Data location and government access

This page contains the information required by Article 28(1) of the Data Regulation (EU) 2023/2854 ("Data Act"):

• the jurisdiction to which the infrastructure of each of our services is subject (point (a)), and
• the technical, organisational and contractual measures NexAI has taken to prevent government access from third countries to non-personal data stored in the EU where such access would conflict with EU or German law (point (b)).

For personal data the GDPR rules on transfers to third countries apply in addition (Article 44 et seq. GDPR). The details are in the data processing agreement (Annex B to the framework agreement, section 10 and Appendix 2) and in our privacy policy.

1. NexAI and our servers

• NexAI: NexAI – Next Generation Artificial Intelligence GbR, Untere Bergstraße 13, 74586 Frankenhardt-Honhardt, Germany. NexAI is subject to German and EU law.
• Our servers: All systems NexAI operates itself run at Hetzner Online GmbH (Gunzenhausen) in data centres in Germany. The backups are there too. Hetzner evidences its security with a BSI C5 attestation and ISO/IEC 27001 certification.
• These systems are subject to German and EU law.

2. Infrastructure per service

Phone line of the Voice Agent, where set up this way: easybell GmbH, Berlin. This is a telecommunications service, not data processing on our behalf.

3. Services based in third countries

These services are based in the USA or belong to a parent company there. US law applies to these companies. With Vapi, Soniox, OpenAI and Anthropic, data is held in the USA for limited periods.

These services use further processors. Their own lists apply: Vapi, OpenAI, Anthropic, Amazon Web Services, Google Workspace, Resend, Hetzner.

4. Our measures against unlawful government access

Technical

• All systems NexAI operates itself, and their backups, are located in Germany.
• Each customer's data is stored separately. In the NexAI Mail Agent each customer has an own instance with an own encrypted database and own key. In the NexAI CRM the database separates customers row by row.
• Stored data is partly encrypted: in the Mail Agent the whole database, in the CRM among others call transcripts and access keys, in the automations the credentials for customer services. The keys are held by NexAI, not by the services in third countries.
• Data is encrypted in transit over the internet (TLS). One exception at present is the voice connection of the Voice Agent: between telephony provider, phone system and platform provider, signalling and voice are not encrypted end to end.
• With services in third countries NexAI stores as little as possible: no audio recording in the Voice Agent, call log at the platform provider for around 14 days, no stored successful workflow runs, language models without training on your data.
• Only the two partners of NexAI have access to the servers.

Contractual and legal

• Every service has a data processing contract that imposes the same data protection obligations as our agreement with you.
• NexAI bases transfers to the USA on the EU-U.S. Data Privacy Framework (Article 45 GDPR) or on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR). For transfers based on the clauses NexAI has prepared transfer impact assessments. Customers receive them and a copy of the clauses on request.
• If the adequacy decision lapses for a recipient, NexAI bases the transfer on the clauses or ends it.
• NexAI announces a new service at least 14 days in advance. You can object and, if NexAI cannot do without the service, terminate the affected service.

Organisational

• NexAI processes your data only on your documented instructions.
• The partners and everyone involved are bound to confidentiality.
• NexAI does not pass customer data to AI tools during maintenance or troubleshooting.
• NexAI reviews these measures at least once a year and on every material change.

5. If an authority from a third country demands data

From NexAI:

• NexAI processes your data only on your instructions or where EU or German law requires it. A demand by a court or authority of a third country is not such a requirement.
• Such a demand is recognised only if it is based on an international agreement, such as a mutual legal assistance treaty (Article 48 GDPR; Article 32(2) Data Act).
• For non-personal data Article 32(3) to (5) Data Act applies: without such an agreement NexAI discloses data only if the conditions set out there are met, and only the minimum amount. NexAI informs you of the demand beforehand; the only exception is for as long as necessary for law enforcement.

From a service in a third country:

• If a service tells NexAI that an authority of a third country has demanded or accessed your data, NexAI informs you without undue delay in text form, as far as legally permitted. The same applies if NexAI learns that the law in the recipient country undermines the agreed safeguards.
• You can then instruct NexAI to suspend transfers to this service. If the service cannot be provided without it, you can terminate it.

6. What these measures cannot do

Language models and the call control of the Voice Agent must process content in plain text. Encryption does not protect against access at the provider there. NexAI therefore limits what is stored there and states the periods in the data processing agreement (Annex B, Appendix 3).

7. Contact

Questions on data location and third countries: mbt@nex-a-i.com. Which data you can take with you and how: Data formats and switching.