Data Processing Agreement
Version 1.0 · Last updated 13 September 2026 · Canonical URL: https://airhive.ai/legal/dpa
1. Parties, conclusion and incorporation
This Data Processing Agreement ("DPA") is entered into between the Customer identified in the applicable Account, order form or Terms of Service ("Customer") and Airhive GmbH, Eckernwoort 16, 22607 Hamburg, Germany, registered with the commercial register of the Local Court (Amtsgericht) of Hamburg under HRB 199886 ("Airhive"). It forms part of the agreement governing the Service ("Agreement").
This DPA is concluded by the Customer's acceptance of the Terms of Service or by use of the Service. No separate signature is required. On request, Airhive will provide a countersigned copy of this DPA for the Customer's records.
This DPA applies where Airhive processes Personal Data contained in Customer Content on behalf of the Customer. It is intended to satisfy Article 28 GDPR and equivalent processor-contract requirements under applicable EU or Member State law.
On data-protection matters this DPA prevails over every other part of the Agreement, including an order form, unless the order form expressly refers to the provision of this DPA that it replaces and provides at least equivalent protection for Data Subjects.
Airhive's contact for all matters under this DPA is privacy@airhive.ai (postal address: Airhive GmbH, Data protection, Eckernwoort 16, 22607 Hamburg, Germany).
2. Definitions
- Applicable Data Protection Law: the GDPR and any national laws supplementing or implementing it that apply to the Processing, including the German Federal Data Protection Act (BDSG).
- Controller: has the meaning given in Article 4 GDPR.
- Customer Personal Data: Personal Data contained in Customer Content that Airhive Processes on behalf of the Customer.
- Data Subject: has the meaning given in Article 4 GDPR.
- GDPR: Regulation (EU) 2016/679.
- Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- Process / Processing: has the meaning given in Article 4 GDPR.
- Processor: has the meaning given in Article 4 GDPR.
- Subprocessor: a processor engaged by Airhive to Process Customer Personal Data.
Other capitalised terms have the meaning given in the Terms of Service.
3. Roles and Customer authority
The Customer is the Controller and Airhive is the Processor for Customer Personal Data. If the Customer Processes Personal Data on behalf of another Controller, the Customer acts as Processor and Airhive acts as Subprocessor; the Customer confirms that it has authority to appoint Airhive and give the instructions set out in the Agreement and this DPA.
Airhive acts as independent Controller for Account, billing, support, security and other data processed for Airhive's own purposes, as described in the Privacy Policy. This DPA does not apply to that independent Controller processing.
4. Processing details and duration
The subject matter, nature, purpose, duration, categories of Data Subjects and types of Personal Data are described in Annex 1. Processing continues for the term of the Agreement and any deletion, backup, transition or legally required retention period.
5. Documented instructions
Airhive will Process Customer Personal Data only on documented instructions from the Customer, including instructions concerning international transfers, unless EU or Member State law requires otherwise. Where legally permitted, Airhive will inform the Customer before Processing required by law.
Documented instructions include the Agreement, this DPA, Account and Workspace settings, permissions, uploads, sharing, exports, deletions, AI Feature settings, connector settings, instructions submitted through the Service, and written instructions accepted by Airhive.
Airhive will promptly inform the Customer if, in Airhive's opinion, an instruction infringes Applicable Data Protection Law. Airhive may suspend the affected Processing until the parties agree a lawful instruction. Airhive is not required to provide legal advice to the Customer.
Instructions outside the ordinary Service functionality may be subject to reasonable fees, feasibility assessment and additional terms.
6. Customer obligations
The Customer is responsible for:
- ensuring that its instructions and Processing comply with Applicable Data Protection Law;
- providing privacy notices and establishing a lawful basis for Customer Personal Data;
- determining whether consent, a data-protection impact assessment or prior consultation is required;
- configuring permissions, sharing, AI scope, connectors, retention and deletion appropriately;
- ensuring that Personal Data is accurate, relevant and limited to what is necessary;
- responding to Data Subject requests and regulatory enquiries as Controller;
- notifying Airhive of restrictions, objections or special handling requirements that Airhive has agreed to support.
Where the Customer uses the Service for special-category data, criminal-offence data, children's data, health records, employment data, government-classified information or other high-risk data, the Customer is responsible for assessing suitability and for implementing appropriate legal, contractual and technical safeguards, including the Workspace permissions and AI scope settings available in the Service.
