Data Processing Agreement (DPA) for the fairyfly cloud service

Last updated: 13 November 2026 · Version 1.0

Agreement on the processing of personal data on behalf of a controller under Art. 28 of the General Data Protection Regulation (GDPR). This text is a translation. Only the German version ("Auftragsverarbeitungsvertrag", AVV, at https://fairyfly.io/avv) is legally binding.

between the Customer as defined in the Terms of Service for the fairyfly cloud service (https://fairyfly.io/terms) – the "Controller" –

and

DataZoo GmbH, Quellenstraße 7, 70376 Stuttgart, Germany, represented by the managing directors Dr. Simon Müller and Joachim Rosskopf, Amtsgericht Stuttgart, HRB 769481 – the "Processor" or "DataZoo" –

§ 1 Subject matter, duration, nature and purpose of the processing

1. This agreement covers the processing of personal data by DataZoo on behalf of the Controller when DataZoo provides the fairyfly cloud service at fairyfly.io (the "Service") under the Terms of Service for the fairyfly cloud service (the "Terms").

2. Annex 1 describes the nature and purpose of the processing, the types of personal data, the categories of data subjects and the retention periods.

3. This agreement has the same term as the contract under the Terms. The obligations of this agreement continue for as long as DataZoo processes personal data of the Controller (§ 11).

§ 2 Scope, responsibility

1. The Controller is responsible for the lawfulness of the processing and for the rights of the data subjects. In particular, the Controller decides which people it invites, which desktops it pairs, which AI assistants it connects, which data these AI assistants get from SAP, if changes in SAP are allowed, and if the audit trail with screenshots is switched on.

2. This agreement applies to all processing in Annex 1. If this agreement and the Terms do not agree, this agreement has priority for the processing on behalf of the Controller.

3. This agreement does not apply to processing for which DataZoo itself is the controller. This includes the website fairyfly.io, the registration, contract handling and billing with the Controller, communication with DataZoo, legal retention obligations, and the security and abuse prevention of the Service, including the locked audit log (400 days) and the technical operational logs (30 days). The privacy policy at https://fairyfly.io/privacy gives the details.

4. The providers of the AI assistants that the Controller connects to the Service are not sub-processors of DataZoo. The Controller uses them under its own contracts (§ 7 of the Terms).

§ 3 Instructions

1. DataZoo processes the personal data only on documented instructions from the Controller, also for transfers to a third country, unless Union or Member State law requires DataZoo to process the data. In that case, DataZoo tells the Controller about this legal requirement before the processing, unless that law prohibits this on important grounds of public interest.

2. The instructions are fully documented in:

   • this agreement and the Terms,
   • the settings and actions that owners and administrators of the Controller make in the web app (for example: invite or remove users, pair or block desktops, allow changes in SAP, set the audit trail and its retention period, connect a SIEM, restrict sign-in, close the organisation), and
   • the calls of the AI assistants that the Controller connects and that its users start, within these settings.

3. Owners or administrators of the Controller give individual instructions in text form to cloud@fairyfly.io. If an instruction is outside the agreed scope of the Service, the parties treat it as a request for a change of the Service. If DataZoo cannot do such an instruction, DataZoo tells the Controller.

4. DataZoo tells the Controller immediately if, in DataZoo's opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. DataZoo can stop the execution of the instruction until the Controller confirms or changes it.

§ 4 Obligations of the Processor

1. DataZoo processes the personal data only under this agreement and the instructions of the Controller, and not for its own purposes. § 2(3) is not affected.

2. The data is stored in data centres in the European Union (Annex 3). Exceptions: the load balancer and Google Cloud Armor operate at Google's global network edge, so the TLS connection can also end outside the EU. Google Workspace processes e-mails according to its terms. For transfers to a third country, § 9 applies.

3. DataZoo keeps a record of processing activities under Art. 30(2) GDPR.

4. DataZoo has not appointed a data protection officer. The data protection contact at DataZoo is cloud@fairyfly.io. On request, the Controller gives DataZoo a contact person. If there is doubt, the owners of the organisation are the contact persons.

5. DataZoo tells the Controller without delay about inspections and measures of a supervisory authority, if they concern this agreement, and about requests of authorities for data of the Controller, if the law permits this.

§ 5 Confidentiality

1. DataZoo makes sure that the persons who are authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2. At DataZoo, only the persons who need access for the operation and support of the Service get access to personal data of the Controller, and only as far as necessary. The confidentiality obligation continues after the end of their work.

§ 6 Technical and organisational measures

1. DataZoo takes the technical and organisational measures under Art. 32 GDPR that Annex 2 describes. Annex 2 is part of this agreement.

2. The measures follow technical progress. DataZoo can replace them with equivalent or better measures. The level of protection must not decrease. DataZoo documents significant changes and updates Annex 2.

