Terms of use

Version of 2 December 2024

1. SCOPE OF APPLICATION

1.1. These General Terms and Conditions (hereinafter "GTC") of Serviceplan AI Lab GmbH & Co KG, Friedenstraße 24, 81671 Munich (hereinafter "Licensor") apply to the use of Serviceplan Generate.AI by the Licensee. The version of these GTC valid at the time of inclusion shall be authoritative.

1.2. By confirming the GTC, the Licensee commissions the Licensor to provide the software Serviceplan Generate.AI.

2. SERVICES

2.1. The Licensor provides the Licensee with access to the software Serviceplan Generate.AI ("Serviceplan Generate.AI"), which is based on the open source diffusion model Stable Diffusion ("Stable Diffusion"). Serviceplan Generate.AI is an interactive user interface that enables the user of the software to operate Stable Diffusion easily and efficiently. The Licensor operates Stable Diffusion for the Licensee for use with Serviceplan Generate.AI on an "as is" basis. The Licensor is not the manufacturer, importer, deployer, provider, supplier or similar of Stable Diffusion. The Licensor warrants that it has the necessary Stable Diffusion license that enables the Licensee to use the application Stable Diffusion in accordance with the contractual use of Serviceplan Generate.AI.

2.2. The Licensor guarantees an annual average availability of Serviceplan Generate.AI of 90% from Monday to Friday from 8.00 am to 6.00 pm. The demarcation point at which availability is measured is the WAN-directed router output of the data centre used to operate Serviceplan Generate.AI. The Licensor shall notify the Licensee of any necessary maintenance work in text form five (5) working days in advance, where technically possible. Maintenance work shall be scheduled no more than once per calendar month. Times of necessary maintenance work are not taken into account when calculating availability.

2.3. The Licensor is authorized to use subcontractors at its own discretion when providing the services. In all other respects, Section 4 of Appendix 2 (DPA) shall apply.

2.4. In particular, the following activities are not services within the meaning of these GTC and are not owed by the Licensor: Generation of certain generative AI outputs that are identical to the ideas of the Licensee, as well as the development or maintenance of Stable Diffusion.

3. INTELLECTUAL PROPERTY

3.1. All intellectual property rights (in particular copyright, invention rights and technical property rights) to Serviceplan Generate.AI, to which intellectual property rights may exist, remain with the Licensor.

3.2. The Licensor grants the Licensee a non-exclusive and non-transferable right to use Serviceplan Generate.AI limited to the period of use. The Licensor may revoke the rights of use to Serviceplan Generate.AI if (i) there is misuse for which the Licensee is responsible, including by third parties, and/or (ii) the Licensee has breached these GTC or the duty of care in handling its account.

3.3. By entering data, the Licensee grants the Licensor a non-exclusive, non-transferable right to use this data and any existing intel-lectual property of the Licensee and/or have it used by subcontractors for the duration of use, insofar as this is necessary to provide the services to the Licensee.

3.4. The Licensee may not sublicense Serviceplan Generate.AI, make it publicly accessible or make it available to third parties for a fee or free of charge.

3.5. The Licensee may not modify, translate, decompile or disassemble Serviceplan Generate.AI and may not change any proprietary notices in Serviceplan Generate.AI. The Licensee may not download or install Serviceplan Generate.AI. The Licensee may not attempt to disable or circumvent any technical security measures in Serviceplan Generate.AI.

3.6. The Licensee bears sole responsibility for activities that take place under the Licensee's account, insofar as these activities were authorised by the Licensee or, if they were not authorised, could have been prevented by the Licensee.

4. PROVISIONS FOR THE USE OF SERVICEPLAN GENERATE.AI

4.1. The Licensee undertakes to use Serviceplan Generate.AI and all related or connected parts exclusively in accordance with the Terms of Use as per Appendix 1 (Terms of Use Serviceplan Generate.AI) and is responsible for ensuring that all authorised users comply with the Terms of Use as per Appendix 1.

4.2. The Licensee is solely responsible for the use and the results obtained with Serviceplan Generate.AI. The Licensee is solely responsible for ensuring that the manner of its use and the use of the Serviceplan Generate.AI output complies with all applicable laws and regulations.

