Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

Version: September 27, 2026

between

Data Controller („Customer") — the controller within the meaning of Art. 4(7) GDPR

and

Processor — Tobias Heer, Friedrichshafener Str. 5, 70329 Stuttgart, Germany (netloop.ai), E-Mail: legal@netloop.ai

1. Subject matter and duration

The subject matter is the processing of personal data by the Processor in the context of the netloop.ai service (CLI-based management of network switches with AI-assisted querying), including all associated contractual and pre-contractual relationships.
The duration corresponds to the term of the underlying service agreement (Terms). Obligations under this agreement, in particular the deletion or return of data and confidentiality, continue beyond termination.

Nature of processing: collection, storage, use, transmission, restriction and erasure of personal data in the context of the use of the service.
Purpose: provision of the service, in particular switch administration, AI-assisted querying, troubleshooting, support, security and operation of the platform.
Categories of data and data subjects: see Annex 1. In particular users and administrators of the Customer as well as the Customer's employees (devices appearing in ARP/MAC tables, IP addresses, host names) and contact data.
The Processor processes personal data only on documented instructions of the Customer and not for its own purposes.

Instructions are documented and implemented by the Processor without undue delay.
The abstract instructions on processing are set out in this agreement as well as in the Processor's Terms and Privacy Policy.
If the Processor considers an instruction unlawful, it informs the Customer without undue delay and may suspend the processing in question until the instruction is confirmed or amended.

The current sub-processors are listed in Annex 2.
The Customer grants its general authorisation to engage the sub-processors listed in Annex 2 (Art. 28(2) GDPR).
If the Processor intends to engage, replace or substitute a sub-processor, it informs the Customer in due time. In case of a material impact, the Customer may object.
Each sub-processor is bound to at least the data-protection standards set out in this agreement (Art. 28(4) GDPR). Transfer occurs only on the basis of a data processing agreement.

The Processor assists the Customer in fulfilling the data subjects' rights of access, rectification, erasure, restriction, data portability and objection, in accordance with Art. 28(3)(e) GDPR.
Requests from data subjects addressed directly to the Processor are forwarded to the Customer without undue delay and without being asked.

The Processor implements technical and organisational measures appropriate to the risk in order to ensure a level of security appropriate to the risk. The implemented categories of measures include in particular:
- Confidentiality: access concept with role-based permissions; pseudonymisation of personal values (in particular IP and MAC addresses, e-mail addresses, phone numbers, host names) before transfer to AI providers; encryption of data in transit and at rest.
- Integrity: measures against unauthorised alteration; logging without raw data (hashed values only). Deliberate plaintext exceptions (network devices, no personal data): target IPs of network devices and the SSH device account username (structured, login events only, never the password, opt-out via `log_usernames`).
- Availability and resilience: redundancy, recovery procedures, limited retention periods with automatic deletion.
- Processes: regular review and update of measures, support for data protection impact assessments, procedures for handling data protection incidents.
The concrete measures are evidenced upon request within the framework of the audit rights (§ 7). A full detailed technical documentation is not published publicly.

The Customer may request reasonable evidence of compliance with data protection requirements. Audits are permissible upon prior notice and within a reasonable scope, but no more than once per calendar year unless there is a specific reason. Audits shall be conducted remotely (questionnaire, provision of evidence) where possible. On-site inspections are excluded as no relevant processing takes place at the Processor's premises. The Customer bears any costs exceeding what is reasonable.
The Processor notifies the Customer without undue delay, at the latest within 24 hours of becoming aware, of personal data breaches (Art. 33 GDPR) by email to the contact address provided by the Customer. The notification contains the information required under Art. 33(3)(a)-(d) GDPR (nature of the breach, categories and approximate number of data subjects, likely consequences, measures taken). The Processor assists the Customer in notifying the supervisory authority (within 72 hours) and in informing the affected individuals (Art. 33, 34 GDPR). The Processor's central contact point for incidents is legal@netloop.ai.
Incidents relating exclusively to data processed by the Processor in its own capacity as controller (in particular account data and audit logs) are not subject to this notification entitlement; in that respect the Processor reports independently in accordance with Art. 33, 34 GDPR.

Upon termination, personal data is — unless statutory retention obligations prevail — deleted or returned to the Customer. The retention periods set out in the Privacy Policy apply (standard: 90 days).
On the Customer's express request, the Processor provides evidence of deletion.

Liability is governed by the Terms.
The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).
If any provision of this agreement is or becomes invalid, the validity of the remaining provisions remains unaffected.

Activity	Data	Retention
Switch data	Configurations, VLANs, interfaces, ARP/MAC/IP caches, host names	Raw data transient; no persistence
Chat/prompt data	Queries and responses in the context of AI querying	90 days (automatic deletion)
Audit metadata	Log entries (hashed values, no raw content); deliberate plaintext exceptions (network devices, no personal data): target IPs of network devices + SSH device account username (no password)	90 days
Connector – Target data	Management IPs of queried network devices (no personal endpoints)	Audit log (server): 90 days, readable Customer machine: no server persistence
Connector – Credentials	SSH username and password for switch access	Password customer only: RAM (volatile), config (optionally encrypted) Never on server, never in audit log. The username is additionally recorded server-side in the audit log (see Audit metadata), opt-out via `log_usernames`
Connector – Network data (SSH output)	ARP tables, MAC addresses, IP addresses of endpoints, host names, switch configurations	Chat history (server): 90 days, plaintext Before AI transfer: pseudonymisation of IP/MAC/host names/email/phone

Sub-processor	Purpose	Location	Contractual basis
Amazon Web Services (AWS)	Hosting and infrastructure	EU (eu-central-1, Frankfurt)	AWS DPA + SCC
Mistral AI	AI LLM inference	EU (France)	Mistral DPA