Data processing agreement (DPA)

Parties

Controller (“Customer”): the business using Sendmora under the terms of service, with the company details given at signup.

Processor (“Provider”): Fabian Faraz Farid, trading as “LuminaX”, Richard-Wagner-Straße 137, 41065 Mönchengladbach, Germany, email: [email protected].

This agreement sets out the data protection duties under the Sendmora contract (main contract). It is concluded together with the main contract, online on signup, and meets Art. 28(3) and (9) GDPR (text form is sufficient). The Customer can download it as a PDF and confirm it in the account.

§ 1 Subject and term

(1) The Provider processes personal data on behalf of the Customer as far as needed to provide Sendmora as online software under the main contract, including hosting, sending, maintenance and support. (2) The term equals that of the main contract. Duties that by nature continue (deletion, confidentiality, proof) survive it.

§ 2 Nature, purpose and scope

Purpose: managing contacts and consent, double opt-in signup, sending the Customer’s newsletters and system emails, processing bounces, complaints and unsubscribes, stats, web archive, migration from the previous provider, optional AI writing help, support.

Nature: collection, storage, organisation, retrieval, use, transmission by email, restriction, erasure.

Data subjects: recipients and prospects of the Customer’s newsletters, users of the customer account.

Types of data:

• Contact data: email address, optionally name and custom fields, tags, lists, status.
• Consent records: time of signup and confirmation, shortened IP address, source, wording and version of the consent text.
• Sending data: delivery, bounces, complaints, unsubscribes; opens and clicks only for recipients who consented to measurement.
• Content of newsletters and web archive pages, insofar as it contains personal data.
• Credentials for the previous provider during a migration (encrypted, deleted afterwards).
• Account user data: email, name, role, logs of important actions.

Special categories under Art. 9 GDPR are only processed if the Customer enters them. The Customer refrains from putting such data into fields or content.

§ 3 Instructions

(1) The Provider processes data only on documented instructions of the Customer unless required by EU or German law, in which case it informs the Customer beforehand unless the law prohibits this. (2) Instructions follow from the main contract, this agreement and the settings in Sendmora. Further instructions are given in text form to [email protected]. (3) If the Provider considers an instruction unlawful, it informs the Customer and may suspend it until clarified.

§ 4 Provider duties

• Processing only for the purposes in § 2, not for its own purposes, in particular not for advertising and not for AI training.
• Confidentiality obligations for everyone with access.
• Technical and organisational measures under Art. 32 GDPR as in Annex 1.
• Data protection contact: [email protected].
• Record of processing activities under Art. 30(2) GDPR.
• Cooperation with the supervisory authority and informing the Customer of measures affecting this agreement.

§ 5 Subprocessors

(1) The Customer approves the subprocessors in Annex 2. The Provider has contracts with them that offer at least the protection of this agreement (Art. 28(4) GDPR). (2) The Provider announces planned changes at least four weeks in advance by email and on this page. The Customer may object for important data protection reasons within that period. If the parties cannot agree, the Customer may terminate the main contract as of the change. (3) Processing outside the EU and EEA only takes place under Art. 44 and following GDPR.

§ 6 Assistance

(1) The Provider forwards data subject requests to the Customer without delay. The Customer can handle access, export and deletion of individual contacts in Sendmora directly. (2) The Provider assists with the duties under Art. 32 to 36 GDPR based on the information available to it.

§ 7 Personal data breaches

The Provider notifies the Customer of a breach without undue delay, where possible within 24 hours of becoming aware, by email to the Customer’s admins, with the information under Art. 33(3) GDPR as far as known. Notifying the authority and data subjects is the Customer’s duty, the Provider assists.

§ 8 Deletion and return

(1) During the term the Customer can export and delete contacts, records and content directly. Migration credentials are deleted by the Provider when the migration finishes or is cancelled. (2) After the contract ends, the Provider deletes all Customer data 14 days after the contract ends (the Customer can export until then) unless law requires retention. Until then the Customer can request an export. Data in backups is overwritten in the regular backup cycle.

§ 9 Proof and audits

(1) On request the Provider supplies the information needed to demonstrate compliance, in particular a current description of measures and subprocessor certifications. (2) If that is insufficient, the Customer may carry out audits with reasonable notice, itself or through an auditor bound to confidentiality who is not a competitor.

§ 10 Liability and final provisions

(1) Liability follows Art. 82 GDPR, otherwise the terms of service apply. (2) In case of conflict this agreement prevails over data protection provisions of the main contract. (3) German law applies. Place of jurisdiction for merchants is Mönchengladbach, Germany.