3. The Controller is responsible for the security of the areas that it operates itself (in particular PCs with the desktop app, SAP systems, sign-in accounts of the users, its SIEM and the connected AI assistants), see §§ 4 and 5 of the Terms.

§ 7 Assistance to the Controller

1. Rights of data subjects. DataZoo helps the Controller with appropriate technical and organisational measures to respond to requests of data subjects under Chapter III GDPR. The Controller can do many of these tasks itself in the web app (for example: remove users, export audit data as CSV/JSON and audit trail sessions as ZIP). If a data subject contacts DataZoo directly, DataZoo sends the request to the Controller without delay. DataZoo does not answer the request itself, unless the Controller instructs it to.

2. Other obligations. DataZoo helps the Controller to comply with Art. 32 to 36 GDPR (security, notification of breaches, communication to data subjects, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to DataZoo. DataZoo does this in particular with the information in this agreement, in Annex 2 and in the privacy policy.

3. For assistance that goes beyond the functions of the Service and the information in paragraph 2, DataZoo can ask for a reasonable fee if DataZoo announces it before in text form. This does not apply if the assistance is necessary because DataZoo breached this agreement or the GDPR.

§ 8 Sub-processors

1. The Controller gives DataZoo a general authorisation to engage sub-processors. Annex 3 lists the sub-processors at the time the contract is made; they are authorised.

2. DataZoo informs the owners of the organisation in text form (e-mail) at least four weeks before it adds or replaces a sub-processor, and updates Annex 3 on fairyfly.io. The notice gives the sub-processor, its service, the place of processing and the basis of a possible transfer to a third country.

3. The Controller can object to the change within this period on reasonable data protection grounds, in text form to cloud@fairyfly.io. The parties then try to find a solution together. If they find no solution, the Controller can end the contract at any time under § 14(2) of the Terms. DataZoo can terminate the contract with effect from the date on which the new sub-processor starts, if DataZoo cannot provide the Service without it.

4. DataZoo gives each sub-processor, by contract, the same data protection obligations as this agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR (Art. 28(4) GDPR). If a sub-processor does not fulfil its data protection obligations, DataZoo stays liable to the Controller for the performance of that sub-processor's obligations.

5. The following are not sub-processing under this section: ancillary services of third parties for which DataZoo does not have personal data of the Controller processed on its behalf, and services that the Controller selects itself or uses under its own contract (Annex 3, part B).

§ 9 Transfers to third countries

1. DataZoo or its sub-processors process data outside the European Union or the European Economic Area only if the conditions of Art. 44 to 49 GDPR are met.

2. The sub-processors belong to a group with its seat in the USA. For possible transfers to the USA, the EU standard contractual clauses (Art. 46(2)(c) GDPR) apply. They are part of the data processing terms of Google Cloud and Google Workspace. Where the recipient is certified under the EU-US Data Privacy Framework, the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR) also applies. Annex 3 gives the details for each sub-processor.

§ 10 Notification of personal data breaches

1. DataZoo notifies the Controller of a personal data breach that concerns data of the Controller without undue delay, at the latest within 48 hours after DataZoo becomes aware of it, also if not all information is available yet. DataZoo sends the notification by e-mail from cloud@fairyfly.io to the owners of the organisation. The contact at DataZoo for the incident is cloud@fairyfly.io. If sending by e-mail is not possible, DataZoo puts a notice on https://fairyfly.io (without personal data and without names of customers) that asks the owners to contact cloud@fairyfly.io.

2. As far as DataZoo knows them, the notification contains the information in Art. 33(3) GDPR: the nature of the breach, where possible with the categories and approximate number of data subjects and records concerned, a contact person, the likely consequences, and the measures taken or proposed. DataZoo sends information that is not available yet in phases.

3. DataZoo takes the necessary measures without delay to secure the data and to reduce possible adverse effects for the data subjects, and agrees these measures with the Controller. The Controller makes the notifications to the supervisory authority and the communications to the data subjects (Art. 33, 34 GDPR). DataZoo helps the Controller (§ 7(2)).

§ 11 Deletion and return at the end of the contract

1. During the term of the contract, DataZoo deletes personal data according to the retention periods in Annex 1 and on instruction of the Controller, for example when an administrator removes a user or a desktop.

2. Return. The Controller can export its audit data itself until the end of the contract (CSV/JSON; audit trail sessions as ZIP). If DataZoo terminates, the Controller can export until the termination takes effect. When the Controller closes the organisation itself, the Controller selects the deletion of the other data under paragraph 3.

