Addendum for anny AI

Version dated 06/07/2026AI-powered products and features for bookings and customer communication

Addendum to the General Terms and Conditions and the Privacy Policy of anny GmbH

This supplementary agreement ("Supplementary Agreement") applies exclusively to customers who have activated at least one product or feature from the anny AI ("anny AI") suite in their anny account. It is separately acknowledged and confirmed during activation and takes effect upon this confirmation.

This Supplementary Agreement complements the General Terms and Conditions of anny GmbH ("anny GTC") and the Privacy Policy of anny GmbH. In the event of any conflict between this Supplementary Agreement and the anny GTC or the Privacy Policy, this Supplementary Agreement shall prevail. For customers who have not activated anny AI, this Supplementary Agreement has no effect.

anny AI can be made available through various communication channels ("Channels"), such as phone, WhatsApp, WhatsApp Call, Instagram, web chat widgets, Slack, or MS Teams. Which channels the customer activates depends on their configuration in the anny account. The channel-specific details — in particular regarding identifiers, recording/logging, transparency notices, providers used, third-country transfers, retention periods, and billing — are set out in the "Channels" Annex (Channel Matrix) at the end of this Supplementary Agreement. This Annex can be expanded; by adding further channels to the matrix, they will be covered by this Supplementary Agreement without changing the remaining text of the agreement.

If the customer activates a voice channel (especially the phone use case / AI phone assistant), the voice- or phone-specific provisions of this Supplementary Agreement, in particular in Sections 2, 5, 6, and 10 and the "Channels" Annex, shall also apply.

Section 1 Subject Matter and Definitions

(1) anny AI is a supplementary product and feature portfolio for the anny platform. It includes AI-powered features for customer communication, appointment, and booking processes, as well as the processing of user inquiries via one or more channels. In the phone use case, anny AI specifically enables the automated answering of incoming phone calls by an AI-based phone assistant.

(2) For the purposes of this Supplementary Agreement:

• "Customer": the natural or legal person who activates anny AI within the framework of their contractual relationship with anny.

• "Channel": a communication channel via which anny AI is provided (e.g., phone, WhatsApp, WhatsApp Call, Instagram, web chat widget, Slack, MS Teams). The supported and activated channels in each case are set out in the "Channels" Annex and the customer's configuration.

• "Voice Channel": a channel via which the interaction takes place entirely or predominantly as voice (audio) (especially phone and WhatsApp Call). "Text Channel": a channel via which the interaction takes place entirely or predominantly as a text/chat message (especially WhatsApp, Instagram, web chat widget, Slack, MS Teams).

• "External Channel": a channel aimed at third parties (especially end customers of the Customer). "Internal Channel": a channel aimed at employees or other internal authorized persons of the Customer after logging in (especially Slack and MS Teams in internal use); Section 15 applies additionally to this.

• "Users": people who interact with the AI assistant via a channel. In the case of voice channels, users are also referred to as "Callers".

• "AI Assistant": the AI-powered system provided by anny for the automated processing of incoming interactions via the activated channels. The version used for voice channels is referred to as the "AI Phone Assistant".

• "Interaction" (also "Conversation"): an exchange between users and the AI assistant conducted via a channel. In the case of voice channels, the interaction is also referred to as a "Call" or "Call Conversation".

• "Identifier": the contact or identification feature of the user processed per channel (e.g., phone or WhatsApp number, Instagram handle, web session/device/IP identifier, Slack or Teams user ID).

• "End-Customer Content": all content generated, transmitted, or posted to the platform by the customer or users as part of their use of anny AI, in particular configurations, prompts, knowledge base data, message and conversation histories, transcripts and (for voice channels) call recordings.

• "Plan": the pricing model chosen by the customer for anny AI.

• "Phone Use Case": the use of anny AI as an AI phone assistant for incoming calls over a voice channel.

Section 2 Scope of Services of anny AI

(1) anny provides the customer with the activated anny AI services via the activated channels as part of the selected plan. The specific scope of services for each channel is set out in the "Channels" Annex. Across all channels, this includes in particular:

• Automated acceptance and processing of incoming interactions by the AI assistant

• Configuration interface for greetings/initial announcements, FAQs, fallback behavior and — for voice channels — voice and language

• Forwarding and transfer of booking requests to the anny booking platform

• Interaction/call logs and summaries per interaction in the anny admin area

(2) For the phone use case, the scope of services additionally includes in particular:

• A dedicated phone number (included in the selected plan)

• Optional call recording and transcription (enabled by default, see Section 6)

(3) anny AI is exclusively intended for receiving incoming interactions in the course of the customer's ordinary business activities. anny AI is not an emergency service via any channel and is not suitable for emergency communication. The customer shall point this out to users as necessary.

(4) The specific range of functions may vary depending on the plan and channel. anny reserves the right to adapt the scope of services with a reasonable notice period (at least 30 days). Significant reductions in service entitle the customer to extraordinary termination of anny AI.

(5) Bookings via anny AI. For bookings placed via the AI assistant, the following special conditions apply:

• An email address of the user is not a mandatory requirement. For voice channels, the caller's mobile phone number is automatically captured from the incoming interaction and saved as the contact feature of the booking; for text channels, the respective channel-typical identifier is used.

