Addendum for anny AI

Version dated June 07, 2026AI-powered products and features for bookings and customer communication

Addendum to the General Terms and Conditions and the Privacy Policy of anny GmbH

This supplementary agreement ("Supplementary Agreement") applies exclusively to customers who have activated at least one product or function from the anny AI ("anny AI") suite in their anny account. It is separately acknowledged and confirmed during the activation process and comes into effect upon such confirmation.

The Supplementary Agreement complements the General Terms and Conditions of anny GmbH ("anny GTC") and the Privacy Policy of anny GmbH. In the event of contradictions between this Supplementary Agreement and the anny GTC or the Privacy Policy, this Supplementary Agreement shall prevail. For customers who have not activated anny AI, this Supplementary Agreement has no force or effect.

anny AI can be made available via various communication channels ("Channels"), such as phone, WhatsApp, WhatsApp Call, Instagram, web chat widget, Slack, or MS Teams. Which channels the customer activates is determined by their configuration in the anny account. The specific details for each channel — in particular, identifiers, recording/logging, transparency notices, providers used, third-country transfers, retention periods, and billing — are set out in the "Channels" Appendix (Channel Matrix) at the end of this Supplementary Agreement. This appendix is expandable; by adding further channels to the matrix, they will be covered by this Supplementary Agreement without any changes to the rest of the contract text.

If the customer activates a voice channel (in particular, the phone use case / AI phone assistant), the voice- or phone-specific provisions of this Supplementary Agreement, in particular in Sections 2, 5, 6, and 10 and the "Channels" Appendix, shall additionally apply.

§ 1 Subject Matter of the Contract and Definitions

(1) anny AI is an additional portfolio of products and features for the anny platform. It includes AI-powered features for customer communication, appointment and booking processes, and the processing of user inquiries via one or more channels. In the phone use case, anny AI specifically enables the automated handling of incoming phone calls by an AI-based phone assistant.

(2) For the purposes of this Supplementary Agreement, the following definitions apply:

• "Customer": the natural or legal person who activates anny AI as part of their contractual relationship with anny.

• "Channel": a communication channel through which anny AI is provided (e.g., phone, WhatsApp, WhatsApp Call, Instagram, web chat widget, Slack, MS Teams). The supported and activated channels are listed in the "Channels" Appendix and determined by the customer's configuration.

• "Voice Channel": a channel where interaction takes place entirely or predominantly as voice (audio), such as phone and WhatsApp Call. "Text Channel": a channel where interaction takes place entirely or predominantly as text/chat messages, such as WhatsApp, Instagram, web chat widget, Slack, MS Teams.

• "External Channel": a channel directed at third parties, in particular end customers of the customer. "Internal Channel": a channel directed at employees or other internal authorized users of the customer after logging in, such as Slack and MS Teams in internal use; Section 15 applies additionally here.

• "Users": individuals who interact with the AI assistant via a channel. In the case of voice channels, users are also referred to as "Callers".

• "AI Assistant": the AI-powered system provided by anny for the automated processing of incoming interactions via the activated channels. The version used for voice channels is referred to as the "AI Phone Assistant".

• "Interaction" (also referred to as "conversation"): an exchange conducted via a channel between users and the AI assistant. For voice channels, the interaction is also referred to as a "call" or "conversation".

• "Identifier": the contact or identification feature of the user processed per channel (e.g., phone or WhatsApp number, Instagram handle, web session/device/IP identifier, Slack or Teams user ID).

• "End-Customer Content": all content that the customer or users generate, transmit, or post to the platform in connection with the use of anny AI, in particular configurations, prompts, knowledge base data, message and conversation history, transcripts, and, in the case of voice channels, call recordings.

• "Plan": the anny AI pricing model selected by the customer.

• "Phone Use Case": the use of anny AI as an AI phone assistant for incoming calls via a voice channel.

§ 2 Scope of Services anny AI

(1) anny provides the customer with the activated anny AI services via the activated channels within the scope of the selected plan. The specific scope of services for each channel is set out in the "Channels" Appendix. Across channels, this includes in particular:

• Automated acceptance and processing of incoming interactions by the AI assistant

• Configuration interface for greeting/opening message, FAQs, fallback behavior, and, for voice channels, voice and language settings

• Forwarding and transfer of booking requests to the anny booking platform

• Interaction/call logs and summaries per interaction in the anny admin area

(2) In the phone use case, the scope of services additionally includes:

• A dedicated phone number (included in the selected plan)

• Optional call recording and transcription (enabled by default, see Section 6)

(3) anny AI is intended exclusively for receiving incoming interactions in the ordinary course of the customer's business. anny AI is not an emergency service on any channel and is not suitable for emergency communication. The customer is responsible for informing users of this if necessary.

(4) The specific range of functions may vary depending on the plan and channel. anny reserves the right to adjust the scope of services with reasonable advance notice of at least 30 days. Material reductions in performance entitle the customer to terminate anny AI for cause.

