This agreement specifies the data protection obligations of the parties arising from the agreement on the use of the AltOwl service (the "Main Agreement"). It governs the processing of personal data on behalf of the customer pursuant to Art. 28 of the General Data Protection Regulation (GDPR).

Processor: s1 media, Patrick Tangemann & Kolja Wagschal GbR, Uesener Feldstraße 20a, 28832 Achim, Germany (the "Processor" or "AltOwl").

Controller: the customer who uses the AltOwl service and has entered into the Main Agreement (the "Controller" or "Customer"), identified by the user account created at registration.

Subject Matter and Duration

(1) The subject matter is the automated creation of alternative texts (alt texts) for images that the Customer submits via the AltOwl WordPress plugin or the AltOwl API. The images are analysed and described using AI services.

(2) The duration of this agreement follows the Main Agreement. It ends when the user account is deleted, at the latest upon termination of the Main Agreement.

Nature, Purpose and Scope of Processing

(1) Purpose: creation of accessible image descriptions for the Customer's website.

(2) Nature of processing: receipt of image URLs or image files, transmission to an AI provider for image analysis, storage of the result, return to the Customer. For certain formats (including SVG, AVIF, TIFF, GIF) AltOwl briefly downloads the image, converts it into a format the AI providers can read and deletes the copy once the job completes, at the latest after 1 hour(s).

(3) Types of data:

• image data and image URLs submitted by the Customer, including any persons, places, vehicles, licence plates, text or other information recognisable in them
• processing options chosen by the Customer (language, custom instructions, instruction regarding the description of persons)
• technical job metadata (timestamps, status, file name, AI model used)
• the generated alternative texts

(4) Categories of data subjects: persons depicted in the images (e.g. employees, customers, visitors), persons whose data is recognisable in image text, and persons operating the plugin on behalf of the Customer (usage data).

(5) Special categories: the service is not intended for the targeted processing of special categories of personal data (Art. 9 GDPR). The Customer ensures that images revealing health data, religious or political beliefs, sex life or biometric data for unique identification are only submitted where a legal basis exists. AltOwl creates no biometric templates and does not identify persons.

Obligations of the Processor

(1) AltOwl processes personal data solely within the scope of this agreement and on the documented instructions of the Customer (§ 5). No processing for its own purposes takes place. In particular, customer images are not used to train AI models — neither by AltOwl nor, under the terms of the paid services used, by the AI providers.

(2) AltOwl binds all persons with access to the data to confidentiality (Art. 28(3)(b) GDPR).

(3) AltOwl implements the technical and organisational measures described in Annex 1 (Art. 32 GDPR) and reviews them regularly. Measures may evolve provided the level of protection is not reduced.

(4) AltOwl assists the Customer in responding to data subject requests (Art. 12–22 GDPR), in data protection impact assessments and in consultations with the supervisory authority insofar as they relate to this processing.

(5) AltOwl informs the Customer without delay if it considers an instruction to infringe data protection law and may suspend the instruction until it is confirmed or amended.

(6) AltOwl is not required to appoint a data protection officer under § 38 BDSG. Contact for data protection matters: datenschutz@s1-media.de.

(7) AltOwl maintains a record of processing activities pursuant to Art. 30(2) GDPR.

Obligations of the Controller

(1) The Customer is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. In particular, the Customer ensures that it may lawfully process the submitted images and transmit them to AltOwl.

(2) The Customer informs AltOwl without delay of any errors or irregularities it detects in the processing.

(3) The Customer names AltOwl as a processor in its own privacy policy where required under Art. 13, 14 GDPR. AltOwl provides a suggested text for this purpose.

(4) The Customer reviews generated alternative texts before publication. The texts are created automatically and may describe persons or objects inaccurately.

Instructions

(1) Instructions are generally issued through the functions of the service: submitting an image, the selected processing options (e.g. language, "do not describe physical characteristics of persons", custom instructions) and deleting jobs or the user account constitute documented instructions.