• After a successful booking, anny automatically sends a booking confirmation with the key booking details (date, time, service) via a suitable method (in particular a confirmation SMS for voice channels or confirmation message in the respective text channel) to the recorded identifier of the user.

• The sending of the booking confirmation is free of charge within normal use (one confirmation per booking). In the event of abusive volume, anny reserves the right to charge for the shipping costs incurred; anny will notify the customer of this at least 14 days in advance.

(6) Booking Guarantee. anny ensures that bookings via anny AI are always processed in accordance with the rules configured by the customer in anny. This includes in particular compliance with availabilities, time slots, buffer times, prices and cancellation conditions as stored by the customer in their anny account. Information provided by the AI assistant during the interaction must be distinguished from this (see Section 10).

Section 3 Plans, Prices and Billing

(1) anny AI is offered in various plans. The current plans, prices, and conditions can be viewed in the anny admin area and apply in the version valid at the time of activation or plan change.

(2) Included Volume. Each plan includes a monthly base price and an included volume of billable units. The units that apply to each channel are set out in the "Channels" Annex. Depending on the plan, the included volume includes in particular:

• Call minutes for voice channels (especially phone, WhatsApp Call);

• Messages for text channels (especially WhatsApp, Instagram, web chat widget); only messages sent by users count here, not the replies of the AI assistant;

• Phone numbers for voice channels (at least one standard phone number for plans with a voice channel).

(3) Additional Volume. Usage exceeding the included volume is billed monthly in arrears as additional volume at the price valid in the plan, in particular:

• Additional minutes: call minutes exceeding the included volume; they are billed down to the second;

• Additional messages: messages exceeding the included volume; here, too, only messages sent by users count, not the replies of the AI assistant;

• Additional phone numbers: further phone numbers beyond those included in the plan;

• Transfer minutes: minutes incurred when forwarding (transferring) a call to another phone number.

(4) Authoritative Volumes and Prices. The exact included volumes as well as the prices for the base price and additional volume always result from the anny plan selected in the anny admin area and from the email confirmation of activation or plan change.

(5) For voice channels, only actually connected call seconds count as billable call and transfer minutes. Ringing time, failed connections, and connections that did not materialize are not billed.

(6) Plan changes are possible for the next billing period. Unused included volume expires at the end of the respective billing month and cannot be transferred or refunded.

(7) All prices are net prices plus the applicable statutory value-added tax. Billing is carried out via the customer's existing anny account. anny reserves the right to adjust prices with a notice period of at least 30 days; the customer can terminate anny AI in this case at the time the price change takes effect.

Section 4 Activation and Provisioning

(1) The customer activates anny AI independently in their anny account by selecting a plan and the desired channels and accepting this Supplementary Agreement. Upon sending the activation request, the contract for anny AI is concluded.

(2) After activation, anny provides the customer with the respective channel access (in the phone use case, in particular a phone number). Provisioning usually takes place within a few minutes. For channels whose integration requires approval, verification, or an account with a third-party provider (e.g., WhatsApp, Instagram, Slack, MS Teams), provisioning may take longer and require the cooperation of the customer. anny does not guarantee a specific provisioning period.

(3) Access to the advanced configuration interface (FAQs, welcome message, fallbacks, and voice for voice channels) is via a single sign-on link from the anny admin area. The customer is responsible for configuring the AI assistant themselves.

(4) anny recommends that the customer tests anny AI thoroughly before productive use and adapts the AI configuration to their own requirements and interaction cases.

Section 5 Notice of the AI Assistant (Transparency)

(1) The customer acknowledges that anny AI utilizes an AI-based assistant that automatically processes incoming interactions. anny ensures that users are informed about the AI character in a transparent manner suitable for the channel. This occurs in particular:

• for voice channels through an announcement played at the beginning (including reference to recording if recording is enabled);

• for text channels by a visible notice or disclaimer in the chat window or in the first message of the interaction.

The specific transparency mechanism per channel is set out in the "Channels" Annex.

(2) The customer is entitled to adjust the wording of these notices within the platform configuration. However, the adjustment must not lead to the information about the AI character being omitted or not recognizable to users. Any configuration that actively conceals or denies the AI character of the assistant is impermissible. The customer shall specifically observe the transparency and labeling obligations according to Art. 50 of Regulation (EU) 2024/1689 (AI Regulation / EU AI Act), as far as applicable.

(3) The customer ensures that they and their users are appropriately informed about the use of AI, in particular through suitable notices on their own website, in appointment confirmations, or on other communication material.

Section 6 Recording, Transcription and Logging

(1) Voice Channels. The call recording and transcription function is optional for voice channels and is enabled by default. The customer can disable the recording and transcription function at any time in the anny admin area. As long as the function is enabled, the customer is solely responsible for ensuring that they have the necessary legal basis and, if applicable, the consents of the callers. The customer specifically observes:

• Section 201 of the German Criminal Code (StGB) (Violation of the confidentiality of the word): The secret recording of conversations without the knowledge of the callers is a punishable offense.

• The relevant requirements of the GDPR, in particular the obligation to inform the data subjects and the requirement of a suitable legal basis for processing.