(5) Bookings via anny AI. For bookings submitted via the AI assistant, the following rules apply:

• An email address of the user is not a mandatory field. For voice channels, the mobile number of the caller is automatically captured from the incoming interaction and stored as a contact feature of the booking; for text channels, the typical channel identifier is used.

• Upon successful booking, anny automatically sends a booking confirmation with the essential booking details (date, time, service) via a suitable method (in particular, SMS confirmation for voice channels or confirmation message in the respective text channel) to the user's captured identifier.

• The sending of the booking confirmation is free of charge under normal usage (one confirmation per booking). In the event of abusive volume, anny reserves the right to charge for the postage costs incurred; anny will notify the customer of this at least 14 days in advance.

(6) Booking Guarantee. anny ensures that bookings via anny AI are always processed in accordance with the rules configured by the customer in anny. This includes, in particular, compliance with availabilities, time slots, buffer times, prices, and cancellation policies as stored by the customer in their anny account. This must be distinguished from information provided by the AI assistant during the interaction (see Section 10).

§ 3 Plans, Pricing, and Billing

(1) anny AI is offered in various plans. The current plans, prices, and conditions are visible in the anny admin area and apply in the version valid at the time of activation or plan change.

(2) Included Volume. Each plan contains a base price per month as well as an included volume of billable units. The units applicable to each channel are set out in the "Channels" Appendix. Depending on the plan, the included volume includes in particular:

• Minutes of call time for voice channels (in particular, phone, WhatsApp Call);

• Messages for text channels (in particular, WhatsApp, Instagram, web chat widget); only messages sent by users count, not the responses of the AI assistant;

• Phone numbers for voice channels (at least one standard phone number for plans with a voice channel).

(3) Additional Volume. Usage beyond the included volume will be billed monthly in arrears as additional volume at the price valid in the plan, in particular:

• Additional Minutes: call minutes beyond the included volume; they are billed down to the second;

• Additional Messages: messages beyond the included volume; here, too, only messages sent by users count, not the responses of the AI assistant;

• Additional Phone Numbers: additional phone numbers beyond those included in the plan;

• Transfer Minutes: minutes incurred when forwarding (transferring) a call to another phone number.

(4) Governing Volumes and Prices. The exact included volumes and prices for the base price and additional volume are always determined by the anny plan selected in the anny admin area and the email confirmation of activation or plan change.

(5) For voice channels, only actually connected seconds of call time are considered as billable call and transfer minutes. Ring time, failed connections, and busy signals are not charged.

(6) Plan changes are possible for the next billing period. Unused included volume expires at the end of each billing month and cannot be carried over or refunded.

(7) All prices are net prices plus the applicable statutory sales tax. Billing is handled through the customer's existing anny account. anny reserves the right to adjust prices with at least 30 days' notice; in this case, the customer may cancel anny AI at the time the price change takes effect.

§ 4 Activation and Provisioning

(1) The customer activates anny AI independently in their anny account by selecting a plan and the desired channels and accepting this Supplementary Agreement. Upon sending the activation request, the contract for anny AI comes into effect.

(2) After activation, anny provides the customer with access to the respective channel (in the phone use case, in particular, a phone number). Provisioning usually takes place within a few minutes. For channels that require approval, verification, or an account with a third-party provider (e.g., WhatsApp, Instagram, Slack, MS Teams), provisioning may take longer and require the customer's cooperation. anny does not guarantee a specific provisioning time.

(3) Access to the advanced configuration interface (FAQs, greetings, fallbacks, and, for voice channels, voice settings) is via a single sign-on link from the anny admin area. The customer is solely responsible for the configuration of the AI assistant.

(4) anny recommends that the customer test anny AI thoroughly before productive use and adjust the AI configuration to their own requirements and interaction scenarios.

§ 5 Information about the AI Assistant (Transparency)

(1) The customer acknowledges that anny AI utilizes an AI-based assistant that automatically processes incoming interactions. anny ensures that users are informed of the AI nature of the service in a channel-appropriate and transparent manner. This is done in particular:

• for voice channels, by playing an announcement at the beginning of the call (including a notice of recording if recording is enabled);

• for text channels, by a clearly visible notice or disclaimer in the chat window or in the first message of the interaction.

The specific transparency mechanism for each channel is set out in the "Channels" Appendix.

(2) The customer is entitled to adjust the text of these notices in the platform configuration. However, the adjustment must not lead to the information about the AI nature being omitted or inaudible/invisible to users. A configuration that actively conceals or denies the AI nature of the assistant is impermissible. The customer shall in particular comply with the transparency and labeling obligations pursuant to Art. 50 of Regulation (EU) 2024/1689 (EU AI Act), as far as applicable.

(3) The customer shall ensure that they themselves and their users are adequately informed about the use of AI, in particular by appropriate notes on their own website, in appointment confirmations, or on other communication materials.

§ 6 Recording, Transcription, and Logging

(1) Voice Channels. The call recording and transcription feature is optional for voice channels and enabled by default. The customer can disable the recording and transcription function at any time in the anny admin area. As long as the function is enabled, the customer is solely responsible for ensuring that they have the necessary legal bases and, if applicable, consents from the callers. The customer shall in particular comply with:

• Section 201 of the German Criminal Code (StGB) (Violation of the confidentiality of the spoken word): Secret recording of conversations without the knowledge of the callers is a criminal offense.

