Convenience translation. Only the German version is legally binding; in the event of any discrepancy the German text prevails.
Undertaking to maintain professional secrecy (Section 203 StGB)
Undertaking by elunos.ai Labs UG (haftungsbeschränkt)
Annex 5 to the General Terms and Conditions (GTC) for the elunos.ai platform, edition for Professional Secrecy Holders
Version 2026-09 · version 1.0, published on 21.09.2026
Undertaking
by
elunos.ai Labs UG (haftungsbeschränkt)
Neue Mainzer Straße 31, 60311 Frankfurt am Main, Germany
represented by the managing directors Konstantin Leidig and Felix Reuter
(hereinafter “elunos”)
to
the company designated in the customer account upon completion of the order
(hereinafter “Customer”)
Scope and incorporation
This Undertaking is Annex 5 to the Software-as-a-Service agreement between elunos and the Customer under the General Terms and Conditions (GTC) for the elunos.ai platform (agreement hereinafter “Main Agreement”; clause references in this Undertaking refer to the GTC). It becomes part of the Main Agreement upon conclusion of the contract (receipt of the order confirmation from elunos in text form, Clause 10.4) and applies to every Customer who is a Professional Secrecy Holder within the meaning of Section 203 para. 1 of the German Criminal Code (Strafgesetzbuch, StGB). The confirmation of this status, which the Customer gives when placing the order in a separate sentence that must be confirmed specifically (Clause 24.5), is not a precondition for its application; it documents the status, is logged and triggers the executed copy pursuant to Section 11a as well as the activation pursuant to Clause 24.5. Neither a separate agreement nor a signature by the Customer is required.
elunos gives this Undertaking unilaterally and signs it as issuer (Section 126 para. 1 of the German Civil Code (Bürgerliches Gesetzbuch, BGB)). Pursuant to Section 11a, the Customer automatically receives an executed copy issued in its name and signed by elunos.
To the extent that the DPA or any other part of the contract makes reference to an “agreement pursuant to Annex 5” having been concluded or being applicable, the application of this Undertaking in accordance with this section is equivalent to such a conclusion.
In the event of conflicts, this Annex 5 takes precedence over the Main Agreement and Annex 4 with regard to duties of confidentiality under professional law (Clause 12.2).
The applicable version of this Undertaking, its version date and the times of the order and of the order confirmation are documented in the customer account and confirmed to the Customer in text form. Earlier versions remain available, stating their version date, at elunos.ai/de/verschwiegenheitserklaerung-deutschland.
Preamble
(A) The Customer is the holder of a professional secret within the meaning of Section 203 para. 1 StGB; it has confirmed this when placing the order (Clause 24.5). The relevant sector module is the one designated in Section 10 below; in all other respects Section 1 para. 4 applies.
(B) elunos operates AI agents for the Customer for the automated answering and handling of incoming telephone calls (telephony channel) and of enquiries via the chat widget embedded in the Customer's website (chat channel), in each case in accordance with Annex 1. Concurrently with the Main Agreement, elunos and the Customer conclude a Data Processing Agreement (Annex 4, hereinafter “DPA”); offer, acceptance and separate confirmation are governed by Clauses 10.4 and 10.6. This Undertaking is Annex 5 to the Main Agreement and supplements the DPA.
(C) In the course of providing the services, elunos and the Further Assisting Persons engaged by elunos (subcontractors and sub-processors) may obtain knowledge of facts that are subject to the Customer's professional secrecy. In doing so, elunos acts as an other assisting person within the meaning of Section 203 para. 3 sentence 2 StGB.
(D) This Undertaking serves to fulfil the Customer's obligation under Section 203 para. 4 sentence 2 no. 1 StGB to bind the assisting person to secrecy, and to safeguard the chain of undertakings. It supplements the data protection obligations under the DPA; duties of confidentiality under professional law go beyond data protection law and are governed here independently.
