§ 1 Provider and scope
The provider is Lukas Steinke – Steinke Systeme, c/o Postflex #9943, Emsdettener Str. 10, 48268 Greven, Deutschland, trading as Zeus Voice. Contact: info@zeusvoice.de, +49 162 3901189; VAT ID DE455141320.
These terms apply to contracts for Zeus Voice between the provider and businesses within the meaning of Section 14 of the German Civil Code (BGB), legal persons under public law or special funds under public law. Consumers cannot use the offering. The person acting confirms their authority to represent the customer and the business use. Individual agreements take precedence; differing customer terms apply only if the provider expressly accepts them.
§ 2 Formation of contract and contract documents
Registration or an order with accurate company and contact details constitutes the customer's offer. The provider accepts it by express confirmation, activation or provision of the booked service. Free registration alone does not create a paid subscription. Offers are non-binding unless expressly described as binding.
The contract includes the service and price description identified during ordering, these terms and, where data is processed on the customer's behalf, the following data processing agreement (DPA) with its processing specification and technical and organisational measures (TOMs). The current specific sub-processor register is available before contract formation on request at info@zeusvoice.de and, after registration, in the protected customer area. The incorporated version must be accessible and saveable before acceptance. The DPA prevails on data-protection matters. The privacy policy provides information and is not blanket consent.
§ 3 Contract software and scope of service
Zeus Voice is a multi-tenant cloud application for AI-supported business telephony. Depending on the booked plan, it may include agent configuration, answering incoming calls, real-time speech processing, transcripts, summaries, contacts, callbacks, complaints, appointment management, transfers, staff and department assignments, notifications, website scans, calendar connections, statistics and user permissions.
The specific functions, allowances and additional services follow the offer displayed when the contract is concluded. Individual development, migration, consulting, training or ongoing integration that has not been expressly agreed is not owed. Features labelled beta or preview may have limited functionality; that label does not generally exclude statutory remedies for defects.
§ 4 Provision, access and user accounts
The application is provided over the internet as software as a service. The customer needs a suitable internet and telephony environment. Credentials must be assigned to individuals, kept secret and protected against unauthorised use. The customer informs the provider without delay if misuse is suspected. The customer is liable for misuse only to the extent it is responsible for it.
The customer manages its authorised users and roles. It checks whether access must be changed or removed when duties change or a user leaves. The provider may temporarily suspend access where concrete security risks or material breaches of contract require this, taking the customer's legitimate interests and reasonable advance notice into account.
§ 5 Trial period
Under the currently intended plan model, the trial for the first agent lasts no more than seven calendar days or until 15 conversation minutes have been used. The trial conditions shown at the start are decisive. There is no automatic conversion to a paid subscription.
The agent may become inactive after the trial. Without a subsequent booking, an assigned telephone number may be released after 14 calendar days. During a trial, too, the customer is responsible for lawful configuration, informing real callers and having any required legal basis.
§ 6 Rights of use, customer content and open source
For the contract term, the customer receives a simple, non-exclusive, non-transferable right to use Zeus Voice as agreed for its own business purposes through authorised users. Providing it to others, sublicensing it or using it for third parties, particularly as a reseller, requires express agreement. Acts permitted by mandatory law remain allowed.
Rights to the platform, software, documentation and general developments remain with the provider or the relevant licensors. As between the parties, customer data, knowledge content and individual configurations remain attributable to the customer. The provider receives only the rights required to provide, support and secure the service. The licence terms of any open-source components used apply additionally.
§ 7 Telephony and telephone numbers
Assigned telephone numbers generally serve technical call forwarding and use within Zeus Voice. Unless expressly agreed otherwise, they are not transferred to the customer as a permanently owned business number and must not be advertised as a permanently available main number.
The customer establishes call forwarding with the line holder's authority and removes it no later than before the destination number is released. After a paid agent plan ends, a reservation of 30 calendar days is currently intended; after a trial, 14 days. The number may then be released, and reactivation may require another number. Mandatory telecommunications-law or expressly agreed contractual porting rights remain unaffected.