• The relevant requirements of the GDPR, in particular the obligation to inform data subjects and the requirement of a suitable legal basis for processing.

(2) Text Channels. For text channels, no audio recording is generated; the message or conversation history itself serves as the interaction log. Section 201 of the German Criminal Code (StGB) does not apply to text channels. However, the customer remains responsible for informing users about the processing of message content in accordance with Art. 13/14 GDPR and, if necessary, ensuring a required legal basis or consent.

(3) anny merely provides technical resources (e.g., default announcements on voice channels informing about AI and recording, optional announcements to obtain consent, and notice texts on text channels); legal advice on the admissibility of recording or logging in specific cases is not provided.

(4) Voice recordings (audio) are automatically and irretrievably deleted by default after 7 days, unless otherwise configured by the customer (statutory minimum deletion periods remain unaffected). Channel-specific default storage periods for other interaction data are set out in Section 9 and the "Channels" Appendix.

§ 7 Acceptable Use

(1) The customer agrees to use anny AI and all AI features provided through the platform exclusively for purposes that comply with applicable laws and are within the ordinary course of their business.

(2) The following are strictly prohibited:

• (i) any unlawful, discriminatory, misleading, abusive, or ethically questionable use;

• (ii) processing content that infringes third-party rights (copyrights, trademarks, personal rights);

• (iii) sending spam, malware, or unsolicited advertising via the AI assistant;

• (iv) impairing the operability of the platform or third-party systems;

• (v) configuring the AI assistant for purposes clearly outside of normal customer support, booking handling, or informational services.

(3) The customer must also comply with the terms of use and policies of the respective channel providers (in particular WhatsApp/Meta Business Policies, Instagram Platform Policies, and terms of use for Slack and Microsoft Teams). Violations of these platform policies may result in the blocking of the respective channel by the provider; the customer is responsible for this.

(4) anny is entitled to block access to anny AI with immediate effect in the event of serious or repeated violations of these terms of use. The right to terminate for cause remains unaffected.

§ 8 Data Protection and Data Processing Addendum

(1) To the extent that the customer processes personal data in connection with the use of anny AI (in particular, names, identifiers, and interaction content of users), they are the Controller within the meaning of Art. 4 No. 7 GDPR. anny is the Processor within the meaning of Art. 4 No. 8 GDPR.

(2) The Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is part of the contract between the customer and anny and is attached as an appendix to this Supplementary Agreement. It is deemed concluded upon activation of anny AI; a separate signature is not required. The sub-processors used to provide anny AI are listed in Annex 2 of the DPA.

(3) Requests from users and other data subjects pursuant to Art. 12 to 22 GDPR (e.g., access, deletion) must be processed by the customer as the controller. anny supports the customer in this regard in accordance with the DPA.

(4) anny generally processes personal data within the European Union when providing anny AI. Single functions or channels (in particular, certain voice models for voice channels and connections to messaging services like WhatsApp or Instagram) can, for technical reasons, only be provided through providers with hosting or processing outside the EU. In these cases, anny ensures that the transfer takes place on the basis of appropriate safeguards in accordance with Art. 46 GDPR (in particular EU Standard Contractual Clauses, supplementary measures, and other permissible transfer mechanisms where applicable). Other storage and processing takes place in Europe where technically possible. The utilized sub-processors and safeguards are listed in Annex 2 of the DPA.

(5) Exclusion of model training: End-customer content is not used to train, fine-tune, or otherwise improve AI models that would benefit other customers or third parties. anny contractually ensures that this also applies to utilized technical sub-processors.

§ 9 Retention Periods

(1) Unless instructed otherwise by the customer, the following default retention periods apply:

Data CategoryDefault PeriodCall recordings (Audio, voice channels only)7 days after the call, thereafter automatic irretrievable deletion unless configured otherwise by the customerTranscripts and interaction logs (Voice channels)In accordance with statutory requirementsMessage and conversation history (Text channels)According to channel-specific period in “Channels” Appendix, otherwise according to statutory requirementsWeb widget logs and cookie/session data (Web chat widget)According to channel-specific period in “Channels” Appendix; cookie/session data only to the extent necessaryConfigurations, prompts, and knowledge baseFor the duration of the contract relationshipSystem and security logsIn accordance with statutory requirementsUsage and billing data (excluding content)According to statutory retention obligations (in particular Section 147 AO)

(2) Upon the customer's instruction, call recordings, transcripts/conversation logs, message/conversation histories, as well as configurations, prompts, and the knowledge base will be deleted without undue delay, at the latest within 60 days, or made available in a standard machine-readable format.

§ 10 AI Output, Hallucinations, and Booking Guarantee

(1) The customer is aware and expressly acknowledges by using the service that content and answers generated by the AI assistant (hereinafter "AI Output") may contain inaccurate, incomplete, or misleading information (so-called "hallucinations").