(E) This Undertaking is designed as a unilateral undertaking by elunos and is signed by elunos. Requirements under professional law according to which the service provider must be bound to confidentiality in writing (for instance Section 15 para. 2 of the Professional Code of the Westphalia-Lippe Chamber of Pharmacists (Berufsordnung der Apothekerkammer Westfalen-Lippe)) are thereby fulfilled: the obligation arises from the Undertaking signed by elunos as the person bound (Section 126 para. 1 BGB); a signature by the Customer is not required for this purpose. Customers whose professional chamber or internal compliance function requires a version signed by both sides may use the countersignature block at the end of this Undertaking.
Section 1 Subject matter and order of precedence
(1) This Undertaking governs the obligation of elunos to maintain the Customer's professional secrecy within the scope of the services provided under the DPA.
(2) It is Annex 5 to the Main Agreement and applies for the entire term of the DPA. In the event of conflicts between this Undertaking and the DPA, the provisions of this Undertaking take precedence with regard to duties of confidentiality under professional law.
(3) In all other respects, the Main Agreement and its other annexes remain unaffected.
(4) To the extent that provisions of professional law on the involvement of service providers apply to the Customer, this Undertaking is designed to satisfy their requirements, in particular with regard to the obligation in text form, the instruction on the consequences under criminal law, the restriction of obtaining knowledge to what is necessary, the careful selection, and the onward obligation of downstream persons; the provisions relevant to the Customer are, where they exist, named in Section 10.
Section 2 Definitions
(1) “Professional secrecy” means secrets of another, namely secrets belonging to the personal sphere of life as well as business or trade secrets, which have been confided to, or have otherwise become known to, the Customer in its capacity under Section 203 para. 1 StGB.
(2) “Protected Data” means all information subject to professional secrecy that becomes accessible to elunos or to Further Assisting Persons in the course of the services, in particular the content and circumstances of telephone calls and chat conversations, the identity and contact details of callers and chat users, and facts that can be derived therefrom.
(3) “Further Assisting Persons” means natural or legal persons outside elunos's own business that are engaged by elunos for the provision of the services, in particular subcontractors and sub-processors within the meaning of Art. 28 para. 4 GDPR.
(4) In all other respects, the definitions of the DPA and of the GTC (Clause 14) apply.
Section 3 Involvement of elunos as assisting person
(1) The involvement of elunos as an other assisting person within the meaning of Section 203 para. 3 sentence 2 StGB and the authority to obtain knowledge of Protected Data to the extent necessary for the proper provision of the services arise from the Main Agreement and the DPA (Clause 24). elunos accepts this involvement and binds itself in accordance with this Undertaking.
(2) The involvement takes place exclusively for the purposes specified in the DPA and in the Main Agreement. Any obtaining of knowledge or use going beyond this is not permitted.
Section 4 Duty of confidentiality
(1) elunos undertakes to maintain silence about all Protected Data and neither to disclose them without authorisation nor to exploit them. The obligation applies to elunos and to all persons employed by elunos and working for elunos.
(2) elunos discloses Protected Data to third parties only to the extent that the Customer has given prior consent in text form or a statutory duty of disclosure or duty to provide information exists. In the case of a statutory duty, elunos informs the Customer in advance without undue delay, to the extent this is legally permissible.
(3) The obligation exists independently of the data protection obligations and applies in addition to them.
(4) elunos informs the Customer without undue delay of any unauthorised disclosure, obtaining of knowledge, alteration or destruction of Protected Data that has become known to it or is specifically imminent, as well as of any suspicion of such an occurrence, irrespective of whether there is at the same time a notifiable personal data breach within the meaning of Art. 33 GDPR. The notification is made in text form and covers the nature, extent and time of the incident, the Protected Data affected, and the remedial measures taken and planned; elunos supports the Customer in fulfilling its own obligations under professional law and the law of the professional chambers. A notification pursuant to Section 5 of the DPA is at the same time deemed to be a notification pursuant to this paragraph, to the extent that it covers the content thereof; in all other respects this obligation applies independently in addition.
(5) Protected Data are not used, either by elunos or by Further Assisting Persons, for the training, improvement or evaluation of artificial intelligence models. For Protected Data, this prohibition takes precedence over the approval exception in Clause 20.3; in all other respects Clause 20.3 remains unaffected.