§ 8 Updates and further development
The provider may maintain the application, provide security updates and develop features appropriately. Maintenance needed for security and conformity with the contract forms part of ongoing provision. New services that can be used independently or major extensions may be offered as separately paid additions.
The essential agreed scope of service must not be unreasonably reduced. If a change requires customer cooperation or new configuration, the provider gives reasonable notice. Product changes do not replace a required amendment to the contract.
§ 9 Operation, maintenance and support
The provider operates and maintains the application with care customary in the industry. The existing availability target of 99.5 percent on a monthly average is an operational target; a binding service level, including measurement method and response and recovery times, exists only if expressly agreed. Planned maintenance is announced at least 48 hours in advance where possible.
Support is available through the in-app chat and info@zeusvoice.de. The customer describes errors in a way that can be followed and provides necessary technical information without sending unnecessary personal conversation content. Additional advice, training and customer-specific adaptations may be agreed separately.
§ 10 Customer obligations
The customer uses Zeus Voice only within the agreed business scope. It keeps company, contact, knowledge, calendar, routing and forwarding data current, checks the accuracy of supplied content and ensures its users have the required permissions. Legally binding statements, prices, guarantees or deadlines may be used automatically only after appropriate approval.
The customer reviews call logs and automated results to a degree appropriate to the risk and arranges human handover for important, unusual or time-critical matters. Zeus Voice is not an emergency service or the sole substitute for legally required archives, CRM, ERP, HR or documentation systems.
§ 11 Prohibited use and sensitive areas
Prohibited uses include covert surveillance, unlawful audio recording, unauthorised advertising or cold calling, deception about identity, unlawful or discriminatory content, malware, interference with other systems, emergency or safety-critical uses, and AI practices prohibited by Article 5 of Regulation (EU) 2024/1689.
Targeted collection of special categories of personal data under Article 9 GDPR, criminal data under Article 10 GDPR, and uses subject to professional secrecy or high risk require separate approval in text form before use and an appropriate legal and protection framework. This particularly concerns medical advice and insurance processes involving health, risk or benefit assessments. Ordinary appointment handling, forwarding or callback organisation is not automatically excluded. Unsolicited sensitive disclosures should be minimised, not actively pursued and, where appropriate, handed to a suitable human contact.
§ 12 Use of artificial intelligence and transparency
Zeus Voice uses AI systems to recognise and generate speech and to process conversation content in a structured way. Automated output may be incorrect, incomplete or misleading. The provider therefore does not owe infallible content; statutory warranty and liability rules remain unaffected.
The customer must not remove, conceal or bypass the mandatory notice that the assistant is AI. Identifying the AI does not replace the customer's other information duties, particularly concerning purposes, legal basis, recipients and storage of transcripts. Decisions with legal or similarly significant effects require appropriate human review. Zeus Voice must not be used as the sole source of specialist advice.
§ 13 Integrations and third parties
The customer may connect approved calendar, telephony, payment and other interfaces. It is responsible for authority over connected accounts and for data-minimising configuration. The terms of a third party independently engaged by the customer apply to that separate relationship; they do not replace these terms or data-protection information duties.
The provider's statutory responsibility for services it uses to supply Zeus Voice remains unaffected. An outage at a third party does not automatically exclude all provider obligations. The current data-protection use of sub-processors is governed by the DPA and its register.
§ 14 Data protection and processing on behalf of customers
Processing of account, contract, billing and the provider's own security data is described in the privacy policy. To the extent Zeus Voice processes personal data of callers or other customer data on instructions, the following DPA forms part of the contract.
The customer is responsible for the lawfulness of its purposes, legal bases and information to data subjects. The provider remains responsible for its own statutory duties. OAuth approval, an AI notice or acceptance of another party's terms does not replace required privacy information or consent.
§ 15 Confidentiality
Both parties treat non-public business, access, configuration, security and conversation data confidentially and use it only for the contract purpose. They grant access only to persons who need it for their duties and are bound to confidentiality or an equivalent statutory duty.
