Last updated: 29 May 2026

Data Processing Agreement

This English version is provided for convenience. If legal interpretation differs, the German version applies unless mandatory law provides otherwise.

Agreement on processing personal data pursuant to Art. 28 GDPR between the customer as controller and Proximo Systems Dreessen & Haensch GbR, Bauernholztal 33, 21149 Hamburg, Germany, as processor.

1. Subject matter and duration

The subject matter of this agreement is the processing of personal data in connection with the use of clutr. clutr enables upload, storage, OCR, AI-supported classification, search, export, API upload, email import, workspaces and optional external storage integrations. The duration follows the underlying service agreement.

2. Nature and purpose of processing

Processing is carried out to provide document filing, technical security, encryption, recovery, classification, metadata extraction, searchability, export, user management, billing and error analysis.

3. Categories of personal data

Account data, contact and communication data, authentication data, role and permission data, billing data, technical log data and all personal data contained in uploaded documents, OCR text, metadata, emails, attachments or search queries may be processed.

4. Categories of data subjects

Data subjects may include users of the customer, employees, customers, suppliers, contractual partners, authority contacts, applicants, family members, insured persons, patients and other persons whose data is contained in the customer's documents or emails.

5. Customer instructions

The processor processes personal data only on documented instructions of the customer unless a legal obligation requires otherwise. Instructions initially arise from the service agreement, settings in clutr and this agreement. Individual instructions may be issued in text form.

6. Processor obligations

The processor undertakes to treat personal data confidentially, grant access only to authorized persons, implement suitable technical and organizational measures, use subprocessors only in accordance with this agreement and reasonably support the customer with data subject rights, deletion, data portability, data protection impact assessments and notifications of personal data breaches.

7. Confidentiality

Persons with access to personal data at the processor are bound to confidentiality or are subject to an appropriate statutory duty of confidentiality.

8. Technical and organizational measures

The technical and organizational measures are described in the separate TOM documentation. The processor may further develop measures provided that the level of protection is not materially reduced.

9. Subprocessors

The customer grants general authorization to use the subprocessors listed in the subprocessor list. Changes are communicated appropriately. The customer may object for important data protection reasons.

10. Third-country transfers

Where subprocessors process data outside the EU or EEA, the processor ensures appropriate safeguards, such as adequacy decisions, standard contractual clauses or supplementary protective measures.

11. Support obligations

The processor supports the customer to a reasonable extent with access, rectification, deletion, restriction, data portability, objection, data protection impact assessments and consultation of supervisory authorities.

12. Personal data breach notification

The processor informs the customer without undue delay if it becomes aware of a personal data breach. The information includes, where available, nature of the incident, affected data, affected systems, likely consequences and measures taken or proposed.

13. Evidence and audits

The processor provides the customer with suitable information to demonstrate compliance with this agreement. Audits take place after reasonable prior notice, during usual business hours and while preserving security and confidentiality interests of other customers.

14. Deletion and return

After the end of service provision, the processor deletes or returns personal data at the customer's choice unless statutory retention obligations or legitimate evidence obligations prevent this. Details follow from the deletion concept.

15. Order of precedence

In case of contradictions, this agreement and its annexes take precedence over the general terms to the extent processing of personal data on behalf of the customer is concerned.