7. Confidentiality and authorised personnel
Airhive will ensure that persons authorised to Process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty and receive access only where necessary for operation, support, security, maintenance, incident response, legal compliance or another authorised purpose.
Airhive maintains processes for granting, reviewing and revoking personnel access and applies least-privilege principles. Access to production systems containing Customer Personal Data is granted only to named personnel located in the EU/EEA, is logged, and is reviewed at least quarterly.
8. Security of Processing
Airhive will implement and maintain the technical and organisational measures set out in Annex 2, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs, nature, scope, context and purposes of Processing, and risks to individuals.
Airhive may update the measures to reflect technical progress and changing risks, provided the overall level of protection is not reduced. Airhive will inform Customers of material changes to Annex 2 through the Service or by email.
The Customer acknowledges that the Service is a shared-responsibility environment. Customer security obligations include credential protection, role configuration, offboarding, connector review, appropriate data selection and reporting suspected compromise.
9. AI Processing under the DPA
Where the Customer enables AI Features, Airhive Processes Customer Personal Data to provide OCR, classification, naming, metadata and entity extraction, semantic search, document chat, summaries, suggestions, lifecycle analysis and related functions.
An AI provider that Processes Customer Personal Data on Airhive's behalf is appointed as a Subprocessor, is listed in the Subprocessors list and is bound by obligations consistent with this DPA. All AI Processing takes place within the EU/EEA.
No training on Customer Content. Airhive does not use Customer Content to train, fine-tune, evaluate or otherwise improve any artificial-intelligence or machine-learning model, whether Airhive's own or a third party's, and contractually prohibits its subprocessors from doing so. The only exception is a separate, express, opt-in agreement by the Customer for a specifically described purpose, which the Customer may withdraw at any time with effect for the future.
Airhive applies minimisation, scoping and file-level access restrictions before AI Processing, and redaction or pseudonymisation where the feature supports it. The Customer acknowledges that such methods may not remove every identifier or inference from every file and do not replace the Customer's obligation to select appropriate data.
The Customer is responsible for human review and for determining whether its use triggers obligations relating to automated decision-making, high-risk AI, transparency, impact assessments or sector-specific regulation. Airhive's own obligations as provider of an AI system are described in Section 9 of the Terms of Service and the AI Transparency Notice.
10. Customer-directed external connectors
Where the Customer connects an external AI, storage or workflow provider under the Customer's own account and instructs Airhive to transmit selected Customer Personal Data, Airhive acts on the Customer's instruction for the transmission. The third party is not an Airhive Subprocessor unless Airhive has separately appointed it to provide part of the Service.
The Customer is responsible for assessing the third party's role, terms, lawful basis, security, international transfers, retention and model-training practices. Revocation through Airhive stops future transfers but does not control data already held by the third party.
11. Subprocessors
The Customer grants general written authorisation for Airhive to engage the Subprocessors identified in the current Subprocessors list at https://airhive.ai/legal/subprocessors (Annex 3). Airhive imposes data-protection obligations substantially equivalent to those in this DPA on each Subprocessor by written contract, including confidentiality, security, assistance, deletion, onward-processing and transfer obligations.
Airhive remains fully liable to the Customer for the performance of a Subprocessor's obligations in accordance with Article 28(4) GDPR.
Airhive will give at least 30 days' notice by email to the Account email address of the Customer's Administrators, and through the Service, before adding or replacing a Subprocessor that Processes Customer Personal Data, unless an urgent change is necessary to protect security or comply with law, in which case Airhive will notify the Customer as soon as possible. The Customer may object on reasonable data-protection grounds within the notice period.
The parties will seek a reasonable solution to an objection. If no solution or alternative is reasonably available within 30 days of the objection, the Customer may terminate the affected part of the Service with effect from the date on which the new Subprocessor is engaged and will receive a pro-rata refund of prepaid fees for the terminated part. An objection does not relieve the Customer of payment obligations for unaffected services.
12. Processing location and international transfers
Airhive hosts and Processes Customer Personal Data exclusively on servers located in the EU/EEA. As at the effective date of this DPA, every Subprocessor is established in the EU/EEA and Processes Customer Personal Data exclusively within the EU/EEA, and no personnel located outside the EU/EEA have access to Customer Personal Data. No transfer of Customer Personal Data to a third country within the meaning of Chapter V GDPR takes place.
