English translation. In the event of discrepancies or differences in interpretation, the German version prevails to the extent permitted by law.
This Data Processing Agreement ("DPA") forms part of the agreement governing the use of Maildroppa ("Main Agreement"). It governs the processing of personal data by Maildroppa on behalf of the Customer pursuant to Article 28 of the General Data Protection Regulation ("GDPR").
PARTIES
Customer:
The natural or legal person identified as the contracting party in the Main Agreement, the order or the Maildroppa account, including any affiliated company validly included therein, insofar as that company is the controller in respect of the relevant customer data.
Processor ("Maildroppa"):
Marcus Biel, trading as "Maildroppa" Dr.-Peter-Hecker-Str. 4b 82031 Grünwald Germany
Contact: Contact form
The Customer and Maildroppa are collectively referred to as the "Parties".
1 Subject matter, term and order of precedence
1.1 This DPA governs the processing of personal data that Maildroppa processes for the Customer in connection with the service ("Customer Personal Data"). The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.
1.2 This DPA enters into force through acceptance of terms of use that incorporate it, an order that incorporates it or a separate electronic agreement. It applies for the term of the Main Agreement and thereafter for as long as Maildroppa processes Customer Personal Data.
1.3 In the event of a conflict between this DPA and the Main Agreement, this DPA shall prevail in relation to processing on behalf of the Customer. Mandatory data protection law and, where applicable, overriding provisions of standard contractual clauses entered into with binding effect shall remain unaffected.
1.4 To the extent that Maildroppa processes personal data for its own purposes as a controller, in particular for contract administration, billing or compliance with its own statutory obligations, such processing is governed by Maildroppa's Privacy Policy and not by this DPA. The distinction is determined by the actual purposes and circumstances of the processing concerned. This does not limit Maildroppa's obligation to follow instructions in respect of Customer Personal Data.
2 Definitions and applicable data protection law
2.1 The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR.
2.2 "Applicable Data Protection Law" means the GDPR, the German Federal Data Protection Act and any other data protection provisions applicable to the processing concerned.
2.3 Where the Customer itself acts as a processor on behalf of a third party, Maildroppa acts as a sub-processor. The Customer shall ensure that it is authorised to engage Maildroppa and to issue the relevant instructions. It shall provide Maildroppa with the information and requirements of the controller that are necessary for processing in accordance with the contract.
3 Customer responsibilities and instructions
3.1 The Customer is responsible for the lawfulness of its use of the service, the data and content it provides, and its instructions. This includes, in particular, the necessary legal bases, privacy notices and consents, the selection of permissible recipients and the determination of appropriate retention periods.
3.2 Instructions may be issued only by the Customer or by persons authorised by the Customer for that purpose. Documented instructions derive from the Main Agreement, this DPA, the Customer's chosen configuration and use of the service, and supplementary instructions in text form. Supplementary instructions may, in particular, be submitted via the contact form and shall be documented.
3.3 Instructions that materially extend the agreed scope of services or change the nature and purpose of the processing may require a separate agreement and reasonable remuneration. Maildroppa's statutory obligations, in particular those relating to assistance, return, deletion and cooperation with audits, shall remain unaffected.
3.4 The Customer may process special categories of personal data under Article 9 of the GDPR, data relating to criminal convictions and offences under Article 10 of the GDPR, complete payment instrument data, official secrets, professional secrets protected under Section 203 of the German Criminal Code (StGB), or other data afforded special statutory protection in Maildroppa only if this has been expressly agreed in advance in text form for the specific purpose, including the necessary additional safeguards.
3.5 The Customer shall use the available permission, export, deletion, consent, tracking and integration functions in a manner appropriate to the risks. It shall protect its accounts, domains, API keys and access credentials and keep the contact details on file for contractual and data protection notices up to date.
4 Processing solely on documented instructions
4.1 Maildroppa shall process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to a third country or an international organisation. An exception applies to the extent that Maildroppa is required to process the data by European Union or Member State law. In such a case, Maildroppa shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
4.2 Maildroppa shall use Customer Personal Data only to provide, secure, support and terminate the agreed service and to carry out lawful instructions. Customer Personal Data shall not be sold, used for Maildroppa's own or third-party advertising outside the Customer's instructions, or used to build third-party recipient lists.
