Privacy Policy

The controller for the processing of data on this website and on the Kollegia platform is:

Data protection contact: Shahab Houshangi, legal@kollegia.ai

We process personal data in two roles:

As controller

For the website, registration, the contractual relationship with our customers, billing and technical operation. This policy relates to that.

As processor

For the content that our customers (companies) and their employees bring into their tenants (e.g. employee, competence, process and document data). In that respect, the respective customer company is the controller under data protection law; the basis is our data processing agreement (DPA) under Art. 28 GDPR, including the sub-processors listed therein. Employees of our customers should please direct data subject requests regarding tenant content to their employer; we support the employer in responding.

The website and platform are operated at Hetzner Online GmbH (Gunzenhausen, Germany) in data centres in Germany; a DPA is in place with Hetzner. The database and uploaded files are stored on our servers operated there — no external cloud database or object storage services are used.

On access, technically necessary server logs are processed (IP address, timestamp, requested resource, user agent, referrer).

The fonts used are hosted locally on our servers. No connection to third-party servers is established when the page is loaded.

On registration we process name, business email address, company, password (hashed) and verification codes. Optionally, sign-in via Microsoft Entra ID (single sign-on) is possible; in that case we receive the profile details transmitted by Microsoft (name, email, tenant identifier).

6.1 Transactional emails

We send transactional emails (verification, notifications, system messages) via Microsoft 365 (Microsoft Ireland Operations Ltd.); with Microsoft, a DPA as well as standard contractual clauses and a certification under the EU-U.S. Data Privacy Framework are in place for any transfers to the USA.

6.2 Marketing communication

For marketing communication (e.g. newsletters, product updates) we use the CRM platform ALL ONE (all-one.io); a DPA is in place with the provider. You will only receive marketing emails with your consent or within the scope of § 7(3) UWG to existing customers; you can unsubscribe at any time via the unsubscribe link or by email to legal@kollegia.ai.

6.3 Digital colleague mailboxes

The platform can operate dedicated mailboxes for digital colleagues (name@<customer>.labskills.ai) for customer organisations; we process their content as a processor (section 2).

The core of the platform is AI-assisted digital colleagues. To provide these features we use AI model providers as sub-processors. By default, AI processing takes place on endpoints in the EU:

Within this EU provider pool we may switch at any time for technical reasons (e.g. performance, availability); processing always remains within the EU/EEA.

Optional features with processing in the USA

Individual features that can be expressly activated by the customer organisation use providers with processing in the USA (safeguarded via standard contractual clauses or the Data Privacy Framework): OpenAI (including voice/speech interaction), Anthropic (selectable chat model), Google and Microsoft Bing (AI web search), Parallel (AI research). These features are disabled by default; activation is up to the customer organisation.

For paid plans we process payments via Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland; parent company Stripe, Inc., USA). Stripe processes name, email, billing data and payment information; card data is collected directly by Stripe and does not reach our servers. Stripe safeguards transfers to the USA via standard contractual clauses and the Data Privacy Framework.

To detect and fix technical errors we use Sentry (Functional Software, Inc.). When an error occurs, technical details (error message, stack trace, browser/system information) are processed. Processing takes place in the EU (Sentry EU organisation, Frankfurt data centre); IP addresses are not stored permanently.

If you report an error in the app, we transmit your description as well as any screenshots/recordings you attach and technical context to our project management tool ClickUp (Mango Technologies, Inc., USA; safeguarded via standard contractual clauses). Please attach screenshots without personal data that is not required.

Customer organisations or individual users can connect third-party systems to the platform (e.g. Microsoft SharePoint/Teams, Personio, GetMyInvoices, DATEV, Slack, Asana, ClickUp, Google Gmail/Calendar, own IMAP mailboxes, own MCP servers). These connections are disabled by default and are only set up by the customer organisation or user. Processing then takes place on their behalf; the customer organisation remains responsible for the connected systems (details in the DPA, Annex 2).

We store personal data only for as long as necessary for the stated purposes or as long as statutory retention obligations exist. After the usage relationship ends, tenant data is deleted or returned in accordance with the DPA; backups are overwritten in the regular cycle (at the latest after 35 days). Billing-relevant data is subject to statutory retention periods.

Insofar as we are the controller, you have the following rights regarding your personal data:

To exercise these rights, an email to legal@kollegia.ai is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

We make no automated decisions with legal effect or similarly significant impairment within the meaning of Art. 22 GDPR. Outputs of the AI features are decision support for human decision-makers.