This does not cover information demonstrably known lawfully or publicly available without breach of contract. Disclosures required by law remain permitted; the other party is informed in advance where legally allowed. Confidentiality continues after the contract ends while the information requires protection.
§ 16 Prices and conversation allowances
Prices, billing period, included conversation minutes, additional packages and other variable charges follow the offer shown when booking. Prices for business customers are net plus statutory VAT. Billing is generally in advance per booked agent and billing period.
Automatic add-on packages or usage-based charges may be charged only on the basis of price and trigger rules clearly shown before booking. Subsequent changes to a public pricing page do not change existing remuneration merely by being published. Objections to inaccurate measurement or billing remain possible.
§ 17 Payment, plan changes and default
Payments are handled through the payment service specified during ordering. Under the conditions shown in advance, plan changes may produce prorated charges, credits or a new billing period. The customer provides a valid payment method and accurate billing details.
In the event of material payment default for which the customer is responsible, the provider may, after a reminder and reasonable period to remedy, proportionately suspend the affected service. Justified objections and statutory rights of retention must be considered. Default interest and further rights are governed by law.
§ 18 Defects and warranty
The provider maintains the application in a condition suitable for contractual use. The customer reports reproducible defects without delay and assists analysis to a reasonable extent. The provider may first remedy a defect or provide an equivalent workaround; statutory rights where this fails or is unreasonable remain.
No defect claim exists to the extent an impairment is demonstrably caused by use in breach of contract, unapproved modifications or systems solely within the customer's sphere. A guarantee of quality exists only if expressly identified and agreed as such. Claims for defects become time-barred after twelve months where permitted by law. Mandatory exceptions, particularly for deceit, intent, gross negligence and injury to life, body or health, remain unaffected.
§ 19 Liability and third-party claims
The provider has unlimited liability for intent, gross negligence, injury to life, body or health, under the German Product Liability Act, and for deceit or an expressly assumed guarantee. For slightly negligent breach of essential contractual duties, liability is limited to the damage typical for the contract and foreseeable when it was concluded. Otherwise liability for slight negligence is excluded where permitted by law. Mandatory data-protection claims, particularly under Article 82 GDPR, remain unaffected.
If the customer culpably breaches its own duties, it supports defence against justified third-party claims and reimburses attributable necessary losses under statutory rules. There is no transfer of every claim, fine or provider error regardless of fault. Contributory causation and failure to take reasonable steps to mitigate damage are considered under law.
§ 20 Term and termination
Unless an individual agreement says otherwise, the contract runs for an indefinite term and may be terminated at the end of the relevant billing period. Individual agent subscriptions may be ended separately; ending one agent does not automatically delete the entire customer account. Termination can be declared in text form or through an available account function.
The right to terminate for good cause remains, usually after an unsuccessful reasonable period to remedy where setting such a period is reasonable. The effect of termination on active plans, telephone numbers, data and integrations must be shown or confirmed to the customer.
§ 21 Consequences of contract termination
The right to use Zeus Voice ends with the contract. The customer removes call forwarding, disconnects integrations no longer needed and exports required data in time. Outstanding payment, confidentiality, data-protection and other duties that survive by their purpose remain.
Return and deletion of commissioned data follow the DPA. At the customer's choice, the provider generally deletes or returns that data within 30 days after processing ends, unless a legal duty prevents it. Data subject to statutory retention is blocked for that purpose. Cancelling one agent is distinct from closing the entire customer account.
§ 22 Set-off, retention and assignment
The customer may set off undisputed claims, claims established by final judgment or claims arising from the same reciprocal relationship. Statutory rights of retention remain unaffected. Assignment of claims under the contract requires the provider's consent to the extent reasonable for the customer and permitted by law; Section 354a of the German Commercial Code (HGB) and other mandatory provisions remain unaffected.