(2) Any further instructions must be given in text form (email to datenschutz@s1-media.de). Verbal instructions must be confirmed in text form without delay.

(3) Persons authorised to issue instructions on the Customer's side are those with access to the user account or the API keys.

Sub-processors

(1) The Customer grants AltOwl general authorisation (Art. 28(2) sentence 1 GDPR) to engage the sub-processors listed in Annex 2. AltOwl concludes a contract with each sub-processor imposing the same data protection obligations as set out in this agreement.

(2) AI providers: AltOwl uses several AI providers for image description and automatically selects one per job (availability, load, quality). The provider that handled a specific job is logged and can be disclosed on request. The Customer cannot restrict processing to individual providers.

(3) If AltOwl intends to add or replace a sub-processor, it informs the Customer at least 30 days in advance by email to the address stored in the user account. The Customer may object within this period in text form for a substantial data protection reason. If no amicable solution is reached, the Customer may terminate the Main Agreement with effect from the date of the change; unused credits are refunded pro rata.

(4) The current list is available at https://altowl-staging.s1-media.de/subprocessors.

Processing in Third Countries

(1) AltOwl's servers are located in Germany. Image description is, however, partly performed by AI providers established in or processing in the USA (see Annex 2).

(2) For these transfers AltOwl ensures an adequate level of protection under Chapter V GDPR: through the EU Commission's adequacy decision on the EU-US Data Privacy Framework for certified providers and, in addition, through the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

(3) Only the image and the description prompt are transmitted to the AI providers — no customer identifiers, no account data and no information about the Customer's website unless apparent from the image URL itself.

Audit Rights

(1) AltOwl demonstrates compliance with its obligations by appropriate evidence, in particular this document, the description of the technical and organisational measures and information provided in text form.

(2) Upon prior notice with a reasonable period (at least 14 days) and during normal business hours, the Customer may verify compliance with this agreement, as a rule no more than once per year. The Customer bears the cost of an on-site audit unless it reveals material breaches.

Notification of Personal Data Breaches

(1) AltOwl notifies the Customer of any personal data breach affecting the Customer's data without undue delay and at the latest within 48 hours of becoming aware, by email to the address stored in the user account.

(2) The notification includes, as far as known: the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences and the measures taken or proposed.

(3) AltOwl assists the Customer with its notification obligations (Art. 33, 34 GDPR).

Deletion and Return

(1) AltOwl deletes the Customer's personal data automatically according to the following rules:

• copies of downloaded images (format conversion): once the job completes, at the latest after 1 hour(s)
• image URLs in jobs: after 90 days; the generated alt text and a checksum of the image are retained so that repeated requests for the same image can be answered without renewed AI processing
• job data as a whole: after 365 days
• server logs: after 14 days

(2) Upon termination of the Main Agreement (deletion of the user account) AltOwl deletes all of the Customer's jobs, image URLs, alternative texts and API keys without delay. Data that AltOwl must retain under statutory retention obligations (in particular invoicing data, 10 years under § 147 AO, § 257 HGB) is exempt and is blocked from further processing.

(3) The Customer may export its data in machine-readable form via the user account at any time. The generated alternative texts are in any case stored in the Customer's WordPress installation.

Liability and Final Provisions

(1) The liability of the parties is governed by Art. 82 GDPR and the provisions of the Main Agreement.

(2) In the event of conflict between this agreement and the Main Agreement, this agreement prevails in data protection matters.

(3) Amendments require text form. This agreement is concluded electronically: by acceptance at registration or by confirmation in the user account. AltOwl stores the time, version and IP address of acceptance as evidence.

(4) The law of the Federal Republic of Germany applies. Should individual provisions be invalid, the validity of the remaining provisions is unaffected.

