Important Notice: This English version is a non‑binding translation of the original German Data Processing Agreement (DPA). The legally binding version is the German text. In case of discrepancies, the German version shall prevail.

According to Art. 28 (3) GDPR, it is necessary for the contracting parties to regulate their data protection obligations through a data processing agreement in order to ensure legal certainty for the processing of personal data (hereinafter referred to as "Data") within the scope of the General Terms and Conditions (hereinafter referred to as "Main Contract"). The following Data Processing Agreement applies to activities related to the Main Contract in which employees of Conbool GmbH (hereinafter referred to as "Processor") or third parties commissioned by the Processor process Data on behalf of the Client. This agreement is based on the template provided by the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht).

§ 1 Subject Matter and Duration of Data Processing

The subject matter of this Agreement are the rights and obligations of the parties applicable within the scope of the service provision according to the service description and Main Contract, insofar as data processing is carried out by the Processor as a processor for the Controller in accordance with Art. 28 GDPR. This includes all activities required to fulfil the order that constitute data processing by the Processor.
Processing shall generally take place within the EU or the EEA. If, exceptionally, a transfer to a third country is necessary, the Processor shall ensure suitable guarantees in accordance with Art. 44 et seq. GDPR, in particular through Standard Contractual Clauses, and shall take supplementary technical and organizational measures. Details and the respective involved processors are set out in Appendix 1.
The processing of Data begins with the conclusion of the Main Contract and continues for an indefinite period until the termination of this Data Processing Agreement or the Main Contract.
The Controller has the right to terminate the underlying Main Contract as well as this Data Processing Agreement at any time without notice if there is a serious breach by the Processor of data protection regulations or the provisions of this Agreement.

§ 2 Nature and Purpose of Processing, Types of Personal Data, and Categories of Data Subjects

Data processing includes all types of processing within the meaning of the GDPR for the fulfilment of the order.
The purpose of the processing is the provision of the agreed services from the Main Contract, in particular the provision of the Conbool platform with the modules SecureMail, MailGuard, SecureFiles, Disclaimer/Signature Manager, DMARC Reports, email archiving, continuity (email continuity), awareness, 365 backup, and Conbool Mail. Processing includes, among other things:
- SecureMail: filtering, analysis, encryption, decryption, signing, and validation of e-mails, as well as provision in a message portal.
- MailGuard: inbound filtering, DLP analysis, threat detection.
- SecureFiles: storage, provision, and transfer of large files via four modes (Secure Send, Secure Inbox, Public Link, Shared Pool).
- Disclaimer/Signature Manager: server‑side insertion of signatures, disclaimers, and banners.
- DMARC Reports: collection, parsing, storage, and visualization of DMARC aggregate and forensic reports.
- Email archiving: compliant long-term storage of inbound and outbound e-mails in accordance with the retention policies configured by the Controller. Immutability is enforced in software in the Standard storage class and secured by a hash chain whose head is regularly written as a seal outside the database into the object storage (immutable in the Compliance storage class); in the Compliance storage class it is additionally secured by an object lock at the storage target (WORM/Object Lock).
- Continuity (email continuity): retention of incoming messages and provision of access independent of the Controller's mailbox system during an outage, and onward delivery thereafter.
- Awareness: sending of phishing simulations to the recipient groups determined by the Controller, capture of interaction events, assignment and evaluation of training lessons.
- 365 Backup: retrieval, storage, and restoration of content and metadata from Microsoft 365 via Microsoft's interfaces.
- Conbool Mail: provision of mailboxes including storage, delivery and retrieval of e-mails, calendars and contacts; migration of existing content from Exchange Online and from Outlook data files uploaded by the Controller; export of mailboxes.
If the Controller uses their own MPKI (Managed Public Key Infrastructure), they remain the Controller within the meaning of Art. 4 No. 7 GDPR for identity verification, policies, application and approval processes, issuance, renewal, suspension, and revocation. The Processor exclusively provides technical interfaces and does not check policy content. Insofar as the Controller obtains certificate services via the Processor, the respective involved certification authorities regularly act as separate Controllers. Processing by certification authorities is subject to their CP and CPS. Decisions of the certification authorities are beyond the Processor's sphere of influence. Fees of the certification authorities shall be borne by the Controller. Reimbursement of already incurred CA fees is excluded unless the certification authority provides for a reimbursement.