4.3 If Maildroppa considers that an instruction infringes the GDPR or other data protection provisions of the European Union or its Member States, Maildroppa shall inform the Customer without undue delay. Maildroppa may suspend the processing concerned until the matter has been clarified. The Parties shall cooperate to find a lawful solution. Unlawful processing does not become lawful merely because the instruction is confirmed.
4.4 Only persons who require access for the performance of their duties may access Customer Personal Data. These persons shall be bound by confidentiality obligations or be subject to an appropriate statutory obligation of confidentiality. They shall receive the data protection and security instructions necessary for their duties.
5 Technical and organisational measures
5.1 Maildroppa shall implement the technical and organisational measures required by Article 28(3)(c) and Article 32 of the GDPR. In doing so, it shall take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the likelihood and severity of the risks to the rights and freedoms of data subjects. The agreed measures are described in Annex 2.
5.2 The Customer gives advance approval for the further development of individual measures or their replacement with equivalent or more effective measures within the agreed scope of processing and the agreed security requirements. The agreed overall level of protection and the requirements of applicable law must be maintained. Changes to the agreed scope of processing or the agreed security requirements require prior agreement in accordance with Clause 15.1. The Customer shall be informed of material changes to the agreed security measures. Where changes within this approved framework are immediately necessary to avert an imminent threat, the Customer shall be informed without undue delay after their implementation.
5.3 The Customer is responsible for the security of its own systems, access credentials, content and integrations with services it engages itself. Risks arising from the Customer's environment or configuration do not relieve Maildroppa of its own statutory or contractual obligations.
6 Assistance with data subject rights
6.1 Taking into account the nature of the processing, Maildroppa shall assist the Customer, insofar as possible, by appropriate technical and organisational measures in fulfilling requests for the exercise of data subjects' rights under Chapter III of the GDPR.
6.2 Where the Customer can handle such requests itself using the product functions provided, it shall use those functions. For any further assistance that is required, Maildroppa shall provide the information available to it and carry out necessary rectifications, exports, restrictions of processing or deletions in accordance with documented instructions.
6.3 If Maildroppa receives a request from a data subject that clearly concerns Customer Personal Data, Maildroppa shall inform the Customer without undue delay. It shall respond to the substance of the request only on the Customer's instructions or where legally required to do so. Maildroppa may acknowledge receipt of the request and confirm that it has been forwarded.
6.4 The Customer shall provide only the information necessary to identify and handle the request. Reasonable additional remuneration for specific assistance outside the agreed scope of services may be agreed in advance, to the extent permitted by law. Assistance required by law shall neither be refused nor unduly delayed because an agreement on remuneration remains outstanding.
7 Assistance with compliance, impact assessments and dealings with authorities
7.1 Taking into account the nature of the processing and the information available to it, Maildroppa shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR. This includes, in particular, security of processing, personal data breaches, data protection impact assessments and prior consultations with the supervisory authority.
7.2 For this purpose, Maildroppa shall provide the necessary information available to it concerning the service, the data flows concerned, safeguards, sub-processors and known risks. Documentation already provided that remains up to date may be used for this purpose.
7.3 If Maildroppa receives a binding request from a public authority or a court concerning Customer Personal Data, it shall inform the Customer before making any disclosure, to the extent permitted by law. Maildroppa shall assess the legal obligation and the scope of the request, limit the disclosure to what is legally required and document the matter. Clause 10 shall remain unaffected.
8 Personal data breaches
8.1 Maildroppa shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification shall be sent to the contact address held in the Customer account or communicated through another appropriate direct channel.
8.2 To the extent available, the notification shall include the nature of the breach, the categories and approximate numbers of data subjects and data records concerned, the likely consequences, the containment and remedial measures taken or proposed, the known time or period of the breach, and contact details for further enquiries.
8.3 Information not yet available shall be provided without undue further delay. The initial notification shall not be withheld until the investigation has been completed.
