pursuant to Art. 28 GDPR – Ensight DMS
Controller (hereinafter "Client"):
The customer whose data is processed within the Ensight subscription.
Processor (hereinafter "Provider"):
Entropy Software & Consulting, Bastian Entrup, Mühlenstieg 19, 37181 Hardegsen
(1) The subject of this agreement is the processing of personal data by the Provider in connection with the provisioning and operation of the software Ensight DMS — a digital document management system for automated capture, analysis, archiving, and search of business documents (in particular incoming invoices and receipts).
(2) Processing begins upon conclusion of the main contract and ends upon its termination, unless this DPA contains deviating provisions.
Personal data is processed exclusively for the purpose of providing the contractually agreed services:
Processing for purposes other than those stated is not permitted.
| Category | Examples |
|---|---|
| Contact and identification data | Name, company, address of suppliers, customers |
| Financial data | Invoice amounts, tax numbers, IBAN, payment references |
| Communication data | Email address (for email import), subject lines |
| Contract data | Order numbers, customer numbers, service descriptions |
| Metadata | Upload timestamps, file hash values, version information |
Special categories of personal data within the meaning of Art. 9 GDPR are not processed as a matter of principle. Should such data exceptionally be contained in transmitted documents, responsibility for the legal basis lies with the Client.
(1) The Provider processes personal data exclusively on documented instructions from the Client, unless required by Union or Member State law to process otherwise.
(2) Instructions are generally given through the main contract, its annexes, and in writing or text form (email).
(3) If the Provider considers that an instruction infringes the GDPR, it shall immediately inform the Client and is entitled to suspend execution pending clarification.
(4) Verbal instructions are confirmed in writing without delay.
(1) The Provider ensures that persons authorized to process data are committed to confidentiality or are subject to an appropriate statutory obligation of secrecy.
(2) The Provider regularly trains its staff on data protection and information security matters.
The Provider implements the following technical and organizational measures pursuant to Art. 32 GDPR. Material changes will be communicated to the Client in advance.
tenant-<slug>)restart: unless-stopped; systemd unit for automatic start after server rebootdocker compose logs(1) The Provider uses the following sub-processors, to which the Client generally consents by concluding this DPA:
| # | Company | HQ | Processing location | Purpose |
|---|---|---|---|---|
| 1 | Hetzner Online GmbH | Gunzenhausen, Germany | Germany (Nuremberg / Falkenstein) | Server infrastructure, hosting, backup storage |
| 2 | Anthropic, Inc. | San Francisco, USA | USA ¹ | AI extraction of document content via Claude API |
¹ Third-country transfer (Anthropic): Transfer to the USA is based on EU Standard Contractual Clauses (SCCs) pursuant to Implementing Decision (EU) 2021/914. Anthropic does not use transmitted document content for training AI models (per Anthropic's API usage policy).
(2) The Provider will inform the Client of intended changes to sub-processors at least 30 days in advance. The Client may object for documented good cause.
(3) The Provider imposes the same data protection obligations on sub-processors as agreed between the parties.
(1) The Provider assists the Client in fulfilling its obligations under Art. 32–36 GDPR through appropriate technical and organizational measures, where possible.
(2) The Provider assists the Client in responding to requests from data subjects (access, rectification, erasure, data portability, objection).
(3) For assistance beyond the contractually agreed scope, the Provider may charge reasonable compensation.
(1) The Provider reports personal data breaches to the Client without undue delay, at most within 24 hours of becoming aware.
(2) The notification contains at minimum: the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and remedial measures taken.
(3) Notification is made to the Client's designated contact by email.
(1) After termination of the main contract, the Provider deletes all personal data of the Client. Deletion includes: PostgreSQL database, MinIO bucket, OpenSearch index, and backups after expiry of the 90-day retention period.
(2) The Provider confirms deletion in writing within 30 days of contract termination, on request.
(1) The Provider makes all information necessary to demonstrate compliance with Art. 28 GDPR obligations available to the Client.
(2) The Provider allows audits with at least 14 days' notice. Audits must not disproportionately impair ongoing operations and are limited to data protection-relevant aspects.
(3) The Provider may present equivalent evidence (e.g. ISO 27001 or SOC 2 certifications) in lieu of an on-site audit.
Liability between the parties is governed by the provisions of the main contract (ToS) and the statutory provisions of the GDPR, in particular Art. 82 GDPR.
(1) This DPA is part of the main contract and follows its fate. In case of conflict between DPA and ToS, the DPA takes precedence.
(2) Amendments require text form. German law applies. Place of jurisdiction is, to the extent permitted by law, the Provider's registered office.
Entropy Software & Consulting · Bastian Entrup · Mühlenstieg 19 · 37181 Hardegsen
Email: info@entropy-zero.de
As of: May 2026