Data Processing Agreement

Data Processing Agreement (DPA)

The Customer acts as the data controller within the meaning of Article 4(7) of the GDPR.
coding-agent.de acts as the data processor (Processor) within the meaning of Article 4(8) of the GDPR.

The Processor processes personal data solely on behalf of and according to the documented instructions of the Customer for the purpose of providing the AI-assisted data labeling service available through the platform.

The categories of data subjects and personal data processed depend on the datasets uploaded by the Customer. The Processor does not determine the content of the datasets submitted by the Customer.

Sub-processor disclosure

The Customer authorizes the Processor to engage sub-processors for the provision of the Service.

The Processor shall ensure that any sub-processor is contractually bound by data protection obligations equivalent to those set forth in this Agreement.

A current list of sub-processors is available at coding-agent.de/sub-processors.

The Processor shall inform the Customer of any intended changes concerning the addition or replacement of sub-processors and provide the Customer with the opportunity to object on reasonable data protection grounds.

Security measures

The Processor implements appropriate technical and organizational measures (TOMs) to protect personal data, including access controls, encrypted transport, authenticated user access, and hosting within the European Union (Hetzner, Germany). A summary is available on request at info@sonja-berger.org. Sub-processors are listed at coding-agent.de/sub-processors.

Personal data breaches

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data processed under this Agreement, and shall provide reasonable information to enable the Customer to meet its obligations under Articles 33 and 34 GDPR.

Assistance with data protection impact assessments

Upon reasonable request, the Processor shall provide information necessary for the Customer to carry out data protection impact assessments or prior consultations with supervisory authorities relating to the Customer's use of the Service.

Dataset ownership and training rights

The Customer retains all rights, title, and interest in and to any datasets uploaded to the Service, including any annotations or labels generated through the use of the Service.

The Processor does not claim ownership of Customer Data.

The Processor shall not use Customer Data for the purpose of training or improving machine learning models unless explicitly agreed to by the Customer.

The Processor may use anonymized and aggregated data derived from Customer Data for the purpose of improving the Service, provided such data cannot reasonably be used to identify the Customer or any individual.

Liability for incorrect labels

The Service may generate automated labeling suggestions using artificial intelligence. Such suggestions are provided for assistance purposes only.

The Customer is solely responsible for reviewing and validating any labels or annotations generated by the Service before using them in downstream applications.

The Processor does not guarantee the accuracy, completeness, or suitability of AI-generated outputs for any specific purpose.

To the extent permitted by law, the Processor shall not be liable for damages resulting from incorrect or incomplete labels generated by the Service.

AI transparency

The Service uses artificial intelligence systems to assist with the generation of data annotations and labels.

The Customer acknowledges that AI-generated outputs may contain errors and should be verified prior to use in critical or production environments.