§ 23 Changes to terms and final provisions
Changes to these terms are communicated to the customer in a traceable way and require valid incorporation into the contract. Silence is not generally deemed consent. Merely replacing text on the website or in the admin area does not amend existing customer contracts. Changes to sub-processors follow the DPA's specific information and objection process.
German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. For merchants, legal persons under public law and special funds under public law, Greven is the place of jurisdiction where permitted. Otherwise statutory venues apply. If individual provisions are invalid, statutory rules take their place; the remainder remains effective. Legally relevant notices may be given in text form unless a mandatory rule requires another form.
Accompanying annexes
Annex 1: Data processing agreement including the processing specification. Annex 2: Technical and organisational measures. The current specific sub-processor register is available before contract conclusion on request at info@zeusvoice.de and subsequently in the protected customer area, and is maintained under the procedure in the DPA.
Data processing agreement under Article 28 GDPR
Last updated: 04.09.2026
1. Parties, incorporation and precedence
The controller is the company identified in the contract and customer account, represented by the person authorised to place the order. The processor is Lukas Steinke – Steinke Systeme, c/o Postflex #9943, Emsdettener Str. 10, 48268 Greven, Deutschland, trading as Zeus Voice; contact: info@zeusvoice.de, +49 162 3901189.
This DPA specifies processing on behalf of the controller under Article 28 GDPR within the Zeus Voice service contract. It is expressly incorporated together with the terms and its annexes; an additional handwritten signature is not required. For existing contracts, replacing the agreed version requires a valid amendment. Publication alone does not create retroactive acceptance.
On data-protection matters, this DPA prevails over conflicting general contract provisions. Mandatory statutory data-subject rights, supervisory powers and applicable standard contractual clauses remain unaffected.
2. Subject matter and duration
The subject matter is provision and operation of the commissioned AI telephony application, including configuration, conversation processing, documentation, contact and appointment organisation, forwarding, notifications and approved integrations. Processing takes place during commissioned use and afterwards only for return or deletion, or where a legal duty prevents that. Confidentiality and protection duties continue until complete deletion.
3. Description of processing (Annex 1a)
Purposes: handling incoming business requests, managing appointments and callbacks, forwarding, documenting matters for the controller, and necessary operation, support and security of this engagement.
Operations: collecting and transmitting speech, ongoing speech recognition and output, conversion to text, generating replies and summaries, structuring, storing, retrieving, transmitting to commissioned recipients, correcting, exporting and deleting. Separate permanent audio recording is not part of the standard engagement. Transcripts and summaries, however, are stored content data.
Types of data: telephone numbers, names, contact details, matters raised and callback requests, conversation content in text form, appointments and services, business and knowledge content supplied by the controller, staff and routing data, roles, integration identifiers and necessary call, error and usage metadata.
Data subjects: callers, customers and prospective customers of the controller, its employees and other contacts mentioned in necessary conversation context. Scope and frequency follow the functions activated by the controller and incoming calls. The controller determines purpose, recipient selection, access roles and necessary duration within the permitted offering.
The engagement does not include targeted collection of special categories under Article 9 GDPR, data under Article 10 GDPR, medical advice, emergency services or other particularly sensitive or confidentiality-bound uses without prior separate assessment and approval in text form. Such approval requires a suitable additional processing specification, legal basis and protection framework. Unsolicited sensitive disclosures must be minimised, not explored further and deleted on instruction or handed to a suitable human contact.
4. Controller's instructions and responsibility
The controller is responsible for the lawfulness of its purposes, legal bases, information duties, any consent required and the accuracy of its configuration. It issues instructions through the contract, approved settings and documented individual directions from authorised contacts. Urgent oral instructions are confirmed promptly in text form. Changes outside the agreed service scope are agreed separately; statutory minimum duties are not limited by this.
The processor handles commissioned data only on documented instructions, including for third-country transfers. If Union or Member State law requires processing, it informs the controller beforehand unless an important public interest legally prohibits notice. If it considers an instruction unlawful, it informs the controller without delay and, where necessary, suspends the affected processing pending clarification. Commissioned data must not be used independently for advertising, sale or training general models.