8.4 Maildroppa shall take appropriate measures to contain the breach, preserve evidence, analyse its causes and take remedial action. Maildroppa shall document the incident and provide the Customer with the available information that the Customer requires to fulfil its obligations under Articles 33 and 34 of the GDPR.
8.5 Where the Customer is the controller, it shall be responsible for the assessment and for making the required notifications to the supervisory authority and communications to data subjects within the statutory time limits. Where the Customer is itself a processor, it shall fulfil its obligations to inform its controller. A notification by Maildroppa does not in itself constitute an acknowledgement of a breach of duty or an admission of liability.
8.6 The Customer shall inform Maildroppa without undue delay of security incidents in its environment to the extent that they may affect Customer Personal Data processed by Maildroppa or the security of the service, and shall cooperate in implementing the necessary protective measures.
9 Sub-processors
9.1 The Customer grants Maildroppa general written authorisation to engage sub-processors in accordance with this section. The sub-processors authorised at the time this DPA is concluded are listed in Annex 3.
9.2 Maildroppa shall use only sub-processors that provide sufficient guarantees of processing in compliance with data protection requirements. Maildroppa shall impose on them, by way of a binding contract, the data protection obligations applicable to the processing entrusted to them in accordance with Article 28(4) of the GDPR. This also includes the obligations to provide the information required under Article 28(3)(h) of the GDPR and to allow for and contribute to audits, including inspections, conducted by the Customer or an auditor appointed by the Customer. The safeguards and coordination arrangements under Clause 12 shall apply accordingly. Maildroppa shall remain responsible to the Customer for the performance of its sub-processors' obligations.
9.3 Maildroppa shall inform the Customer of the intended addition or replacement of a sub-processor before using that sub-processor, by notice in text form sent to the contact address held in the Customer account. The notice shall identify the provider, its service, the data categories concerned, the relevant countries of processing and access, any required third-country safeguards and the intended start date. The notice shall be given sufficiently in advance to allow the Customer a reasonable period to review the proposed change and object before the intended start date. Maildroppa shall also publish a dated update to the list of sub-processors.
9.4 A shorter notice period may be provided for where there is an urgent security or availability need. Maildroppa shall explain the reason and give notice as early as possible. Prior notice and an effective opportunity to object must be preserved even in such cases. If this is not possible, any early use of the sub-processor for the affected Customer Personal Data shall require the Customer's separate prior authorisation.
9.5 The Customer may object within the notified period on specific, reasoned grounds relating to data protection. The Parties shall endeavour to find a reasonable solution, such as an alternative means of providing the service or a change in configuration. Where such an objection is made within the applicable period, the sub-processor objected to shall not be used for the affected Customer Personal Data until the matter has been resolved. If the affected service cannot be continued without that sub-processor and no agreement is reached, either Party may terminate that service before the intended start date without a separate termination charge. If an appropriate partial termination is not possible, this shall apply to the Main Agreement. Obligations to return and delete data shall remain in force.
9.6 Maildroppa shall keep up-to-date information available on all sub-processors involved in processing Customer Personal Data, including further sub-processors within the processing chain, and shall make that information readily accessible to the Customer. This shall include, in particular, each sub-processor's name and address, its contact person with their name, role and contact details, and the services, processing locations and any required transfer safeguards. A company's mere membership of a corporate group does not replace its required inclusion under this DPA.
9.7 Ancillary services that do not involve the processing of Customer Personal Data do not constitute sub-processing. Services that the Customer engages directly and connects to Maildroppa through its own accounts do not become sub-processors of Maildroppa solely as a result of that connection. Their classification depends on the actual processing and engagement arrangements.
10 Transfers to third countries
10.1 Maildroppa shall transfer Customer Personal Data to recipients outside the European Economic Area ("EEA") or to international organisations, or permit corresponding access from third countries, only on the basis of documented instructions and in compliance with Chapter V of the GDPR.
