Data Processing Agreement

between

the customer who concludes this agreement with us in text form (the “Controller”, controller within the meaning of Art. 4(7) GDPR)

and

via now UG (haftungsbeschränkt), Tegernseer Landstraße 36, 81541 Munich, Germany, Munich Local Court (Amtsgericht München) HRB 314380, represented by the managing director (the “Processor”, processor within the meaning of Art. 4(8) GDPR).

§ 1 Subject matter and term

(1) The Processor operates the dictation app SpeechDone for iPhone and iPad, including the keyboard, server and website (the “Service”). Where the Controller, or persons designated by the Controller, use the Service for the Controller’s professional activity, the Processor processes personal data on behalf of the Controller in doing so.

(2) The agreement applies for as long as the Controller or persons designated by the Controller use the Service. It ends without notice upon deletion of the last account that the Controller has assigned to the agreement, and either party may terminate it in text form with one month’s notice. The right to terminate for good cause remains unaffected.

(3) The Service is based on the Terms of Use (speechdone.com/en/terms/) and the Privacy Policy (speechdone.com/en/privacy/). In the event of conflict, this agreement prevails with regard to data protection.

§ 2 Nature, purpose and scope of processing

(1) Purpose: Converting spoken language into text, cleaning up, rewriting, translating and answering dictated texts, synchronizing the dictionary and text snippets between the devices of an account, delivering notes to the user’s own devices (Inbox), account administration, error analysis.

(2) Nature of processing: Collection (recording in the app), transmission to the Processor’s server and to the subprocessors listed in Annex 2, processing in working memory, temporary storage under paragraph 4, deletion.

(3) Types of data:

Voice recordings and the texts recognized from them, which may contain information about patients, clients or third parties, including special categories of data under Art. 9 GDPR (for example health data),
dictionary entries and text snippets,
notes in the Inbox,
users’ account data (email address, name where applicable, Apple identifier, settings, plan),
device data (random device identifier, device name, platform, app version, push token),
technical logs without dictation content.

(4) Retention on the Processor’s server:

Voice recordings: not stored. They are processed in working memory only during recognition and discarded afterwards.
Result texts: at most 24 hours in a cache, to prevent duplicate processing when a connection is interrupted.
Style profile (only if a user turns it on): the last 100 revised texts, each for at most 30 days.
Inbox: until picked up by the devices, at most 7 days.
Dictionary, text snippets, account and device data: until deletion by the user or of the account.
App error logs: 30 days; flow events without content: 90 days.
The dictation history is stored in the user’s iCloud with Apple, not with the Processor.

(5) Data subjects: Users of the Service at the Controller, and persons who are spoken about in dictations (patients, clients, business partners, third parties).

§ 3 Instructions

(1) The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information (Art. 28(3)(a) GDPR).

(2) The instructions result from this agreement and from the settings that the Controller or its users choose in the app (for example recognition on the device, style profile, history). The Controller gives further instructions in text form to [email protected].

(3) If the Processor considers an instruction to be unlawful, it informs the Controller without undue delay and may suspend execution until the instruction is confirmed (Art. 28(3), third subparagraph GDPR).

§ 4 Confidentiality

(1) The Processor engages only persons who are bound by confidentiality or are subject to an appropriate statutory duty of confidentiality (Art. 28(3)(b) GDPR). Access to the server and database is limited to persons who need it for operation and troubleshooting.

(2) For Controllers who are subject to a professional duty of secrecy (in particular physicians, lawyers, tax advisers), the confidentiality undertaking in Part 4 of this document applies in addition.

§ 5 Security of processing

The Processor implements the technical and organizational measures under Art. 32 GDPR that are described in Annex 1. It may further develop them as long as the level of protection does not decrease; it documents material changes and communicates them on request.

§ 6 Subprocessors

(1) The Controller gives general authorization for the engagement of further processors (Art. 28(2) GDPR). At the time of conclusion of the agreement, the subprocessors listed in Annex 2 are engaged; they are deemed authorized.

