Data Processing Agreement (DPA)

1. Data Processing and Data Transfer Agreement (DPA)

This Data Processing and Data Transfer Agreement (the “DPA”) reflects the parties’ agreement with respect to the Processing of Customer Personal Information by Everymail GmbH, Olper Hütte 3, 57462 Olpe, Germany, d/b/a Everymail (the “Processor”) on behalf of the subscriber to Everymail services (the “Controller”) in connection with Processor’s services (the “Services”) under the Everymail subscription (the “Agreement”) governing Controller’s use of the Services. The DPA supplements the Agreement and remains active during the entire subscription term. The parties to this DPA shall each be referred to as a “Party”, collectively as the “Parties”.

2. Preamble

This DPA serves to fulfil the obligations under Article 28 and Chapter V of the General Data Protection Regulation (GDPR) for Processing operations in which the Controller is established outside the EEA, the Processor is established in the EEA, and the Processor engages Sub-Processors, including Sub-Processors located in the United States.

This document is based on the European Commission's Standard Contractual Clauses (SCCs) pursuant to Implementing Decision (EU) 2021/915 (processing between controllers and processors) and, for transfers to Sub-Processors located in Third Countries, Implementing Decision (EU) 2021/914 (Module Three).

3. Definitions

The definitions contained in Article 4 GDPR shall apply to this DPA. Additionally, the following definitions apply:

a. “Adequacy Decision Country” means any country for which the EU Commission has decided that it ensures an adequate level of protection according to Art. 45(3) GDPR or an equivalent decision that remains in force under Art. 45(9) GDPR. If the adequacy decision is limited in scope (e.g. if it applies only to certain legal entities), then the definition shall only apply where the decision applies in the given context (i.e. if the relevant parties and data processing activities are within the scope of the adequacy decision).

b. “Customer Personal Information” means any data processed by Processor on Controller’s behalf, that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person, to the extent that such information is protected as “personal data” under the GDPR or as “personal information” (or an analogous variation of such term) under other applicable Data Protection Laws.

c. “Data Protection Laws” means the GDPR and all other laws and regulations applicable to the Processing of Customer Personal Information, including, where applicable, the Privacy Act 2020 (New Zealand).

d. “DPF” means the EU-U.S. Data Privacy Framework within the meaning of Commission Implementing Decision (EU) 2023/1795.

e. “EEA Country” means any country that is a member of the European Economic Area.

f. “EU Commission” refers to the European Commission.

g. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

h. “Instructions” means the written, documented instructions issued by Controller to Processor, and directing the same to perform a specific or general action with regard to Customer Personal Information (including, but not limited to, depersonalizing, blocking, deletion, and making available).

i. “Processing” means any operation or set of operations which is performed on Customer Personal Information, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Customer Personal Information. The terms “Process,” “Processes” and “Processed” will be construed accordingly.

j. “SCC (third country transfers)” means the EU Commission’s “Standard Contractual Clauses” as set out in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR. When referring to the SCC (third country transfers) in this DPA, the applicable module shall also be indicated.

k. “SCC (EEA)” means the EU Commission’s “Standard Contractual Clauses” as set out in the Annex to the Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) GDPR.

l. “Sub-Processor” means any other person or entity engaged by Processor to assist it in Processing Customer Personal Information on behalf of Controller.

m. “Third Country” means any country that is neither an EEA Country nor an Adequacy Decision Country.

References in the SCC (EEA) and the SCC (third country transfers) to “personal data” shall be read as references to Customer Personal Information, and references to “instructions” as references to Instructions.

4. Roles of the Parties and Controller’s Instructions

The Parties acknowledge and agree that regarding the Processing of Customer Personal Information performed on behalf of Controller, Processor is a processor and Controller is a controller within the meaning of the GDPR. Processor receives Customer Personal Information pursuant to the business purpose of providing the Services to Controller in accordance with the Agreement.