5. Confidentiality and security
Access is restricted to authorised persons who are bound to confidentiality or an equivalent statutory duty and need the data for their tasks. Permissions are adjusted when duties change or a person leaves. Support access is limited to the specific engagement and necessary data.
The parties consider the nature, scope, context and purposes of processing and risks to people. The specifically agreed measures are in Annex 2. The processor may develop them further provided the agreed protection level is not reduced; material changes are documented and communicated. Planned measures must not be presented as already implemented.
6. Sub-processing
The controller gives general authorisation to use the companies named in the incorporated sub-processor register within the scope described there. The version applicable when the contract is concluded is available to the controller before acceptance on request at info@zeusvoice.de in a saveable form and afterwards in the protected customer area. The register is therefore a separately maintained part of the contract documentation; an exclusively internal list unavailable to the controller is insufficient.
At least 14 days before an intended addition or replacement, the processor informs the controller in text form about identity, service and relevant data-protection changes. During that period the controller may object for understandable data-protection reasons. The affected processing will not use the new provider until the period has expired and a justified objection has been resolved. If no suitable solution is possible, the affected service may be ended before the change; payments already made for services not delivered are refunded proportionately. Urgent security situations require a lawful alternative, not blanket approval after the event.
Equivalent data-protection duties necessary for commissioned processing are agreed with sub-processors. The processor remains responsible to the controller for their compliance and reviews necessary guarantees according to risk. Payments for the customer's own Zeus subscription and services independently engaged by the customer are listed separately according to their actual role.
7. International transfers
The primary database region is Frankfurt. Other processing locations and possible remote access follow the incorporated sub-processor register; processing exclusively in the EEA is not agreed. A transfer outside the EEA takes place only where the requirements of Chapter V GDPR are met. Applicable adequacy decisions, the scope of certification or standard contractual clauses, including required assessment and additional measures, are evidenced for the specific recipient. If a basis ceases to apply, it must lawfully be replaced before processing continues or the affected transfer suspended. An automatic cure through a general reference to SCCs is not agreed.
8. Data-subject rights and regulatory duties
Considering the nature of processing, the processor assists the controller with appropriate measures for access, rectification, erasure, restriction, portability and objections. Requests received directly about commissioned data are forwarded without delay; without instructions the processor does not decide their substance on its own unless required by law. Identity is checked appropriately.
The processor assists the controller with duties under Articles 32 to 36 GDPR, particularly risk assessment, data protection impact assessments and prior consultation, to the extent these concern the commissioned processing and available information.
9. Personal data breaches
The processor reports a breach concerning commissioned data to the controller without delay and no later than 24 hours after becoming aware of it. An initial notice is given even if the facts are incomplete and is supplemented without undue delay. Where available, it includes the nature and extent, affected data and groups of persons, contact, likely consequences and measures taken or proposed. The processor preserves necessary evidence, limits consequences and supports assessment. The decision whether the controller reports to a supervisory authority or affected persons remains with the controller unless the processor has its own statutory duty.
10. Information and audits
The processor makes available all information needed to demonstrate compliance and permits audits, including inspections by the controller or an independent auditor it appoints. Procedure and timing are coordinated reasonably; short-notice audits are possible for incidents or regulatory urgency. Evidence and suitable reports can prepare an on-site inspection but do not automatically replace it. Trade secrets and other customers' data are protected without excluding necessary audit rights. Statutorily required cooperation must not be prevented through unreasonable costs or secrecy.
11. Return, deletion and end of processing
During use, the controller may issue necessary correction and deletion instructions and use available export routes. Before the contract ends, the parties agree on return in a common format or deletion. After services conclude, the processor, at the controller's choice, deletes or returns personal data and deletes existing copies, generally within 30 days after the contract ends, unless a statutory retention duty prevents this. No copy is retained for unrestricted further use.
Data that must be kept by law is blocked separately for the relevant purpose; the basis and duration are communicated. Backups are included in a demonstrated deletion framework. Restoration must not permanently reverse completed deletion instructions. Completion is confirmed on request. The absence of a deadline from the customer does not authorise indefinite storage.