(2) The AI Output makes no claim to correctness, timeliness, or error-free status. anny owes the correct technical provisioning of the AI assistant, but not the substantive accuracy of the information generated by the AI in the interaction. This applies in particular to information given by the AI assistant regarding prices, availabilities, opening hours, or features — such statements (whether spoken in conversation or written in a message) are not binding promises.

(3) The customer is obliged to check AI Output for plausibility before any business-critical or legally relevant use and, if necessary, perform human review. In particular, anny recommends checking the knowledge base provided to the AI assistant regularly for timeliness and correctness.

(4) anny is not liable for damages resulting from the customer or third parties relying on incorrect AI statements in the interaction, unless caused by anny intentionally or through gross negligence.

(5) Booking Logic and Booking Guarantee. Notwithstanding the preceding paragraphs, anny ensures that bookings submitted via anny AI are processed exclusively on the basis of the data configured by the customer in anny — in particular, availabilities, time slots, buffer times, prices, and cancellation policies. The technical booking logic is not based on the interaction content of the AI assistant, but rather exclusively on the configurations stored in the anny system. Consequently, in the event of a booking, only what is configured in anny applies — not what the AI assistant stated during the interaction.

§ 11 Responsibility for End-Customer Content

(1) The customer is solely responsible for all content generated, distributed, or processed through their use of anny AI, including any AI instances configured or used by them.

(2) The customer ensures that this content does not infringe third-party rights, violate statutory provisions, or contain misleading or illegal statements.

(3) The customer shall indemnify and hold anny harmless from any third-party claims arising from unlawful or abusive use of anny AI or the content generated by the AI assistant, to the extent the customer is responsible for such use.

§ 12 Availability

(1) anny guarantees an average availability of anny AI of 99.0% on an annual average, measured at the exit of the anny infrastructure. Planned maintenance work will be announced at least 5 business days in advance where possible and preferably performed outside core business hours (Monday to Friday, 8:00 AM – 6:00 PM).

(2) The average availability calculation excludes downtime caused by:

• force majeure (e.g., natural disasters, third-party network outages, cyber attacks);

• disruptions in the public telecommunications network or disruptions, blockages, or changes to the services of the respective channel providers (e.g., telephony providers, WhatsApp/Meta, Instagram, Slack, Microsoft);

• circumstances for which the customer or third parties are responsible.

(3) anny AI is not a replacement for personal customer service. anny does not guarantee specific booking or conversion results achieved through the AI assistant.

§ 13 Liability

(1) To the extent legally permissible, anny’s liability for damages resulting from the use of anny AI is limited to the net fees paid by the customer for anny AI in the 12 calendar months preceding the damaging event. Mandatory statutory liabilities under data protection law, in particular pursuant to Art. 82 GDPR, remain unaffected.

(2) This limitation of liability does not apply to:

• (i) intent or gross negligence by anny;

• (ii) damages resulting from injury to life, body, or health;

• (iii) damages for which anny has given a guarantee;

• (iv) liability under the Product Liability Act (Produkthaftungsgesetz).

(3) Claims of the customer for damages arising from the use of anny AI expire in 2 years from the date of the customer gaining knowledge of the damage and the person liable, unless shorter statutory periods apply.

(4) anny is not liable for the content of interactions conducted by the AI assistant to the extent it is based on the knowledge base configured by the customer. The customer bears substantive responsibility for their configuration.

§ 14 Term and Termination of anny AI

(1) The agreement on anny AI begins with activation by the customer and runs for an indefinite period. There is no minimum term.

(2) The customer can terminate anny AI at any time with a notice period of 30 days to the end of the current billing month. Termination is carried out via the anny admin area or in text form.

(3) anny can terminate anny AI with a notice period of 30 days to the end of a month. The right of both parties to terminate for cause remains unaffected. For anny, cause exists in particular in the event of repeated or serious violations by the customer of Sections 5, 6, or 7 of this Supplementary Agreement.

(4) Upon termination of anny AI, the assigned channel accesses are disabled (in the phone use case, in particular, the assigned phone number). Upon request within 30 days after contract end, the customer will receive an export of their configuration data in a standard machine-readable format. All end-customer content will be deleted at the latest 60 days after the end of the contract, unless statutory retention obligations prevent this.

(5) Portability of phone numbers upon termination is subject to technical and regulatory availability and must be coordinated with anny in advance.

§ 15 Special Provisions for Internal Channels (Slack, MS Teams)

(1) If the customer activates an internal channel (in particular Slack or MS Teams in internal usage after login), anny AI is directed at employees or other internal authorized users of the customer. In this case, the data subjects are regularly employees of the customer.

(2) As the controller and, if applicable, the employer, the customer is solely responsible for ensuring a suitable legal basis for processing employee data (in particular Section 26 of the German Federal Data Protection Act (BDSG) / Art. 88 GDPR) as well as observing any co-determination rights of the works council (especially with regard to potential behavior or performance monitoring) and other labor law requirements. anny is not responsible for providing legal advice in this regard.