The Parties agree that the Agreement (including this DPA), together with Controller’s use of the Services in accordance with the Agreement, constitute Controller’s complete and final Instructions to Processor in relation to the Processing of Customer Personal Information, and additional instructions outside the scope of the Instructions shall require prior written agreement between the Parties.

Through Section 5, Controller and Processor enter into the SCC (EEA). Section 6 sets out the safeguards for the engagement of Sub-Processors located in the United States.

5. Controller to Processor (Controller outside the EEA)

This Section 5 applies to any Processing of Customer Personal Information where Controller is located outside the EEA and Processor is located in an EEA Country. The Parties agree that the SCC (EEA) apply between them, irrespective of the fact that Controller is not established in an EEA Country. Controller and Processor agree to be bound by the SCC (EEA) with the following provisions:

• the optional docking clause 5 shall be included;
• with regard to clause 7.7, Processor shall have Controller’s general authorisation to sub-contract any of its processing operations performed on behalf of Controller to a Sub-Processor, with the time period for Controller’s objection being at least two weeks;
• with regard to clause 7.8, Controller instructs Processor to transfer Customer Personal Information to the Sub-Processors listed in Schedule 3, including Sub-Processors located in the United States, subject to Section 6;
• with regard to clauses 8(c)(4), 9.1(b), 9.1(c) and 9.2, the first option shall apply in each case;
• the Annexes shall be filled in as follows:

The competent supervisory authority for Processor is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

6. Sub-Processors in the United States

Where a Sub-Processor engaged under Section 5 is located in the United States or another Third Country, Processor shall ensure that the transfer of Customer Personal Information to that Sub-Processor complies with Chapter V GDPR. For this purpose, Processor shall ensure for each such Sub-Processor that:

Schedule 3 indicates the transfer mechanism applicable to each Sub-Processor located in a Third Country. Upon Controller’s reasonable request, Processor shall provide Controller with a copy of the SCC concluded with a Sub-Processor; Processor may redact commercial information and information not relevant to data protection.

If the transfer mechanism relied upon for a Sub-Processor is invalidated or ceases to apply, Processor shall without undue delay implement an alternative transfer mechanism or suspend the transfer to that Sub-Processor, and shall inform Controller accordingly.

7. New Zealand Privacy Act 2020

Where Controller is subject to the Privacy Act 2020 (New Zealand), Processor holds Customer Personal Information solely for and on behalf of Controller, and not for its own purposes, within the meaning of section 11 of the Privacy Act 2020. Processor shall notify Controller without undue delay after becoming aware of a privacy breach affecting Customer Personal Information, so that Controller can assess and make any notification required under Part 6 of the Privacy Act 2020.

8. Miscellaneous

In case of any conflict or inconsistency between this DPA and other relevant agreements, they will take priority in this order: (i) SCC (EEA), (ii) Transfer Mechanism, (iii) DPA, (iv) Agreement.

Changes and amendments to this agreement must be made in writing and contain explicit reference to this agreement and the intention to amend it. This also holds true for this requirement of written form.

In case individual provisions of this agreement should be invalid, the remaining provisions of this agreement shall remain unaffected.

9. Schedules

The following schedules become part of and form an integral part of this DPA by reference:

• Schedule 1 - Description of the Processing
• Schedule 2 - Technical and Organisational Measures
• Schedule 3 - List of Sub-Processors

DPA Schedule 1 – Description of the Processing

Capitalised terms have the meaning given to them in the DPA.