We update this privacy policy when the processing or the legal situation changes. The version published here at any given time applies.

Insofar as we process personal data on behalf of our customers (section 2), the following agreement on the processing of personal data on a commissioned basis under Art. 28 GDPR applies. It is used by Labskills GmbH as processor towards customers (tenants) of the Kollegia platform and is an annex to the respective main contract (SaaS/usage agreement, terms and conditions).

§ 1 Subject matter and duration

(1) The processor provides the client with the software-as-a-service platform Kollegia, including the AI-assisted digital assistants it contains ("Digital Colleagues", hereinafter "DCWs"), modules (including Organisation, Competence, Knowledge Base, Processes, Commercial), connectors and automations in accordance with the main contract. Insofar as it processes personal data on behalf of the client in doing so, this agreement applies.

(2) The term of this agreement corresponds to the term of the main contract. Separate termination is excluded; it ends with the main contract.

(3) The client is the controller within the meaning of Art. 4 no. 7 GDPR and is solely responsible for the lawfulness of the processing. The processor processes the data exclusively within the scope of this agreement and the client's instructions.

(4) Role clarification AI Regulation: Within the meaning of Regulation (EU) 2024/1689 (AI Act), the processor is the provider of the AI systems contained in the platform; the client is the deployer. The resulting obligations of the parties remain unaffected by this agreement; details are governed by the processor's deployer guide in its version applicable at any given time.

§ 2 Type, scope and purpose of the processing

(1) Purpose: Provision and operation of the Kollegia platform for the client, including processing by DCWs (chat, email, voice and channel interactions, scheduled analyses and reports), competence and knowledge management, the commercial modules and the connectors configured by the client.

(2) Type of processing — according to the activated modules and connectors:

• Operation of the platform incl. storage, structuring and provision of the client's data
• AI-assisted processing by DCWs: answering requests, creating analyses, reports and document drafts, executing approved playbooks
• Processing of incoming and outgoing emails of the DCW mailboxes (name@<tenant>.labskills.ai)
• Voice interaction with DCWs — only with the opt-in activated under Annex 3 no. 4
• AI-assisted document/OCR processing (invoices, scans)
• Competence and qualification management (roles, skills, target/actual, training, evidence, onboarding)
• Process and knowledge management (document control, standards, QM/ISO 17025 module)
• Commercial modules (controlling, quotes/invoices, contracts, suppliers, procurement)
• Web search by DCWs (search queries may contain tenant context) — Annex 3 no. 4
• Data import/synchronization via connectors: Microsoft Entra, SharePoint, Teams, Personio, DATEV, GetMyInvoices, email (IMAP), Slack, Asana, ClickUp, Google (Gmail/Calendar), Custom MCP

(3) Categories of data subjects:

• Employees of the client (including applicants, trainees, temporary workers, interns)
• Customers and prospects of the client
• Suppliers and business partners of the client (incl. their contact persons)
• Other communication partners (senders/recipients of emails to DCW mailboxes, Teams/chat conversation partners)

(4) Categories of personal data:

• Master data (name, salutation, function, organisational affiliation, team, role)
• Contact data (address, phone, email)
• Competence and qualification data (skills, target/actual profiles, training and examination evidence, onboarding status, certificates)
• Employee data from connected systems (Personio, Entra) in the configured field scope
• Communication content (chat histories with DCWs, email content incl. attachments, voice interactions, Teams messages, comments)
• Contract and billing data, commercial transaction data (quotes, invoices, receipts, contracts, supplier data)
• Uploaded files and their content (documents, receipts, images)
• Usage and log data (logins, activity logs, audit logs)

(5) Special categories of personal data (Art. 9 GDPR) are not processed unless expressly agreed otherwise. Through the configuration of the connectors (field mapping) and through organisational specifications for uploads, the client ensures that such data is not transmitted.

§ 3 Right of instruction of the client

(1) The processor processes personal data exclusively on documented instruction of the client, including with regard to transfers to third countries — unless it is required to process under Union law or the law of a member state. In that case, it informs the client of the legal requirements before processing, unless the law in question prohibits this on grounds of an important public interest.

(2) Instructions are generally given in text form. Instructions can also be given by configuration within the platform — in particular by activating/deactivating modules, connectors, DCWs, feature switches (e.g. HR features, voice, web search) and field mappings. The platform logs such configuration instructions with user and time.

(3) Authorized to issue instructions on the client's side are the persons stored as administrators in the admin area as well as the contact persons named in the contract.