(3) Connection of internal channels is established via the official app or bot integration of the respective provider (e.g. Slack App, MS Teams Bot). The terms of use and privacy policies of the respective provider apply additionally. The specific data flow and providers used are set out in the "Channels" Appendix and Annex 2 of the DPA.

(4) In all other respects, the provisions of this Supplementary Agreement and the DPA apply analogously to internal channels, unless Section 15 states otherwise.

§ 16 Final Provisions

(1) This Supplementary Agreement and the anny GTC together form the contractual basis for the use of anny AI. In addition, the current version of the anny GTC applies.

(2) anny reserves the right to amend this Supplementary Agreement — including the "Channels" Appendix — with an announcement period of 30 days in text form. The inclusion of further channels in the "Channels" Appendix, which does not impose additional obligations on the customer and does not lower the level of security, can be done without separate announcement. The customer is deemed to have agreed unless they object in writing to an amendment subject to announcement within 30 days of receiving the amendment notice. anny will point out this legal consequence separately in the amendment notice. In the event of an objection, anny is entitled to continue anny AI for the customer on the previous conditions until the end of the current billing month and terminate it thereafter. Changes to the DPA are governed exclusively by the change provisions of the DPA.

(3) German law applies. The place of jurisdiction for disputes with merchants, legal entities under public law, or special funds under public law is Cologne, Germany.

As of: June 2026

anny GmbH · Cäcilienstraße 30 · 50667 Cologne · anny.co

"Channels" Appendix (Channel Matrix)

This appendix is part of the Supplementary Agreement and describes channel-specific features. It is expandable: further channels can be included by adding a row to the table without amending the rest of the contract text. “Recording/Log” refers to the default form of documenting the interaction; “Transparency” to the channel-appropriate notice of the AI nature; “Billing” to the billable unit according to Section 3.

As of: June 2026. The entries in the "Provider/Subprocessors" column are not exhaustive; the current Annex 2 of the DPA is decisive.

ChannelTypeAudienceIdentifierRecording/Logging (Default)TransparencyProviders/Subprocessors (according to Annex 2 DPA)Third-Country TransferStorage PeriodBillingPhoneVoiceExternalPhone number (MSISDN)Audio recording + transcript (default active)Voice opening promptTelephony provider, STT/TTS/voice modelsYes (certain voice models)Audio 7 days; transcript according to § 9Minutes of call timeWhatsApp CallVoiceExternalWhatsApp/phone numberAudio recording + transcript (default active)Voice prompt/notice at the startMeta (WhatsApp), telephony/voice modelsYesAudio 7 days; transcript according to § 9Minutes of call timeWhatsAppTextExternalWhatsApp/phone number, profile nameMessage history serving as logNotice in first message/chatMeta (WhatsApp) or WhatsApp Business Solution ProviderYesMessage history according to § 9MessagesInstagramTextExternalInstagram handle/ID, profile nameMessage history serving as logNotice in first message/chatMeta (Instagram)YesMessage history according to § 9MessagesWeb Chat WidgetTextExternalWeb session/device/IP identifierMessage history serving as logVisible notice in chat windowWeb widget hosting/CDNDepending on providerMessage history according to § 9; cookie/session data only where necessaryMessagesSlackTextInternal (after login)Slack user ID/workspaceMessage history serving as logNotice upon activation/first messageSlack (Salesforce)Depending on providerMessage history according to § 9MessagesMS TeamsTextInternal (after login)Teams user ID/tenantMessage history serving as logNotice upon activation/first messageMicrosoft (Teams)Depending on providerMessage history according to § 9Messages

Annex: Template for the Customer's Privacy Policy

This section is not a part of the contract, but a non-binding text template. Customers using anny AI are obliged under Art. 13/14 GDPR to supplement their privacy policy with information on the use of the AI assistant via the activated channels. The following text can serve as a starting point and should be adjusted to individual circumstances and the channels actually used. Review by own legal counsel is recommended.

Sample Text: Supplement to the Privacy Policy for Users of anny AI

Use of anny AI (AI-based assistant across various communication channels)

For our digital customer communication and appointment/booking processes, we use the product anny AI, a service of anny GmbH, Cäcilienstraße 30, 50667 Cologne (hereinafter "anny"). anny AI can be provided via various channels, e.g., phone, WhatsApp, WhatsApp Call, Instagram, a web chat widget on our website, and — for internal purposes — Slack or MS Teams. Please adjust this list to the channels you actually use.

What is anny AI? anny AI is an AI-powered product and feature portfolio that automates the processing of requests and supports booking processes. Incoming interactions are handled automatically. At the beginning of the interaction, you will be informed in a channel-appropriate manner that you are communicating with an AI system (for voice channels via an announcement, for text channels via a notice in the chat).

What data is processed?