3. Deletion. Deletion starts only at the end of the contract: when the Controller closes the organisation (§ 14(2) of the Terms) or when another termination takes effect; DataZoo then closes the organisation. From that time,

   • DataZoo immediately deletes the e-mail addresses, names and provider IDs of all users, blocks the desktops and deletes their computer names,
   • DataZoo deletes the screenshots and field changes of the audit trail without delay,
   • DataZoo automatically and permanently deletes the other records of the organisation (in particular the organisation with its name and domain, users, desktops, invitations) 90 days after closing,
   • DataZoo deletes data for which Annex 1 gives its own period (in particular audit trail step records and usage counters: 400 days; copies of sent e-mails: at most 12 months) at the latest when that period ends.

   Copies of deleted data in the database backups and in the point-in-time recovery are also removed at the latest 7 days after the deletion (Annex 2 section 4).

4. Exceptions are data that DataZoo must keep under Union or Member State law, and data that DataZoo processes as a controller (§ 2(3)). After the final deletion, only the ID, the dates (creation, closing, deletion) and the Paddle customer and subscription IDs (link to the billing records) remain of the organisation record itself.

5. On request in text form, DataZoo confirms the deletion to the Controller.

§ 12 Information and audits

1. DataZoo gives the Controller all information that is necessary to show compliance with Art. 28 GDPR and this agreement, in particular this agreement with its annexes, information in text form and, if available, evidence of the sub-processors (for example certificates and audit reports).

2. DataZoo allows and contributes to audits, including inspections, by the Controller or by an auditor that the Controller engages. The auditor must not be a competitor of DataZoo and must be bound to confidentiality. The Controller announces inspections in text form with reasonable notice, normally at least 14 days before. Inspections occur during normal business hours and must not disturb operations more than necessary. Without a specific reason (for example a breach under § 10), inspections occur not more than once per calendar year.

3. The sub-processor Google Cloud operates the data centres (Annex 3). Audits there are done with the evidence in paragraph 1, unless the sub-processor permits an on-site inspection.

4. Each party pays its own costs of an audit. § 7(3) applies correspondingly to work that goes beyond paragraph 1.

§ 13 Liability

Art. 82 GDPR applies to liability to data subjects. Between the parties, § 13 of the Terms applies.

§ 14 Term, changes, final provisions

1. This agreement starts together with the contract under the Terms (§ 2 of the Terms). It is made in electronic form (Art. 28(9) GDPR). It ends with that contract. § 1(3) and § 11 are not affected.

2. Changes to this agreement follow § 15 of the Terms. For sub-processors, § 8 applies.

3. If a provision of this agreement is or becomes invalid, the other provisions stay valid. The statutory rules replace the invalid provision.

4. In all other respects, the Terms apply, in particular § 16 (applicable law, place of jurisdiction).

Annex 1 – Subject matter, types of data, data subjects

1. Nature and purpose of the processing

DataZoo operates the fairyfly Service for the Controller: a cloud gateway that connects AI assistants of the Controller through the Model Context Protocol (MCP) to the fairyfly desktop app on Windows PCs of the Controller, and a web app for management. The processing includes:

• sign-in of users; management of the organisation, users, invitations, desktops and AI connections,
• relay of the calls of the AI assistants to the desktop and of the results back; SAP contents are in memory only for the duration of one call, and the gateway does not store or log them,
• display, export and, if set up, forwarding of the organisation's audit entries to its SIEM,
• storage and display of the audit trail with screenshots, if the Controller switches it on,
• counting of usage (operations) for the free allowance, billing and its display in the web app,
• sending e-mails to users (invitations, budget notices, a daily usage summary without data about individual users),
• deletion according to the periods below and § 11.

The purpose is to provide the Service under the Terms.

2. Categories of data subjects

• users of the Controller (owners, administrators, members), normally employees or persons that the Controller engages,
• invited persons,
• persons whose data SAP shows and the Service relays or the audit trail records (for example employees, customers, suppliers, business partners and contact persons of the Controller).

3. Types of personal data and retention periods

All deletions and periods in this table concern the active data. Copies in the database backups and in the point-in-time recovery (Annex 2 section 4) are also removed at the latest 7 days after the deletion; this also applies to data that is deleted "immediately". Screenshots of the audit trail are not backed up.

4. Special categories of personal data

The Service is not intended for the processing of special categories of personal data (Art. 9 GDPR). But they can be concerned, depending on the SAP contents that the Controller gets through the Service or records in the audit trail (for example from HR applications). The Controller decides about this and checks if it is permitted.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

1. Encryption and pseudonymisation

• Encryption of all connections with TLS 1.2 or higher; encrypted connection between the gateway and the desktop (WebSocket over TLS); encrypted connection between the gateway instances.
• Encryption of stored data.
• Screenshots of the audit trail in private storage, encrypted with a dedicated key in Cloud KMS (HSM) that is rotated every 90 days.
• Signed calls with HSM-protected keys for each organisation (Cloud KMS).
• For AI connections, the Service stores only hashes of the refresh tokens; invitation codes only as hashes.
• At pairing, the IP address is truncated to the first three blocks and kept for 5 minutes only.
• Accounts are identified by the issuer and account ID of the sign-in provider.
• The private key of the desktop does not leave the PC. On Windows, DPAPI protects it.