10.2 If no adequacy decision under Article 45 of the GDPR applies to the transfer concerned, appropriate safeguards under Article 46 of the GDPR must be in place. These may include, in particular, the European Commission's standard contractual clauses that have been validly entered into. The applicable module shall be selected according to the actual roles of the data exporter and data importer in the transfer concerned. The required information and annexes shall be completed for that transfer. This DPA does not replace the requirement to enter into binding standard contractual clauses.
10.3 A transfer based on the EU-US Data Privacy Framework shall take place only to the extent that the relevant adequacy decision applies, the specific US recipient holds a valid certification and the processing concerned falls within the scope of that certification. At appropriate intervals and in the event of relevant changes, Maildroppa shall check whether the requirements for the transfer mechanism used are met.
10.4 Where required, Maildroppa shall assess and document the level of protection for the transfer concerned and implement supplementary technical, contractual or organisational measures. In doing so, it shall take into account, in particular, the law in the recipient country, potential access and the risks associated with the data concerned.
10.5 Maildroppa shall provide the Customer with the information and evidence required to assess the transfers concerned. Confidential information may be protected, provided that this does not prevent the required assessment.
10.6 If the requirements for a transfer mechanism cease to be met, the affected transfer shall be suspended or terminated unless another lawful transfer mechanism is put in place in good time.
11 Return and deletion
11.1 During the contract term, the Customer may use the available export, rectification and deletion functions. It may request the return of its Customer Personal Data in a commonly used, machine-readable format. The available product functions do not limit Maildroppa's statutory obligations to return data and provide assistance.
11.2 After the end of the processing services, Maildroppa shall, at the Customer's choice, delete the Customer Personal Data or return the data and subsequently delete any existing copies, unless a statutory retention obligation under Clause 11.4 applies. Unless instructed otherwise, deletion is agreed. The Customer may change this choice by issuing instructions in text form before the processing services have ended. The return or deletion shall take place without undue delay. Maildroppa shall confirm completion in text form upon request.
11.3 To the extent that immediate selective deletion from backups is technically impossible, the data concerned shall be protected against further operational use and deleted or overwritten no later than the end of the documented, time-limited backup cycle. All protection obligations under this DPA shall continue to apply until then. The applicable backup cycle and the latest date for deletion shall be communicated to the Customer upon request. Where backups are used for recovery, Maildroppa shall reapply the relevant deletions, objections and restrictions of processing without undue delay.
11.4 If European Union or Member State law requires continued storage, Maildroppa shall restrict such storage to the data, purposes and periods required by law. The data shall be protected against any other use. Maildroppa shall inform the Customer of the obligation concerned to the extent legally permitted.
11.5 Data that Maildroppa lawfully processes as a controller in its own right under Clause 1.4 shall be subject to the applicable statutory deletion and retention requirements. This does not confer any general authority to retain Customer Personal Data after the end of processing on the Customer's behalf for security, advertising or any other purposes of Maildroppa's own.
11.6 Return and deletion of Customer Personal Data required by law shall not be refused or unduly delayed because remuneration remains outstanding or is disputed. Valid claims for remuneration shall remain unaffected.
12 Evidence and audits
12.1 Maildroppa shall make available to the Customer all information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR. This may include, in particular, the applicable technical and organisational measures, information on sub-processors and transfers, available audit reports, responses to enquiries and confirmations of deletion.
12.2 Maildroppa shall allow for and contribute to audits, including inspections, conducted by the Customer or an appropriately qualified auditor appointed by the Customer and bound by confidentiality. The Parties shall coordinate the scope and conduct of the audit, taking its purpose into account. Suitable existing documentation may be used. This shall not restrict the right to further audits where required.
12.3 Audits shall take place at reasonable intervals and, as a rule, on reasonable advance notice during normal business hours. They shall be conducted so as not to cause avoidable disruption to operations or other customers or avoidable impairment of security. Additional audits or audits at short notice shall be allowed where justified, in particular, by a personal data breach, indications of non-compliance or a requirement imposed by an authority.
12.4 Maildroppa may take appropriate measures to protect other customers' data, trade secrets and security-sensitive information. These may include secure inspection arrangements or suitable independent evidence. Such measures shall neither prevent necessary audits nor make them unreasonably difficult.