1. Categories of data subjects whose personal data is processed / transferred

• Assigned Users: employees, freelance workers, contractors, advisers and other individuals to whom Controller allots an account in the Services
• Communication partners: senders and recipients of emails and invitations, and other individuals whose data is contained in emails, attachments, calendars, contacts or files stored in the Services

2. Categories of personal data processed / transferred

• User-Account-Information – e.g. name, username, email address, aliases, password (hashed), role, settings
• Communication content – content of emails and attachments
• Meta Data (excl. Geodata) – information necessarily incurred while sending, receiving and storing communications, e.g. email headers, sender and recipient addresses, time stamps, message size, IP address, log files
• Contact Information – address book entries maintained by Assigned Users
• Calendar Data – appointments, participants, invitations and responses
• User Generated Content – files, documents and other content stored by Assigned Users
• Device Data (excl. Geodata) – e.g. client and browser information, operating system, device identifier, as required to operate the Services

3. Sensitive data processed (if applicable)

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• Data revealing Racial or Ethnic Origin
• Data revealing Religious or Philosophical Beliefs
• Genetic Data
• Data concerning Health
• Data revealing Political Opinions
• Data revealing Trade Union Membership
• Biometric Data
• Data concerning Sex Life and Sexual Orientation

Processor and Controller do not programmatically process these data categories. These data categories may be contained in emails, attachments or other content provided or generated solely by Assigned Users and their communication partners. Such content is processed only in automated form as part of the Services (e.g. storage, transmission, spam and malware filtering). Processor’s personnel may get access to such content only where necessary to provide support requested by Controller, subject to the access restrictions set out in Schedule 2.

4. Frequency of the transfer

• Continuous basis during term of DPA / Agreement.

5. Nature of the processing / data transfer and further processing

• Hosting and storage (data, applications, systems, components)
• Operating (application, system, components): sending, receiving and routing of emails; indexing and search; synchronisation across devices
• Automated spam and malware filtering
• Migration of existing mailbox contents from Controller’s previous email service provider, where ordered by Controller
• Support and maintenance (application, system, components)
• Deletion of data at the end of the subscription or upon Controller’s Instructions

6. Purpose(s) for which the personal data is processed on behalf of the controller / purpose(s) of the data transfer and further processing

• Provision, operation, maintenance and security of the Services for Controller and its Assigned Users, and provision of support, in fulfilment of the Agreement.

Processor does not process Customer Personal Information for marketing, advertising or profiling, or to train artificial intelligence models.

7. Duration of the processing

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

• During term of DPA / Agreement. Customer Personal Information is deleted in accordance with the Agreement (section D.e of the Terms of Service) and the DPA.

8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

See Schedule 3. Duration of processing: during term of DPA / Agreement.

DPA Schedule 2 – Technical and Organisational Measures

1. General technical and organisational security measures

The following technical and organisational security measures apply to all of Processor’s internal data processing activities.

1.1 Building Access Control

1.2 Physical Access Control

1.3 Data Access Control

1.4 Transmission Control

1.5 Input Control

1.6 Job Control

1.7 Availability Control

1.8 Data Separation Control

1.9 Pseudonymisation and encryption

1.10 Resilience of systems and services

1.11 Rapid Recovery

1.12 Periodical Review

2. Everymail Services Technical and Organisational Security Measures

In addition to the TOMs listed above, the following TOMs apply if Processor provides Everymail Services to Controller:

2.1 Physical access control

2.2 System access control

2.3 Data access control

2.4 Transmission Control

2.5 Input control

2.6 Job Control

2.7 Availability control

2.8 Data separation control

2.9 Pseudonymisation and encryption

2.10 Resilience of systems and services

2.11 Rapid recovery

2.12 Periodical review

DPA Schedule 3 – List of Sub-Processors

Processor engages the following Sub-Processors. If one of the legal entities listed below is the Processor under the DPA, it is not a Sub-Processor. Controller has authorised the engagement of the following Sub-Processors. Where a Sub-Processor is located in a Third Country, the transfer mechanism stated below applies in accordance with Section 6 of the DPA.

Service providers engaged by Processor for its own purposes (e.g. billing, account verification, marketing, website operation) are not Sub-Processors and are described in Processor’s Privacy Policy, available at https://www.everymail.com/privacy-policy?country=nz.

1. Open-Xchange Group Companies

2. Additional Sub-Processors