Type of Data

Personal master data (e.g., salutation, first and last name, address)
Contract master data (e.g., contractual relationship, products/services)
Communication data (e.g., telephone number, e-mail addresses, domains)
Billing and payment data
Third-party access data (e.g., IP address, timestamp, login token for message portal access)
Metadata of e-mails (e.g., sender, recipient, subject lines)
Content data of e-mails (e.g., text content, attachments)
Certificate status data, OCSP and CRL queries, key material metadata, portal access logs
Identity and verification data for certificate applications (e.g., ID data, commercial register excerpts, proof of representation)
File contents and file metadata (file name, size, hash, MIME type) when using SecureFiles
Upload/download audit data when using SecureFiles (timestamp, IP, device identifier)
DMARC aggregate reports (RUA): sender IPs, recipient domains, SPF/DKIM pass/fail status, volume
DMARC forensic reports (RUF): additionally truncated header information, possibly body hashes or body excerpts
Long-term archived e-mail content and its metadata when using email archiving
Temporarily stored e-mail content and metadata when using continuity
Recipient addresses, group assignments, interaction and training data when using awareness
Content backed up from Microsoft 365 and its metadata when using 365 backup

All persons who use services from the Main Contract
All persons about whom communication takes place
E-mail senders and recipients
External recipients authorized by the Controller
Employees
Customers
Interested parties
Business partners and suppliers
Sales representatives
Contact persons
Recipients and uploaders of files via SecureFiles (internal and external)
Persons appearing as senders or recipients in DMARC forensic reports

§ 3 Responsibility and Processing of Documented Instructions

The Controller is solely responsible under this agreement for compliance with the legal provisions of data protection laws, particularly for the lawfulness of the transfer of Data to the Processor and the lawfulness of the data processing (as the "Controller" within the meaning of Article 4(7) GDPR). This also applies to the purposes and means of processing regulated in this agreement.
Instructions are initially defined by the Main Contract and may subsequently be amended, supplemented, or replaced by individual instructions provided by the Controller in written or text form (e.g., via email). Instructions not provided for in the contract will be treated as a request for a change in service and must be agreed upon jointly by the Controller and Processor. Oral instructions must be confirmed promptly in writing or text form by the Controller.
If implementing an instruction is unreasonable for the Processor, the Processor is entitled to terminate processing and cancel the contract extraordinarily. The Controller's obligation to pay ceases when services are discontinued by the Processor. Unreasonableness particularly exists if services are provided in an infrastructure shared by multiple Controllers/customers (shared services) and a change in processing for individual Controllers is not feasible or reasonable.
The Controller may terminate both the Main Contract and this agreement at any time if the Processor cannot or will not execute an instruction from the Controller or if the Processor unlawfully refuses to grant inspection rights to the Controller.