12.5 As a rule, each Party shall bear its own costs. A reasonable additional fee may be agreed in advance for special audit services requested by the Customer. Cost arrangements must neither prevent the exercise of audit rights nor make it disproportionately difficult. Cooperation required by law shall not be made conditional on any disputed remuneration. In the event of a material breach for which Maildroppa is responsible, Maildroppa shall bear the reasonable and necessary audit costs occasioned by that breach and remedy the breach without undue delay. Statutory rights to compensation shall remain unaffected.
12.6 Maildroppa shall maintain a record of the categories of processing activities under Article 30(2) of the GDPR and cooperate, on request, with the competent supervisory authority. The statutory powers of supervisory authorities shall remain unrestricted.
12.7 The Customer shall keep confidential any non-public trade secrets and security-sensitive information of Maildroppa obtained in connection with evidence of compliance or audits under this DPA, including after its termination. Necessary disclosures to advisers and auditors bound by confidentiality and to competent authorities or courts shall remain permitted. Statutory disclosure and notification obligations shall remain unaffected.
13 Liability
13.1 Liability as between the Parties shall be governed by Article 82 of the GDPR, other mandatory data protection law and the valid liability provisions of the Main Agreement. No provision of this DPA restricts the rights of data subjects or the powers of a supervisory authority.
13.2 As between the Parties, responsibility for damage and costs shall be determined according to each Party's causal contribution and share of responsibility and the applicable statutory and contractual provisions. Statutory rights of recourse and any overriding provisions of standard contractual clauses entered into with binding effect shall remain unaffected.
14 Termination for a breach of data protection obligations
14.1 If Maildroppa breaches material obligations under this DPA, the Customer may suspend the affected processing until the breach has been remedied. If Maildroppa fails to remedy a serious breach within a reasonable period or if the breach cannot be remedied, the Customer may terminate the affected service for cause. Statutory rights to immediate termination for good cause shall remain unaffected.
14.2 Maildroppa may suspend implementation of an unlawful instruction in accordance with Clause 4.3. If no lawful alternative can be found and continuation would violate data protection law, Maildroppa may terminate the affected service.
14.3 If it is not possible to terminate only the affected service in an appropriate manner, the Main Agreement may be terminated. Obligations relating to return, deletion, confidentiality and the provision of evidence shall remain in force.
15 Final provisions
15.1 Amendments to this DPA shall be agreed in text form or incorporated by a legally effective and verifiable electronic procedure.
15.2 The Annexes may be updated in accordance with this DPA to reflect permissible changes in the actual processing or equivalent developments in the protective measures. Rights to information and to object shall be preserved. Updating the Annexes does not confer any authority to unilaterally extend the purposes of processing or restrict the Customer's agreed rights.
15.3 Annexes 1 to 3 form part of this DPA.
15.4 If any provision is invalid, the remaining provisions shall remain valid. The invalid provision shall be replaced by the applicable statutory provisions.
15.5 German law and the valid choice-of-court provision of the Main Agreement shall apply, unless mandatory statutory provisions or overriding provisions of standard contractual clauses entered into with binding effect provide otherwise.
15.6 This DPA is provided in German and English. The English version is a translation of the German original and may be used to conclude the Agreement. In the event of discrepancies or differences in interpretation between the language versions, the German version prevails to the extent permitted by law.
ANNEX 1 Description of the processing on behalf of the Customer
1 Subject matter and purpose
Provision and operation of the cloud-based Maildroppa service for permission-based email marketing.
Depending on use, the processing includes, in particular, contact and list management, sign-up forms and processes, landing pages, campaigns, templates and the email editor, automations, sending, delivery and interaction reports, files, imports and exports, and interfaces, webhooks and integrations.
This includes, as required for these services, technical support, security, error handling, backups, recovery and deletion in accordance with the contract.
2 Duration
For the term of the Main Agreement, including the return, deletion and time-limited backup phase required under Clause 11.
