Data processing agreement (Vertrag zur Auftragsverarbeitung)

Subject

pursuant to Art. 28 GDPR (DSGVO) and Art. 28 UK GDPR for the digital mail service PortoDoc

Parties

The controller (Verantwortlicher) is the company stated as contracting party in the customer account at registration (company name, address and VAT identification number or registration number according to the customer account), represented by the person who concludes this agreement on behalf of the company – hereinafter the “Controller”.

The processor (Auftragsverarbeiter) is Postuvio UG (haftungsbeschränkt), Am Tiergarten 10-12, 22926 Ahrensburg, represented by the managing director (Geschäftsführer) Tom Gladrow, Local Court (Amtsgericht) Lübeck HRB 27726, e-mail: support@portodoc.de – hereinafter the “Processor”.

§ 1 Subject matter and duration

(1) The Processor processes personal data on behalf of the Controller as part of the digital mail service PortoDoc (app.portodoc.de). The basis is the service agreement for PortoDoc under the Processor’s General Terms and Conditions (hereinafter the “Main Contract”, Hauptvertrag). The subject matter, nature and purpose of the processing, the types of data and the categories of data subjects are set out in Annex 1.

(2) The duration of this agreement corresponds to the term of the Main Contract. The obligations regarding return and deletion (§ 12) and confidentiality (§ 4) continue to apply thereafter.

(3) For the Controller’s own contract, account and billing data and for the records of the authorisation (Vollmacht), the Processor is a controller in its own right; this data is not the subject of this agreement.

§ 2 Instructions

(1) The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case, it informs the Controller of that legal requirement before processing, unless that law prohibits this (Art. 28(3)(a) GDPR).

(2) Documented instructions are: this agreement with its annexes, the Controller’s settings in the customer account (e.g. notifications, forwarding of originals) and instructions in text form (Textform) to support@portodoc.de. The Controller confirms oral instructions in text form without undue delay.

(3) Persons authorised to give instructions on behalf of the Controller are its legal representatives and the contact person stored in the customer account. The recipient of instructions at the Processor is Tom Gladrow, managing director, reachable at support@portodoc.de.

(4) If the Processor considers an instruction to infringe data protection law, it informs the Controller without undue delay. It may suspend execution until the Controller confirms or amends the instruction.

§ 3 Obligations of the Processor

(1) The Processor processes the data exclusively to provide the services under the Main Contract. It does not use them for its own purposes.

(2) The Processor maintains a record of processing activities in accordance with Art. 30(2) GDPR.

(3) The Processor names a contact for data protection questions to the Controller: support@portodoc.de. If the Processor is obliged to appoint a data protection officer, it informs the Controller of their contact details in text form.

§ 4 Confidentiality

(1) The Processor only uses persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

(2) The Processor’s employees take note of the content of mail only insofar as this is necessary for scanning, assignment, troubleshooting or an instruction from the Controller.

§ 5 Technical and organisational measures

(1) The Processor implements the technical and organisational measures described in Annex 2 in accordance with Art. 32 GDPR.

(2) The Processor may further develop the measures provided that the level of protection is not reduced. It documents material changes and informs the Controller of them in text form.

§ 6 Sub-processors

(1) The Controller approves the use of the sub-processors (Unterauftragsverarbeiter) and processing locations listed in Annex 3.

(2) The Processor informs the Controller in text form at least 14 days before engaging or replacing a sub-processor. The Controller may object on data protection grounds within 14 days of receipt. If no agreement is reached, either party may terminate the Main Contract with one week’s notice.

(3) The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement (Art. 28(4) GDPR). It is liable to the Controller for the sub-processor’s compliance with these obligations.

(4) The carriage of items by postal service providers up to the delivery address and when originals are forwarded is not sub-processing.

§ 7 Place of processing, third countries

(1) Processing takes place in the European Union: the physical handling of mail on the Processor’s premises in Ahrensburg, hosting in Helsinki (Finland). Details of the sub-processors are set out in Annex 3.

(2) A transfer to a third country takes place only if the conditions of Art. 44 et seq. GDPR are met and the Controller has been informed beforehand.