4.3. Serviceplan Generate.AI is not a knowledge database, a research tool or a reference work. The output of Serviceplan Generate.AI is a mathematical calculation of probabilities in terms of the respective model, which is largely based on the training data. The Licensee understands and accepts that, given the probabilistic nature of machine learning, the use of Serviceplan Generate.AI may in some situations lead to erroneous results that do not accurately reflect real persons, places, facts or the desired output. It is therefore the sole responsibility of the Licensee to assess the suitability of the output on a case-by-case basis, in particular by human verification of the results of the output.

4.4. The Licensee further recognizes and acknowledges that artificial intelligence and machine learning are rapidly evolving areas of research and technology. There can be no assurance that the Output will be unique compared to (i) the Output of other Licensees and (ii) existing works. The Licensee must therefore ensure that a sufficient distance to existing works is maintained when reusing the output. It is the Licensee's responsibility to have this checked by its own lawyers if necessary.

4.5. In the event of a breach of these GTC or the Terms of Use, the Licensee is obliged (i) to inform the Licensor immediately of the breach and (ii) to delete the affected data from Serviceplan Generate.AI without delay. The Licensee is primarily responsible for checking the Licensee's data. In the event of deletion or blocking, the Licensor shall inform the Licensee in an appropriate manner. The Licensor shall apply and enforce the deletion or blocking of data in a careful, objective and proportionate manner, taking into account the rights and legitimate interests of all parties involved and the fundamental rights of the Licensee enshrined in the Charter of Fundamental Rights of the European Union, such as the right to freedom of expression, freedom and pluralism of the media and other fundamental rights and freedoms. However, the Licensor is not subject to any corresponding contractual obligation to monitor, delete or block content.

5. WARRANTY AND OBLIGATION TO GIVE NOTICE OF DEFECTS

5.1. Any existing statutory warranty claims of the Licensee under these GTC shall expire one (1) year after receipt of the services.

5.2. The Licensee shall notify the Licensor of any technical errors and defects in writing without delay, but at the latest within five (5) days of provision of the respective service, and shall provide a reproducible and detailed description of the error and the symptoms. The Licensee shall answer any queries from the Licensor regarding the error description without delay.

5.3. Insofar as the Licensor procures services from third parties in its own name, which it passes on to the Licensee without material modification, the Licensor shall be the sole further-reaching party. The parties therefore exclude the Licensor's liability for such services. Conversely, the Licensor shall pass on to the Licensee all secondary claims (e.g. warranty rights for defects) arising from these contractual relationships with the relevant third parties and hereby declares - insofar as legally permissible - an assignment of such secondary claims to the Licensee.

5.4. Serviceplan Generate.AI may modify, adopt or otherwise influence the input or output of Stable Diffusion without appropriating the input or output of Stable Diffusion, i.e. the Licensor does not appropriate the output of the underlying Stable Diffusion model by providing Serviceplan Generate.AI. If the Licensee asserts claims against the Licensor due to the output, it is assumed that the defect (if any) was caused by Stable Diffusion and not by Serviceplan Generate.AI.

6. RIGHT OF AMENDMENT

The Licensor reserves the right to amend or supplement these GTC (including annexes) and the services with effect for the future, provided that no essential contractual content is changed and the amendment is not unreasonable for the Licensee. Amendments will always be stored in the current version of the GTC in Serviceplan Generate.AI for inspection and acknowledgement by the Licensee.

7. OBLIGATIONS OF THE LICENSEE

7.1. The Licensee is obliged to provide the necessary and appropriate cooperation for the services proactively and without being requested to do so. If the Licensor also requests the Licensee to provide a certain cooperation, the Licensee shall comply with this without delay, in any case within five days.

7.2. Cooperation by the Licensee is an essential contractual obligation. The Licensor accepts no responsibility for consequences (in particular delays and disruptions to performance) resulting from insufficient, improper or late cooperation on the part of the Licensee. All dates and deadlines shall be postponed by the period of such a breach of the obligation to cooperate, plus a reasonable period for the proper continuation of the services concerned. The Licensor may charge the Licensee for the costs (in particular downtime, reserved rooms, booked personnel) incurred as a result of the breach of the duty to cooperate.

