), Lehrer-Wirth-Straße 42, 81829 München, Germany (“Processor”).

It forms part of the Terms of Service and applies automatically from the Customer's first API request. A countersigned copy is available on request from legal@unwindly.app.

1. Scope and roles

1.1 This DPA applies to all personal data that the Processor processes on behalf of the Customer when providing the inference API (“Customer Personal Data”). The Processor's own processing as controller (for example billing data, request metadata and website logs) is described in the Privacy Policy and is not covered by this DPA.

1.2 The Customer acts either as controller or as processor on behalf of its own customers (for example a model router or marketplace). Where the Customer is a processor, the Processor acts as its sub-processor. The Customer then warrants that its controller has authorised this sub-processing and that the Customer's instructions reflect those of its controller.

1.3 Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given in the GDPR. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails.

2. Subject matter, duration, nature and purpose

The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I. The processing lasts as long as the Processor provides the API to the Customer.

3. Instructions

3.1 The Processor processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to third countries, unless EU or Member State law requires otherwise. In that case, the Processor informs the Customer of that legal requirement before processing, unless the law prohibits this.

3.2 The Terms of Service, this DPA and the Customer's API requests (including the parameters sent with them) are the Customer's complete instructions. Further instructions must be given in text form and must be technically feasible within the service.

3.3 The Processor informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Obligations of the Processor

• Customer Personal Data is processed only to generate the requested output and to return it to the Customer. It is held in memory and is not stored persistently (Annex I, section 5).
• Customer Personal Data is not used for the Processor's own purposes, in particular not to train, fine-tune, evaluate or improve models, and is not sold or disclosed to third parties.
• Every person authorised to process Customer Personal Data is committed to confidentiality or is under an appropriate statutory obligation of confidentiality.
• The Processor implements the technical and organisational measures in Annex II (Art. 32 GDPR). It may update them, provided the level of protection is not reduced.
• The Processor designates legal@unwindly.app as its contact for data protection matters. It is not obliged to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG.

5. Sub-processors

5.1 The Customer gives general written authorisation for the Processor to engage sub-processors. The sub-processors engaged on the effective date are listed in Annex III and on the sub-processors page.

5.2 The Processor gives at least 30 days' notice of any intended addition or replacement of a sub-processor. It does so by updating the sub-processors page and, for customers who have provided a contact address, by email. Within that period the Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected service before the change takes effect.

5.3 The Processor imposes on each sub-processor, by contract, data protection obligations providing sufficient guarantees equivalent to this DPA. The Processor remains fully liable to the Customer for the performance of its sub-processors' obligations (Art. 28(4) GDPR).

6. Location and international transfers

Customer Personal Data is processed only in the European Union or the European Economic Area. Any transfer to a third country requires the Customer's prior notice under section 5.2. It must also comply with Chapter V GDPR, for example through an adequacy decision or the EU Standard Contractual Clauses.

7. Assistance

7.1 Taking into account the nature of the processing, the Processor assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights (Chapter III GDPR). The Processor forwards to the Customer, without undue delay, any such request it receives directly. Because request content is not stored, the Processor will normally hold no Customer Personal Data that could be accessed, corrected or deleted.

7.2 The Processor assists the Customer in meeting its obligations under Art. 32 to 36 GDPR, taking into account the information available to it. This covers security, breach notification, data protection impact assessments and prior consultation. The Processor may charge reasonable costs for assistance beyond what the service ordinarily provides.

8. Personal data breaches

The Processor notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. As far as available, the notification describes:

• the nature of the breach;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed.

Information that is not yet available is provided as soon as it becomes available. The Processor takes reasonable steps to contain the breach and to mitigate its effects.

9. Deletion and return

Request content is deleted from memory as soon as the response has been returned, subject only to the transient cache described in Annex I, section 5. When the contract ends, the Processor deletes any remaining Customer Personal Data unless EU or Member State law requires it to be stored. Because no request content is retained, there is nothing to return. The Processor confirms deletion in text form on request.

