GDPR & DPA
DPA, sub-processor list, lawful basis per processing activity, DPO contact.
CleverRouter (operated by Clevermation GmbH) is your processor (Art. 28 DSGVO). You stay the controller. Data does not leave the EU.
At a glance
| Role | Processor (Art. 28 DSGVO) |
| DPA | Click-through at workspace setup, downloadable as PDF |
| DPO | Dr. Lars Hoffmann, dpo@clevermation.com |
| DSGVO rights | privacy@clevermation.com, SLA 30 days |
The DPA
The data-processing agreement is signed click-through at workspace
setup and is available as a PDF at /app/compliance/dpa any time.
You'll want to download a copy for your own records.
Lawful basis per processing activity
| Processing | Legal basis | Retention |
|---|---|---|
| Inference on prompts | Art. 28 DSGVO (data processing) | 0s (ZDR) |
| Account data | Art. 6 (1) b (contract) | Until account deletion |
| Billing data | Art. 6 (1) c (legal obligation) | 10 years (HGB §257) |
| Audit logs | Art. 6 (1) f (legitimate interest) | 365 days |
Third-country transfer: no default transfer. Optionally
activatable providers (Anthropic via Bedrock-EU) operate under
AWS-EU-DPA + SCCs — switchable in the dashboard at
/app/compliance/providers.
Data-subject rights (Art. 15–22 DSGVO)
Send requests to privacy@clevermation.com. SLA 30 days.
Sub-processors
Contractually held to the same TOMs as our own.
| Provider | Region | Function | Status |
|---|---|---|---|
| OVHcloud SAS | Paris (FR) | Infrastructure, storage | active |
| Scaleway SAS | Paris (FR) | LLM inference (Mistral, Llama) | active |
| Mistral AI SAS | Paris (FR) | LLM inference (Mistral direct) | active |
| Tensorix GmbH | Frankfurt (DE) | LLM inference (Llama, Mixtral) | active |
| AWS EMEA | Frankfurt (DE) | Bedrock-EU (opt-in) | active |
| Microsoft Ireland | Frankfurt (DE) | Azure OpenAI EU (opt-in) | active |
| Stripe Payments Europe | Dublin (IE) | Payments | active |
| Plausible Insights OÜ | Tallinn (EE) | Web analytics (cookieless) | active |
| Postmark (ActiveCampaign) | Frankfurt (DE) | Transactional email | active |
| Cohere Europe BV | NL / IE | Embeddings | Q3 2026 |
| Voyage AI (EU replication) | EU | Embeddings | Q3 2026 |
New sub-processors are announced at least 30 days before go-live — via email, in-app banner and RSS feed.
Right to object (Art. 28 (2) DSGVO)
Individual providers can be deactivated via the allowlist at
/app/compliance/providers. If you object to a planned new
sub-processor, write to the DPO before the 30-day window expires.
DPO
Dr. Lars Hoffmann, dpo@clevermation.com. Mail-only, no phone — German DPA guidance recommends written form.
Related
- Zero data retention — what is and isn't logged.
- EU AI Act — model-level transparency.
- Why EU-native — the architectural invariants behind the policy.