(4) The recipient of instructions on the processor's side is: Shahab Houshangi, managing director, legal@kollegia.ai

(5) If the processor considers that an instruction violates data protection provisions, it informs the client without delay. It is entitled to suspend execution of the instruction in question until it is confirmed or changed.

(6) Instructions that go beyond the main contract and cause additional effort are remunerated according to effort.

§ 4 Obligations of the processor

The processor undertakes:

• (1) To carry out processing generally within the territory of the European Union or the European Economic Area. For AI inference the following applies: Standard processing takes place on EU endpoints (Annex 2 Part A). Features that use sub-processors with a third-country nexus are shown in Annex 2 Part B and are used only under the conditions of Chapter V GDPR (appropriate safeguards, in particular SCC or EU-U.S. Data Privacy Framework); insofar as they are designed as opt-in, only after activation by the client (Annex 3 no. 4).
• (2) To ensure that all persons authorised to process are committed to confidentiality or are subject to an appropriate statutory duty of confidentiality (Art. 28(3)(b) GDPR). The obligation continues to apply beyond the end of the activity.
• (3) To take and maintain the necessary technical and organisational measures under Art. 32 GDPR (Annex 1). The processor may further develop the measures as long as the agreed level of protection is not undercut; material changes are documented and communicated to the client upon request.
• (4) Not to use customer data for the training, fine-tuning or other improvement of AI models — neither its own nor third-party models — and to oblige its sub-processors accordingly (Annex 3 no. 2).
• (5) To inform the client without delay if it detects a breach of the protection of personal data affecting the processed data (§ 8).
• (6) To support the client, taking into account the nature of the processing and the information available to it, in fulfilling its obligations under Art. 32 to 36 GDPR — in particular in data protection impact assessments regarding the use of the DCWs on employee data. For this purpose, the processor provides a DPIA aid, data flow descriptions and these contract annexes.
• (7) To support the client in responding to requests from data subjects (Art. 12 to 22 GDPR) through appropriate technical and organisational measures — in particular through the export and deletion functions under Annex 3 no. 6 and 7. If a data subject turns directly to the processor, the processor forwards the request to the client without delay and does not answer it itself.
• (8) To provide the client with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
• (9) To name a contact person for data protection matters: Shahab Houshangi, legal@kollegia.ai.
• (10) To maintain a record of the processing activities carried out on behalf under Art. 30(2) GDPR.

§ 5 Obligations of the client

(1) The client is responsible for the lawfulness of the data processing and for safeguarding the rights of data subjects. In particular, it ensures that a viable legal basis exists for the processing it initiates and that the required information obligations (Art. 13, 14 GDPR) are fulfilled.

(2) Employee data: Before processing employee data on the platform — in particular competence, qualification and onboarding data as well as before activating the HR-related functions under Annex 3 no. 5 — the client checks the legal basis (§ 26 BDSG, Art. 88 GDPR) and whether involvement of the works council is required (§ 87(1) no. 6 BetrVG). Activating the relevant functions on the platform counts as a documented instruction and as confirmation that this check has been carried out.

(3) Connectors: The client configures the connected systems (Personio, Entra, SharePoint, Teams, DATEV, GetMyInvoices, Slack, Asana, ClickUp, Google, IMAP mailboxes, custom MCP servers) and the field mapping on its own responsibility and limits the transmission to the required data fields.

(4) Email channel: The client informs its employees and — where necessary — external communication partners that emails to DCW mailboxes are processed by an AI system.

(5) The client informs the processor without delay if it detects errors or irregularities when reviewing the results.

§ 6 Sub-processing relationships

(1) The client hereby grants general written authorisation for the engagement of sub-processors under Art. 28(2) sentence 2 GDPR.

(2) The sub-processors engaged at the time the contract is concluded are listed in Annex 2. The client approves their use upon conclusion of this agreement. Optional sub-processors (Annex 2 Part B) are engaged only upon activation of the respective function by the client.

(3) The processor informs the client of intended changes at least 30 days in advance in text form (also by in-app notification to the administrators). The client can object within 14 days for an important reason grounded in data protection law.

(4) If the client objects and the relevant service cannot be provided without the sub-processor, or only with disproportionate effort, both parties are entitled to terminate the affected part of the service with one month's notice.

(5) The processor contractually binds each sub-processor to data protection obligations corresponding to those of this agreement — including the training prohibition under § 4(4). It is liable to the client for the sub-processor's compliance with these obligations.

