Data processing agreement

This is a translation. The German version is binding.

Parties

Customer: a business within the meaning of section 14 BGB (German Civil Code), on any plan.

Processor: Stenowise, Inhaber Sören Kann (owner: Sören Kann), Heidkoppel 20B, 21379 Scharnebeck, Germany. Data protection contact: datenschutz@stenowise.com.

§ 1 Subject matter and duration

Provision of the dictation software Stenowise (Windows; macOS and Linux will follow) with speech recognition, text refinement, command mode, dictionary (optionally device sync and shared dictionary), history on the device and account management.

Duration: from creation of the account until deletion of the account and expiry of the deletion periods.

§ 2 Location

Processing in the EU/EEA, exceptions at sub-processors in Annex 2. The Processor's server is in Germany. Speech recognition and text refinement at sub-processors in the EU, locations in Annex 2. Optionally recognition on the Customer's device; the recording then does not leave the device.

§ 3 Nature and purpose

• Recognition (the recording is passed on, not stored by the Processor, periods at the sub-processor in Annex 4)
• Text refinement and command mode (the text is passed on, not stored by the Processor)
• Allowance (word count per dictation and day)
• Account
• Dictionary sync only with the switch turned on, encrypted
• Shared dictionaries with the email addresses of those invited
• Support requests and crash reports only on the user's action
• Usage figures only with the switch turned on, without content
• Billing

§ 4 Types of data

• Voice recordings (transient)
• Recognised and refined text (transient)
• Application name
• Dictionary entries
• Account (email, password as hash, for sign-in with Google its identifier)
• Session token as hash
• Word counts
• Billing address and payments
• IP address in the access log

Clarification: dictations may contain special categories of data under Art. 9 GDPR. The Processor treats all content accordingly.

§ 5 Data subjects

• The Customer's users
• Persons about whom dictation takes place (clients, patients, customers, employees, third parties)
• Persons invited by users to shared dictionaries

§ 6 Instructions

Instructions are given in text form; an email is sufficient. Settings in the app count as documented instructions:

• Recognition on the device
• Text refinement off
• Keep recordings (off by default, 7, 14 or 30 days on the device)
• Device sync of the dictionary (off by default)
• Usage figures (off by default)
• Crash reports (ask, always, never)

§ 7 Confidentiality

Only the owner has access. Commitment to confidentiality including section 203 StGB (German Criminal Code), so that professionals bound by secrecy can engage the Processor as a contributing person under section 203(3) and (4) StGB. If employees join, the commitment applies before they start work.

§ 8 Sub-processors

General authorisation. The Processor announces new sub-processors by email with a 30-day right to object. In the event of a justified objection, there is a right of extraordinary termination. List in Annex 2.

§ 9 Third countries

The Processor does not transfer any data to a third country. Sub-processors may transfer individual data to third countries for security services and group companies, only with safeguards under Art. 44 et seq. GDPR (Annex 2). Any change beyond this requires prior consent in text form.

§ 10 TOMs

The technical and organisational measures are described in Annex 3. They are reviewed annually.

§ 11 Assistance

The Processor assists the Customer with the obligations under Art. 32 to 36 GDPR and with requests from data subjects. Time limit for assistance with requests: 72 hours.

§ 12 Notification of breaches

The Processor notifies a personal data breach without undue delay, at the latest 24 hours after becoming aware of it, with the minimum information under Art. 33(3) GDPR.

§ 13 Deletion

Deleting the account in the app or through the admin deletes the account and, through the foreign keys, all dependent data: sign-in identities, tokens, word counts per week and day, dictation identifiers, billing data, free trial month, email records, dictionary sync, own shared dictionaries, invitations, reports, usage figures.

Entries the account has written to other users' shared dictionaries pass to their owners and remain. Invoices remain in the accounts for 8 years. Confirmation is given in text form on request. Backup copies: see Annex 4. After deletion, a check value of the email address (HMAC with a key of the Processor) remains without reference to the account, so that the same address does not receive a second free trial month.

§ 14 Audit rights

Evidence through documents (this agreement, record of processing activities, contracts with the sub-processors, their certificates), questionnaires and, on request, a remote audit with 14 days' notice. An on-site audit does not apply, as the Processor does not operate its own data centre; Hetzner provides evidence for the data centre.

§ 15 Liability, final provisions

Liability under Art. 82 GDPR. In data protection matters, this agreement takes precedence over the main contract. German law applies. The place of jurisdiction is Lüneburg, Germany, to the extent that the law permits such an agreement.

Annex 1: Description of the processing

• Subject matter: provision of the dictation software Stenowise with speech recognition, text refinement, command mode, dictionary, history on the device and account management.
• Duration: from creation of the account until deletion of the account and expiry of the deletion periods.
• Nature and purpose: recognition, text refinement and command mode, allowance, account, dictionary sync, shared dictionaries, support and crash reports, usage figures, billing.
• Data: voice recordings, recognised and refined text, application name, dictionary entries, account data, session tokens, word counts, billing address and payments, IP address in the access log.
• Data subjects: the Customer's users, persons about whom dictation takes place, persons invited to shared dictionaries.
• Location: EU/EEA. Server in Germany, recognition and text refinement at sub-processors in the EU (Annex 2), optionally on the Customer's device.

Annex 2: Sub-processors

Not on the list, with their own justification: Mollie (independent controller for payment), Google (only for sign-in with Google, independent controller).

Annex 3: Technical and organisational measures

• Physical access: Hetzner data centre Nuremberg, ISO 27001.
• System access: passwords only as argon2id hash, session and refresh tokens only as SHA-256, refresh tokens 90 days, server access only by SSH key.
• Data access: only the owner; admin area with separate sign-in.
• Transmission: TLS for all connections, dictionary sync stored encrypted.
• Separation: data per account.
• Data minimisation: recording and text are not stored by the Processor, logs without content, access log limited in size (5 files of 20 MiB each).
• Availability: daily database backup on the server (7 days rolling) and daily backup of the whole server by Hetzner. Hetzner keeps seven backups per server; each new one deletes the oldest. Off-site backup is planned, not yet set up.
• Review: annually.

Annex 4: Retention periods per data category

• Recording: 0 days at the Processor. At the sub-processor for speech recognition: for recognition after the end of the recording no storage (zero data retention, since 23.09.2026); for recognition during the recording up to 30 days for abuse monitoring, as long as zero data retention has not been granted for this route. For recognition if the first fails: no storage under the sub-processor's zero data retention principle, diagnostic data on errors up to 14 days.
• Text: 0 days.
• Word counts: until deletion of the account.
• Account: until deletion of the account.
• Refresh tokens: 90 days.
• Dictionary sync: until deletion by the user or deletion of the account.
• Support requests, feedback and crash reports: 90 days after reply or resolution, including attachments.
• Access log: limited in size, five files of 20 MiB each, the oldest is deleted.
• Service log (without content): 30 days.
• Invoices: 8 years.
• Backup copies: 7 days rolling on the server; seven daily backups of the server at Hetzner, each new one deletes the oldest.

Deleted accounts therefore disappear from the backups no later than 7 days after deletion.

Annex 5: Persons authorised to give instructions

On the Processor's side: the owner, Sören Kann. The Customer names the persons authorised to give instructions on its side in text form when concluding the agreement. It notifies changes in text form.