Data Processing Agreement (DPA / AVV)

This Data Processing Agreement (DPA) specifies the parties' data-protection obligations under Art. 28 GDPR. It becomes part of the contract between the customer (controller) and Good Point GmbH (processor) as soon as the customer uses the HancVoice platform or API to process personal data of third parties. Processing of the customer's own account data is governed by the Privacy Policy.

1. Parties & subject

The processor processes personal data solely on behalf of and on the documented instructions of the controller. Use of the platform in accordance with the contract and documentation constitutes an instruction.

2. Subject, duration, nature and purpose of processing

• Subject: provision of text-to-speech, voice creation, voice conversion, transcription, project storage and REST API at hancvoice.com.
• Duration: for the term of the main contract; ends upon its termination plus the statutory or contractually agreed retention and deletion periods.
• Nature: collection, recording, storage, alteration, retrieval, transmission, erasure — by automated means.
• Purpose: solely the contractual provision of the services named; no own purposes of the processor.

3. Categories of personal data & data subjects

• Data categories: texts, audio recordings (voice samples) provided by the customer and audio generated from them; names, voice and speech characteristics contained in content; technical metadata (timestamps, job IDs).
• Special categories (Art. 9): only insofar as the controller introduces such data into the content; the controller is responsible for the legal basis.
• Data subjects: end users, customers, employees or other third parties of the controller whose data it processes via the platform.

4. Obligations of the processor (Art. 28(3) GDPR)

The processor undertakes in particular to:

• process data only on documented instructions, including for transfers to third countries, unless legally required otherwise;
• ensure that persons authorised to process the data are committed to confidentiality (Art. 28(3)(b), Art. 29, 32(4));
• implement appropriate technical and organisational measures under Art. 32 (see section 5);
• engage sub-processors only under the conditions of section 6;
• assist the controller with data-subject rights (Chapter III) and obligations (Art. 32–36);
• at the controller's choice, delete or return all data after the end of processing (section 9);
• make available all information needed to demonstrate compliance and allow audits (section 10);
• inform the controller immediately if, in its opinion, an instruction infringes data-protection law.

5. Technical & organisational measures (Art. 32 GDPR)

• Encryption: TLS for all transport; credentials stored as scrypt hashes, no plaintext passwords.
• Access control: role-based permissions, admin area additionally PIN-protected, rate limiting and login throttling, webhook signature verification.
• Tenant separation: data is segregated per account; users see only their own projects and voices.
• Logging: event and admin-action logs for accountability.
• Availability & resilience: hosting in the EU (Hetzner, Nuremberg/DE), backups, firewall (ufw).
• Data minimisation & deletion: retention by purpose; self-export (Art. 20) and account deletion (Art. 17) are available.

6. Sub-processors (Art. 28(2) & (4))

The controller grants a general authorisation to engage sub-processors. The processor informs the controller of intended changes and grants a right to object. Currently engaged, in particular:

The current, complete list of sub-processors including their location is provided on request via legal@hancvoice.com. Contracts with equivalent data-protection obligations under Art. 28(4) are in place with every sub-processor.

7. Assistance with data-subject rights

The processor assists the controller by appropriate technical and organisational measures in fulfilling requests for access, rectification, erasure, restriction, portability and objection (Art. 15–22). If a data subject contacts the processor directly, the processor forwards the request to the controller without undue delay.

8. Notification of personal-data breaches (Art. 33, 34)

The processor notifies the controller of any personal-data breach without undue delay after becoming aware of it and assists the controller with its notification obligations towards the supervisory authority and data subjects.

9. Deletion & return after end of contract

After the end of processing, the processor, at the controller's choice, deletes or returns all personal data and destroys existing copies, unless a statutory retention obligation applies.

10. Audit rights & evidence

The processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 and allows for and contributes to audits — including inspections — conducted by the controller or an auditor mandated by it, to a reasonable extent and with reasonable prior notice.

11. Third-country transfers (Art. 44 et seq.)

Processing outside the EU/EEA takes place only if the requirements of Art. 44 et seq. GDPR are met — in particular an adequacy decision or standard contractual clauses (SCC) together with any necessary supplementary measures.

12. Liability & applicable law

Art. 82 GDPR applies. Otherwise this DPA is governed by Austrian law, excluding its conflict-of-law rules; mandatory consumer-protection provisions remain unaffected. In case of conflict between this DPA and the main contract, the data-protection provisions of this DPA prevail.