During an interaction, the following personal data may be processed depending on the channel:

• Your typical channel identifier (e.g. phone or WhatsApp number, Instagram handle, for our web chat widget your IP address as well as session/device data, for Slack/MS Teams your internal user ID)

• Interaction content (voice, text, or message data) that you share in exchange with the AI assistant

• Date, time, and duration of the interaction

• Transcripts, conversation histories, and summaries generated by the AI assistant

• Booking data, if you submit a booking or appointment request

• Recording of the conversation (audio), if you use a voice channel and the recording function is enabled

Purpose and Legal Basis of Processing

The processing of your data is done for the purpose of handling your concerns, booking requests, and other inquiries, as well as ensuring our availability via the utilized channels. The legal basis is Art. 6 Abs. 1 lit. b GDPR (performance of a contract or steps prior to entering into a contract) and Art. 6 Abs. 1 lit. f GDPR (legitimate interest in efficient communication and availability).

If a conversation over a voice channel is recorded, you will be pointedly informed at the beginning and asked for your consent. The legal basis of the recording is your consent pursuant to Art. 6 Abs. 1 lit. a GDPR. Consent can be revoked at any time with future effect.

If our web chat widget uses cookies or comparable technologies that are not absolutely necessary for operation, we will obtain your consent under Section 25 TDDDG or Art. 6 Abs. 1 lit. a GDPR.

For internal channels (Slack, MS Teams), employee use is governed by Section 26 BDSG / Art. 88 GDPR; company policies or collective agreements may additionally apply.

Data Processing

We have concluded a Data Processing Agreement with anny GmbH in accordance with Art. 28 GDPR.

Your data is generally processed within the European Union. In individual cases where certain functions or channels (e.g. particular voice models or messaging services like WhatsApp/Instagram) technically require processing outside the EU, the transfer takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR (such as EU Standard Contractual Clauses and additional security measures). Other storage and processing takes place in Europe where technically possible.

Retention Periods

Your data will only be stored as long as necessary to achieve the processing purpose:

• Call recordings (Audio, voice channels only): automatic deletion after 7 days, unless otherwise configured by the customer

• Transcripts, message and conversation histories: deletion in accordance with contractually defined periods; at latest 60 days after the end of the contract, unless statutory retention obligations exist

• Booking data: according to the general retention periods of our privacy policy

Automated Decision-Making

The AI assistant does not make fully automated decisions within the meaning of Art. 22 GDPR that have legal effects on you or significantly affect you in a similar manner. Booking requests captured by the assistant are processed through our system; you can contact us at any time to correct or cancel a process.

Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR) from us as the controller at any time. To the extent processing is based on a legitimate interest, you have a right to object pursuant to Art. 21 GDPR. To exercise your rights, please contact: [Name of company], [Email address of data protection contact of company]

You also have the right to lodge a complaint with a data protection authority. The supervisory authority responsible for you is: [The data protection authority competent for you]

End of template — please adapt to individual circumstances and have legally reviewed

Data Processing Agreement (DPA) — anny AI

pursuant to Art. 28 GDPR

between

the Customer (hereinafter "Controller") — identified by the contact details stored in the anny account —

and

anny GmbH, Cäcilienstraße 30, 50667 Cologne (hereinafter "Processor" or "anny")

— jointly referred to as the "Parties" —

This DPA is part of the anny AI Supplementary Agreement and comes into force upon activation of anny AI by the customer. It defines the obligations of the parties under data protection law in connection with using anny AI. anny AI can be provided via various communication channels ("Channels") (e.g., phone, WhatsApp, WhatsApp Call, Instagram, web chat widget, Slack, MS Teams). The activated channels are determined by the customer's configuration. Insofar as a voice channel is activated (in particular the phone use case), the voice- or phone-specific processing operations (in particular call reception, transcription, voice models, and telephony) shall apply; insofar as text channels are activated, the message-related processing operations shall apply accordingly.

Art. 1 Subject Matter and Duration of the Processing

(1) anny processes personal data on behalf of the Controller, which arises during the use of anny AI via the activated channels. The subject matter of the processing is set out in the anny AI Supplementary Agreement.

(2) The duration of the processing corresponds to the term of the anny AI Supplementary Agreement. Upon termination of the Supplementary Agreement, personal data will be deleted or returned in accordance with Art. 7 of this DPA.

Art. 2 Nature and Purpose of the Processing

(1) anny processes personal data exclusively for the purpose of providing anny AI, in particular:

• Reception and processing of incoming interactions (calls and/or messages) by the AI assistant via the activated channels (including phone use case)

• Creation and storage of transcripts, message and conversation histories, and summaries

• Processing and transmission of booking requests to the anny booking platform

• Sending booking confirmations to users (e.g., confirmation SMS for voice channels or confirmation message in the respective text channel)

• Providing interaction/conversation logs in the anny admin area of the Controller

• Optional call recording for voice channels (if enabled)

• Operating, maintaining, and ensuring the availability of the platform

(2) Processing for other purposes — in particular for anny's marketing purposes, transfer to third parties, or the training of AI models — does not take place.

