Publisher-approved document version

Data processing – AIVANA Team

Document version 0.16.1 · 2026-10-17.

Contract annex 0.16.1. This is not an already signed agreement. Parties, contract reference, contacts and effective date are specified in the offer accepted by both parties. This annex must be effectively incorporated before real customer use.

Subject matter, duration and instructions

The customer is controller and Aivana GmbH is processor. The subject matter is storage, return and checking of decision history and Azure project sources in activated projects during the main contract and agreed return period. Processing takes place exclusively on documented instructions, including transfers. Aivana points out instructions it considers unlawful; statutory processing obligations are communicated to the customer where permitted.

Data and data subjects

User IDs, display names, role assignments, decision authors, rationale, timestamps, project/work-item IDs, descriptions, assignments, acceptance criteria and test evidence. Data subjects include in particular the customer's employees and project participants, and people named in work items. Special categories of data are not intended for this service and may only be transferred under a separate agreement.

Confidentiality and technical measures

People authorised to access data are bound to confidentiality. Measures: TLS, existing Azure authentication, identity and project checks per request, explicit tenant/project bindings, AIVANA roles, atomic write checks, bounded snapshots, hash chaining, no token persistence, no work-item text in application logs, access-restricted operator accounts and backups. Infrastructure administrators are privileged. MFA and recovery procedures for operator accounts must be evidenced before commercial use; code review does not replace this operational evidence.

Subprocessors and third-country involvement

Cloudflare is envisaged for Workers/D1. The customer provides Microsoft Azure DevOps; Aivana uses the read requests permitted there. No additional processors are used without information and the agreed authorisation. Aivana imposes corresponding obligations on subprocessors and remains responsible to the customer. The Cloudflare DPA, current subprocessors and relevant transfer safeguards must be identified in the customer offer. New subprocessors are announced at least 30 days in advance; justified objections are resolved before use. AI providers are not part of this plan.

Assistance, incidents and oversight

Aivana provides reasonable assistance with data subject rights, data security, data protection impact assessments and authority enquiries. Personal data breaches are reported to the customer without undue delay with the available information; missing information follows later. Evidence and reasonable reviews of agreed measures are enabled while protecting other customers and system security.

Return, rectification and deletion

During use, the customer can export the JSON history including sources. At contract end there is a 30-day return window with existing roles and no new writes, unless security or legal restrictions prevent this. Project sources are then deleted on confirmed instructions; the operator records the instruction, project scope, time and result without the deleted text. This is a controlled operator process, not unattended automatic deletion. Statutory retention obligations are explained separately.

Application append-only rules do not exclude expressly instructed deletion under data protection law. Backups are excluded from regular restoration or removed within the agreed cycle, at the latest 30 days after confirmed deletion. On restoration, deletion instructions documented since the backup are reapplied before access is restored. Rectification for data subjects takes place through supplementary correction documentation or, where required, controlled deletion of affected sources; there is no claim that history may never be deleted.