7.3. The Licensee warrants that the data provided by the Licensee and its use do not violate applicable law, official orders, third-party rights or agreements with third parties. The Licensee shall defend the Licensor against any claim made against the Licensor by a third party alleging that data provided by the Licensee infringes the rights of third parties. Licensor will (i) provide reasonable notice to Licensee upon discovery of the claim against Licensor, (ii) give Licensee sole control of the defence and settlement of the claim, and (iii) provide Licensee with all reasonable assistance at Licensee's expense.

8. USAGE RESTRICTIONS FOR STABLE DIFFUSION

The Licensee acknowledges that the use of Serviceplan Generate.AI goes hand in hand with the use of Stable Diffusion. Stable Diffusion is subject to the CreativeML Open RAIL++-M license at https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/blob/main/LICENSE.md. The Licensee shall ensure that the use of Serviceplan Generate.AI is in accordance with the CreativeML Open RAIL++-M license at https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/blob/main/LICENSE.md.

9. REMUNERATION

9.1. For the services under these GTC, the Licensor shall receive the respective remuneration agreed between the parties for the use.

9.2. Any remuneration under these GTC is subject to the applicable statutory value added tax.

10. DATA PROTECTION

Details of the obligations of the parties to protect personal data are regulated at Appendix 2 (DPA).

11. CONFIDENTIALITY

11.1. The parties are obliged to treat the Confidential Information that one party discloses, hands over or otherwise brings to the attention of the other party as confidential and to use it exclusively for the purpose of providing the service. However, Confidential Information does not include information that

  • were already known to the party taking cognizance before it became aware of them through notification by the other party under these GTC;

  • The information was disclosed to the party taking cognizance independently of the cognizance due to its own development, without it having made use of the other party's Confidential Information;

  • the receiving party received from a third party that is not restricted in the use or disclosure of such information;

  • of one party are already lawfully available on the day of transmission and do not originate from the other party;

  • have become known to the public other than through a breach of these GTC; or

  • which a party has exempted in writing from the requirement of confidentiality vis-à-vis the party taking cognizance.

11.2. The parties shall protect Confidential Information from unauthorized access and treat it with the same care that they apply to their own, equally Confidential Information, but at least with the care of a prudent businessman.

11.3. Confidential information may not be disclosed by the receiving party to third parties without the prior written consent of the other party, unless,

  • this is required by mandatory applicable laws or judicial or regulatory orders and the receiving party has promptly informed the other party in writing of the relevant obligation; or

  • he Confidential Information is made available to the receiving party's advisors in connection with the interpretation or execution of the contract documents or a dispute arising therefrom and the advisor has given a prior written undertaking to the receiving party to maintain confidentiality or is already under a professional duty of confidentiality; or

  • the disclosure to employees or subcontractors is necessary or expedient for the provision of the services.

12. FORCE MAJEURE

12.1. If an event that could not have been foreseen by the Licensor using reasonable care and could not have been avoided by reasonable precautions taken by the Licensor ("Force Majeure") results in the Licensor being unable to fulfil its obligations under these GTC, or being unable to fulfil them in full or on time, the Licensor shall be released from its contractual obligations, in particular the provision of services, for the duration of the Force Majeure. Force Majeure includes, in particular, war, epidemics, pandemics (e.g. Covid-19), riots, civil unrest, strikes, embargoes, explosions, fires, floods and storms.

12.2. The Licensee's obligation to pay remuneration shall remain unaffected for the period of Force Majeure, unless the Force Majeure situation lasts longer than one week. In this case, the parties shall agree on an interruption of the obligation to pay remuneration.

13. LIABILITY

13.1. The Licensor shall be liable without limitation for (i) damages based on a grossly negligent breach of duty by the Licensor or on an intentional or grossly negligent breach of duty by a legal representative or vicarious agent of the Licensor, (ii) damages resulting from injury to life, body or health which are based on a negligent breach of duty by the Licensor or an intentional or negligent breach of duty by a legal representative or vicarious agent of the Licensor, (iii) to the extent of a guarantee assumed by the Licensor, (iv) under the German Product Liability Act, and (v) insofar as the applicable laws provide for mandatory unlimited liability.

