Version of 2 October 2026
This agreement on processing on behalf of a controller under Art. 28 GDPR forms part of the terms of use for archmax Cloud. It applies between the Customer as controller (the "Customer") and archmax GmbH, Paulinenstr. 14, 72072 Tübingen, Germany, as processor ("archmax") and is concluded upon agreeing to the terms of use. This English version is provided for convenience. Only the German version is legally binding.
(1) This agreement covers the processing of personal data by archmax on behalf of the Customer when providing archmax Cloud. The nature, purpose and scope of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
(2) The agreement applies for the term of the contract for the use of archmax Cloud and beyond for as long as archmax processes personal data of the Customer.
(3) In the event of any conflict, this agreement takes precedence over the terms of use with regard to the protection of personal data.
(1) archmax processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless archmax is required to do so by Union or Member State law. In that case, archmax informs the Customer of that legal requirement before processing, unless that law prohibits this.
(2) The terms of use, this agreement and the Customer's configuration and use of archmax Cloud, such as its workflows, connections and choice of models, constitute the Customer's instructions. The Customer gives further instructions in text form.
(3) archmax informs the Customer without undue delay if, in archmax's opinion, an instruction infringes data protection law and may suspend its execution until the Customer confirms or changes it.
(1) archmax ensures that persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(2) archmax takes the technical and organizational measures under Art. 32 GDPR described in Annex 2. archmax may develop them further provided the level of protection is not reduced.
(3) archmax does not process the data for its own purposes and in particular does not use it to train AI models.
(4) archmax has not appointed a data protection officer, as there is no legal obligation to do so. The contact person for data protection is Dr. Steffen Wütz, reachable at info@archmax.ai.
(5) archmax informs the Customer without undue delay of inspections and measures by a supervisory authority insofar as they relate to this processing.
(6) If an authority or court requests the disclosure of the Customer's data, archmax informs the Customer in advance where legally permitted, examines the lawfulness of the request, challenges unlawful requests and only discloses the data it is obliged to disclose. This also applies to requests from third countries addressed to sub-processors, insofar as archmax becomes aware of them.
(7) archmax staff only access the Customer's content to the extent necessary for support at the Customer's request, for remedying faults or for averting security incidents, and only to the extent required.
(8) If the Customer is subject to professional secrecy, for example as a tax adviser or lawyer, archmax undertakes to keep confidential any third-party secrets it becomes aware of when providing its services and only takes note of them to the extent necessary for the services. archmax obliges the persons and sub-processors it engages accordingly. The Customer hereby informs archmax of the criminal consequences of a breach of this obligation (Section 203(4) of the German Criminal Code, StGB).
(1) The Customer grants archmax general authorization to engage sub-processors. The sub-processors engaged at the conclusion of the contract are listed in Annex 3 and are deemed approved.
(2) archmax informs the Customer in accordance with § 16 of the terms of use at least 30 days in advance of any intended addition or replacement of a sub-processor and updates Annex 3. The Customer may object to the change within this period for an important reason relating to data protection. If the parties cannot reach agreement, the Customer may terminate the contract as of the date of the change. If archmax has to replace a sub-processor at short notice to avert an acute risk to the security of the data or the availability of archmax Cloud, archmax provides the notice without undue delay afterwards; the right to object remains unaffected.
(3) archmax contractually imposes on each sub-processor data protection obligations equivalent to those in this agreement, in particular sufficient guarantees for appropriate technical and organizational measures. archmax is liable to the Customer for sub-processors' compliance with these obligations.
(4) If the Customer connects archmax Cloud to third-party services or stores credentials for its own model provider, those providers are not sub-processors of archmax. Transfers to them take place on the Customer's instructions, and the Customer governs its own relationship with those providers.
(1) archmax generally processes the data in the EU. Data is only transferred to a third country if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision or the European Commission's standard contractual clauses. On request, the Customer receives a copy of the agreed standard contractual clauses.