If, in future, a transfer of Customer Personal Data to a third country becomes necessary, Airhive will (a) notify the Customer in accordance with Section 11, (b) ensure a lawful transfer mechanism — an adequacy decision or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) in the module applicable to the parties' roles, with Annexes I to III completed on the basis of Annexes 1 and 2 of this DPA and the Subprocessors list — together with a transfer impact assessment and supplementary measures where required, and (c) provide the completed clauses to the Customer on request. Where Standard Contractual Clauses apply, they prevail over this DPA for the transfer in question.
13. Data Subject requests
Taking into account the nature of Processing, Airhive will assist the Customer through appropriate technical and organisational measures, insofar as possible, with Data Subject requests for access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making.
The primary means of assistance are the Service's access, search, export, correction, permission, sharing and deletion functions. Additional manual assistance may be charged at reasonable rates where permitted and where it requires work outside standard functionality.
If Airhive receives a request relating to Customer Personal Data, Airhive will refer it to the Customer within five business days where the Customer is reasonably identifiable and will not respond on the merits unless instructed by the Customer or required by law.
14. Assistance with compliance
Taking into account the nature of Processing and information available, Airhive will provide reasonable assistance with Articles 32 to 36 GDPR, including security, Personal Data Breach obligations, data-protection impact assessments and prior consultation.
The Customer remains responsible for determining whether a DPIA or prior consultation is required for its use, especially for sensitive data, large-scale monitoring, consequential decisions, external AI connectors or regulated sectors.
15. Personal Data Breach notification
Airhive will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification is sent by email to the Account email address of the Customer's Administrators and, where a security contact has been designated in the Workspace settings, to that contact.
The notification will describe, to the extent the information is available at that time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point. Airhive will supplement the information in phases as the investigation progresses and will provide reasonable cooperation with the Customer's own notification obligations. The Customer is responsible for notifications to authorities and Data Subjects unless Airhive is independently required to notify.
Airhive's notification is not an admission of fault or liability.
16. Return, export and deletion
During the term, the Customer may retrieve or export Customer Personal Data using the export functions described in Section 17 of the Terms of Service. On termination, Airhive will delete or return Customer Personal Data according to the Customer's choice, unless law requires retention.
Following termination of the Agreement or deletion of the relevant Account or Workspace, Airhive will delete Customer Personal Data from active production systems within 30 days, unless the Customer exports or deletes the data earlier through the Service. Residual copies in encrypted backups are overwritten through Airhive's backup-rotation process within at most 35 days after production deletion. Airhive may retain limited data where required by law, necessary to establish, exercise or defend legal claims, or required for security and fraud-prevention records, provided that such data remains protected and is not used for any other purpose.
On request, Airhive will confirm deletion in writing. After deletion, Airhive may retain an irreversible record that deletion occurred and limited metadata needed to prevent fraud or comply with law.
17. Audit and information rights
Airhive will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR. This includes this DPA, Annex 2, security summaries, certifications and audit reports where available, penetration-test summaries, Subprocessor information and responses to reasonable security questionnaires, subject to confidentiality, privilege and security restrictions.
The Customer may request an audit no more than once in any twelve-month period, unless a material breach, regulator request or Personal Data Breach reasonably requires more frequent review. Airhive may satisfy the request through independent reports or documentation where appropriate.
On-site or custom audits require at least 30 days' advance notice, must occur during normal business hours, must not compromise other customers or systems, and may be subject to reasonable fees. The auditor must be independent, competent and bound by confidentiality.
18. Government and law-enforcement requests
If Airhive receives a binding request for Customer Personal Data, Airhive will review its validity, disclose only what is legally required and notify the Customer before disclosure where legally permitted. Airhive will challenge disproportionate or unlawful requests where reasonable and legally available.
19. Liability and termination
Liability arising under this DPA is subject to the liability provisions of the Agreement, including the separate cap for data-protection breaches in Section 24 of the Terms of Service, except where Applicable Data Protection Law requires otherwise. Nothing limits a Data Subject's rights or a supervisory authority's powers.
A material breach of this DPA that is not remedied within 30 days after notice permits the other party to terminate the affected Service, subject to mandatory law and the Agreement.