2. Confidentiality

Physical access control. DataZoo does not operate its own data centres. The Service runs on Google Cloud (Annex 3). The physical security of the data centres follows the data processing terms of Google Cloud.

System access control.

• Users sign in only through OpenID Connect with Google or Microsoft Entra ID. DataZoo does not receive or store passwords. Personal Microsoft accounts are refused.
• The Controller can restrict sign-in to its Google Workspace domain or its Entra tenant.
• Session cookie with the attributes HttpOnly, Secure and SameSite=Lax; session duration 8 hours; the sign-in flow is protected by a state value that is valid for 10 minutes.
• Access tokens of AI connections are valid for 10 minutes, refresh tokens for 30 days (rolling).
• Desktops are paired only after the signed-in user confirms in the browser. The confirmation page shows the truncated IP address and the approximate location of the request. A pairing offer is valid for 5 minutes.
• When a user is removed, the user's access ends immediately and the user's desktops are blocked.
• Web application firewall (Google Cloud Armor) with a limit of requests per IP address.

Data access control.

• Roles owner, administrator and member with different rights.
• By default, actions that change data in SAP are blocked ("read only"). Changes need the permission of the organisation and a confirmation by the person at the PC.
• Only owners and administrators of the organisation, and the person at the PC for their own sessions, can see the screenshots of the audit trail. Each access is logged.
• At DataZoo, only the persons who need access for operation and support get access. Actions of operators of the Service are logged in the audit log with their e-mail address.
• Access to stored data from outside the Service is logged.
• Credentials and keys of the Service are kept in Google Secret Manager or Cloud KMS.

Separation control. Separation of the organisations in all data paths; a dedicated signing key for each organisation.

Data minimisation.

• The gateway does not store or log SAP contents (screen contents, field values, arguments, results).
• The audit trail with screenshots is off by default. Password fields are always made unreadable on the PC, bank fields by default. A PC that cannot make them unreadable does not send screenshots. While the audit trail runs, the person at the PC sees a notice.
• The daily usage summary contains only totals of the organisation.
• The web app uses no analytics or tracking tools and loads no external fonts. The desktop app sends no telemetry.

3. Integrity

Transfer control. Encrypted transmission (section 1). Audit entries go to a SIEM only if the Controller sets it up.

Input control. For each call of an AI assistant and each administrative action, the Service writes an audit entry (time, user, AI client, function, decision, confirmation at the desktop, result, desktop, request ID; no SAP contents). The audit log is kept for 400 days in locked storage that technically prevents an early change or deletion. The Controller can see the entries of its organisation, export them and forward them to its SIEM.

4. Availability and resilience

• Operation on Google Cloud in the regions in Annex 3; database (Firestore) as a multi-region database in the EU (eur3: Belgium and Netherlands).
• Protection against overload with a limit of requests per IP address (Google Cloud Armor).
• The database is backed up daily. In addition, recovery to any point in time of the last 7 days is possible. Backups are kept in the EU (eur3) and are deleted after 7 days. Deleted data is removed from all backups at the latest 7 days after its deletion. Screenshots of the audit trail are not backed up. Recovery from backup is tested and recorded every month.

5. Deletion

• Daily automatic deletion run: removed users, desktops, invitations and closed organisations are permanently deleted 90 days after the event.
• Screenshots of the audit trail are deleted automatically after the selected period (lifecycle rules, without delayed recovery); operational and server logs after 30 days.
• Copies in the database backups are removed at the latest 7 days after the deletion (section 4).

6. Security incidents

• DataZoo has a documented procedure for handling security incidents and documents each personal data breach.

Annex 3 – Sub-processors

A. Authorised sub-processors

B. Not sub-processors of DataZoo

The following parties get data under their own responsibility or under the Controller's own contracts. They are not sub-processors of DataZoo:

• the providers of the AI assistants that the Controller connects (for example Anthropic, OpenAI, Microsoft, Google),
• the Controller's SIEM,
• Google and Microsoft as sign-in providers (sign-in through OpenID Connect; check of Google access tokens for Gemini Enterprise),
• Google Public DNS (query of the domain name only, for domain verification),
• GitHub, Inc. (download and update check of the desktop app; public GitHub issues for support, § 8(4) of the Terms),
• Microsoft (Microsoft Store) for the Store version of the desktop app,
• Paddle.com Market Ltd. (London, United Kingdom) as merchant of record for payment, invoices and VAT (§ 9 of the Terms); Paddle is an independent controller for the payment data.