Structural Content
Private beta

Data Processing Agreement (Art. 28 GDPR)

Standard contractual clauses between controllers and processors, Commission Implementing Decision (EU) 2021/915 of 4 June 2021, with the four annexes completed for the Structural Content private beta. Part of the Private Beta Terms.

Version 2026-10-29

How it is concluded

In electronic form (Art. 28(9) GDPR). The processor offers it by issuing the controller's private upload link. A person authorised to act for the controller accepts it there, together with the Private Beta Terms, naming the company and themselves, before anything is uploaded. The processor records the acceptance with the version above and the time. That record takes the place of signatures. Once accepted, this agreement covers every later upload link until it ends.

The agreement

The parties agree the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/915 ("the Clauses"), which are incorporated by reference and not altered. The official text in all EU languages: commission.europa.eu.

Where the Clauses ask the parties to choose or complete:

Annex I: List of parties

ControllerThe company named in the acceptance record, with the address and register entry given there. Contact: the privacy contact named there, or else the person who accepted.
ProcessorStructural Content UG (haftungsbeschränkt), Kollwitzstraße 76, 10435 Berlin, Germany; Amtsgericht Charlottenburg, HRB 291186 B; managing director Sebastian Rasso Messerer. Contact: sebastian@structuralcontent.com.
AccessionThe processor by issuing the upload link that offers this agreement; the controller by accepting it there. The acceptance record holds the company's name, address and register entry; the name, role and email of the person accepting; an optional privacy contact; the time; and the version accepted.

Annex II: Description of the processing

Categories of data subjectsThe controller's customers and prospects as they appear in the exported records. The controller's employees appear only if the controller includes free text that names them.
Categories of personal dataOnly the columns the controller exports, per a column list the parties agree for each source before its first upload. The list leaves out contact names, email addresses, phone numbers and fields naming the controller's staff (owner, assignee, creator, team, agent). It includes business facts (stages, amounts, dates, categories, reasons), identifiers that link records across systems, and company names. Free-text fields (notes, descriptions, transcripts, comments) are included only where the controller chooses them for a source and may then contain names someone typed in. Records without names are still treated as personal data.
Sensitive dataNone requested. If free text the controller includes contains special categories of data, it is processed only for the purpose below and deleted with everything else.
SourcesThe systems the controller exports from, each with its column list, as the parties agree in writing (email suffices) before that source's first upload. That agreement forms part of this Annex.
Nature of the processingThe controller exports files from its own systems and uploads them through a private link the processor issues, together with the priority and metrics it states. The processor analyses them, with AI inference, and hands campaign briefs back through a private download link. The processor receives no logins, API keys or connector access to the controller's systems, and accepts the controller's data only through the upload link: a file sent any other way is deleted on receipt.
PurposeDeriving campaign briefs for the controller's marketing team against the priority the controller states. No other purpose. The data is never used to train or evaluate any model, or for any other customer.
DurationFor the term of the Private Beta Terms. It ends when they end, and deletion follows as their Clause 9 states.
What is kept after deletionA record that holds none of the controller's files and no personal data from them: the number of files and their sizes, the dates of each step, the kinds of question the controller asked about the briefs (without their content), the controller's reply to the follow-up question after the briefs are handed over (which briefs it used and whether the metric moved), the deletion confirmation, and the record of the controller's acceptance of this agreement, which is kept until the end of the sixth year after the year in which this agreement ends; the rest of this record is kept as long and deleted with it. File names are removed from the processor's upload log at deletion.
Processing by the sub-processorStorage and AI inference as in Annex IV, for the duration above.

Annex III: Technical and organisational measures

EntryFiles arrive only through private upload links issued per controller. Each expires after 7 days and accepts files up to 1 GiB. No system access is granted.
StorageA private Amazon S3 bucket in eu-central-1 (Frankfurt). Public access is blocked; only TLS connections are accepted; data is encrypted at rest (AES-256); every object is scheduled to expire 30 days after upload. The credential the transfer tool uses can reach this bucket and nothing else.
ProcessingOne company laptop with full-disk encryption (FileVault), used only by named staff and only within the EU. The controller's files live in one directory per controller, excluded from backups and cloud sync.
AI analysisAmazon Bedrock, EU cross-region inference profile (EU regions only), account set to zero data retention: the model service stores no inputs or outputs. No model is trained on the data, and model providers receive no copy of it.
DeliveryBriefs are handed over through a private download link that expires after 7 days.
AccessNamed processor staff bound to confidentiality. At acceptance that is one person, the managing director named in Annex I.
TransportTLS on every leg; the storage refuses plain HTTP.
MinimisationThe column list per source (Annex II), agreed before the first upload.
DeletionAs in Annex II, confirmed in writing; independently, scheduled expiry in storage 30 days after upload.
RecordAn upload log: which file arrived, from which system and when. The controller may see its part at any time. At deletion it is reduced as in Annex II.
BreachThe controller is notified within 24 hours of the processor becoming aware (Clause 9.2).
CertificationNone held. This agreement and its annexes are offered for direct review instead.

Annex IV: List of sub-processors

The controller has authorised the use of the following sub-processor:

EntityProcessingLocationTransfer safeguard
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 LuxembourgStorage (Amazon S3) and AI inference (Amazon Bedrock)EU: S3 in eu-central-1; Bedrock in EU regions only, zero data retentionStandard contractual clauses incorporated in the AWS GDPR Data Processing Addendum, for any transfer that may arise

No other service of the processor receives the controller's data: data enters only through the upload link, setup calls run on the controller's own meeting tool, and email between the parties is each party's own correspondence.

This page is published in English and German; if the two differ, the German version prevails. The Clauses themselves are binding in their official text.