20. Annex 1 – Processing description
| Item | Description |
|---|---|
| Subject matter | Provision of Airhive as a document management and knowledge workspace, including capture, upload, storage, organisation, search, sharing, review, audit logging, AI-assisted processing, agent access and connectors. |
| Duration | The term of the Agreement plus deletion, backup, transition and legally required retention periods. |
| Nature and purpose | Collection by upload or source connection; hosting; encryption; indexing; OCR; extraction; classification; tagging; search; retrieval; sharing; AI processing; logging; export; support and deletion according to Customer instructions. |
| Types of Personal Data | Any Personal Data contained in Customer Content, potentially including contact, identification, correspondence, financial, employment, contractual, transaction, image, metadata and other records selected by the Customer. Special categories of Personal Data only where the Customer has assessed suitability under Section 6. |
| Categories of Data Subjects | Customer personnel, clients, prospects, suppliers, contractors, family members, counterparties, representatives and other persons whose data appears in Customer Content. |
| Frequency | Continuous or intermittent according to Customer use. |
| Processing location | EU/EEA (Germany; Luxembourg for backups). |
21. Annex 2 – Technical and organisational measures
| Control area | Measures |
|---|---|
| Governance and risk management | Documented security responsibilities; annual risk assessment; annual policy review; defined incident-management roles; supplier due diligence before engagement and annually thereafter. |
| Identity and access management | Unique accounts; role-based access (Owner, Administrator, Member, Guest); least privilege; privileged-access controls for Airhive personnel; multi-factor authentication (TOTP) available to every user on every Plan and enforceable by Administrators at Workspace level; mandatory MFA for Airhive personnel with production access; quarterly access review; revocation within one business day of offboarding. |
| Workspace and tenant separation | Logical separation of Workspaces and customer environments enforced at the application and database layer; permission enforcement on every request; scope controls for sharing, AI and connectors. |
| Encryption and key management | Encryption in transit using TLS 1.2 or higher for all connections; encryption at rest (AES-256) for file storage, databases and backups; keys managed in a dedicated key-management service with restricted access and rotation. |
| Logging and auditability | Authentication, administrative, sharing, connector, AI-access and review events are logged; logs are write-protected and access-restricted; time synchronisation; security logs retained for 90 days; Workspace audit logs retained per Plan configuration; monitoring for anomalous events. |
| Secure development | Change control; mandatory code review for production changes; dependency vulnerability scanning; secrets management (no secrets in source code); automated testing; separation of development, staging and production environments; critical vulnerabilities remediated within 7 days, high within 30 days. |
| Infrastructure security | Hardened configurations; network segmentation and firewalls; patching of operating systems and runtime within 30 days of release for security patches; monitoring; anti-abuse controls; malware scanning of uploaded files; DDoS protection at the network edge. |
| Availability and resilience | Daily encrypted backups to a geographically separate EU location; backup retention of 35 days; restoration testing at least twice per year; recovery time objective (RTO) of 24 hours and recovery point objective (RPO) of 24 hours; capacity monitoring; documented business-continuity and incident-response process. |
| Security testing | External penetration test at least once per year and after material architectural changes; findings tracked to remediation; summary available to Customers on request under Section 17. |
| AI safeguards | Feature scoping; file-level access; read-only modes where applicable; redaction or pseudonymisation where the feature supports it; logging of AI access; human-review flows; contractual prohibition of model training; provider assessment; EU-only AI Processing. |
| Personnel and confidentiality | Written confidentiality commitments for all personnel; security-awareness training at onboarding and annually; role-based training; access on a need-to-know basis; documented offboarding. |
| Subprocessor management | Due diligence; written data-processing terms; transfer safeguards; change management with 30 days' notice; annual review. |
| Deletion and disposal | Production deletion workflows (30 days); backup rotation (35 days); secure disposal of storage media by the hosting provider; revocation of access tokens and credentials. |
| Incident response | Detection, triage, containment, investigation, remediation, evidence preservation and notification procedures; Customer notification within 48 hours (Section 15); post-incident review. |
22. Annex 3 – Approved Subprocessors
The approved Subprocessors are listed in the Airhive Subprocessors document at https://airhive.ai/legal/subprocessors, which is incorporated into this DPA by reference. Changes to the list are governed by Section 11.
23. Contact
DPA and privacy enquiries: privacy@airhive.ai | Security incidents: security@airhive.ai