(2) Text Channels. No audio recording is created for text channels; the message or conversation history itself serves as the log of the interaction. Section 201 StGB does not apply to text channels. However, the customer remains responsible for informing the affected users in accordance with Art. 13/14 GDPR about the processing of message content and, if necessary, ensuring a required legal basis or consent.

(3) anny merely provides technical means (e.g., pre-recorded announcements enabled by default for voice channels notifying about AI and recording, optional pre-recorded announcements to obtain consent, and notice texts for text channels); legal advice on the permissibility of recording or logging in individual cases is not owed.

(4) Call recordings (audio) are automatically and irretrievably deleted after 7 days by default, unless configured otherwise by the customer (the statutory minimum retention period remains unaffected). Channel-specific default storage periods for other interaction data are set out in Section 9 and the "Channels" Annex.

Section 7 Acceptable Use

(1) The customer agrees to use anny AI and all AI functions provided via the platform exclusively for purposes that are compatible with the applicable legal provisions and in the course of their ordinary business activities.

• (i) any unlawful, discriminatory, misleading, offensive, or ethically questionable use;

• (ii) the processing of content that infringes third-party rights (copyrights, trademarks, personal rights);

• (iii) the distribution of spam, malware, or unsolicited advertising via the AI assistant;

• (iv) undermining the functionality of the platform or third-party systems;

• (v) configuring the AI assistant for purposes that clearly lie outside of ordinary customer service, booking acceptance, or information delivery.

(3) The customer also observes the respective terms of use and guidelines of the providers of the channels used (in particular the WhatsApp/Meta Business Policies, Instagram Platform Policies, and the terms of use of Slack and Microsoft Teams). Violations of these platform policies may lead to the blocking of the respective channel by the provider; the customer is responsible for this.

(4) anny is entitled to block access to anny AI with immediate effect in case of serious or repeated violations of these terms of use. The right to extraordinary termination remains unaffected.

Section 8 Data Protection and Data Processing

(1) Insofar as the customer processes personal data in the course of using anny AI (in particular names, identifiers, and interaction content of users), they are the Controller within the meaning of Art. 4 No. 7 GDPR. anny is the Processor within the meaning of Art. 4 No. 8 GDPR.

(2) The Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is part of the contractual relationship between the customer and anny and is attached as an annex to this Supplementary Agreement. It is deemed concluded with the activation of anny AI; a separate signature is not required. The sub-processors used to provide anny AI are listed in Annex 2 of the DPA.

(3) Inquiries from users and other data subjects pursuant to Art. 12 to 22 GDPR (e.g., access, deletion) are to be processed by the customer as the controller. anny supports the customer in this in accordance with the DPA.

(4) anny generally processes personal data within the framework of anny AI in the European Union. Due to technical reasons, individual functions or channels (in particular certain voice models for voice channels and the integration of messaging services like WhatsApp or Instagram) can only be provided via providers with hosting or processing outside the EU. In these cases, anny ensures that the transfer takes place on the basis of suitable safeguards in accordance with Art. 46 GDPR (in particular EU Standard Contractual Clauses, supplementary protection measures, and, where applicable, other permissible transfer mechanisms). Other storage and processing takes place in Europe as far as technically possible. The sub-processors used and safeguards are listed in Annex 2 of the DPA.

(5) Exclusion of Training Use: End-customer content of the customer is not used to train, fine-tune, or otherwise improve AI models that would benefit other customers or third parties. anny contractually ensures that this also applies to technical sub-processors used.

Section 9 Storage Periods

(1) Unless the customer issues a different instruction, the following standard storage periods apply:

Call recordings (audio, voice channels only)
7 days after the call, then automated irretrievable deletion, unless configured otherwise by the customer

Transcripts and call logs (voice channels)
In accordance with legal requirements

Message and conversation histories (text channels)
In accordance with the channel-specific period according to the "Channels" Annex, otherwise in accordance with legal requirements

Web widget logs and cookie/session data (web chat widget)
In accordance with the channel-specific period according to the "Channels" Annex; cookie/session data only to the extent necessary

Configurations, prompts, and knowledge base
For the duration of the contractual relationship

System and security logs
In accordance with legal requirements

Usage and billing data (excluding content)
In accordance with statutory retention obligations (in particular Section 147 AO)

(2) Upon instruction of the customer, call recordings, transcripts/call logs, message/conversation histories, as well as configurations, prompts, and the knowledge base will be deleted without undue delay, at the latest within 60 days, or made available in a common machine-readable format.

Section 10 AI Output, Hallucinations, and Booking Guarantee

(1) The customer notes and expressly acknowledges through use that content and answers generated by the AI assistant (hereinafter "AI Output") may contain incorrect, incomplete, or misleading information (so-called "hallucinations").

(2) AI Output does not claim to be correct, up-to-date, or error-free. anny owes the proper technical delivery of the AI assistant, but does not guarantee the accuracy of content in information generated by the AI in the interaction. This applies in particular to information from the AI assistant regarding prices, availabilities, opening hours, or performance characteristics — such statements (whether oral in phone calls or written in messages) are not binding commitments.