(2) The Processor informs the Controller in text form at least 30 days in advance of any intended addition or replacement. Within that period, the Controller may object for an important data protection reason. If no agreement is reached, the Controller may terminate the agreement without notice. The current list is available at speechdone.com/en/subprocessors/.

(3) The Processor imposes on each subprocessor by contract the same data protection obligations that this agreement imposes on it, in particular sufficient guarantees for appropriate technical and organizational measures (Art. 28(4) GDPR). It remains liable to the Controller for the subprocessor’s compliance.

(4) Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision (for example the EU-U.S. Data Privacy Framework for certified recipients) or Standard Contractual Clauses.

§ 7 Rights of data subjects

(1) The Processor assists the Controller by appropriate technical and organizational measures in responding to requests from data subjects under Chapter III GDPR (Art. 28(3)(e) GDPR).

(2) Users can export their data themselves (app, Account, data export) and can themselves delete their account together with all data on the server. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay, insofar as it can identify the Controller.

§ 8 Assistance, notification of breaches

(1) The Processor assists the Controller in complying with its obligations under Art. 32 to 36 GDPR (security, notification, communication, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to the Processor.

(2) If the Processor becomes aware of a personal data breach affecting the Controller’s data, it notifies the Controller without undue delay, if possible within 24 hours, in text form at the most recently provided address. The notification contains, as far as known, the information under Art. 33(3) GDPR; missing information is supplied afterwards.

§ 9 Deletion and return

(1) After the end of the agreement, the Processor deletes all data processed on behalf of the Controller, unless there is a statutory obligation to retain it (Art. 28(3)(g) GDPR). Before that, the Controller can retrieve the data through the data export of the app.

(2) Backups are not cleaned individually. They expire on a rolling basis and are overwritten no later than four months after deletion. Until then they are protected against access and are not used for other purposes.

(3) On request, the Processor confirms the deletion in text form.

§ 10 Evidence and audits

(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it who is bound to confidentiality (Art. 28(3)(h) GDPR).

(2) On-site inspections are announced with reasonable notice, as a rule 14 days, take place during business hours and must not disproportionately disrupt operations. The server is located in a data center of Hetzner Online GmbH; access there is governed by Hetzner’s rules, and the Processor provides Hetzner’s evidence instead.

§ 11 Place of processing

(1) The Processor’s server is located in a data center of Hetzner Online GmbH in Germany. Speech recognition and text processing run exclusively on servers in the European Union (Annex 2).

(2) Speech recognition and text processing do not take place outside the European Union, not even as a fallback in case of a disruption. If a provider fails, the step fails or returns the unprocessed text; the app retries recognition later. If a user selects “On this device” in the app, speech recognition takes place on the device.

(3) Network and protection services (Cloudflare) and email delivery (Resend) are provided by providers based in the USA; the basis for the transfer is stated in Annex 2.

§ 12 Liability, final provisions

(1) Art. 82 GDPR governs liability. In all other respects, the liability rules of the Terms of Use apply.

(2) Amendments and additions to this agreement require text form. This also applies to any waiver of this form requirement.

(3) Should any provision be invalid, the remainder of the agreement remains valid. German law applies.

(4) The agreement is concluded when the Controller requests it by email at [email protected] and the Processor returns it countersigned in text form.

2. Annex 1: Technical and organizational measures (Art. 32 GDPR)

As of October 2026. Each measure is evidenced in operation (configuration, code or test).

Confidentiality

Physical access: The server is located in a data center of Hetzner Online GmbH in Germany. Physical access control is provided by Hetzner (certified under ISO/IEC 27001).
System access: Sign-in to the server only with an SSH key; password sign-in and root sign-in are disabled. Administration interfaces are reachable only through a private network (Tailscale), not from the internet.
Data access: The database and cache have no publicly reachable ports; only the application container reaches them, in a separate network. The application container runs without root privileges, with a read-only file system and without additional kernel capabilities. Keys and credentials are kept in a file readable only by the operating user, not in the source code.
Separation: SpeechDone runs in its own containers with its own database, separate from other applications on the same server.
Data minimization: Voice recordings are not stored on the server and are processed only in working memory; an automated test enforces this. Error logs and flow events contain no dictation content and are not assigned to an account. Crash reports (Sentry) are stripped of name, email and IP address before sending.