The Licensor's liability for slightly negligently breached obligations, the fulfilment of which is essential for the proper performance of the GTC, the breach of which jeopardizes the achievement of the purpose of the contract and on the observance of which the Licensee regularly relies (so-called cardinal obligations), shall be limited to the amount of damage that is foreseeable and typical for the type of transaction in question for obligations other than those specified in Section 13.1. Otherwise, the Licensor shall not be liable.

13.2. Section 13.1 shall apply accordingly to any personal liability of the Licensor's employees, representatives, bodies and vicarious agents for claims arising from or in connection with these GTC.

14. ASSIGNMENT; SET-OFF; RIGHTS OF RETENTION; GUARANTEES

14.1. The assignment of rights under these GTC by the Licensee to third parties requires the prior written consent of the Licensor. Offsetting by the Licensee against the Licensor is only permitted if the counterclaim has been legally established or is undisputed by the Licensor or arises from the same contractual relationship. The Licensor shall have no rights of retention in respect of the agreed remuneration.

14.2. The Licensor does not grant the Licensee any guarantees under these GTC unless the Licensor uses the term 'guarantee' and expressly indicates in the respective provision that this paragraph is to be deviated from.

15. FINAL PROVISIONS

15.1. There are no verbal agreements or other ancillary agreements to these GTC. Amendments or additions to the GTC or the other contractual documents must be made in writing to be effective. The same applies to the waiver or amendment of this written form requirement.

15.2. Should individual provisions of these GTC be or become invalid or unenforceable, this shall not affect the validity of the remaining provisions of these GTC. The parties undertake to jointly replace the invalid or unenforceable provision with a valid provision that comes as close as possible to the invalid or unenforceable provision. The same applies to any loopholes in these GTC. Section 139 of the German Civil Code (BGB) shall not apply.

15.3 These GTC and the agreements made hereunder shall be governed exclusively by the laws of the Federal Republic of Germany with the exception of its conflict of laws provisions. The UN Convention on Contracts for the International Sale of Goods (CISG) is excluded. For all disputes arising from and in connection with these GTC, to the extent permitted by law, the exclusive jurisdiction of the court at the Licensor's registered office shall apply.

Appendix 1

Terms of use Serviceplan Generate.AI

1 PROHIBITED PURPOSES

The use of Serviceplan Generate.AI is prohibited for the following purposes:

  • for use for unlawful purposes;

  • defame (including, but not limited to, libel and slander), harass, stalk, threaten or otherwise violate the rights of others (including, but not limited to, their general right to privacy);

  • to generate codes, files, scripts or programmes that are intended to cause damage, e.g. viruses, worms and Trojan horses;

  • upload materials that contain software or other material protected by copyright, trademark, patent, personal or other legal rights, unless the Licensee has the necessary rights, licenses or consents;

  • to promote or carry out unlawful purposes or activities;

  • to promote content that has been categorized as harmful to minors;

  • to generate, promote or disseminate disinformation;

  • to generate content that infringes the rights of third parties;

  • for fully automated decisions that affect a person's rights or create or change a binding, enforceable obligation;

  • for any purpose that discriminates against or harms any individual or group on the basis of their online or offline social behaviour or known or predicted personal or character traits;

  • to exploit the vulnerabilities of a particular group of people because of their age, social, physical or mental characteristics in order to materially influence the behavior of a person belonging to that group in a way that causes physical or psychological harm to that person or another person;

  • for any purpose which has as its object or effect discrimination against individuals or groups on the basis of legally protected characteristics or categories;

  • to provide medical advice and interpretation of medical results; and

  • to generate or disseminate information for the purpose of using it for the administration of justice, law enforcement, immigration or asylum procedures, such as predicting that an individual will commit fraud/crime (e.g. through text profiling, drawing causal links between allegations made in documents, indiscriminate and arbitrary targeting).

