Data processing agreement

1. Parties and roles

The customer is the controller to the extent it enters personal data into SlideWizard (web app and PowerPoint add-in) or has users of its organization process it. slidewizard.ai GmbH acts as processor for this data. For its own purposes (contract management, billing, security, legal defence) it is an independent controller.

2. Conclusion, subject matter and duration

The customer concludes this DPA when registering its organization: the registering person accepts it on behalf of the organization. SlideWizard stores the accepted version with time and person as evidence.

The subject matter is providing the web app and add-in for creating, editing, managing and exporting presentations, and managing organizations, users, roles, billing and support. Processing lasts until the end of the contract and the subsequent deletion under section 12.

3. Nature and purpose of processing

• Authentication, authorization and session management.
• Managing organizations, memberships, teams, roles and invitations.
• Creating, editing, storing, previewing and exporting slides and presentations.
• Automated processing of prompts, presentation content, templates, chat history and references by AI services (section 9).
• Saving the Agent chat in the PowerPoint file, encrypted for the person who had the chat.
• Billing, trial, usage budget, overage and subscription management.
• Operation, monitoring, security, error analysis, abuse prevention and support.

4. Types of data and data subjects

5. Instructions

SlideWizard processes customer data only on documented instructions of the customer unless the law requires otherwise. Instructions follow from the contract, use of the app, the organization's settings (including export and deletion) and support requests. If SlideWizard considers an instruction unlawful, it informs the customer.

6. Confidentiality

Everyone who may access customer data is bound to confidentiality. Access follows the need-to-know principle.

7. Technical and organizational measures

• Encryption in transit (TLS). Encryption at rest at AWS.
• Role- and organization-based access control. Separation of customer organizations at application level.
• Secrets in AWS Secrets Manager. Least-privilege runtime roles.
• Logging of operational and security events. Alerting.
• Versioned, reviewed delivery through CI/CD.
• Encryption of the Agent chat saved by the add-in with a per-person key (AES-256, HMAC-SHA256).
• Backups kept at most 14 days after a deletion. Documented deletion process with an independent deletion ledger.

8. Sub-processors

The customer approves the following sub-processors:

9. AI services

AI services receive only the content required for the task. SlideWizard uses them through business APIs whose terms exclude using customer data for model training.

10. Changes of sub-processors

SlideWizard announces new or replacing sub-processors at least 30 days in advance on this page and by email to the organization owner. The customer may object for an important data protection reason. If no reasonable solution is found, the customer may terminate the affected service.

11. Transfers to third countries

Where sub-processors process data outside the EU/EEA, SlideWizard ensures appropriate safeguards, in particular adequacy decisions (EU-U.S. Data Privacy Framework) or EU standard contractual clauses with supplementary measures.

12. Deletion and return

• The organization owner can download a copy of the data at any time in the settings (ZIP with accounts, members, presentations and chat history) and request deletion of the organization. Members can request deletion of their own account or leave the organization.
• A deletion request is carried out after a 14-day waiting period and can be withdrawn until then.
• On execution, SlideWizard cancels a running Paddle subscription, deletes content, files, accounts and sign-in identities and confirms the deletion. Only the Paddle customer and subscription IDs remain as evidence for statutory retention.
• Backups are overwritten no later than 14 days after deletion.
• Presentations of departed members stay with the organization unless the customer decides otherwise (transfer or deletion).

13. Data subject rights and assistance

SlideWizard reasonably assists the customer with data subject rights (in particular through export and deletion in the app), data protection impact assessments, security incidents and requests from supervisory authorities. SlideWizard reports personal data breaches without undue delay, at the latest within 48 hours of becoming aware. Contact: info@slidewizard.ai.

14. Evidence and audits

SlideWizard provides reasonable evidence on request. Audits take place by arrangement, during business hours and without endangering security, operations or the rights of other customers, primarily through documentation and certificates.