Integrity

Transmission: Connections between the app and the server and between the server and subprocessors are encrypted with TLS. The upstream network service (Cloudflare) also connects to the server over TLS with a verified certificate. HSTS on speechdone.com.
Outgoing emails: Content and recipient are stored encrypted in the database until sending (Fernet); afterwards only a log without content and without recipient remains.
Input control: Changes to code and configuration go through version control with review steps before release.

Availability and resilience

Backups: daily database backup with an automated restore test, kept locally for 14 days; in addition a daily, client-side encrypted off-site backup (Hetzner Storage Box) with 7 daily, 4 weekly and 3 monthly generations.
Failure protection: mirrored disks (RAID 1). Release of new versions without interruption (blue-green with health check), automatic restart, regular health checks.
Protection against attacks: upstream network and protection service (Cloudflare), rate limiting per IP address and account.

Procedures for regular review

Security review of changes to sign-in, data and notifications by a second, independent review process before release.
Automated tests for retention periods, data export, account deletion and “no audio on the server” as part of the pre-release check chain; after every release, an automated check of the running service.
Review of this annex at least annually and upon material changes.

Limits (for transparency)

The server’s disks and the local database backups are not additionally encrypted; protection is provided by access and permission controls. The off-site backup is encrypted.
History and recordings on the device are with the user (device, iCloud) and are subject to the user’s protective measures and those of Apple.

4. Confidentiality undertaking for holders of professional secrets

Undertaking of via now UG (haftungsbeschränkt) as a person cooperating in the professional’s work under Section 203(3) and (4) German Criminal Code (StGB), Section 43e Federal Lawyers’ Act (BRAO), Section 62a Tax Advisers Act (StBerG)

(1) Scope. This undertaking applies to Controllers who are subject to a professional duty of secrecy under Section 203(1) StGB, in particular physicians and other healthcare professionals, lawyers and tax advisers, and is part of the DPA.

(2) Confidentiality. via now UG (haftungsbeschränkt) undertakes to maintain confidentiality about all third-party secrets that become known to it in providing the Service, in particular the content of dictations about patients and clients. This obligation continues after the end of the agreement.

(3) Instruction. via now UG (haftungsbeschränkt) is aware that persons cooperating in the professional’s work are liable to prosecution under Section 203(4), first sentence StGB if they disclose a third-party secret without authorization that became known to them in the course of, or on the occasion of, their activity. The penalty is imprisonment of up to one year or a fine, and up to two years where the act is committed for remuneration or with the intent to enrich oneself or another or to harm another (Section 203(6) StGB).

(4) Necessity. via now UG (haftungsbeschränkt) obtains knowledge of third-party secrets only to the extent necessary to provide the Service. Dictation content is processed technically, not read; it views the content only if the Controller or a user expressly asks it to for troubleshooting, and only to the extent necessary.

(5) Employees. Persons who work for via now UG (haftungsbeschränkt) and may have access to Controllers’ data are bound to confidentiality in text form before they start work and are instructed on the criminal consequences under Section 203(4) StGB.

(6) Further persons. via now UG (haftungsbeschränkt) is entitled to engage the subprocessors listed in Annex 2. It binds each subprocessor that may gain knowledge of third-party secrets to confidentiality in text form, with reference to the criminal consequences (letter under Part 5 of the German document), and keeps the undertakings available as evidence.

(7) Foreign countries. via now UG (haftungsbeschränkt) uses services abroad for these Controllers only insofar as the protection of the secrets there is comparable to the protection in Germany (Section 43e(4) BRAO, Section 62a(4) StBerG). Speech recognition and text processing take place exclusively in Member States of the European Union (§ 11 DPA).

(8) Notification. via now UG (haftungsbeschränkt) informs the Controller without undue delay if it learns of a breach of this undertaking or if an authority demands the disclosure of the Controller’s data, unless the law prohibits this.