2 PROHIBITED USE

It is prohibited,

  • interfere with or disrupt the Serviceplan Generate.AI or the networks or servers connected to the Licensor;

  • impair the use of Serviceplan Generate.AI;

  • attempt to gain unauthorized access to Serviceplan Generate.AI or the systems or networks connected to it;

  • provide direct or indirect access to Serviceplan Generate.AI or use Serviceplan Generate.AI in a way that circumvents a contractual restriction on use, or use Serviceplan Generate.AI to access, copy or use the Licensor's intellectual property, except as permitted under these GTC;

  • frame or mirror parts of Serviceplan Generate.AI;

  • Serviceplan Generate.AI in violation of laws, including, but not limited to, export control laws and applicable laws regulating artificial intelligence;

  • Serviceplan Generate.AI to use the generation of the output or the output for the development or training of generative models or comparable models of artificial intelligence;

  • use automated or programmatic methods to extract data or generate output from Serviceplan Generate.AI, including scraping, web harvesting or web data extraction;

  • to claim that output from Serviceplan Generate.AI was generated by humans when this is not the case;

  • use prompt injection to override a meta-prompt or manipulate the data source to manipulate the input; and

  • to circumvent the protection or security measures built into Serviceplan Generate.AI.

3 MITIGATION MEASURES

Whenever Serviceplan Generate.AI is used, it must be ensured that

  • the output created by Serviceplan Generate.AI is carefully checked for any duplicates. If there is a duplicate, the output must not be used;

  • the output created by Serviceplan Generate.AI is subsequently further processed and is not used unchanged;

  • no existing works or general legally protected reference objects, such as trademarks, are reproduced. This must be observed accordingly when prompting (e.g. prompts such as "create a picture of Mickey Mouse" are prohibited because such content may infringe the rights of third parties).

4 TERMS OF USE OF STABLE DIFFUSION

Any use of Serviceplan Generate.AI must comply with the terms of use of the CreativeML Open RAIL++-M license at https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/blob/main/LICENSE.md.

Appendix 2 - DPA

This agreement on the processing of personal data on behalf of a controller pursuant to Article 28 GDPR ("DPA") between the company for which you are acting as a representative (the "Licensee") and Serviceplan AI Lab GmbH & Co KG, Friedenstraße 24, 81671 Munich (the "Licensor", together with the Licensee the "Parties" or individually a "Party") governs the relationship between the Parties under data protection law in connection with the General Terms and Conditions (the "GTC") concluded to fulfil the requirements of the GDPR. Part of the implementation of the GTC is the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR).

1 OBJECT/SCOPE OF THE ASSIGNMENT

1.1 The cooperation between the Parties in accordance with the GTC entails the Licensor gaining access to the Licensee's personal data (the "Licensee Data").

1.2 The Licensor shall process the Licensee Data exclusively in the manner, scope and purpose specified in Annex 1 (Processing details).

1.3 The provisions of this DPA shall apply to all activities that are related to the GTC and in which the Licensor and its employees or persons authorised by the Licensor come into contact with personal data originating from the Licensee or collected for the Licensee.

2 RIGHTS AND OBLIGATIONS OF THE LICENSEE

2.1 The Licensor is the processor and the Licensee is the controller within the meaning of the GDPR.

2.2 The Licensee has the right to request all necessary information from the Licensor to prove compliance with the obligations set out in Article 28 GDPR and to carry out inspections - including onsite inspections - at the Licensor's premises either itself or through third parties commissioned by it ("Audit"). The Licensee is entitled to carry out an Audit once per calendar year ("regular Audit"). The costs incurred by the Parties in carrying out the regular Audit shall be borne by the Parties themselves. In addition, the Licensee may carry out Audits if it has justified reasons to assume that the Licensor's processing violates applicable data protection law ("extraordinary Audits"). The costs of extraordinary Audits shall be borne by the Licensee, unless the Licensee's assumption that data processing is in breach of data protection law is confirmed. In this case, the Licensor shall bear the costs of the extraordinary Audit.

3 OBLIGATIONS OF THE LICENSOR

3.1 The Licensor shall process the personal data only on documented instructions from the Licensee - including in relation to the transfer of personal data to a third country or an international organization - unless required to do so by Union or Member State law to which the Licensor is subject; in such a case, the Licensor shall notify the Licensee of these legal requirements prior to processing, unless the law in question prohibits such notification on grounds of important public interest.

3.2 If Licensor is of the opinion that an instructed processing violates data protection regulations or other laws, Licensor shall inform Licensee immediately and may cease processing until Licensee amends or confirms the instruction. If the Licensee confirms the instruction and the Licensor is still of the opinion that the processing is unlawful, the Licensor shall have an extraordinary right of termination.

