This English version is a convenience translation. In the event of any discrepancy, the German version at filehub.one/de/auftragsverarbeitung shall prevail.
Preamble and Scope
This Agreement governs the processing of personal data on behalf of the Customer pursuant to Art. 28 GDPR. It forms part of every contract for the services described in Annex 1 (Main Contract) and is agreed upon conclusion of the Main Contract without the need for a separate signature.
Parties
The controller is the company, based in, represented by an authorized signatory (hereinafter referred to as the “Customer”).
The processor is filehub GmbH, UdS Campus Starterzentrum, Geb. A1 2, 66123 Saarbrücken, Germany (Local Court of Saarbrücken, HRB 111041) (“Contractor”).
If the Customer obtains services from both filehub GmbH and workcentrix GmbH, the Customer usually concludes a separate Main Contract with each company. Each company is then an independent processor for its own services; the services of workcentrix GmbH are governed by its own data processing agreement. Where workcentrix GmbH provides services under a Main Contract with filehub GmbH without having its own contract with the Customer, it acts as a sub-processor of the Contractor (Annex 3).
In the event of any conflict, this Agreement takes precedence over the Main Contract in all matters of data protection. Terms such as “personal data”, “processing” or “personal data breach” have the meaning given to them in Art. 4 GDPR.
Section 1 Subject Matter, Duration, Nature and Purpose
The subject matter of the processing is the services under the Main Contract. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
The Contractor processes the data solely to provide these services. No processing for the Contractor’s own purposes takes place, except for the use of anonymised features governed by Section 7.
The term of this Agreement corresponds to the term of the Main Contract. It does not end as long as the Contractor still processes personal data of the Customer (e.g. during the export period under Section 8).
The right to terminate for good cause remains unaffected. Good cause exists in particular if the Contractor seriously breaches this Agreement or the GDPR or fails to carry out an instruction of the Customer.
Section 2 Instructions
The Contractor processes personal data only on documented instructions from the Customer. The instructions are defined by the Main Contract, this Agreement and the Customer’s configuration of the services (e.g. recipients, interfaces, rules and confidence thresholds).
The Customer issues individual instructions in text form (email is sufficient) to support@filehub.one or to the address stated in the Main Contract. The Customer confirms verbal instructions in text form without delay. The Contractor documents all individual instructions.
If the Contractor is required by law to carry out other processing (Art. 28(3)(a) GDPR), it informs the Customer beforehand, unless the law prohibits such information.
If the Contractor considers that an instruction infringes data protection law, it informs the Customer without delay. It may suspend execution until the Customer confirms or amends the instruction.
Instructions going beyond the agreed scope of services are treated as change requests and may be charged on a time and material basis.
Section 3 Obligations of the Contractor
Confidentiality. The Contractor only deploys persons who have committed in writing to confidentiality and have been familiarised with data protection law. This obligation continues after their engagement ends.
Security of processing. The Contractor implements the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 2 (TOMs, published at filehub.one/tom). It may adapt them to the state of the art provided the level of protection is not reduced. It documents material changes and publishes the current version of the TOMs.
Assistance. The Contractor assists the Customer in complying with the obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations, to the extent the necessary information is available to it.
Data protection contact. There is no obligation to appoint a data protection officer. The data protection contact is the management, reachable at datenschutz@filehub.one. If a data protection officer is appointed, the Contractor will provide their contact details.
Records of processing. The Contractor maintains a record of processing activities carried out on behalf of controllers pursuant to Art. 30(2) GDPR.
Measures by authorities. The Contractor informs the Customer without delay of inspections and measures by the supervisory authority insofar as they relate to this processing.
Section 4 Sub-processors
The Customer grants general authorisation for the engagement of further processors (Art. 28(2) GDPR). The sub-processors engaged at the time the contract is concluded are listed in Annex 3 and are deemed approved.
The Contractor informs the Customer in text form at least 30 days in advance of any intended addition or replacement of a sub-processor.
The Customer may object to the change in text form within 14 days of receipt on important data protection grounds. If the parties cannot find a solution, the Customer may terminate the affected service with effect from the date the change takes effect. If no objection is raised in time, the change is deemed approved.
The Contractor selects sub-processors carefully, taking their technical and organisational measures into account, and contractually binds them to the same data protection obligations as set out in this Agreement (Art. 28(4) GDPR).
The Contractor is liable to the Customer for its sub-processors’ compliance with their obligations.
Ancillary services without access to the Customer’s personal data, such as telecommunications, postal and transport services or hardware maintenance without data access, do not constitute sub-processing within the meaning of this provision.
Section 5 Data Subject Rights and Personal Data Breaches
The Contractor assists the Customer with appropriate measures in responding to requests from data subjects under Art. 12 to 22 GDPR. Where the Customer can carry out access, rectification, export or erasure itself via the services, this takes precedence.
If a data subject contacts the Contractor directly, the Contractor forwards the request to the Customer without delay and does not respond to it itself.
The Contractor notifies the Customer of personal data breaches without undue delay and no later than 48 hours after becoming aware of them. The notification contains, as far as known, the information required by Art. 33(3) GDPR; missing information is provided as soon as it becomes available.
The Contractor takes measures without delay to contain the breach and mitigate possible adverse effects, and assists the Customer with notifications to the supervisory authority and communications to data subjects (Art. 33, 34 GDPR).
Assistance under this Section that is not caused by a breach on the part of the Contractor and exceeds a minor effort may be charged at the hourly rates of the Main Contract.