Technical and Organisational Measures (Art. 32 GDPR)

1. Confidentiality

• Physical access control: servers are located in a certified data centre of Hetzner Online GmbH in Germany (authorised personnel only, CCTV, mantrap systems). s1 media has no physical access to the hardware.
• System access control: server access exclusively via SSH key pairs, no password login; access restricted to the two partners. User accounts with password (bcrypt hash, minimum 8 characters), lock-out after too many failed attempts (10 per minute), email verification by double opt-in.
• Data access control: role separation customer/administrator in the application. Each customer sees only its own jobs, keys and invoices. API access only with a personal key; keys are stored encrypted (AES-256, application key outside the database) and never written to logs in clear text.
• Separation control: separate systems for testing (staging) and production with their own databases. Tenant separation in the database via customer ID; reuse of previously generated descriptions for identical images happens exclusively within the same customer account.
• Pseudonymisation: only the image and the description prompt are sent to AI providers — no customer or account data.

2. Integrity

• Transfer control: all connections (browser, WordPress plugin, AI providers, payment provider) exclusively over TLS 1.2 or higher. HTTP Strict Transport Security and security headers are active. Images are transmitted to AI providers only for the duration of the request; AltOwl retains no image copies beyond the job.
• Input control: every processing operation is logged with timestamp, customer account, job and AI provider used. Credit changes are recorded as bookings with balance and are traceable.
• Abuse protection: rate limiting per API key and per IP address, protection against server-side request forgery when loading images (public addresses only, size and format checks), protection against automated registrations.

3. Availability and Resilience

• Backups: daily automatic database backups, retained for 14 days, accessible to administrators only; in addition, daily automatic server backups by the hosting provider with seven restore points.
• Recoverability: the application can be fully restored from source control and database backup; the procedure is documented.
• Fault tolerance: several AI providers with automatic failover; queue with retry logic so that jobs are not lost during temporary outages. System health check endpoint and logging of all incidents.
• Currency: operating system security updates are applied automatically; application dependencies are updated regularly.

4. Procedures for Regular Review

• Data protection management: record of processing activities; review of these measures at least annually and upon every material change of the architecture or addition of a sub-processor.
• Incident management: defined procedure for personal data breaches (detection, containment, assessment, notification to customers within 48 hours, documentation).
• Privacy by default: automatic deletion periods (see § 10), no data collection without purpose, no tracking, no disclosure to third parties for their own purposes, no third-party resources (fonts, scripts) embedded in the application.
• Processor control: data processing agreements with all sub-processors; verification of certifications (e.g. EU-US Data Privacy Framework) before onboarding.

Authorised Sub-processors

Suggested Text for the Customer's Privacy Policy

The following paragraph can be added to the privacy policy of the website on which AltOwl is used:

Automatic image descriptions (alt texts) with AltOwl

To make our website accessible we have alternative texts for images created automatically. For this we use the AltOwl service of s1 media, Patrick Tangemann & Kolja Wagschal GbR, Uesener Feldstraße 20a, 28832 Achim, Germany ("AltOwl"). When an image is uploaded or a description is requested, the image is transmitted to AltOwl and analysed there using an AI service. AltOwl uses the following providers: Google Ireland Limited, OpenAI, L.L.C., Anthropic, PBC. Processing by Google Ireland Limited and OpenAI, L.L.C. and Anthropic, PBC partly takes place in the USA; the transfer is safeguarded by the EU Commission's adequacy decision (EU-US Data Privacy Framework) and the EU Standard Contractual Clauses.
Only the image and information about the desired description are transmitted — no data about you as a visitor of our website. Where persons are recognisable in images this may constitute personal data; persons are not identified. Images are not used to train AI models. Image addresses are deleted by AltOwl after 90 days.

AltOwl acts as our processor (Art. 28 GDPR); a data processing agreement has been concluded. The legal basis is our legitimate interest in an accessible website and in complying with statutory accessibility requirements (Art. 6(1)(f) GDPR). Further information: https://altowl-staging.s1-media.de/privacy