Section 5 Principle of necessity and restriction of access
(1) elunos restricts the obtaining of knowledge of Protected Data to what is necessary for the provision of the services (Section 203 para. 3 sentence 2 StGB).
(2) Access to Protected Data is granted only to persons who need it to perform their tasks and who are bound pursuant to Section 6 of this Undertaking or pursuant to elunos's internal undertaking.
(3) elunos takes precautions to ensure that Protected Data are not stored beyond what is necessary. elunos furthermore takes technical and organisational precautions to prevent data identifying patients or data identifying clients from entering permanently stored agent configurations (system prompts, knowledge bases), since these are not covered by the zero retention mode, and points out to the Customer in the Software that such data must not be entered there.
Section 6 Onward obligation of Further Assisting Persons
(1) If elunos engages Further Assisting Persons for the provision of the services, elunos binds them, before they commence their activity, in text form and to the same extent as in this Undertaking, to maintain professional secrecy and to comply with Section 203 StGB (Section 203 para. 4 sentence 2 no. 2 StGB).
(2) elunos binds Further Assisting Persons that it engages directly in accordance with paragraph 1 and requires them to impose corresponding onward obligations. In the case of providers of standardised platform services whose internal organisation is not subject to the control of elunos, elunos owes the careful selection, the contractual obligation of the provider to maintain professional secrecy, the regular review and the provision of evidence to the Customer; elunos cannot promise a particular form or a particular wording of the obligation which the provider uses vis-à-vis its own employees. For ElevenLabs, as currently the only provider of this kind through which Protected Data pass, the obligation of professional confidentiality has been contractually agreed; at the same time, the permanently activated zero retention mode (Annex 4-D Clause 5 to the DPA) ensures that no conversation content of which knowledge could be obtained is stored there. A Further Assisting Person may in turn involve further persons only if these are also bound accordingly.
(3) Chain of undertakings as at the version date: elunos GmbH, Neue Mainzer Straße 31, 60311 Frankfurt am Main, carries out the operation, set-up and support of the platform as subcontractor (Annex 4-C to the DPA). It is bound vis-à-vis elunos to maintain professional secrecy by a separate undertaking at supplier level pursuant to Section 203 para. 4 sentence 2 no. 2 StGB; this obligation includes binding the personnel deployed by it in text form before they commence their activity (internal level). The chain of undertakings thus runs from the Customer via elunos (this Undertaking) and elunos GmbH (supplier level) to the personnel directly performing the work.
(4) In all other respects, the engagement of Further Assisting Persons is governed by the provisions of the DPA on sub-processing; the Customer's rights of approval and objection provided for therein apply accordingly.
(5) Upon request, elunos provides the Customer with evidence that the Further Assisting Persons have been bound.
Section 7 Technical and organisational measures
(1) elunos takes the technical and organisational measures necessary to maintain professional secrecy; these are set out in the TOMs annex to the DPA (Annex 4-D).
(2) To the extent that Protected Data are processed in a third country, elunos works towards ensuring, by appropriate measures, that a level of protection equivalent to the GDPR (Art. 44 et seq. GDPR) exists, and complies with any requirements under professional law as to the comparability of the protection.
Section 8 Evidence and monitoring
(1) elunos provides evidence of compliance with the obligations under this Undertaking at the Customer's request, in particular by submitting the evidence of the obligations pursuant to Sections 4 and 6, a current overview of the Further Assisting Persons engaged, and suitable evidence of the technical and organisational measures taken.
(2) The Customer's monitoring and audit rights under the DPA (Art. 28 para. 3 sentence 2 lit. h GDPR, Section 7 DPA) apply accordingly to the review of compliance with this Undertaking.
(3) elunos maintains a current overview of the Further Assisting Persons bound to professional secrecy and makes it available to the Customer upon request.
