1.1 This agreement is concluded between the customer named in the account ("Customer", the controller) and Igor Gerweck, Pulvermühlenweg 7, 34125 Kassel, Germany ("Provider", the processor). It supplements the Terms of service and is accepted electronically when the account is opened (Art. 28(9) GDPR).
1.2 The Provider processes personal data on behalf of the Customer in order to provide i-mailsend. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
1.3 This agreement applies for as long as the Provider processes personal data for the Customer, including the inactive period after a cancellation and until deletion under clause 10.
2.1 The Provider processes personal data only on documented instructions from the Customer, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in that case the Provider informs the Customer of that legal requirement before processing, unless the law prohibits this (Art. 28(3)(a) GDPR).
2.2 The Customer's instructions are given by this agreement, the Terms of service, the settings the Customer chooses in the Service, and the actions it takes there (for example importing, sending, exporting or erasing). Further instructions are given in text form to info@i-mailsend.eu.
2.3 The Provider informs the Customer without delay if, in its opinion, an instruction infringes data protection law. It may suspend carrying out the instruction until the Customer confirms or changes it.
3.1 The Customer is responsible for the lawfulness of the processing, in particular for having a legal basis for each email (such as consent obtained with double opt-in) and for informing data subjects. The Service supports this with generated consent wording, double opt-in and a tamper-evident consent record per contact.
3.2 The Customer instructs the Provider to keep addresses that unsubscribed, bounced, complained or were erased on a suppression list, where possible only as a one-way hash, so that they are not emailed again, and to keep consent records for 3 years after the end of the year in which a consent was withdrawn or a contact was erased.
3.3 Open and click measurement is off by default. If the Customer switches it on, the Provider applies it only to contacts with a recorded tracking consent.
The Provider ensures that every person authorised to process the personal data is committed to confidentiality or is under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR), and processes the data only as instructed.
5.1 The Provider takes the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).
5.2 The measures are subject to technical progress. The Provider may replace them with adequate alternatives, provided the level of security of Annex 2 is not reduced. Significant changes are documented and the Annex is updated.
6.1 The Provider stores and processes the personal data in the European Union.
6.2 A transfer to, or access from, a country outside the European Economic Area takes place only if the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses. Annex 3 states the safeguard for each sub-processor.
6.3 If an authority requests access to the Customer's data, the Provider informs the Customer without delay, unless the law prohibits this, and discloses data only where legally obliged to.
7.1 The Customer gives its general written authorisation for the Provider to engage sub-processors. The sub-processors listed in Annex 3 are approved.
7.2 The Provider informs the Customer by email, and by updating Annex 3 and its Privacy policy, at least 30 days before a new sub-processor is engaged or an existing one is replaced. The Customer may object within these 30 days on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Customer may terminate the affected service with effect from the date of the change, without further cost.
7.3 The Provider imposes on each sub-processor, by contract, the same data protection obligations as in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). The Provider remains fully liable to the Customer for the performance of each sub-processor's obligations.
7.4 Services that the Provider uses only as an ancillary service, such as telecommunications or the merchant of record for payments (which acts as an independent controller and receives no subscriber data), are not sub-processors.
8.1 Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). The Service provides for this: search, correction and export of a contact, erasure with suppression, unsubscribe without login, and a printable consent record per contact.
8.2 If a data subject contacts the Provider directly about the Customer's data, the Provider forwards the request to the Customer without delay and does not answer it itself, unless instructed to.
8.3 The Provider assists the Customer, taking into account the information available to it, in ensuring compliance with Art. 32 to 36 GDPR (security, breach notifications, data protection impact assessments and prior consultation).
9.1 The Provider notifies the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Customer's data.
9.2 The notification describes, as far as known: the nature of the breach including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact person. Information that is not yet available is provided as soon as it is.
9.3 The Provider takes the necessary measures to secure the data and to limit possible adverse effects, and documents every breach.
10.1 The Customer can export its data at any time while the account exists, in common machine-readable formats (Art. 28(3)(g) GDPR).
10.2 When a cancellation takes effect, the account becomes inactive. The Provider keeps the data for 12 months so that the Customer can export it or resume the subscription, and reminds the Customer by email 2 months, 1 month, 2 weeks and 7 days before deletion. The Customer can instruct earlier deletion at any time.
10.3 At the end of that period, or on the Customer's earlier instruction, the Provider deletes all personal data processed for the Customer within 30 days, unless Union or Member State law requires storage. Copies in backups are overwritten within a further 30 days. On request, the Provider confirms the deletion in text form.
11.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this agreement with its annexes, and answers reasonable written questions about the processing.
11.2 The Customer, or an independent auditor bound to confidentiality and appointed by it, may carry out an audit, including an on-site inspection during normal business hours with at least 30 days' notice, normally not more than once a year, unless a breach or an authority's request gives reason for more. The audit must not disrupt operations or give access to other customers' data. Each party bears its own costs. Audits of the data centres are carried out by relying on the providers' certifications and reports.
The Provider acts as an independent controller only for the following limited processing, which protects recipients and the delivery of all customers' email and is described in the Privacy policy: a platform-wide list of addresses that do not exist (hard bounces) or are known spam traps, kept where possible as a one-way hash; and aggregated, non-personal sending statistics. It uses no subscriber data for advertising, profiling or training AI models.
13.1 Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the Terms of service apply.
13.2 If this agreement conflicts with the Terms of service, this agreement prevails in matters of data protection. Where Standard Contractual Clauses apply, they prevail over both.
13.3 Changes to this agreement are made as described in the Terms of service. Changes to Annex 3 follow clause 7.
13.4 The law and place of jurisdiction of the Terms of service apply. This agreement is written in English; translations are for convenience.
| Sub-processor | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Oracle (Oracle Cloud Infrastructure) | Server, database and storage for the platform and this website; delivery of all emails (Oracle Email Delivery) and its delivery logs. | All data stored in the platform, including subscriber data; recipient addresses and delivery status in the delivery logs (kept by Oracle for 30 days). | EU region Frankfurt, Germany (eu-frankfurt-1) | Data processing agreement (Oracle Services Privacy Policy and Data Processing Agreement). Data is stored in Frankfurt; any access from outside the EEA, for example by Oracle support, is covered by the EU Standard Contractual Clauses. |
| Google Cloud (Cloud Storage) | Off-site storage of encrypted database backups. | Database backups, encrypted on our server before upload. Google does not have the key and cannot read them. | EU region (Frankfurt, Germany) | Data processing agreement (Cloud Data Processing Addendum); EU Standard Contractual Clauses for any access from outside the EEA. |
| Cloudflare, Inc. | DNS for our domains (no proxying of website or application traffic) and forwarding of email sent to our own addresses (Email Routing). | Emails you send to our addresses, for example to support or abuse. Subscriber data only if you include it in such an email. | Global network; company in the USA | Data processing agreement; EU–US Data Privacy Framework certification and EU Standard Contractual Clauses. |
Changes follow clause 7: at least 30 days' notice by email, with a right to object.
This agreement is accepted electronically when the account is opened (Art. 28(9) GDPR); a signature is not required. The current version is always available at https://i-mailsend.eu/dpa/.