3 Nature of the processing
Collection, recording, organisation, structuring, storage, adaptation, segmentation, alignment, retrieval, display, importing, exporting, transmission, sending, making available, logging, analysis, restriction, backing up and deletion in accordance with the Customer's instructions.
This also includes the technical preparation of email templates and message content for editing, display and sending.
4 Categories of data subjects
Data subjects may include the Customer's subscribers, prospects, customers and other business contacts; visitors to and users of its forms and landing pages; recipients of its messages; and other persons whose data the Customer lawfully enters into the service.
These may include employees and other contact persons of the Customer to the extent that their data are processed on the Customer's behalf.
5 Categories of personal data
Master and contact data: Names, email addresses and other contact details entered by the Customer.
Profile and assignment data: Custom fields, tags, topics, segments, lists and audience assignments.
Consent, source and evidence data: Sign-up source, form details, consent and confirmation wording, timestamps, confirmation and unsubscribe status, and associated IP and browser metadata, where collected and lawfully processed.
Technical form and abuse data: Screen dimensions, browser and operating system information, device identifiers derived from these data, IP and request data, and the last pop-up display time stored in the browser, where the corresponding form feature is used.
Message and content data: Campaigns, forms, landing pages, automations, templates, full HTML/CSS content provided for editing or preparation, and the personal information, links and image URLs it contains.
Sending and interaction data: Sending and delivery status, open and click events, where enabled and permissible, delivery failures, complaints, unsubscribes and sending suppression records.
Technical operational data: IP addresses, device, browser, session, request, security, log and error data, and technical account, message and template identifiers.
File data: Uploaded images, attachments and other files, including associated metadata, to the extent that they constitute personal data.
Integration and business transaction data: Information and identifiers transmitted via connected services, interfaces or imports; in the case of relevant shop integrations, in particular, order, shopping cart and related transaction data.
Support data: Personal information and content transmitted to handle a support request or viewed to the extent necessary for that purpose.
6 Specially protected data
The processing of the specially protected data referred to in Clause 3.4 does not form part of the agreed standard service. It requires prior express agreement, including the necessary additional protective measures.
7 Frequency and scope
Processing takes place on an ongoing basis or in response to specific events to the extent determined by the Customer's use, configuration, data entered, features used and instructions.
8 Rights and obligations of the Customer
The Customer's rights and obligations arise from this DPA, the Main Agreement and Applicable Data Protection Law. The Customer determines, in particular, the purposes, legal bases, data categories, recipients, configuration and required storage period, and is responsible for fulfilling its obligations towards data subjects.
ANNEX 2 Technical and organisational measures
Maildroppa implements the following measures to protect Customer Personal Data. Their specific implementation is determined by the risks of the processing and the requirements of Article 32 of the GDPR. Further development of these measures is governed by Clause 5.2.
1 Organisation and responsibilities
Responsibilities for data protection, security and incident handling are defined and documented.
Persons authorised to access the data are subject to a confidentiality obligation or an appropriate statutory obligation of confidentiality and receive data protection and security instructions relevant to their duties.
Procedures are in place for handling instructions, data subject requests, deletions and requests from authorities, and for reviewing and entering into agreements with relevant service providers.
2 System access and data access control
Access to protected product and administration functions requires authentication and the appropriate authorisations. Account authentication is carried out through the integrated authentication service.
Internal access rights are granted individually and only where necessary. Privileged access and system secrets are protected against unauthorised use. Maildroppa does not store account passwords in plain text.
Authorisations are reviewed in response to relevant events and according to risk. Authorisations that are no longer required are revoked. Security-related account and administration activities are logged.
Devices and administrative working environments used for business purposes are protected against unauthorised entry and access. Physical access to the hosting infrastructure is subject to the access controls of the relevant infrastructure operator.
3 Transmission and communication security
Maildroppa's public web interface and APIs are provided over HTTPS/TLS. Web and API communications with integrated technical services take place over encrypted connections.
Non-public interfaces are protected by authentication and authorisation checks. Webhooks use the authentication, signature or secret-based methods provided for the respective interface.
Domain and sender verification and supported email authentication methods help protect against abusive email sending. Network, proxy and access controls limit abusive requests and load.
