Data processing agreement (Art. 28 GDPR)

Controller

The customer using the EDI EXPLAINER account.

Processor

pörtner consulting — digital business consulting & solutions, Im Bruch 31, 56414 Hundsangen, Germany

Contact

edi-explainer@poertner-consulting.eu

The processor analyses, validates, transforms and explains structured business documents (EDIFACT, ANSI X12, XML/UBL/CII, JSON, CSV) that the controller uploads. Processing lasts for the duration of the subscription plus the retention window of the selected plan.

• Account data: name, e-mail address, company, role, language.
• Document content: business partner identifiers, contact names, addresses, article and amount data contained in uploaded documents.
• Usage data: analysis counters, timestamps, plan and quota state.
• Data subjects: employees of the controller, employees of the controller's trading partners.

• Process personal data only on documented instructions of the controller.
• Ensure confidentiality obligations for all persons authorised to process data.
• Implement the technical and organisational measures described in the Security page (Art. 32 GDPR).
• Assist the controller with data subject requests and with data protection impact assessments.
• Notify the controller without undue delay after becoming aware of a personal data breach.
• Delete or return all personal data at the end of the contract, subject to statutory retention obligations.
• Make available all information necessary to demonstrate compliance and allow audits.

The controller grants general authorisation for the subprocessors listed on the Subprocessors page. The processor informs the controller of any intended change and gives the controller the opportunity to object.

Application and database hosting takes place in the European Union. Where a subprocessor processes data outside the EU/EEA, the transfer is covered by EU Standard Contractual Clauses and supplementary technical measures such as pseudonymisation of document content.

• AI explanation is optional and can be switched off per analysis.
• With PII masking enabled, names, e-mail addresses, phone numbers, IBANs and tax IDs are replaced before the document is sent to the model.
• Document content is not used to train foundation models.
• Model requests are transient; no long-term storage happens at the model provider.