Note: This is an English translation of the original German page. The German version is legally binding.

This page explains how we handle our clients' personal data when a consulting engagement brings us into contact with it. It is not a contract. How to obtain the contract is set out below.

Data processing on this website is governed solely by our Privacy Policy. The two topics have nothing to do with each other.

1. When We Act as a Processor

Haven AI Solutions UG (haftungsbeschränkt) provides consulting and implementation services in the field of AI and data. In some projects this gives us access to client systems or datasets that contain personal data — for example when we analyse a dataset or develop a solution against a production system.

In so far as we process such data solely on the client's instructions, we act as a processor within the meaning of Art. 28 GDPR. The client remains the controller in those cases.

In such cases we conclude a data processing agreement before any processing begins.

2. What We Do Not Do

So that it is clear from the outset what is not being discussed here:

We operate no platform, no software service and no customer portal.
We do not host client data on our own infrastructure and do not store it permanently in our systems.
We issue no access credentials, no user accounts and no API keys to clients.
We do not use client data to train AI models, and not for our own purposes.
There are no service packages, no tenant separation and no tiered isolation levels — there is no product in which such things could exist.

All processing takes place within a specific, time-limited engagement.

3. The Contract Is Concluded per Engagement

We deliberately do not publish a template contract here. A data processing agreement has to describe the specific engagement: which types of data are involved, which categories of data subjects, for what purpose, for how long, and under which technical and organisational measures. These details differ from project to project. A pre-published, unfilled form could not reflect them and would be accurate for no engagement at all.

Each contract contains the provisions required by Art. 28(3) GDPR, in particular on subject matter and duration, nature and purpose, types of data and categories of data subjects, the obligation to act only on instructions, confidentiality, technical and organisational measures under Art. 32 GDPR, the engagement of further processors, assistance with data subject rights and notification duties, deletion or return of data at the end of the engagement, and the controller's rights to information and inspection.

It is concluded in writing or in an electronic format, in accordance with Art. 28(9) GDPR.

How to obtain it: Request the draft tailored to your engagement at privacy@haven-ai.eu. We are equally happy to review and sign your own DPA if your organisation uses a standard form — in practice that is the more common route.

4. Notification of Personal Data Breaches

If we become aware of a personal data breach affecting a client's data, we notify the client without undue delay, so that the client can meet its own deadline under Art. 33 GDPR. We do not commit to a fixed number of hours on this page; if your organisation requires a specific deadline, we agree it in the relevant contract.

5. Further Processors

Where we engage further service providers to deliver an engagement, and those providers thereby receive access to the client's personal data, they are sub-processors within the meaning of Art. 28(4) GDPR. In that case we name them individually in the relevant contract, obtain the authorisation required under Art. 28(2) GDPR before processing begins, and contractually bind them to the same data protection obligations that apply to us.

Which providers those are in a given case — and whether any are engaged at all — depends on the specific engagement. You will see them in the draft contract before you sign it.

The hosting provider for our own website is not a sub-processor for client projects; it processes only the website data described in our Privacy Policy.

6. Contact

Questions about data processing, requests for a draft contract, or review of your own template: privacy@haven-ai.eu

Status: August 2026