12. Annexes and amendments
Annex 1a is the processing specification in Section 3. Annex 2 describes the agreed TOMs. The separate register, available on request and in the customer area, contains specific sub-processors and separately lists other recipients. DPA, TOMs and register must have clear versions on acceptance. Changes require a traceable agreement in text form unless a permitted process regulated here applies. Statutory liability rights, particularly Article 82 GDPR, are not restricted to the detriment of data subjects.
Technical and organisational measures
Last updated: 04.09.2026
1. Identities, login and access
The application uses user accounts and role- and organisation-based permissions. Backend functions verify identity and the required permissions; private service keys are not delivered to the browser. Administration of legal documents is separate from ordinary customer permissions. Direct administrative access to the database platform is currently limited to the owner of Steinke Systeme as developer and data-protection officer and is protected by two-factor authentication. This does not promise a general MFA requirement for every customer account.
Permissions are granted only for necessary tasks, reviewed when duties change and withdrawn promptly when a person leaves. Administrator accounts must not be shared without control. Secrets and keys are managed with restricted access and replaced if compromise is suspected.
2. Tenant separation and processing control
The application is multi-tenant. Organisation scope, server-side permissions and row-level security separate customer data at database level. Privileged backend functions additionally verify the required role because administrative service keys can technically bypass row-level security. Access paths for calls, transcripts, contacts, calendars, configurations, exports and support are tested with positive and negative permission cases during development and release.
3. Transmission and secrets
Encrypted transport is used for the web application and API connections. Access to private keys and OAuth tokens is restricted; tokens must not appear in error messages or publicly accessible logs. Transport security for individual web connections is not end-to-end encryption of the public telephone network. No claim is made that every database field has additional application-level encryption.
4. Support, confidentiality and organisation
Support can be reached through the in-app chat and at info@zeusvoice.de. Access to customer content is limited to authorised persons, a specific purpose and the data required. The request, scope and handling must be documented in a traceable way. General access for training or marketing is not included.
Persons with access are bound to confidentiality and to data-protection and security requirements and are instructed on granting access and incident procedures. Commissioned data is avoided in development and testing; necessary exceptions require lawful approval and the smallest possible amount of test data.
5. Secure development and changes
Source control, code review, automated checks and separate approval of production changes form part of the development process. Changes are reviewed according to risk for access protection, tenant separation, input validation and unintended data disclosure. External webhooks are protected by suitable authenticity or signature checks where the provider technically supports them.
6. Availability and recovery
Manual database dumps are currently created as a supplementary backup. Automated database backups from the platform provider are not yet part of the confirmed measures; they will be added only after plan activation, documented configuration and a recovery test. No particular recovery time or maximum data-loss period is promised unless expressly agreed.
7. Data minimisation and deletion
Permanent audio recording is not part of the standard offering. Zero Retention is activated for the production agent at the voice provider; according to that provider's current product description, it does not retain call recordings, transcripts or conversation metadata containing personally identifiable information after a call. Required post-call data is transmitted to Zeus Voice, where transcripts and summaries are stored separately.
Deletion periods and responsible systems for Zeus Voice are documented as a plan in an internal register. A daily technical preview run counts records due for deletion but deletes nothing. Actual cleanup remains manual until separate technical approval. Restoration must not permanently undo deletions already carried out.
8. Incidents, oversight and providers
Suspected incidents are escalated through the support contact, investigated and reported to the controller under the DPA. Responsibility, availability, preservation of evidence and the reporting route are recorded in the internal incident documentation. Providers are assessed according to risk for commissioned processing, contract, locations, sub-processors and safeguards; a standard contract alone does not replace this assessment.
9. Further development and confidential details
The confirmed status of these measures is updated with a date, responsible person and test result. Security-sensitive implementation details, keys and information about other customers are not published. The customer's necessary audit and evidence rights remain. Later changes to measures must not reduce the contractually agreed level of protection.