4 Tenant separation and separation of purposes
Customer-specific data and resources are logically assigned to the respective Customer account. Server-side authorisation checks restrict access to the resources authorised for the respective account.
Access for operations and support is granted according to the task and to the extent necessary. Maildroppa's own contract and billing processing is separated by purpose from processing on behalf of the Customer.
Customer Personal Data is not used for advertising by Maildroppa or third parties outside the Customer's instructions, or for trading in lists. This does not affect publications and transfers initiated by the Customer.
5 Availability, resilience and recovery
The core application runs on infrastructure in Germany. Primary object storage is located in the European Union. Possible processing and access by integrated service providers in other locations are set out in Annex 3 and the supplementary transfer information.
Protection mechanisms against network attacks and abusive load, operational monitoring and error logging support the availability of the service.
Backups of relevant data are retained, with restricted access, in accordance with a documented schedule. Controlled recovery procedures support the restoration of availability following technical or physical incidents. Deletions and restrictions already initiated are reapplied following recovery.
6 Integrity and secure processing
Supported uploads are subject to technical checks relating to type, size and access.
Software changes are deployed in a controlled manner. Security-related updates, dependencies and identified vulnerabilities are addressed according to risk.
Access and authorisation controls protect against unauthorised modification. Operational and security logs are processed only for their specified purposes and protected against unauthorised access.
Delivery failures, complaints, unsubscribes and sending suppression records are processed in a traceable manner.
7 Data protection by design
Mandatory information is limited to the data required for the respective function. Additional Customer fields and assignments are configurable.
Export, rectification, deletion and blocking functions support the fulfilment of data subject rights. Sign-up and consent processes enable texts, sources and relevant dates and times to be documented.
Open and click tracking is governed by the configuration selected by the Customer. Error and analytics data are minimised in accordance with their purpose and, where appropriate, pseudonymised.
8 Deletion and retention
Deletion procedures are in place for contact data, campaigns, automations, forms, files and associated Customer data.
Contract and invoice data subject to statutory retention requirements are separated from operational Customer Personal Data. Unsubscribe, blocking and security information is processed only for the relevant purposes and for a limited period in accordance with the applicable instruction or legal basis.
Following the end of the services, return and deletion take place in accordance with Clause 11. Backups are subject to a documented retention cycle of limited duration. Completion of the return or deletion is documented on request.
9 Incident management and effectiveness review
Procedures are in place for the detection, classification, containment, investigation, remediation and follow-up of security incidents.
Relevant dates and times, affected systems and data, measures taken and available information on impacts are documented. Necessary evidence is preserved with restricted access.
In the event of a personal data breach affecting Customer Personal Data, the Customer is informed in accordance with Clause 8.
The effectiveness of the technical and organisational measures is regularly reviewed and assessed, and the measures are adjusted where necessary. Changes to the processing and findings from security incidents are taken into account.
ANNEX 3 Approved sub-processors and transfers
The following list applies to the provision of the functions described for each provider. Providers do not necessarily process the same data for every Customer. The functions used and the actual data flows are decisive.
The provider's place of establishment and hosting location are stated separately. Hosting in the EEA does not rule out a transfer to a recipient established in a third country or access from a third country. Such transfers and access are subject to the requirements of Clause 10.
Hetzner Online GmbH, Germany
Services and Customer Personal Data potentially processed
Core hosting, computing capacity, database and network infrastructure; the Customer Personal Data required for the hosted Maildroppa systems.
Hosting and processing
Germany.
Third-country provisions
No third-country transfer for regular operations within the EEA.
Cloudflare, Inc., USA
Services and Customer Personal Data potentially processed
DNS, proxy, content delivery, protection against network attacks and abusive use; IP, request, domain and traffic data, and content transmitted where proxy processing is used.
Hosting and processing
EU and global network locations; possible access from the USA.
Third-country provisions
Processing in and access from third countries only subject to the requirements of Clause 10.
Amazon Web Services EMEA SARL, Luxembourg
Services and Customer Personal Data potentially processed
Object storage and technical cloud services; in particular, Customer images in Maildroppa's AWS account, other files and associated metadata.