§ 8 Assistance to the Controller

(1) The Processor assists the Controller with appropriate measures in responding to requests from data subjects (Art. 12 to 23 GDPR). It forwards requests it receives to the Controller without undue delay.

(2) The Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR.

§ 9 Personal data breaches

(1) The Processor notifies the Controller of a personal data breach without undue delay, if possible within 24 hours of becoming aware of it, with the information under Art. 33(3) GDPR insofar as it is available to it.

(2) The following in particular count as a breach: assignment of a letter to the wrong customer account, loss of an original and unauthorised access to scans or originals.

(3) The Processor documents each breach with time, scope and the measures taken and makes this documentation available to the Controller on request.

§ 10 Evidence and audits

(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement.

(2) The Controller may carry out audits, including inspections, itself or through an auditor bound to confidentiality. On-site inspections (Ahrensburg) are announced with reasonable notice and carried out during business hours without avoidable disruption of operations.

§ 11 Originals

(1) After scanning, the Processor keeps the originals in a lockable cabinet for 90 days.

(2) After the 90 days have expired, it destroys the originals in compliance with data protection requirements using a document shredder. On instruction from the Controller, it forwards originals to a specified address instead.

(3) Storage and destruction under paragraphs 1 and 2 are deemed a documented instruction of the Controller unless it instructs otherwise in text form. If the Processor uses a service provider for destruction, § 6 applies.

§ 12 Return and deletion

(1) After the end of the services, the Processor returns the digitised mail at the Controller’s choice (export of the scans) or deletes it, unless there is a legal obligation to store it. It confirms the deletion in text form.

(2) Originals in storage are forwarded on instruction or destroyed in accordance with § 11.

(3) Data in backup copies is deleted when the backup cycle expires.

§ 13 Special features of AI processing

(1) For the summary and deadline detection, the recognised text of the letters is processed by an AI model, exclusively at the locations listed in Annex 3. The results are assistance.

(2) In the interim, AI processing runs on a computer of the shareholder Robert Amthor in Germany, which is connected via an encrypted private network. In future, AI processing will take place at a provider with its registered office and place of processing in the European Union; the change will be announced in accordance with § 6(2).

(3) Letter content is not used to train AI models.

§ 14 Liability and final provisions

(1) Liability is governed by Art. 82 GDPR.

(2) In the event of contradictions, this agreement takes precedence over the Main Contract in matters of data protection.

(3) Amendments and additions require text form. The law of the Federal Republic of Germany applies. Should a provision be invalid, the validity of the remaining provisions remains unaffected.

(4) Annexes 1 to 3 form part of this agreement.

(5) If the Controller is subject to the UK GDPR, this agreement also fulfils the requirements of Art. 28 UK GDPR; references to provisions of the GDPR are to that extent also deemed references to the corresponding provisions of the UK GDPR.

Conclusion of the agreement

This agreement is concluded electronically in text form (Art. 28(9) GDPR). The Controller declares the conclusion at registration or in the customer account by confirming on behalf of the company. As evidence, the time, name of the acting person, IP address, browser identifier and the version of this text are logged. The Controller can retrieve the agreement as a PDF in the customer account at any time.

Annex 1 – Subject matter, nature and purpose of processing, data, data subjects

• Subject matter: digital mail inbox. The Controller has its letter mail sent to “Name · PD number, c/o Postuvio UG, Am Tiergarten 10-12, 22926 Ahrensburg”. The Processor receives it, digitises it and makes it available in the customer account.
• Nature of processing: receiving and opening the letters (on working days, Monday to Friday); scanning (Ricoh fi-8170) and uploading to PortoDoc; text recognition (OCR); AI-supported summary with deadline detection; assignment to the customer account; notification by e-mail; provision of the scans in the customer account; storage of the originals (90 days), then destruction in compliance with data protection requirements using a document shredder or, on instruction, forwarding; deletion in accordance with § 12.
• Purpose: digital provision of the Controller’s letter mail so that it can read it regardless of location and recognise deadlines.
• Types of personal data: letter content, which may contain all types of personal data, including names, addresses and contact details, financial and tax data, special categories under Art. 9 GDPR (e.g. health data) and data relating to criminal convictions and offences (Art. 10 GDPR); data generated for each letter: scan, recognised text, AI summary, detected deadlines, date of receipt, assignment; data of the users of the customer account for notification (name, e-mail address).
• Categories of data subjects: the Controller (where a natural person); employees of the Controller; senders of the letters; third parties named in the letters.
• Place of processing: the Processor’s premises in Ahrensburg (opening, scanning, originals); Hetzner Online GmbH, data centre Helsinki, Finland (hosting); further locations according to Annex 3.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality

• Tenant separation: separation of customer data in the database by row-level security (RLS). Each customer sees only the mail assigned to its account.
• Access to PortoDoc: access only with a personal user account (login with e-mail address and password of at least 8 characters).
• Originals: storage of the originals in a lockable cabinet.
• Scanning workstation: scanning with Ricoh fi-8170 and uploading to PortoDoc.
• Staff: employees with access to mail are bound to confidentiality (§ 4).
• Content protection after assignment: before assignment, employees see the scan and recognised text insofar as this is necessary to assign the letter to the correct customer account. After assignment, the Processor’s employees – including administrators – see only metadata in PortoDoc (customer number, receipt, status, number of pages, assignment route), not the scan, recognised text, summary, sender or subject.
• Emergency access: access to the content of an assigned letter is only possible with a stated reason. It applies to exactly this letter and exactly this member of staff for 15 minutes, is logged in an unalterable way, and the Controller immediately receives an e-mail.
• Notifications: the Processor sends letter content (summary, scan) by e-mail only if the Controller has expressly chosen this in the customer account; without such a choice, the notification contains no letter content.

Annex 2 – 2. Integrity

• Transmission: connections to PortoDoc are TLS-encrypted.
• AI processing (interim): connection of the computer used for AI processing via an encrypted private network (see Annex 3).
• Authorisation: the authorisation (Vollmacht) is granted in text form and logged.
• Assignment: incoming mail is assigned to the customer account by means of the PD number; assignments are logged.

Annex 2 – 3. Availability and resilience

• Hosting: servers at Hetzner Online GmbH in Helsinki (Finland, EU).
• Backup: encrypted off-site backup with restic.
• Availability: no specific availability is promised. During the 90-day storage period, the originals are additionally available physically.

Annex 2 – 4. Deletion and destruction

• Originals: after 90 days destruction in compliance with data protection requirements using a document shredder; on instruction, forwarding.
• Digital data: return or deletion after the end of the contract in accordance with § 12.

Annex 2 – 5. Review

• Regular review: the Processor reviews the effectiveness of the measures regularly and in the event of material changes to the service (Art. 32(1)(d) GDPR).

Annex 3 – Sub-processors and processing locations

• Hetzner Online GmbH, Gunzenhausen (Germany): hosting of PortoDoc (servers, database, scans) in the data centre in Helsinki, Finland (EU); all data under Annex 1. Also storage location of an encrypted backup copy (Storage Box, EU).
• Robert Amthor (shareholder of the Processor), own computer in Germany: AI processing of letter content (summary, deadline detection), in the interim until the switch to an AI provider with its registered office and place of processing in the EU; connection via an encrypted private network; recognised text of the letters. Also storage location of an encrypted backup copy.
• Hostinger International Ltd., Larnaka (Cyprus, EU): delivery of e-mail notifications and the mailbox support@portodoc.de; name and e-mail address of the users, content of the notification.
• Resend (Plus Five Five, Inc., USA): alternative delivery route for e-mail notifications; delivery via data centres in the EU; name and e-mail address of the users, content of the notification. A transfer to the USA takes place only under the conditions of Art. 44 et seq. GDPR.

No other bodies process data under Annex 1; in particular, no AI provider is used apart from the processing location named above. Payment processing (Stripe) concerns only contract and payment data for which the Processor is a controller in its own right under § 1(3); it is not the subject of this agreement. A future AI provider (§ 13(2)) will be announced before it is used in accordance with § 6(2).