Data processing agreement (draft)

Draft

This page is a draft and has not been legally reviewed. It describes what the final data processing agreement will cover. The reviewed version replaces it before regular operation starts. The binding version will be the German one.

Version: 2026-10-22-draft

When you create a workspace, you accept this version together with the terms and conditions. Acriva records which version you accepted and when.

What the agreement will cover

Your company is the controller; Acriva processes personal data on your behalf (Art. 28 GDPR). The agreement will set out:

1. Subject and duration: the processing for the term of the contract.
2. Nature and purpose: storing, recognizing, searching, approving and archiving documents revision-safe.
3. Types of data and data subjects: the data in your documents and your members’ accounts.
4. Instructions: Acriva processes the data only on your instructions.
5. Technical and organizational measures: for example separate workspaces, access rights and an audit log.
6. Sub-processors: the list of service providers Acriva uses, and how you are told about changes.
7. Assistance: with requests from data subjects, data breaches and data protection impact assessments.
8. Deletion and return: at the end of the contract, subject to the statutory retention periods.
9. Audits: your rights to check compliance with the agreement.
10. Shared ratings of AI answers: a member who shares a rating with Acriva gives the instruction to read it as long as it is shared; Acriva copies nothing of it (see the privacy notice).

The legal notice says who provides Acriva. The privacy notice says what we process as the controller.