3.3 The Licensor is obliged to observe the statutory provisions on data protection and not to disclose the information obtained from the Licensee's area to third parties or expose it to their access. Documents and data must be secured against unauthorized access, taking into account the state of the art.

3.4 Furthermore, the Licensor shall oblige all persons entrusted by it with the processing and fulfilment of this DPA to maintain confidentiality in writing (obligation of confidentiality, Article 28 para. 3 lit. b GDPR) and ensure compliance with this obligation with due care. At the request of the Licensee, the Licensor shall provide the Licensee with written or electronic evidence of the obligation of these persons.

3.5 The Licensor shall design its internal organization in such a way that it meets the special requirements of data protection. It undertakes to take all appropriate technical and organizational measures in accordance with Annex 2 for the appropriate protection of the Licensee data pursuant to Article 32 GDPR and to maintain these for the duration of the processing of the Licensee data.

3.6 The Licensor reserves the right to change the technical and organizational measures taken, whereby it shall ensure that the contractually agreed level of protection is not undercut.

3.7 The Licensor shall support the Licensee with regard to the type of processing, where possible with appropriate technical and organizational measures, in fulfilling its obligation to respond to requests to exercise the rights of data subjects referred to in Chapter III GDPR and in complying with the obligations set out in Articles 32 to 36 GDPR.

3.8 If a data subject asserts rights against the Licensor to which they are entitled against the Licensee under the GDPR, the Licensor will forward the data subject's request to the Licensee.

4 SUBCONTRACTOR RELATIONSHIPS

4.1 The Licensor shall not use any other processor without the prior separate or general written authorization of the Licensee.

4.2 The Licensee authorizes the subcontractors listed in Annex 3. The Licensor is authorised at any time to replace the subcontractors listed there with other subcontractors or to commission new subcontractors. In this case, the Licensor shall notify the Licensee of the intention to commission a new subcontractor. If the Licensee does not object within 30 days of notification of the assignment, the assignment shall be deemed to have been approved by the Licensee. If the Licensee objects, the Parties shall endeavor to reach an agreement regarding the commissioning of the subcontractor so that the Licensee withdraws its objection. If the Licensee maintains its objection, the Licensor shall have an extraordinary right of termination.

4.3 If the Licensor uses the services of another processor to carry out certain processing activities on behalf of the Licensee, the same data protection obligations as set out in this DPA shall be imposed on this other processor by means of a contract, in particular providing sufficient guarantees that the appropriate technical and organizational measures are implemented in such a way that the processing is carried out in accordance with the requirements of the GDPR.

4.4 If the other processor fails to fulfil its data protection obligations, the first processor shall be liable to the Licensee for compliance with the obligations of that other processor.

5 TERM AND CANCELLATION

5.1 The term of this DPA corresponds to the term of the GTC. If the GTC can be terminated by ordinary notice, the provisions on ordinary termination shall apply accordingly. In case of doubt, termination of the GTC shall also be deemed termination of this DPA and termination of this DPA shall be deemed termination of the GTC.

5.2 Upon completion of the provision of the processing services, the Licensor shall, at the Licensee's option, either erase all personal data covered by this DPA or return it to the Licensee and erase the existing copies, unless there is an obligation to retain the personal data under Union or Member State law. If the Licensor incurs costs for the return of the data that exceed the costs of deleting the data, the Licensee shall reimburse the Licensor for these costs.

6 FINAL PROVISIONS

6.1 Amendments and supplements to this DPA must be made in writing. This also applies to the waiver of this formal requirement.

6.2 In case of doubt, the provisions of this DPA shall take precedence over the provisions of the GTC. Should individual provisions of this DPA prove to be invalid or unenforceable in whole or in part or become invalid or unenforceable as a result of changes in legislation after the conclusion of the contract, this shall not affect the validity of the remaining provisions. The invalid or unenforceable provision shall be replaced by a valid and enforceable provision that comes as close as possible to the meaning and purpose of the invalid provision.

6.3 This DPA is subject to German law. The exclusive place of jurisdiction is the Licensor's registered office. 

Annex 1 (Processing details) to the DPA

Object of data processing
The object of the processing of personal data is the provision of the SaaS solution Serviceplan Generate.AI to the Licensee in accordance with the GTC.