(3) The customer is obliged to check AI Output for plausibility before business-critical or legally relevant uses and, if necessary, review it humanly. In particular, anny recommends checking the knowledge base stored for the AI assistant for accuracy and relevance on a regular basis.

(4) anny is not liable for damages resulting from the customer or third parties relying on incorrect AI statements in the interaction, unless caused by anny intentionally or through gross negligence.

(5) Booking Logic and Booking Guarantee. Notwithstanding the preceding paragraphs, anny ensures that bookings placed via anny AI are processed entirely on the basis of the data configured by the customer in anny — in particular availabilities, time slots, buffer times, prices, and cancellation conditions. The technical booking logic is not based on the interaction content of the AI assistant, but exclusively on the configurations stored in the anny system. Consequently, the result of a booking is always governed by what is configured in anny — not by what the AI assistant stated during the interaction.

Section 11 Responsibility for End-Customer Content

(1) The customer is solely responsible for all content generated, distributed, or processed through their use of anny AI — including the AI instances configured or deployed by them.

(2) The customer ensures that this content does not infringe third-party rights, violate statutory regulations, or contain misleading or impermissible statements.

(3) The customer indemnifies anny against all claims of third parties resulting from unlawful or abusive use of anny AI or the content generated by the AI assistant, insofar as the customer is responsible for this use.

Section 12 Availability

(1) anny guarantees an average availability of anny AI of 99.0% on an annual average, measured at the output of the anny infrastructure. Planned maintenance work will — as far as possible — be announced at least 5 business days in advance and preferably carried out outside of main business hours (Monday to Friday, 8:00 AM – 6:00 PM).

(2) Outages due to the following are not included in the availability calculation:

• Force majeure (e.g., natural disasters, grid failures of third parties, cyberattacks);

• Disturbances in the public telecommunications network or disturbances, suspensions, or changes to the services of the respective channel providers (e.g., phone providers, WhatsApp/Meta, Instagram, Slack, Microsoft);

• Circumstances for which the customer or third parties are responsible.

(3) anny AI is not a replacement for personal customer service. anny does not guarantee specific booking or conversion results achieved by the AI assistant.

Section 13 Liability

(1) The liability of anny for damages from the use of anny AI is — as far as legally permissible — limited to the net fee paid by the customer for anny AI in the 12 calendar months preceding the damaging event. Mandatory data protection liability regulations, in particular pursuant to Art. 82 GDPR, remain unaffected.

(2) This limitation of liability does not apply in case of:

• (i) intent or gross negligence on the part of anny;

• (ii) damages arising from injury to life, body, or health;

• (iii) damages for which anny has assumed a guarantee;

• (iv) liability under the Product Liability Act.

(3) Claims of the customer for damages from the use of anny AI expire in 2 years after the customer becomes aware of the damage and the identity of the party liable, unless shorter statutory periods apply.

(4) anny is not liable for the content of interactions conducted by the AI assistant, insofar as it is based on the knowledge base configured by the customer. The customer bears the content responsibility for their configuration.

Section 14 Term and Termination of anny AI

(1) The agreement on anny AI commences upon activation by the customer and runs for an indefinite period. There is no minimum term.

(2) The customer can terminate anny AI at any time with a notice period of 30 days to the end of the current billing month. Termination is carried out via the anny admin area or in text form.

(3) anny can terminate anny AI with a notice period of 30 days to the end of the month. The right to extraordinary termination for good cause remains unaffected for both sides. Good cause for anny exists in particular in case of repeated or serious violations by the customer of Sections 5, 6, or 7 of this Supplementary Agreement.

(4) Upon termination of anny AI, the assigned channel accesses are deactivated (in the phone use case, in particular the assigned phone number). Upon request within 30 days after the end of the contract, the customer will receive an export of their configuration data in a common machine-readable format. All end-customer content will be deleted at the latest 60 days after the end of the contract, unless statutory retention obligations prevent this.

(5) The possibility of porting phone numbers upon termination depends on technical and regulatory options and must be coordinated with anny in advance.

Section 15 Special Provisions for Internal Channels (Slack, MS Teams)

(1) If the customer activates an internal channel (especially Slack or MS Teams in internal use after logging in), the use of anny AI is directed at employees or other internal authorized persons of the customer. In this case, the data subjects are regularly the employees of the customer.

(2) As the controller and, if applicable, the employer, the customer is solely responsible for ensuring a suitable legal basis for the processing of employee data (in particular Section 26 BDSG / Art. 88 GDPR) as well as observing any co-determination rights of the works council (especially with regard to a possible behavior or performance monitoring) and other labor law requirements. anny does not owe any legal advice in this regard.

(3) Internal channels are connected via the official app or bot integration of the respective provider (e.g., Slack App, MS Teams Bot). The terms of use and privacy policies of the respective provider apply additionally. The specific data flow and the providers used are set out in the "Channels" Annex and Annex 2 of the DPA.

(4) Otherwise, the provisions of this Supplementary Agreement and the DPA apply analogously to internal channels, unless Section 15 states otherwise.

Section 16 Final Provisions

(1) This Supplementary Agreement and the anny GTC together form the contractual basis for the use of anny AI. In addition, the anny GTC in their current version shall apply complementarily.