Art. 3 Categories of Personal Data

In connection with the data processing — depending on the activated channel — the following categories of personal data may be processed:

Data CategoryData SubjectsTypical channel identifier (phone/WhatsApp/MSISDN, Instagram handle/ID, web session/device/IP identifier, Slack/Teams user ID)UsersProfile data of the respective channel (e.g. profile name on WhatsApp/Instagram)UsersInteraction content (voice data, transcripts, message and conversation histories, summaries)UsersBooking data (date, time, service, name)Users / BookersInteraction/call metadata (date, time, duration)UsersCall recordings (audio, if enabled for voice channels)CallersWeb widget data (IP address, device/cookie/session data)Website visitorsInternal user IDs and associated employee data (internal channels Slack/MS Teams)Employees of the ControllerConfiguration data (prompts, knowledge base, greeting texts)Customers (Controllers)Contact details of the customerController / their employees

Special categories of personal data within the meaning of Art. 9 GDPR may also occasionally arise in connection with the use of the service (in particular through free voice or text entry by users). The Controller remains responsible for the legal basis and authorization of the processing. anny processes such data exclusively within the scope of documented instructions and applying enhanced technical and organizational protection measures pursuant to Art. 32 GDPR.

Art. 4 Categories of Data Subjects

• Users of external channels (end customers and other individuals who interact with the Controller's AI assistant via an external channel — e.g. phone, WhatsApp, WhatsApp Call, Instagram)

• Visitors of the Controller's website who use the web chat widget

• Employees and other internal authorized users of the Controller who use internal channels (in particular Slack, MS Teams)

• Staff and representatives of the Controller, to the extent they use the configuration interface

Art. 5 Obligations of anny as Processor

(1) Binding Nature of instructions. anny processes personal data exclusively on documented instructions of the Controller. The Controller's instructions are set out in the anny AI Supplementary Agreement and in separate written or electronic instructions. If anny believes an instruction violates data protection law, anny will inform the Controller immediately.

(2) Confidentiality. anny ensures that all persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(3) Technical and Organizational Measures. anny takes appropriate technical and organizational measures in accordance with Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures in force at the time of contract conclusion are described in Annex 1 to this DPA. anny is entitled to adapt the measures, provided that the level of protection is not compromised.

(4) Subprocessors. anny employs subprocessors in accordance with Art. 6 of this DPA to perform the services.

(5) Support of the Controller. anny supports the Controller — as far as possible and reasonable — in complying with its obligations under Art. 32 to 36 GDPR (data security, notification of data breaches, data protection impact assessments, prior consultation) and in responding to data subject requests under Art. 12 to 22 GDPR.

(6) Notification of Data Breaches. anny will notify the Controller of any personal data breach occurring on anny's side without undue delay, and in any event within 72 hours of becoming aware of it. The notification is sent to the Controller's email address stored in the anny account. anny will provide the Controller with the information required for notification to the supervisory authority.

(7) Deletion and Return. Upon completion of the processing, anny will delete or return personal data at the choice of the Controller, unless there is a statutory retention obligation. Art. 7 contains further details.

(8) Audit and Inspection. anny will make available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allow for audits — including inspections — conducted by the Controller or another auditor mandated by the Controller. The Controller must announce audits at least 4 weeks in advance. Audits must not unreasonably disrupt ongoing operations. The costs of the audit are borne by the Controller; for audits by third parties, anny may claim reimbursement for additional effort.

Art. 6 Subprocessors

(1) The Controller hereby grants anny a general authorization to use the subprocessors listed in Annex 2. Annex 2 is structured channel-dependently and will be supplemented accordingly when additional channels are added.

(2) anny will conclude an agreement with each subprocessor imposing on them at least the same data protection obligations that bind anny under this DPA (Art. 28 para. 4 GDPR).

(3) If anny intends to hire a new subprocessor or replace an existing one, anny will inform the Controller in text form at least 30 days in advance. The Controller may object to changes for justified reasons under data protection law within 14 days of the notification. If no agreement can be reached, the Controller is entitled to terminate the anny AI Supplementary Agreement for cause.

(4) anny remains fully responsible to the Controller for compliance with data protection obligations by subprocessors.

Art. 7 Deletion and Return of Data

(1) After termination of the anny AI Supplementary Agreement, anny will delete all personal data of the Controller and its users, unless statutory retention obligations prevent this. Deletion takes place at latest 60 days after the end of the contract.

(2) Upon request, anny will provide the Controller with an export of the configuration data (knowledge base, prompts, settings) in a standard machine-readable format within 30 days after contract end.

(3) During the term of the contract, the default retention periods set out in Section 9 of the anny AI Supplementary Agreement apply, unless instructed otherwise by the Controller.

(4) Due to technical reasons, backup copies of personal data will be overwritten with the next regular backup cycle, at the latest within 35 days. During this period, they are blocked from further active processing.

Art. 8 Place of Processing

(1) anny fundamentally processes personal data within the European Union.

(2) Where individual subprocessors perform processing outside the EU, this will only take place on the basis of appropriate safeguards in accordance with Art. 46 GDPR, in particular EU Standard Contractual Clauses (SCC) in their current version, and additional security measures. This is relevant to:

• certain voice, speech-to-text, text-to-speech, and AI model providers (voice channels) that are technically only available with US hosting;

• the connection of messaging channels WhatsApp and Instagram via Meta Platforms, where processing can also take place outside the EU (in particular USA);

• if applicable, providers of internal channels (Slack/Salesforce, Microsoft/Teams) as well as web widget hosting/CDN.

