PrivatAI
← All documents

Professional Secrecy Undertaking (Section 203 German Criminal Code)

Convenience translation for information purposes only. The legally binding version is the German original („Verpflichtung auf das Berufsgeheimnis (§ 203 StGB)", Anlage 4 zum AVV). In case of any discrepancy, the German version prevails.

Annex 4 to the Data Processing Agreement — for holders of professional secrets (law, tax, auditing, health professions). Provided as an annex upon the Client's request. Version: July 2026

Undertaking as an "Other Participating Person" within the Meaning of Section 203 (3), (4) of the German Criminal Code (StGB)

between

the Client – holder of professional secrets within the meaning of Section 203 StGB (details per account/order confirmation) –

and

Artur Parutkin (sole proprietorship), Isestraße 35, 20144 Hamburg, Germany – as participating person, hereinafter the "Contractor".

Preamble

As a member of a profession listed in Section 203 StGB, the Client is subject to a professional duty of confidentiality. The Contractor provides IT/AI-supported services for the Client (privatai.com) and thereby acts as an "other participating person" within the meaning of Section 203 (3) sentence 2, (4) StGB. The involvement of participating persons is permissible under professional law (inter alia Section 43e of the Federal Lawyers' Act (BRAO), Section 62a of the Tax Advisory Act (StBerG), Section 50a of the Auditors' Code (WPO), and the medical professional codes). This declaration supplements the Data Processing Agreement (DPA).

§ 1 Confidentiality

  1. The Contractor undertakes to maintain silence about all third-party secrets of the Client and of the Client's clients/patients ("Protected Secret Data") that become known to it in the course of its activity, and not to disclose or exploit them without authorization.
  2. Access to Protected Secret Data occurs only to the extent strictly necessary for providing the service. In regular operation, Inputs and Outputs are neither stored nor viewed (cf. Annex 2 TOM and § 4 DPA).

§ 2 Instruction on Criminal Liability under Section 203 StGB

  1. Subject of the duty of confidentiality. As an "other participating person" within the meaning of Section 203 (3) sentence 2, (4) StGB, the Contractor is bound to confidentiality regarding all third-party secrets that become known to it in the exercise of, or on the occasion of, its activity for the Client. Third-party secrets are in particular secrets belonging to the personal sphere of life (such as mandate, treatment and advisory relationships, health data, personal and financial circumstances) as well as trade and business secrets.

  2. Criminal liability for disclosure. Whoever, as a participating person, discloses without authorization a third-party secret that became known to them in the exercise of, or on the occasion of, their activity is punished under Section 203 (4) sentence 1 StGB with imprisonment of up to one year or a fine. Disclosure is any passing-on or other making-accessible to an unauthorized third party, in whatever form.

  3. Increased penalty. If the offender acts in return for payment, or with the intent to enrich themselves or another or to harm another, the penalty is imprisonment of up to two years or a fine (Section 203 (6) StGB).

  4. Prohibition of exploitation. Under Section 204 StGB, it is likewise a criminal offence to exploit without authorization a third-party secret that one is obliged to keep confidential under Section 203 StGB (imprisonment of up to two years or a fine).

  5. Continuation. The duty of confidentiality continues unchanged after the end of the activity for the Client; disclosure after that point in time is also punishable (Section 203 (4) StGB, § 4 of this declaration).

  6. Passing on the obligation. If the Contractor involves further persons who can access Protected Secret Data in perceivable form, the Contractor must, before they commence their activity, bind them to confidentiality in the same manner and instruct them on the criminal liability (§ 3 of this declaration). If the Contractor fails to do so and the involved person discloses a secret, the Contractor itself may incur criminal liability under Section 203 (4) sentence 2 StGB.

  7. Criminal complaint; further obligations. The offence is prosecuted only upon application (Section 205 StGB). The obligations under the GDPR and the German Federal Data Protection Act (BDSG), the contractual obligations under the DPA and this declaration, and civil claims of the Client and of the data subjects (in particular injunctive relief and damages) remain unaffected.

  8. Confirmation. The Contractor confirms that it has received, read and understood this instruction and undertakes to comply with it.

§ 3 Involvement of Own Staff and Subcontractors

  1. The Contractor binds the persons it engages (employees, contractors) to confidentiality to the same extent and instructs them on Section 203 (4) StGB before they receive access.
  2. Subcontractors are bound accordingly to the extent that they can access Protected Secret Data in perceivable form. In the standard plans, Inputs and Outputs are neither stored nor logged (subject to the narrow security exception under § 4 No. 2 DPA); access by the sub-processors' personnel is not intended and is prevented by the measures described in Annex 2 (TOM); their personnel are bound to confidentiality under Art. 28 (3) lit. b, Art. 29 GDPR (§ 4 DPA). An express contractual Section 203 and seizure-protection commitment covering the entire processing chain — including the inference data centre — is offered by the Contractor as part of the Enterprise setup (German hosting via a suitable provider; the binding designation is made in the Enterprise contract).

§ 4 Duration

The duty of confidentiality applies during the term of the contract and continues after its termination.

§ 5 Relationship to the DPA / Main Contract

This declaration stands alongside the DPA and the main contract. In the event of a conflict in matters of professional secrecy, this declaration prevails.