Data Processing Agreement

MyClawn Emails · Art. 28 GDPR · Last updated: November 9, 2026

This agreement is part of the Terms of Service between you as a business customer ("controller") and 20Vision GmbH ("processor") and applies whenever your files contain personal data. It applies to the extent the GDPR (or a comparable law such as the UK GDPR) applies to your processing. A signed copy is available on request at [email protected].

1. Subject, duration, nature and purpose

Subject: delivering the MyClawn Emails service ordered by you. Nature: storage, automated AI analysis and transformation, and return of results. Purpose: only to produce your job and the included changes. Duration: as long as we hold your files, at most 30 days after each job was created.

2. Data and people concerned

Categories of data subjects: people named on your website (for example owners, staff or reviewers). Types of data: names, photos and reviews published on your website; we do not receive your subscriber lists. Special categories of data are not intended; if your files contain them, you are responsible for having a legal basis.

3. Our duties as processor

We process the data only on your documented instructions, which are your order and the request you type; we tell you if we think an instruction breaks the law.
Everyone with access is bound to confidentiality.
We take the security measures in section 6.
We help you answer data subject requests and with security, breach notification, impact assessments and consultations (Art. 32-36 GDPR), as far as we can given the nature of the processing.
We notify you without undue delay after becoming aware of a personal data breach affecting your data.
At the end of processing we delete the data (automatically after 30 days, earlier on request), unless law requires us to keep it.
We make available the information needed to show compliance and allow audits, normally by written answers and documents; on-site audits with reasonable notice and at your cost.

4. Sub-processors

Hetzner Online GmbH, Germany: hosting (Falkenstein, Germany; entry server in Ashburn, USA).
Anthropic PBC, USA: AI model that reads the file content; no training on the data.
Cloudflare, Inc., USA: network proxy in front of the website (data in transit).

You give general authorisation to these and future sub-processors. We announce changes on this page at least 14 days in advance; you may object for good reason and, if we cannot meet the objection, cancel your plan. We bind every sub-processor to equivalent data protection duties.

5. Transfers outside the EU/EEA

Transfers to the USA rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (module 3, processor to processor).

6. Technical and organisational measures

TLS for all connections; an encrypted WireGuard tunnel between our entry server and the processing server.
Each job runs in an isolated workspace as a separate system user without direct internet access; the AI key is not exposed to the job.
Server access is limited to the operator and uses SSH keys.
Files are reachable only with a per-job secret link or your signed-in account.
Automatic deletion after 30 days; unpaid drafts after 24 hours.
Processing servers in Germany.

7. Liability and law

Liability follows Art. 82 GDPR and the limits in the Terms of Service as far as the law allows. Austrian law applies; place of jurisdiction is Vienna.