Other storage and processing takes place in Europe where technically possible. The specific third-country transfers and used safeguards are listed in Annex 2.

Art. 9 Exclusion of Model Training

anny and the subprocessors employed by anny do not use personal data of the Controller and its users to train, fine-tune, evaluate, or otherwise improve general AI models that would benefit other customers or third parties. anny ensures this through appropriate contract agreements with subprocessors (in particular "Zero Data Retention" / "No Training" configurations with AI providers, where available).

Art. 10 Obligations of the Controller

(1) The Controller is solely responsible for the lawfulness of the processing of personal data in connection with anny AI. This includes in particular:

• compliance with information obligations under Art. 13/14 GDPR towards users (anny provides a sample text as an annex to the Supplementary Agreement for this purpose)

• the existence of a suitable legal basis for each processing activity

• compliance with Section 201 of the German Criminal Code (StGB) if call recording is enabled on voice channels (obtaining consent of callers)

• when using a web chat widget, compliance with the requirements for cookies and comparable technologies (in particular Section 25 TDDDG) and, if applicable, obtaining consent

• for internal channels (Slack, MS Teams), compliance with employee data protection rules (in particular Section 26 BDSG / Art. 88 GDPR) and any co-determination rights of the works council

• observance of the terms of use and platform policies of the respective channel providers

• responding to data subject requests under Art. 12 to 22 GDPR

(2) The Controller issues instructions for processing personal data in text form (email is sufficient). Verbal instructions must be confirmed in writing without delay.

(3) The Controller will inform anny immediately if it detects errors or irregularities in the processing of personal data by anny.

Art. 11 Liability

The liability of the parties for violations of data protection provisions is governed by statutory provisions (in particular Art. 82 GDPR) and the liability rules of the anny AI Supplementary Agreement. Mandatory statutory data protection liability rules remain unaffected. In the internal relationship between the parties, each party is liable for the share of the damage for which it is responsible.

Art. 12 Final Provisions

(1) In all data protection matters, this DPA takes precedence over the provisions of the anny AI Supplementary Agreement.

(2) Amendments to this DPA require text form. anny may adapt this DPA with an announcement period of 30 days, provided the changes are necessary to comply with new statutory or regulatory requirements or the level of protection for the Controller is not compromised.

(3) Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions shall not be affected.

(4) German law applies. The place of jurisdiction is Cologne, Germany.

Annex 1: Technical and Organizational Measures (TOM)

The measures described below represent the state of affairs at the time of contract conclusion. anny continuously updates the TOM.

1. Physical Access Control

• Server infrastructure in certified data centers within the EU

• Access to server rooms restricted to authorized personnel only

2. System Access Control

• Access to production systems only via encrypted connections (VPN / SSH)

• Multi-factor authentication for all administrative access

• Role-based authorization concept (Principle of Least Privilege)

3. Data Access Control

• Strict tenant separation: customer data is technically isolated from one another

• Logging of all administrative access to personal data

4. Separation Control

• Personal data of different customers are technically processed and stored separately

• Testing and production environments are strictly separated

5. Pseudonymization

• Interaction and conversation metadata are stored pseudonymized internally, to the extent compatible with the purpose of processing

6. Integrity

• Encryption of all personal data during transfer (TLS 1.2 or higher)

• Encryption of stored personal data (AES-256 or equivalent)

7. Availability and Resilience

• Regular automated backups

• Redundant system architecture to ensure availability (SLA 99.0% p.a.)

• Disaster recovery plans and recovery procedures documented and regularly tested

8. Data Protection Management

• Data Protection Officer designated (if legally required)

• Regular employee training on data protection

• Procedures for detecting and reporting data breaches implemented

9. Channel-Specific Measures

• Web Chat Widget: secure integration of the widget, security measures against cross-site scripting/content injection, restriction of cookie/session data collected to what is necessary

• Messaging Channels (WhatsApp, Instagram): integration via the official, secure provider interfaces; transport encryption in accordance with provider standards

• Internal Channels (Slack, MS Teams): integration via official app/bot integration with provider-side authentication and authorization control

Annex 2: Subprocessors

As of: June 2026. anny informs about changes in accordance with Art. 6 para. 3 of this DPA. The "Channel" column indicates which channels a subprocessor is assigned to; "all" refers to across-the-board services. This list will be supplemented accordingly when additional channels are added.

SubprocessorFunctionChannelLocationThird-Country TransferGuaranteeDialogine GmbHOperation of the AI Assistant platform, voice/message processing, forwardingallCologne, Germany (EU)Yes, with selected models/channelsEU SCC

The list of subprocessors is continuously updated. Changes are made in accordance with Art. 6 para. 3 of this DPA.

As of: June 2026

anny GmbH · Cäcilienstraße 30 · 50667 Cologne · anny.co

This DPA is deemed concluded upon activation of anny AI by the customer. A separate signature is not required; the confirmation of activation in the anny admin area is considered legally binding approval.