Hosting and processing
Primarily Frankfurt, Germany; possible support access from outside the EEA.
Third-country provisions
Transfers to and access from third countries only subject to the requirements of Clause 10.
Bird B.V., Netherlands - SparkPost
Services and Customer Personal Data potentially processed
Email transmission, delivery events, delivery failures and complaints; recipient addresses, sender details, message content and sending metadata.
Hosting and processing
Configured SparkPost EU endpoint; possible support access or access by group companies from outside the EEA.
Third-country provisions
Transfers to and access from third countries only subject to the requirements of Clause 10.
Okta, Inc., USA - Auth0
Services and Customer Personal Data potentially processed
Authentication and account access, to the extent that Customer Personal Data is processed on behalf of the Customer; user and login identifiers, email addresses and security and session metadata.
Hosting and processing
Europe, in accordance with the configured Auth0 tenant region; possible access from the USA.
Third-country provisions
Transfers to recipients in third countries and access from third countries only subject to the requirements of Clause 10.
SmartBear Software, Inc., USA - Bugsnag
Services and Customer Personal Data potentially processed
Error diagnosis and operational monitoring; account and user identifiers and error, device, request and version metadata, to the extent that they constitute personal data.
Hosting and processing
USA; hosting on Google Cloud Platform.
Third-country provisions
Transfers to the USA and other third-country access only subject to the requirements of Clause 10.
Stripo Inc., USA (Delaware)
Services and Customer Personal Data potentially processed
Provision of the email editor and technical preparation of email templates created by the Customer; transmitted HTML/CSS content, including personal information, links and image URLs contained therein, to the extent that the content constitutes personal data. The intended template processing does not include the separate transmission of recipient lists or customer master data such as names and email addresses.
Hosting and processing
Ireland; hosting of the plugin server services operated by Stripo on Amazon Web Services.
Third-country provisions
Transfers to the US provider and any third-country access only subject to the requirements of Clause 10.
Transfer mechanisms and downstream processing chains
A transfer to a third country must be covered by an adequacy decision under Article 45 of the GDPR applicable to the specific recipient and the processing concerned, or by appropriate safeguards under Article 46 of the GDPR. Where standard contractual clauses are used, they must be entered into as a binding agreement using the appropriate module and, where necessary, supplemented by additional protective measures. The requirements of Clause 10 also apply where hosting takes place within the EEA.
Maildroppa shall provide the Customer with details of the transfer mechanism used for the processing concerned and the necessary supporting evidence in accordance with Clause 10.5. Inclusion of a provider in this list replaces neither the sub-processing agreement required under Clause 9.2 nor any required third-country transfer safeguard.
Where other companies or sub-processors are involved in the services concerned, Maildroppa shall provide the information required for the relevant processing in accordance with Clause 9.6.
Image storage and email editor
Storage of images uploaded by the Customer is provided through Maildroppa's AWS account.
As part of the technical preparation of email templates, Stripo receives the HTML/CSS content transmitted for that purpose. Personal information, links and image URLs may form part of that content. Recipient lists and customer master data such as names and email addresses are not transmitted separately for this template processing. Stripo is covered by this Annex only to the extent that it processes Customer Personal Data on behalf of the Customer in doing so.
Distinction from processing for own purposes
Auth0/Okta and other providers are covered by this Annex only to the extent that they process Customer Personal Data on behalf of the Customer. Processing for Maildroppa's own purposes is governed by Clause 1.4.
Customer-controlled integrations
Zapier, Make and other services that the Customer engages directly and connects to Maildroppa are not automatically sub-processors of Maildroppa.
The Customer is responsible for selecting these recipients, entering into the agreements required of it and ensuring the lawfulness of its transfer instructions. Maildroppa's own obligations, in particular those relating to compliance with instructions, security and compliance with the requirements for third-country transfers, continue to apply.
Notifications of changes
The addition or replacement of sub-processors is governed by Clause 9. Merely updating the published list does not replace the prior notification to the Customer required by that Clause.