10. Information and audits

10.1 The Processor makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR. This includes answers to reasonable security questionnaires and, where available, the certifications of its sub-processors.

10.2 The Customer, or an independent auditor bound to confidentiality and mandated by the Customer, may carry out audits, including inspections, where the information under 10.1 is not sufficient. The following conditions apply:

• The Customer gives at least 30 days' notice.
• Audits take place during normal business hours and without disrupting operations.
• The Customer may audit no more than once in any twelve months. Further audits are allowed after a personal data breach or when a supervisory authority requires one.
• Inspections of data centres are carried out by relying on the sub-processors' certifications and audit reports.
• The Customer bears its own audit costs, and the Processor's reasonable costs, unless the audit reveals material non-compliance by the Processor.

11. Customer obligations

The Customer is responsible for:

• the lawfulness of the processing, including having a legal basis;
• informing data subjects;
• not sending special categories of personal data (Art. 9 GDPR) or data about criminal convictions unless this is lawful and necessary for its purpose.

The Customer informs the Processor without undue delay if it finds errors or irregularities in the processing.

12. Liability, term and final provisions

12.1 Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the limitations of liability in the Terms of Service apply to the extent permitted by law.

12.2 This DPA remains in force for as long as the Processor processes Customer Personal Data for the Customer.

12.3 Amendments must be made in text form. If any provision is invalid, the remaining provisions stay in force.

12.4 German law applies.

Annex I — Description of the processing

1. Subject matter: providing an API that runs open-weight language and multimodal models on the Customer's inputs and returns the generated outputs.
2. Nature of processing: receiving requests over encrypted connections, processing them in memory on GPU servers, generating outputs, returning them, and discarding the request content.
3. Types of personal data: any personal data the Customer or its end users include in prompts, system messages, conversation history, files, images, audio or tool-call data, and any personal data contained in generated outputs. The Processor does not control or inspect these inputs. They may include special categories of data if the Customer sends them.
4. Categories of data subjects: the Customer's end users and staff, and any persons mentioned in inputs or outputs.
5. Retention:
   • Request content is not written to persistent storage or logs.
   • The inference engine may keep a transient cache of processed prompts in GPU or server memory to speed up repeated requests. This cache is not stored as readable text, is overwritten automatically and is lost on restart.
   • Request metadata without content is processed by the Processor as controller, as described in the Privacy Policy.
6. Location: Germany or Finland (EU).

Annex II — Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access: servers are located in ISO/IEC 27001-certified data centres operated by the hosting sub-processor, with access control, video surveillance and 24/7 security staff. The Processor has no physical access.
• System access: administrative access only via SSH with key-based authentication (passwords disabled). Multi-factor authentication is used on all hosting and provider accounts, and access is restricted to the operator.
• Data access: request bodies are excluded from all application, proxy and system logs. API keys are stored only as hashes, and there is no interface for viewing request content.
• Separation: the inference servers are dedicated to this service and do not run other products or customer workloads.

Integrity

• All API traffic is encrypted in transit with TLS 1.2 or higher.
• Server configuration is managed as code under version control, so changes are traceable.
• Firewalls are set to deny by default. Only the HTTPS API port and the administrative SSH port are reachable.

Availability and resilience

• Health monitoring with alerting, automatic restart of failed services, and capacity limits with rate limiting to prevent overload.
• Server configuration and model artefacts are backed up so that the service can be restored on replacement hardware. Request content is not backed up because it is not stored.
• Security updates for the operating system and inference software are applied promptly.

Review and incident handling

• These measures are reviewed at least once a year and whenever the infrastructure changes.
• A documented incident response procedure covers detection, containment, assessment and notification under section 8 of this DPA.

Annex III — Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: Dedicated GPU servers that run the inference API. Location: Germany or Finland (EU). Data: Prompts and outputs in server memory while a request is processed; request metadata.