(2) anny reserves the right to amend this Supplementary Agreement — including the "Channels" Annex — with an announcement period of 30 days in text form. The addition of further channels to the "Channels" Annex, which does not impose additional obligations on the customer and does not deteriorate the level of protection, can take place without separate announcement. The customer is deemed to have accepted the changes unless they object to an announcement-based amendment in text form within 30 days of receiving the notification of change. anny will refer to this legal consequence separately in the notification of change. In the event of an objection, anny is entitled to continue anny AI under the previous conditions until the end of the current billing month and to terminate it thereafter. Changes to the DPA are strictly governed by the amendment provisions of the DPA.

(3) German law applies. The venue for disputes with merchants, legal entities under public law, or special public-law funds is Cologne.

Last updated: June 2026

anny GmbH · Cäcilienstraße 30 · 50667 Köln · anny.co

"Channels" Annex (Channel Matrix)

This Annex is an integral part of the Supplementary Agreement and describes the channel-specific details. It is expandable: further channels can be added by adding a table row without having to change the remaining text of the agreement. "Recording/Log" refers to the default form of documenting the interaction; "Transparency" means the channel-appropriate indication of the AI character; "Billing" means the billable unit according to Section 3.

As of: June 2026. The entries in the column "Providers/Sub-processors" are not exhaustive; the current Annex 2 of the DPA is authoritative in each case.

Appendix: Template for the Customer's Privacy Policy

Phone
Type: Voice
Audience: external
Identifier: Phone number (MSISDN)
Recording/Log (Default): Audio recording + transcript (enabled by default)
Transparency: Voice announcement at the start
Providers/Sub-processors: Telephony providers, STT/TTS/voice models
Third-country transfer: Yes (individual voice models)
Storage period: Audio 7 days; Transcript according to Section 9
Billing: Call minutes

WhatsApp Call
Type: Voice
Audience: external
Identifier: WhatsApp/phone number
Recording/Log (Default): Audio recording + transcript (enabled by default)
Transparency: Voice announcement/hint at the start
Providers/Sub-processors: Meta (WhatsApp), telephony/voice models
Third-country transfer: Yes
Storage period: Audio 7 days; Transcript according to Section 9
Billing: Call minutes

WhatsApp
Type: Text
Audience: external
Identifier: WhatsApp/phone number, profile name
Recording/Log (Default): Message history as log
Transparency: Notice in first message/chat
Providers/Sub-processors: Meta (WhatsApp) or WhatsApp Business Solution Provider
Third-country transfer: Yes
Storage period: Message history according to Section 9
Billing: Messages

Instagram
Type: Text
Audience: external
Identifier: Instagram handle/ID, profile name
Recording/Log (Default): Message history as log
Transparency: Notice in first message/chat
Providers/Sub-processors: Meta (Instagram)
Third-country transfer: Yes
Storage period: Message history according to Section 9
Billing: Messages

Web Chat Widget
Type: Text
Audience: external
Identifier: Web session/device/IP identifier
Recording/Log (Default): Message history as log
Transparency: Visible notice in the chat window
Providers/Sub-processors: Web widget hosting/CDN
Third-country transfer: depending on provider
Storage period: Message history according to Section 9; Cookie/session data only where necessary
Billing: Messages

Slack
Type: Text
Audience: internal (after login)
Identifier: Slack user ID/workspace
Recording/Log (Default): Message history as log
Transparency: Notice upon activation/first message
Providers/Sub-processors: Slack (Salesforce)
Third-country transfer: depending on provider
Storage period: Message history according to Section 9
Billing: Messages

MS Teams
Type: Text
Audience: internal (after login)
Identifier: Teams user ID/tenant
Recording/Log (Default): Message history as log
Transparency: Notice upon activation/first message
Providers/Sub-processors: Microsoft (Teams)
Third-country transfer: depending on provider
Storage period: Message history according to Section 9
Billing: Messages

This section is not a part of the contract, but an non-binding text template. Customers using anny AI are obliged under Art. 13/14 GDPR to expand their privacy policy with information on the use of the AI assistant via the activated channels. The following text can serve as a starting point and should be adapted to the individual circumstances and the channels actually used. Review from own legal counsel is recommended.

Sample Text: Addendum to the Privacy Policy for Users of anny AI

Use of anny AI (AI-based assistant via various communication channels)

We use the product anny AI, a service of anny GmbH, Cäcilienstraße 30, 50667 Köln (hereinafter "anny"), for our digital customer communication and appointment/booking processes. anny AI can be provided via various channels, e.g., phone, WhatsApp, WhatsApp Call, Instagram, a web chat widget on our website, and — for internal purposes — Slack or MS Teams. Please adjust this list to the channels actually used by you.

What is anny AI? anny AI is an AI-powered product and feature portfolio that automatically processes requests and supports booking processes. Incoming interactions are answered automatically. At the beginning of the interaction, you will be informed in a channel-appropriate way that you are communicating with an AI system (for voice channels through an announcement, for text channels through a notice in the chat).

What data is processed?