Section 9 Instruction on criminal liability
(1) elunos is aware that the unauthorised disclosure of Protected Data by a natural person acting for elunos (in particular officers and employees of elunos) as an assisting person is punishable under Section 203 para. 4 sentence 1 StGB and that, in addition, a fine may be imposed on elunos as a legal person pursuant to Section 30 of the German Act on Regulatory Offences (Gesetz über Ordnungswidrigkeiten, OWiG).
(2) elunos is furthermore aware that a breach of the obligation to impose onward obligations on Further Assisting Persons pursuant to Section 203 para. 4 sentence 2 no. 2 StGB may be subject to criminal penalties.
Section 10 Sector-specific additional obligations
(1) The sector module whose requirements are met in the Customer's case applies; modules that are not relevant do not apply. Neither a separate agreement nor a deletion is required.
(2) Healthcare professions (medical practices): Beyond Section 203 StGB, the Customer is subject to the duty of medical confidentiality. elunos complies accordingly with the requirements under professional law resulting therefrom.
(3) Pharmacies: Data from the pharmacy context may constitute health data within the meaning of Art. 9 GDPR as soon as they permit conclusions as to the state of health by way of mental combination or deduction (CJEU, Case C-21/23, Lindenapotheke). elunos treats such data as a special category of personal data.
(4) Tax advisers: The Customer is subject to the duty of confidentiality pursuant to Section 57 of the German Tax Advisory Act (Steuerberatungsgesetz, StBerG); Section 62a StBerG imposes special requirements on the involvement of third parties and on the comparability of the level of protection where data processing is outsourced. elunos complies with these requirements.
(5) Other Professional Secrecy Holders: For Customers who are subject to a professional secret under Section 203 para. 1 StGB that is not separately listed in paragraphs 2 to 4, this Undertaking applies in accordance with Section 1 para. 4.
Section 11 Term and continuing effect
(1) This Undertaking applies for the term of the DPA.
(2) The duty of confidentiality continues to exist beyond the termination of the contractual relationship without limitation in time.
(3) After termination, elunos returns or deletes Protected Data in accordance with the DPA and binds Further Assisting Persons accordingly.
Section 11a Executed copy for the Customer
(1) Concurrently with the order confirmation, elunos automatically generates an executed copy of this Undertaking issued in the Customer's name as a PDF document. The executed copy states the version date of this Undertaking, the company name and address of the Customer, the date of the order, the order reference and the date of issue, and is signed by elunos.
(2) The executed copy is made available to the Customer for retrieval in the customer account and is attached to the order confirmation as an attachment in text form. It also serves the Customer as evidence vis-à-vis professional chambers and supervisory bodies and for its own documentation obligations.
(3) A countersignature by the Customer is not required for this Undertaking to be effective. The countersignature block at the end of this Undertaking remains unaffected.
Section 12 Liability
The liability provisions of the Main Agreement (Clause 25) and of the DPA apply, including the separate maximum liability limit for data protection-related claims pursuant to Section 10 para. 4 of the DPA (Clause 25.5).
Section 13 Final provisions
(1) Amendments and supplements to this Undertaking require text form. This also applies to any amendment of this text form requirement.
(2) Vis-à-vis a Customer to whom this Undertaking applies, amendments become effective only with that Customer's express consent in text form; an amendment procedure with announcement and deemed consent does not apply to this Undertaking. A reissue by elunos that is exclusively more favourable to the Customer remains permissible (Clause 28.3).
(3) Should any provision be or become invalid, the validity of the remaining provisions remains unaffected.
(4) German law applies. The place of jurisdiction is governed by Clause 30.2.
Signature of the issuer
Frankfurt am Main, [date of the executed copy; inserted automatically in the executed copy pursuant to Section 11a]
────────────────────────────
Konstantin Leidig, managing director, for elunos.ai Labs UG (haftungsbeschränkt)
Countersignature by the Customer (optional)
The countersignature is not required for this Undertaking to be effective (Section 11a para. 3). It is available to Customers whose professional chamber, supervisory body or internal compliance function requires a version signed by both sides; in that case the Customer countersigns the executed copy pursuant to Section 11a with its wording unchanged.
Place, date: ────────────────────────────
────────────────────────────
[Name], [Position], for the Customer