Section 6 Evidence and Audits
Upon request, the Contractor provides the Customer with all information necessary to demonstrate compliance with this Agreement (Art. 28(3)(h) GDPR).
Evidence is primarily provided by the TOMs (Annex 2), certificates and audit reports of the hosting partners, penetration test reports and – once available – an ISO/IEC 27001 certification.
If this evidence is insufficient in an individual case, the Customer may carry out an on-site audit itself or have it carried out by an auditor bound to confidentiality. Audits must be announced at least 14 days in advance, take place during business hours and must not disproportionately disrupt operations. The Contractor may reject auditors who are its competitors.
On-site audits take place no more than once per calendar year unless there is a specific reason (e.g. a personal data breach). The data centres of the hosting partners are excluded from on-site audits; their certificates and audit reports apply instead.
The Contractor may charge reasonable compensation for the effort of audits without specific cause.
Further audit and access rights arising for the Customer from regulatory requirements (e.g. Art. 30 DORA) are agreed separately in the Main Contract.
Section 7 AI Processing and Anonymised Features
Classification and extraction in filehub and filehubIDP are controlled on the Contractor’s systems in Germany. The provider named in Annex 3 is used as the language and OCR model. Only the document data required for the respective task is transmitted to the model.
Neither the Contractor nor its sub-processors use the Customer’s personal data to train general models. Customer-specific learning data (e.g. vectors) serves exclusively the respective Customer and is deleted together with the Customer’s tenant.
The Customer instructs the Contractor to derive features without personal reference from the processed documents (e.g. layout features of supplier documents) and to use them across tenants to improve recognition quality. Derivation follows a documented anonymisation procedure that excludes re-identification of data subjects by means reasonably likely to be used. The derived features are not personal data and are not subject to this Agreement.
Use under paragraph 3 is enabled by default. The Customer may disable it at any time in the filehub settings or object in text form; from that point on, no further features are derived from its documents. Anonymised features already derived remain unaffected.
AI results are suggestions. Automated further processing only takes place according to the rules and confidence thresholds configured by the Customer. The Contractor does not make automated decisions within the meaning of Art. 22 GDPR.
Section 8 Deletion and Return
After termination of the Main Contract, the Customer may export its data within 60 days using the export functions of filehub or request its return in a common format.
After this period, the Contractor deletes all personal data of the Customer, including copies, access credentials and learning data. Backup copies expire within the rolling retention period, so that all data is completely deleted no later than 90 days after the end of the contract.
On the Customer’s instruction, the Contractor also deletes data before the end of the contract or before the export period expires.
Further storage only takes place insofar as the Contractor is obliged to do so under Union or German law. In this case, processing is restricted to the statutory purpose.
Deletion is logged and confirmed to the Customer in text form upon request.
The Contractor may retain documentation serving as evidence of proper processing (e.g. logs) beyond the end of the contract in accordance with the periods set out in Annex 2.
Section 9 Location of Processing
Processing takes place exclusively in member states of the EU or the EEA. The services are hosted in Germany.
A transfer to a third country or an international organisation only takes place on documented instructions from the Customer or if the requirements of Art. 44 et seq. GDPR are met, for example through an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.
Where sub-processors with a registered office or group affiliation outside the EU are engaged, the respective safeguards are stated in Annex 3.
Section 10 Liability and Final Provisions
Liability is governed by Art. 82 GDPR. As between the parties, the liability provisions of the Main Contract apply, unless Art. 82 GDPR mandatorily provides otherwise.
If the Customer’s data held by the Contractor is endangered by seizure, confiscation, insolvency or settlement proceedings or other measures by third parties, the Contractor informs the Customer without delay and notifies the third parties that control over the data lies with the Customer.
Any right of retention in respect of the Customer’s data is excluded.
The Contractor may amend this Agreement to adapt it to changes in legal requirements, regulatory guidance or the services, provided that the level of protection for the Customer is not reduced. It informs the Customer of changes in text form at least 30 days before they take effect. Changes to sub-processors are governed by Section 4.
Should any provision of this Agreement be invalid, the validity of the remaining provisions remains unaffected. German law applies. Place of jurisdiction is Saarbrücken, Germany, to the extent permitted by law.
As of: 1 July 2026
Attachment 1: Description of the Processing
The services applicable in each case are determined by the Main Contract.
Service | Provided by | Nature and purpose of processing |
|---|---|---|
filehub (SaaS platform) | filehub GmbH | Receipt, storage, classification and forwarding of documents; connection to the Customer’s portals and target systems |
filehubIDP | filehub GmbH | AI-based classification and extraction of document data |
Integrations, support, remote maintenance – only without the Customer’s own contract with workcentrix GmbH | workcentrix GmbH as sub-processor | Connection to the Customer’s DMS, ERP and accounting systems; set-up, troubleshooting and maintenance, including access to the Customer’s systems |
Types of personal data
Contact and master data of business partners (name, address, email, phone, contact persons)
Contents of documents and receipts (invoices, credit notes, delivery notes, correspondence)
Accounting and payment data (amounts, bank details, tax IDs)
User data of the Customer’s employees (name, email, roles, log data)
Access credentials to the Customer’s third-party systems
Data visible on the Customer’s systems during support and remote maintenance
Special categories of personal data under Art. 9 GDPR are not the subject of the processing. The Customer ensures that such data is only included in exceptional cases (e.g. as content of individual documents) and informs the Contractor if this regularly occurs.
Categories of data subjects
Employees and users of the Customer
Suppliers, customers and other business partners of the Customer and their contact persons
Other persons whose data is contained in the Customer’s documents