Duration of data processing
The duration of the processing depends on the duration of the provision of the services from the GTC.

Nature and purpose of data processing
The Licensor processes the Licensee's personal data for the purpose of

  • fulfilment of this DPA and the GTC,

  • the provision of the contractually agreed functionalities of the SaaS solution Serviceplan Generate.AI,

  • where applicable, the fulfilment of the lawful separate instructions of the Licensee,

  • f necessary, to support the Licensee in fulfilling its data protection obligations towards data subjects.

The processing operations may include, in particular, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, erasure and destruction of personal data.

Categories of data subjects
All persons whose data is entered as input in Serviceplan Generate.AI or output on the basis of such input, e.g:

  • Customers of the Licensee and their end customers, interested parties, partners, suppliers, employees

  • Interested parties of the Licensee and their end customers, interested parties, partners, suppliers, employees

  • Partners of the Licensee and their employees

  • Suppliers of the Licensee and their employees

  • Employees of the Licensee

Categories of personal data
All categories of personal data that are entered as input into Serviceplan Generate.AI or output on the basis of such input, e.g:

  • Photographs of real people

  • AI-generated images with reference to real people

  • Texts with reference to real people, e.g. names and recommendations of influencers and other advertising partners

Annex 2 (Technical and organisational measures) to the DPA

A. General technical and organisational measures of the Serviceplan Group

Access control

Serviceplan takes appropriate measures to prevent unauthorized persons from gaining access to data processing systems that are used to process personal data. To this end, Serviceplan takes the following measures, among others:

  • Unauthorised access to the buildings and rooms is significantly prevented by various structural measures, technical equipment and organisational precautions.

  • Structural protective measures include

    • door locks and electric door locks (transponder card and badge reader).

    • Secured light wells and ventilation openings.

    • Security glazing for windows.

  • Technical facilities include, among others:

    • Video surveillance at entrance areas, sensitive & critical areas by security service providers.

    • Alarm-protected doors

  • Organisational precautions include, among other things:

    • Guarding the buildings (plant security).

    • Key control and acknowledgement of key issue

    • Within this framework, it is documented who receives which access card. The access cards and keys are only issued in personalized form via the personnel system and managed by Facility Management. The card is only valid for as long as required by company affiliation, employee position and/or project duration. The maximum validity for means of identification is 12 months (with the exception of access to general office work areas for permanent employees).

    • Secure storage of master keys and regulations for master key removal.

    • Spatial storage locations for the safekeeping of data backups (lockable cabinet, safe) .

    • Only some of the authorised IT employees and designated employees from facility management are granted access (ten employees in total). This is necessary for maintenance work and for fire safety reasons.

    • Logging of access to delivery zones.

    • Clear assignment of authorizations (access to building, office, server room).

    • Regular checking of access authorizations.

Guest principle:

  • Access to the building is only possible for visitors via the staffed reception, from where visitors are picked up by an internal employee and accompanied through the building at all times, i.e. visitors cannot move freely and uncontrolled in the building.

  • Particularly critical areas (e.g. server rooms) are secured separately with fire doors.

  • Regular and event-driven monitoring of IT functionality, including access control.

B. Technical and organisational measures at Serviceplan Generate.AI

General description Serviceplan Generate.AI "Pro Version"

  • Private cloud environment from AWS, server location EU-Central-1 (FFM)

  • Secure protocol: connections to the web-based tool only via SSL

  • Ubuntu Server

  • Encapsulated VMs that only exist for the period of use

  • AWS Standard Firewall

  • Port released for user access

  • Non-public instances in a dedicated environment

  • The system runs on encapsulated G4DN/G5DN instances, which are started at runtime as determined by the load balancer and terminated again when a user session ends

  • This means that each user gets their own temporary instance in the cloud

  • Any temporary working memory is deleted when the user shuts down or is inactive (10 minutes); no personalized data is stored beyond this

  • Access is controlled via an access management system administered by Serviceplan, which Serviceplan can also use to define the group memberships of users

  • Based on this, Serviceplan differentiates which user groups have access to which stable diffusion image models (SDXL), in-cluding Lora image models specially prepared for customers