(6) Ancillary services without processing of personal data (such as telecommunications or maintenance services) as well as the client's systems that the platform accesses via connectors configured by the client (Annex 2 Part C — e.g. the client's own Microsoft 365 tenant, its own Personio account, customer-configured IMAP mailboxes, DATEV client, the client's own custom MCP servers) do not constitute sub-processing.

§ 7 Technical and organisational measures

(1) The processor takes the technical and organisational measures described in Annex 1 under Art. 32 GDPR.

(2) The measures ensure a level of protection appropriate to the risk, taking into account the state of the art, implementation costs, nature, scope, circumstances and purposes of the processing as well as the likelihood and severity of the risks.

(3) The processor reviews the effectiveness of the measures at least annually.

§ 8 Notification of personal data breaches

(1) The processor notifies the client of any breach of the protection of personal data affecting the data processed on behalf without delay after becoming aware of it, but at the latest within 24 hours.

(2) The notification contains, where available: nature of the breach (categories, approximate number of data subjects and records affected), contact person, likely consequences, measures taken/proposed.

(3) If not all information can be provided at the same time, notification is made in stages without undue further delay.

(4) The processor supports the client in its notification and communication obligations under Art. 33 and 34 GDPR.

(5) The processor does not make notifications to the supervisory authority or to data subjects on its own, insofar as it is not itself legally obliged to do so.

§ 9 Client's audit rights

(1) The client has the right to verify compliance with data protection provisions and the contractual agreements to the extent necessary.

(2) The processor provides the evidence primarily through:

• the provision of the TOM documentation (Annex 1) and its updates
• excerpts from the platform logs (audit log, DCW action log) for its own tenant
• certificates, attestations or audit reports of the sub-processors used (such as ISO 27001, SOC 2)
• the completion of a written questionnaire

(3) If this evidence is insufficient in an individual case, the client can, after giving at least 14 days' notice, carry out an inspection during normal business hours or have it carried out by an auditor bound to confidentiality. The auditor may not be a competitor of the processor.

(4) Inspections take place without avoidable disruption of business operations and at most once a year, unless there is a specific cause.

(5) For inspections that go beyond an annual audit and were not triggered by a cause attributable to the processor, the processor may demand appropriate remuneration.

§ 10 Deletion and return

(1) After the end of the processing services, the processor deletes all personal data or returns it at the client's choice, unless there is an obligation to store the data under Union law or the law of a member state. The deletion covers all storage locations including databases, file stores, chat and action logs, DCW mailboxes as well as derived representations (embeddings/vector indexes). Backups are overwritten after the regular backup cycle, at the latest after 35 days.

(2) The client communicates its choice (deletion or return) at the latest 30 days after the end of the contract in text form. If no communication is made, the data is deleted after a further 30 days.

(3) The return takes place in common, machine-readable formats (tenant export of the platform, see Annex 3 no. 6).

(4) Documentation serving as evidence of proper data processing, as well as commercial artifacts subject to statutory retention (GoBD), may be retained beyond the end of the contract in accordance with the respective retention periods.

(5) The deletion is confirmed to the client in text form upon request.

§ 11 Liability

(1) Art. 82 GDPR and the provisions of the main contract apply to liability.

(2) The client indemnifies the processor against claims by third parties based on the client having violated data protection provisions — in particular through an unlawful instruction, the absence of a viable legal basis or the activation of functions without the conditions required under § 5(2). This does not apply insofar as the processor recognised the unlawfulness and did not report it under § 3(5).

§ 12 Final provisions

(1) Amendments and additions to this agreement require text form. This also applies to the waiver of this form requirement.

(2) In case of conflicts between this agreement and the main contract, the provisions of this agreement take precedence insofar as they concern data protection.

(3) Should any provision be or become invalid, the validity of the remaining provisions remains unaffected. The parties replace the invalid provision with a valid one that comes closest to the economic purpose.

(4) The law of the Federal Republic of Germany applies.

Short version of the platform-specific measures. Specified in more detail by the processor's TOM document in its version applicable at any given time.

1. Tenant separation

Strict logical separation of all tenants at database and application level; no cross-tenant data access. A sandbox environment per organisation for safe testing.

2. Access control / permission model

Role-based rights per user. Each DCW is its own registered system account with editing rights exclusively in its domain. In addition, "rights folding": a DCW's response is always limited to the permissions of the requesting user — information the user is not authorised for is not output, regardless of the channel (app, Teams, email, voice).

3. Logging

Complete, subsequently unalterable action log ("brain log") of all DCW tool calls with session ID, tool, time and effective permissions; audit log for administrative changes (rights, connectors, feature activations).