§ 4 Duties of the Processor

The Processor may only process Data covered by this agreement within the scope of the contract and in accordance with the Controller’s instructions, unless an exceptional case under Article 28(3)(a) GDPR applies and its requirements are met (e.g., investigations by law enforcement authorities). In such cases, the Processor shall inform the Controller of these legal requirements before processing, unless the relevant law prohibits such notification due to an overriding public interest.
The Processor shall immediately inform the Controller if it believes that an instruction violates applicable laws. The Processor may suspend implementation of the instruction until it is confirmed or amended by the Controller.
The Processor ensures that the Data provided for processing is not used for any other purpose, particularly not for its own purposes. The sole exceptions are the use of fuzzy checksums of confirmed malicious messages to protect all tenants as described in Appendix 1 No. 8, which does not cover message content, addresses or subject lines, and the improvement of the protection features under § 4a, insofar as the Controller has consented to it. Furthermore, the Processor ensures that all persons authorized to process personal Data are bound by confidentiality obligations, which continue even after termination of this agreement. This also applies to obligations under telecommunications secrecy (§ 3 TTDSG), social secrecy, and professional secrecy under § 203 StGB.
The Processor shall implement appropriate technical and organizational measures to adequately protect the Controller’s Data in compliance with Article 32 GDPR. These measures must ensure the confidentiality, integrity, availability, and resilience of systems and services related to processing on a continuous basis. The technical and organizational measures are documented by the Processor in Appendix 2 and made available to the Controller for review.
The Processor shall reasonably assist the Controller in fulfilling requests and claims from Data Subjects under Chapter III GDPR as well as in complying with obligations under Articles 33 to 36 GDPR. For this support, the Processor may request reasonable compensation unless the request arises from a breach of contract by the Processor.
The Processor shall promptly notify the Controller of any known breaches of personal Data protection involving the Controller’s Data. The Processor shall take necessary measures to secure the Data and mitigate potential adverse effects on affected individuals.
The Processor shall designate a contact person for data protection matters arising under this agreement.
The Processor shall rectify, delete, or restrict processing of personal Data from this agreement as instructed by the Controller.
In 365 Backup, deletion is carried out per protection unit, that is per mailbox, per archive mailbox, per group mailbox, per OneDrive, per SharePoint list, per Microsoft Team, per Teams chat, per Planner plan, and per directory extract from Microsoft Entra ID. Deletion of individual data subjects from within an existing protection unit is not possible: in a Microsoft 365 backup, information about a person does not reside in that person's own protection unit but is distributed across the mailboxes, channels, chats, and documents of their correspondents, and encryption operates at the level of the protection unit. The Controller shall take this into account when handling requests under Art. 17 GDPR; the Processor executes and logs an instruction to delete a protection unit.
Upon completion of processing services, the Processor shall either delete all personal Data or return it to the Controller at their discretion unless Union or Member State law requires storage of personal Data. If the Controller does not exercise this right of choice, deletion shall take place within 30 calendar days after the end of the contract. If the Controller deletes its tenant itself, this constitutes an instruction for immediate deletion, subject to the lock periods under this paragraph. Deleted data remains in the Processor's daily database backups until these are overwritten after no more than seven days. For Conbool Mail mailbox contents, by way of derogation, deleted contents remain in versions and backups for up to 30 days and are removed afterwards. Backups of the 365 Backup module and export files created from them may be subject to a lock period that the Processor cannot lift either: in the Compliance storage tier the lock period set there. The Processor removes objects that are still locked when the tenant is deleted once the period has expired; objects in a storage target of the Controller's own remain in the Controller's storage. When the tenant is deleted, the Processor deletes all keys without which these backups cannot be decrypted; once the database backups have been overwritten, they can no longer be read by the Processor. By way of derogation, Section 5.5.3 of the Main Contract applies to data in email archiving: if the Controller makes no choice by the end of the contract, the Processor continues to hold the archive until the respective retention period expires, because deletion before then would frustrate the Controller's own retention obligation. The Controller may at any time instruct return or, where no retention obligation stands in the way, deletion. For data processed during a test phase, the following applies differently: deletion at the latest 72 hours after the end of the test. Log data will be deleted according to the Main Contract at the latest after 90 days. When email archiving is used, archived e-mails are stored for the retention period configured by the Controller (regularly several years in line with statutory retention obligations) and deleted after its expiry. Messages archived under a verified object lock are technically protected against deletion until the set lock period expires; a deletion request is executed for them once that period ends (Section 5.5.3 paragraph 5 of the Main Contract).
The Processor shall provide technical means with which the Controller can make content temporarily available to authorized third parties (e.g. external recipients). Access is enabled exclusively at the instigation of the Controller. The Processor shall log these accesses and ensure that they are only possible with valid authorization (e.g. one-time link with expiration date). The lawfulness of the release and information of the data subjects is the responsibility of the Controller.
The Processor shall demonstrate compliance with its obligations under this agreement using appropriate means. Upon request, it will provide documented controls and required information to the Controller.
The Processor agrees that the Controller is entitled to verify compliance with data protection and security requirements as well as contractual agreements through audits or on-site inspections (Article 28(3)(h) GDPR). The Processor may require confidentiality agreements from auditors but not in a way that prevents evidence submission to supervisory authorities by the Controller. Competitors or individuals working for competitors may be rejected as auditors by the Processor.
The Processor assures cooperation during audits conducted by or on behalf of the Controller. For information or support activities during audits, reasonable compensation may be requested unless they arise due to legal or contractual violations by the Processor. A cost estimate will be provided beforehand.
The Processor will provide all necessary information to prove compliance with Article 28 GDPR upon request from either the Controller or an auditor appointed by them.
The Processor confirms awareness of all relevant data protection regulations under GDPR applicable to data processing activities covered by this agreement.
If claims for damages are made against either party under Article 82 GDPR by affected individuals, both parties agree to support each other in defending against such claims within their capabilities. Reasonable compensation may be requested unless claims arise due to breaches of law or contract by the Processor.