  • Stable diffusion image models (SDXL) and Loras are stored centrally and made accessible to the starting instances depend-ing on access management; no data is saved back or used to train the AI

  • Generated data is stored locally by the users on request, there is no centralized storage

General description Serviceplan Generate.AI "Go Version"

  • Uses the same AWS Tenant as the Pro version described above

  • This is the simple interface for quickly generating data

  • Here too, access only takes place on the basis of access management controlled by Serviceplan

  • There are no personal instances here that are started with group and agency-dependent modelling equipment

  • As the usage scenario of the Go version is designed for a general and fast ("ready to go") generation of assets, there are no special customer models here, but only a basic set of Stable Diffusion image models (SDXL)

  • No customer-specific data, image models or information are stored, saved or fed back to the AI, nor is any temporary data from the generated images stored in the system

  • For this purpose, Serviceplan uses a Kubernetes system that was installed and runs as part of the AWS tenant; no further data transfer takes place within this system either

  • The Go version works in the background just like the Pro version with the difference that there are two (always restarted) instances that are always live to reduce waiting times

  • Instances are automatically switched on and off according to load. No data is stored on the system here either; any temporary runtime data is deleted when the instances end their runtime

Measures for pseudonymization and encryption of personal data
The system does not store any user data after the end of a session. Users are only identified by an ID. User data such as name and company name are encrypted and can only be decrypted by the admin using a key.

Measures to ensure the ongoing confidentiality, integrity, availability and resilience of the systems and services in connection with the processing

  • Regular maintenance

  • Regular updates, at least 1-2x per month

  • See also the technical and organisational measures of AWS, https://aws.amazon.com/de/compliance/gdpr-center/

Measures to ensure the ability to quickly restore the availability of and access to personal data in the event of a physical or technical incident

  • In the event of technical difficulties, e.g. disconnection, expiry of the temporary session, etc., the current work progress is automatically downloaded to the user's computer. The system does not leave any data or information on the system after it is switched off.

  • See also the technical and organisational measures of AWS, https://aws.amazon.com/de/compliance/gdpr-center/

Procedures for regularly reviewing, assessing and evaluating the effectiveness of technical and organisational measures to ensure the security of processing

  • Standards are introduced and adapted on an ongoing basis, and spot checks are carried out alongside maintenance.

Measures to identify and authorize users

  • Users are identified via OAuth and SSO and matched with a user list.

  • SSO based on the Microsoft Authenticator

Measures to protect data during storage

No data is stored by the system.

Measures to ensure the physical security of places where personal data is processed

  • Hosting takes place on a secure infrastructure in the data center of the provider AWS. Security is guaranteed by the cloud provider AWS. The AWS data center EU-Central-1 Frankfurt am Main is used.

  • User database is located on a server of the Serviceplan Group, see the access control measures under point A.

Measures to ensure the logging of events

Failures and times are logged and recorded by Serviceplan.

Measures to ensure the system configuration, including the default configuration

Configuration defined on the basis of standards and can be customized. Minimum standard is guaranteed.

Measures for the internal governance and management of IT and IT security

Information Security Management System (ISMS) of the Serviceplan Group certified according to ISO 27001.

Measures for the certification/quality assurance of processes and products

Software licenses are checked in advance by Serviceplan. Hardware is covered by certificates from the cloud provider.

Measures to ensure data minimization

Data is only synchronized for user authentication. No further data storage takes place during further operation.

Measures to ensure data quality

User authentication takes place on the basis of existing data on the user's affiliation to the Serviceplan Group. It is assumed that the data is already optimized and minimized accordingly at this point.

Measures to enable data portability and to ensure erasure

Data is not saved. Users can be removed from the database.

Annex 3 (Authorised subcontractors) to the DPA

The Licensee has authorised the use of the following sub-processors:

Amazon Web Services, Inc.
410 Terry Avenue North
Seattle WA 98109
United States

Hosting of the SaaS solution Serviceplan Generate.AI on servers in Germany (Frankfurt am Main).
See also the general Data Processing Addendum from AWS:
https://docs.aws.amazon.com/de_de/whitepapers/latest/navigating-gdpr-compliance/aws-data-processing-addendum-dpa.html