Depending on the channel, the following personal data may be processed in the course of an interaction:

• Your channel-typical identifier (e.g., phone or WhatsApp number, Instagram handle, for our web chat widget your IP address and session/device data, for Slack/MS Teams your internal user ID)

• Interaction content (voice, text or message data) that you express in exchange with the AI assistant

• Date, time, and duration of the interaction

• Transcripts, message histories, and summaries generated by the AI assistant

• Booking data, if you submit a booking or appointment request

• Recording of the conversation (audio), if you use a voice channel and the recording function is enabled

Purpose and Legal Basis of Processing

The processing of your data is carried out for the purpose of processing your requests, booking inquiries, and other requests, and to ensure our accessibility via the channels used. The legal basis is Art. 6 para. 1 lit. b GDPR (contract fulfillment or pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient communication and accessibility).

If a call is recorded over a voice channel, you will be expressly informed at the beginning and asked for your consent. The legal basis for the recording is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time with future effect.

If our web chat widget uses cookies or comparable technologies that are not absolutely necessary for operation, we will obtain your consent in accordance with Section 25 TDDDG or Art. 6 para. 1 lit. a GDPR.

For internal channels (Slack, MS Teams), use regarding employees is governed by Section 26 BDSG / Art. 88 GDPR; in addition, corporate regulations or works agreements may apply.

Order Processing

We have concluded a data processing agreement with anny GmbH in accordance with Art. 28 GDPR.

Processing of your data takes place primarily within the European Union. Insofar as in individual cases certain functions or channels (e.g., specific voice models or the messaging services WhatsApp/Instagram) technically require processing outside the EU, the transfer takes place on the basis of suitable safeguards in accordance with Art. 46 GDPR (e.g., EU standard contractual clauses and additional protective measures). Other storage and processing takes place in Europe as far as technically possible.

Storage Periods

Your data will only be stored for as long as is necessary to achieve the processing purpose:

• Call recordings (audio, voice channels only): automatic deletion after 7 days, unless configured differently by the customer

• Transcripts, message and conversation histories: deletion in accordance with contractually agreed periods; at the latest 60 days after the end of the contract, unless statutory retention obligations exist

• Booking data: in accordance with the general storage periods of our privacy policy

Automated Decision-Making

The AI assistant does not make fully automated decisions within the meaning of Art. 22 GDPR that have legal effects on you or significantly affect you in a similar manner. Booking requests captured by the assistant are processed further by our system; you can contact us at any time to correct or cancel a process.

Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) as well as the right to data portability (Art. 20 GDPR) towards us as the controller at any time. Insofar as processing is based on a legitimate interest, you have a right of objection pursuant to Art. 21 GDPR. To exercise your rights, please contact: [Name of company], [Email address of data protection contact of company]

You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for you is: [Responsible data protection supervisory authority]

End of template — please adapt to individual circumstances and have reviewed legally

Data Processing Agreement (DPA) — anny AI

pursuant to Art. 28 GDPR

between

the Customer (hereinafter "Controller") — identified by the contact details stored in the anny account —

and

anny GmbH, Cäcilienstraße 30, 50667 Köln (hereinafter "Processor" or "anny")

— jointly the "Parties" —

This DPA is part of the Supplementary Agreement anny AI and enters into force with the activation of anny AI by the customer. It specifies the data protection duties of the parties within the scope of using anny AI. anny AI can be made available through various communication channels ("Channels") (e.g., phone, WhatsApp, WhatsApp Call, Instagram, web chat widget, Slack, MS Teams). Which channels are activated results from the configuration of the customer. Insofar as a voice channel (especially the phone use case) is activated, the voice- or phone-specific processings (especially call answering, transcription, voice models, and telephony) apply; insofar as text channels are activated, the message-related processings apply accordingly.

Art. 1 Subject Matter and Duration of Processing

(1) anny processes personal data on behalf of the Controller, which arises in the course of using anny AI via the activated channels. The subject matter of the processing is set out in the Supplementary Agreement anny AI.

(2) The duration of the processing corresponds to the term of the Supplementary Agreement anny AI. Upon termination of the Supplementary Agreement, personal data will be deleted or returned in accordance with Art. 7 of this DPA.

Art. 2 Nature and Purpose of the Processing

(1) anny processes personal data exclusively for the purpose of providing anny AI, in particular:

• Receipt and processing of incoming interactions (calls and/or messages) by the AI assistant via the activated channels (including the phone use case)

• Creation and storage of transcripts, message and conversation histories, and summaries

• Processing and transmission of booking requests to the anny booking platform

• Sending booking confirmations to users (e.g., confirmation SMS for voice channels or confirmation message in the respective text channel)

• Provision of interaction/call logs in the anny admin area of the Controller

• Optional call recording for voice channels (if activated)

• Operation, maintenance, and securing the availability of the platform

(2) Processing for other purposes — in particular for marketing purposes of anny, for transfer to third parties, or for training of AI models — does not take place.

Art. 3 Categories of Personal Data

Within the scope of order processing — depending on the activated channel — the following categories of personal data may be processed:

Special categories of personal data within the meaning of Art. 9 GDPR may also incidentally arise in the course of use (in particular through free voice or text inputs by users). The Controller remains responsible for the legal basis and authorization of the processing. anny processes such data exclusively within the scope of documented instructions and applying enhanced technical and organizational protection measures in accordance with Art. 32 GDPR.