(2) To run agents and workflows, archmax transmits data to the model provider the Customer connects with its own credentials. With its choice, the Customer determines the provider and the processing location. The transmission takes place on its instructions (§ 4(4)), and the Customer ensures that it is lawful, including where the provider processes data outside the EU.
(1) archmax assists the Customer with appropriate technical and organizational measures in responding to requests from data subjects under Chapter III GDPR. If a data subject contacts archmax directly, archmax forwards the request to the Customer without undue delay and does not respond itself unless the Customer instructs otherwise.
(2) Taking into account the nature of processing and the information available, archmax assists the Customer in complying with the obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations with the supervisory authority.
(3) For assistance that goes beyond the features of archmax Cloud and is not due to a breach by archmax, archmax may charge reasonable fees based on effort.
archmax notifies the Customer of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notification contains, as far as known, the information under Art. 33(3) GDPR; archmax provides missing information as soon as it becomes available. archmax takes the necessary measures without undue delay to remedy the breach and mitigate possible adverse effects.
(1) archmax permanently deletes all personal data of the Customer 30 days after the end of the contract, unless Union or Member State law requires storage. Until then, the Customer can export its data or request its return (§ 9 of the terms of use).
(2) During the term of the contract, archmax deletes data on the Customer's instructions.
(3) Deleted data may remain in backups for up to 90 days until they are deleted in rotation. Backups serve solely for recovery after incidents; if archmax has to restore a backup, it deletes again any previously deleted data it contains.
(4) archmax may retain documentation serving as evidence of proper processing beyond the end of the contract in accordance with statutory retention periods.
(1) On request, archmax provides the Customer with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
(2) The Customer or an auditor appointed by it who is bound to confidentiality and is not a competitor of archmax may conduct audits, including inspections. Audits must be announced with reasonable notice, as a rule at least 30 days, take place during normal business hours and must not disrupt operations disproportionately. archmax may primarily provide evidence by means of suitable documentation, certificates or audit reports, including those of sub-processors. On-site audits take place no more than once per calendar year unless there is a specific reason, such as a personal data breach or an order of the supervisory authority.
(3) The Customer bears the costs of an audit. archmax may charge reasonable fees for its own effort unless the audit reveals a material breach of this agreement by archmax.
Art. 82 GDPR applies to liability towards data subjects. Between the parties, the liability provisions of the terms of use apply.
(1) § 15 of the terms of use applies to changes to this agreement.
(2) Should individual provisions be or become invalid, the validity of the remaining provisions remains unaffected.
(3) The law of the Federal Republic of Germany applies. § 17(4) of the terms of use applies to the place of jurisdiction. The German version of this agreement is authoritative.
Nature and purpose of processing: provision of archmax Cloud, in particular storing, versioning and running agents and workflows, transmitting inputs and files to the language models connected by the Customer, processing by the design agent, retrieving data from and transmitting data to connected third-party services as configured by the Customer, providing chat, webhook and MCP endpoints, logging sessions and decisions, and troubleshooting and support.
Types of personal data:
archmax only processes special categories of personal data under Art. 9 GDPR if the Customer brings them into archmax Cloud. The Customer is responsible for ensuring that the legal requirements for this are met and carries out any required data protection impact assessments.
Categories of data subjects:
Duration of processing: for the term of the contract; after the end of the contract, § 8 applies.
archmax does not operate its own data centers. The physical security of the data centers is ensured by the providers listed in Annex 3 in accordance with their security standards. In addition, archmax takes the following measures in particular.
Confidentiality (Art. 32(1)(b) GDPR):
Integrity (Art. 32(1)(b) GDPR):
Availability and resilience (Art. 32(1)(b) and (c) GDPR):
Regular review (Art. 32(1)(d) GDPR):
archmax engages the following sub-processors:
archmax itself is responsible for signing in and managing user accounts via Auth0 (see privacy policy). Auth0 is therefore not a sub-processor within the meaning of this agreement. Endpoints with sign-in verify tokens from the identity provider the Customer specifies for them.