4. Controlled AI execution

DCWs carry out actions with external effect only via reviewed, deterministic playbooks or after human approval (fail-closed principle). New DCWs go through an onboarding and approval procedure before they work in production. A supervisor process monitors the DCW fleet for stalled operations and failed actions.

5. Encryption

Transport encryption (TLS) for all connections; encryption of data at rest; access credentials for connected systems (connectors) in a protected secret store (vault).

6. Authentication

Sign-in via email/password or Microsoft login (Entra ID); administrative access with elevated requirements.

7. Data minimisation at the interfaces

Configurable field mapping per connector; sensitive field categories are not imported by default.

8. Availability

Regular backups with a defined cycle; recovery procedures; separation of production (my.labskills.ai), test (test.labskills.ai) and development environments.

9. Error diagnostics

Error events are processed via an error-tracking system (Sentry, EU organisation — processing in the EU); personal details in error reports are limited to the necessary minimum (IP anonymization/PII scrubbing enabled).

10. Organisational

Confidentiality obligation of all employees; access to production data only for named administrators of the processor on a need-to-know basis; annual review of the measures.

Part A — Used by default (approved upon conclusion of the contract)

Part B — Optional (only upon activation of the respective function by the client)

Activation by the client counts as a documented instruction.

Part C — No sub-processing relationship (client's systems)

The platform accesses the following systems exclusively on behalf of and on the instruction of the client; the contractual partner of the respective provider remains the client:

• the client's own Microsoft 365/Entra/SharePoint/Teams tenant
• the client's own Personio, GetMyInvoices, Slack, Asana, ClickUp or Google account (personal connectors)
• IMAP mailboxes configured by the client (any mail host of the client)
• DATEV Unternehmen online (receipt transfer to the DATEV upload address configured by the client; DATEV is the client's processor)
• custom MCP servers configured by the client (customer's own third-party servers; the client is responsible for selection and legal basis)
• AI clients that the client connects to the Kollegia MCP interface itself: the client is responsible for the client it uses

This annex specifies the processing by the AI systems contained in the platform.

1. How it works

DCWs are AI-assisted assistants that answer requests from the client's users, create analyses and reports, produce document drafts and execute recurring analyses approved by the client ("playbooks", scheduled tasks). In doing so, they process the data stored in the client's tenant as well as content transmitted to them via the activated channels (app chat, email, Teams, voice).

2. No training

Neither the processor nor its sub-processors use the client's data for the training, fine-tuning or other improvement of AI models. At the model providers used, the corresponding contractual and technical settings (training opt-out, minimal provider-side storage) are enabled.

3. EU processing as standard

Standard AI processing takes place on model endpoints in the EU/EEA (Annex 2 Part A: Mistral, Microsoft Azure EU, Amazon Bedrock EU inference profiles, EUrouter). The processor can switch between providers within this EU pool at any time (e.g. for performance reasons); a switch within the pool is not a change subject to notification under § 6(3).

4. Opt-in features with a third-country nexus

Individual features — currently: voice interaction (voice), direct use of US model providers (OpenAI, Anthropic), AI web search (Google, Bing Grounding, Parallel), personal connectors (Slack, Asana, ClickUp, Google) — use sub-processors in third countries (Annex 2 Part B). These features are disabled by default. Activation is carried out exclusively by an administrator of the client in the admin area (for personal connectors: by the respective user after admin approval), counts as a documented instruction for third-country transfer within the meaning of § 3, and is logged. The client can deactivate the feature at any time.

5. Employee-related features

Features that individually affect the client's employees — in particular proactive reminders/escalations to individual persons, the visibility of individual competence gaps to supervisors, and automated notes on onboarding progress — are disabled by default and are only activated by the client (§ 5(2)). The platform makes no automated decisions with legal or similarly significant effect towards persons (Art. 22 GDPR); DCW outputs about persons (e.g. competence comparisons) are decision support for human decision-makers and are labeled as such.

6. Export

Via the platform, the client can generate (a) a full export of its tenant and (b) a personal export per data subject (stored data, DCW interactions, assessments) in machine-readable formats.

7. Deletion of derived data

Deletion operations (§ 10) also cover derived representations of the data (embeddings, vector indexes, search indexes) as well as chat and action logs after the agreed retention has elapsed.

8. Transparency

DCWs identify themselves as AI systems in all channels (labeling in chat, note in email signatures, announcement in voice interactions). These labels are firmly anchored in the system and cannot be removed by the client.

9. Oversight

The client can view the DCW action log for its tenant and thereby obtains traceability of which DCW used which tools with which permissions and when.