Art. 4 Categories of Data Subjects

Channel-typical identifier (phone/WhatsApp number/MSISDN, Instagram handle/ID, web session/device/IP identifier, Slack/Teams user ID)
Users

Profile data of the respective channel (e.g., profile name for WhatsApp/Instagram)
Users

Interaction content (voice data, transcripts, message and conversation histories, summaries)
Users

Booking data (date, time, service, name)
Users / Bookers

Interaction/call metadata (date, time, duration)
Users

Call recordings (audio, if activated for voice channels)
Callers

Web widget data (IP address, device/cookie/session data)
Website visitors

Internal user IDs and associated employee data (internal channels Slack/MS Teams)
Employees of the Controller

Configuration data (prompts, knowledge base, greeting texts)
Customers (Controllers)

Contact details of the Customer
Controllers / their employees

• Users of external channels (end customers and other persons who interact with the Controller's AI assistant via an external channel — e.g., phone, WhatsApp, WhatsApp Call, Instagram)

• Visitors of the Controller's website who use the web chat widget

• Employees and other internal authorized persons of the Controller who use internal channels (especially Slack, MS Teams)

• Employees and authorized agents of the Controller, insofar as they use the configuration interface

Art. 5 Duties of anny as Processor

(1) Binding Nature of Instructions. anny processes personal data exclusively on documented instructions from the Controller. The instructions of the Controller result from the Supplementary Agreement anny AI and from separate written or electronic instructions. If anny considers an instruction to be in conflict with data protection law, anny shall inform the Controller immediately.

(2) Confidentiality. anny ensures that all persons authorized to process the data are committed to confidentiality or are subject to an appropriate statutory duty of confidentiality.

(3) Technical and Organizational Measures. anny takes appropriate technical and organizational measures pursuant to Art. 32 GDPR to guarantee a level of security appropriate to the risk. The measures in place at the time of contract conclusion are described in Annex 1 of this DPA. anny is entitled to adapt the measures, provided that the level of protection is not compromised.

(4) Sub-processors. anny uses sub-processors in accordance with Art. 6 of this DPA to perform the services.

(5) Support of the Controller. anny supports the Controller — as far as possible and reasonable — in fulfilling its obligations under Art. 32 to 36 GDPR (data security, notification of personal data breaches, data protection impact assessments, prior consultation) and in responding to enquiries from data subjects under Art. 12 to 22 GDPR.

(6) Notification of Data Breaches. anny reports personal data breaches occurring on anny's side to the Controller immediately and without undue delay, but at the latest within 72 hours of becoming aware of them. The notification is sent to the Controller's email address stored in the anny account. anny provides the Controller with the information necessary for a notification to the supervisory authority.

(7) Erasure and Return. After completion of processing, anny deletes or returns personal data at the choice of the Controller, unless there is a statutory retention obligation. Details are regulated in Art. 7.

(8) Auditing and Control. anny makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for audits — including inspections — conducted by the Controller or an auditor mandated by the Controller. The Controller shall announce audits at least 4 weeks in advance. Audits must not disproportionately affect ongoing operations. Costs of the audit are borne by the Controller; in the case of audits by third parties, anny may demand reimbursement of the additional effort.

Art. 6 Sub-processors

(1) The Controller hereby grants anny a general authorization to deploy the sub-processors listed in Annex 2. Annex 2 is structured channel-dependently and will be supplemented accordingly when further channels are added.

(2) anny concludes an agreement with each sub-processor which imposes at least the same data protection obligations on the sub-processor that bind anny under this DPA (Art. 28 para. 4 GDPR).

(3) If anny intends to engage a new sub-processor or replace an existing one, anny informs the Controller at least 30 days in advance in text form. The Controller may object to changes for justified data protection reasons within 14 days of notification. If no agreement can be reached, the Controller is entitled to terminate the Supplementary Agreement anny AI extraordinarily.

(4) anny remains fully liable to the Controller for the performance of the sub-processor's data protection obligations.

Art. 7 Erasure and Return of Data

(1) Upon termination of the Supplementary Agreement anny AI, anny deletes all personal data of the Controller and its users, unless statutory retention obligations prevent this. Erasure will take place at the latest 60 days after the end of the contract.

(2) Upon request, anny will make an export of the configuration data (knowledge base, prompts, settings) available to the Controller in a common machine-readable format within 30 days after the end of the contract.

(3) During the term of the contract, the standard storage periods set out in Section 9 of the Supplementary Agreement anny AI shall apply, unless the Controller issues a differing instruction.

(4) From technical backups, personal data will be overwritten with the next regular backup cycle, at the latest within 35 days. During this period, it is blocked against any further active processing.

Art. 8 Place of Processing

(1) anny generally processes personal data within the European Union.

(2) If individual sub-processors process data outside the EU, this takes place exclusively on the basis of suitable safeguards in accordance with Art. 46 GDPR, in particular EU Standard Contractual Clauses (SCC) in the current version, as well as additional protective measures. This applies in particular to:

• individual voice, speech-to-text, text-to-speech, and AI model providers (voice channels) which are technically only available with US hosting;

• the integration of the messaging channels WhatsApp and Instagram via Meta Platforms, where processing can also take place outside the EU (in particular USA);

• if applicable, providers of internal channels (Slack/Salesforce, Microsoft/Teams) as well as web widget hosting/CDN.

Other storage and processing takes place within the EU as far as technically possible. The specific third-country transfers and safeguards used are set out in Annex 2.

Art. 9 Exclusion of Training Use

anny and the sub-processors deployed by anny do not use personal data of the Controller and its users to train, fine-tune, evaluate, or otherwise improve general AI models that would benefit other customers or third parties. anny ensures this through corresponding contractual agreements with the sub-processors (in particular "Zero Data Retention" / "No Training" configurations with AI providers, as far as available).

Art. 10 Duties of the Controller

(1) The Controller is solely responsible for the lawfulness of processing personal data within the framework of anny AI. This includes in particular:

• compliance with information duties under Art. 13/14 GDPR towards users (anny provides a sample text as an appendix to the Supplementary Agreement for this purpose)

• the existence of a suitable legal basis for each processing activity

• compliance with Section 201 StGB when call recording is enabled on voice channels (obtaining consent of callers)

• when using a web chat widget, compliance with the requirements for cookies and comparable technologies (in particular Section 25 TDDDG) and, if necessary, obtaining consent

• for internal channels (Slack, MS Teams), compliance with employee data protection regulations (in particular Section 26 BDSG / Art. 88 GDPR) and any co-determination rights of the works council

• observance of the terms of use and platform policies of the respective channel providers

• responding to data subject enquiries under Art. 12 to 22 GDPR

(2) The Controller issues instructions for processing personal data in text form (email is sufficient). Verbal instructions must be confirmed in writing immediately.

(3) The Controller informs anny immediately if it detects errors or irregularities in the processing of personal data by anny.

Art. 11 Liability

The liability of the parties for violations of data protection provisions is governed by the statutory regulations (in particular Art. 82 GDPR) as well as the liability regulations of the Supplementary Agreement anny AI. Mandatory data protection liability regulations remain unaffected. In internal relations between the parties, each party is liable for the share of damage for which it is responsible.

Art. 12 Final Provisions

(1) This DPA takes precedence over the provisions of the Supplementary Agreement anny AI in data protection matters.

(2) Amendments to this DPA require text form. anny may adapt this DPA with a notice period of 30 days, provided the amendments are necessary to comply with new statutory or supervisory requirements or do not compromise the level of protection for the Controller.

(3) Should individual provisions of this DPA be or become invalid, this shall not affect the validity of the remaining provisions.

(4) German law applies. The venue is Cologne.

Annex 1: Technical and Organizational Measures (TOM)

The measures described below represent the state at the time of contract conclusion. anny continuously updates the TOM.

1. Physical Access Control

• Server infrastructure in certified data centers within the EU

• Access to server rooms only for authorized personnel

2. System Access Control

• Access to production systems only via encrypted connections (VPN / SSH)

• Multi-factor authentication for all administrative accesses

• Role-based authorization concept (Principle of Least Privilege)

3. Data Access Control

• Strict tenant separation: customer data is technically isolated from each other

• Logging of all administrative accesses to personal data

4. Transfer Control

• Personal data of different customers is technically processed and stored separately

• Test and production environments are strictly separated

5. Pseudonymization

• Interaction and call metadata are stored in pseudonymized form internally, as far as compatible with the processing purpose

6. Integrity

• Encryption of all personal data during transmission (TLS 1.2 or higher)

• Encryption of stored personal data (AES-256 or equivalent)

7. Availability and Resilience

• Regular automated backups

• Redundant system architecture to ensure availability (SLA 99.0% p.a.)

• Emergency plans and recovery procedures documented and regularly tested

8. Data Protection Management

• Data protection officer designated (if legally required)

• Regular employee training on data protection

• Procedures for detecting and reporting data breaches implemented

9. Channel-Specific Measures

• Web Chat Widget: secure integration of the widget, protection measures against cross-site scripting/content injection, limiting collected cookie/session data to what is necessary

• Messaging Channels (WhatsApp, Instagram): connection via official, secured provider interfaces; transport encryption in accordance with provider requirements

• Internal Channels (Slack, MS Teams): connection via official app/bot integration with provider-side authentication and authorization control

Annex 2: Sub-processors

As of: June 2026. anny informs about changes pursuant to Art. 6 para. 3 of this DPA. The column "Channel" indicates which channels a sub-processor is assigned to; "all" refers to services deployed across all channels. The list will be supplemented accordingly when further channels are added.

The list of sub-processors is continuously updated. Changes are carried out pursuant to Art. 6 para. 3 of this DPA.

As of: June 2026

anny GmbH · Cäcilienstraße 30 · 50667 Köln · anny.co

Dialogine GmbH
Function: Operation of the AI Assistant platform, voice/message processing, forwarding
Channel: all
Seat: Cologne, Germany (EU)
Third-country transfer: Yes, for selected models/channels
Warranty: EU-SCC

This DPA is deemed concluded with the activation of anny AI by the customer. A separate signature is not required; the confirmation of activation in the anny admin area is deemed as legally binding consent.