§ 4a Improving the protection features

This section applies only if the Controller consents in the customer portal (Settings › Improving Conbool). Without this consent, the Processor does not use any messages of the Controller for this purpose.

The Controller may consent in the customer portal to messages of its tenant being used to improve the detection of the Processor's products. The consent covers a) messages detected by MailGuard as an attack or spam as well as reported messages confirmed by the Controller as a threat or spam, and b) a sample of delivered inbound messages and messages released from quarantine, the latter in accordance with No. 4. Only owners and security administrators of the tenant can consent, change or withdraw. The consent applies to the products named in the consent text; if a product is added, the Processor obtains renewed consent.
The Processor selects and redacts the messages in accordance with No. 3 on behalf of the Controller. For the subsequent use for training, the Processor is a controller in its own right within the meaning of Art. 4 No. 7 GDPR. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in the security of networks and information systems (Recital 49 GDPR). The Processor informs the data subjects in its privacy policy.
The following applies to the use:
- Before use, email addresses, phone numbers, IBANs, card numbers and the names in the sender and recipient lines are replaced by placeholders.
- Only inbound mail received after the consent is used. Outbound messages are not used.
- Processing is automated and takes place exclusively on the servers on which the Processor operates MailGuard, in a data centre in Germany. There is no disclosure to third parties.
- The copies made for this purpose are deleted immediately after use, and no later than 24 hours. Only the model weights remain permanently.
- The model only outputs a classification, no text. The Processor takes measures so that no personal data can be extracted from the model and documents them.
Messages under No. 1 b are only used if the Controller confirmed when consenting that no one in the tenant is bound by professional secrecy under § 203 StGB; without this confirmation, the consent only covers messages under No. 1 a. For messages under No. 1 a, the confidentiality obligation under § 4 No. 3, including § 203 StGB, applies.
The Controller may change or withdraw the consent at any time in the customer portal. From the withdrawal onwards, no further messages are used. Models already trained are not reverted.
Every consent, change and withdrawal is logged with person, time, scope and version of the text displayed.
The Controller informs its employees appropriately about the consent.

§ 5 Rights and Obligations of the Controller

The Controller is solely responsible for assessing the lawfulness of processing under Article 6(1) GDPR and for safeguarding the rights of Data Subjects in accordance with Articles 12 to 22 GDPR. Nevertheless, the Processor is obligated to promptly forward any such requests, insofar as they are clearly directed exclusively at the Controller. In fulfilling its obligations, the Processor follows the instructions of the Controller. The Processor shall not be held liable if a request from a Data Subject is not answered, answered incorrectly, or answered late by the Controller.
The Controller must promptly and comprehensively inform the Processor if it identifies errors or irregularities in the implementation of this agreement or in compliance with data protection regulations.
Upon termination of the contract, the Controller is obligated to delete any personal Data stored in the services before the end of the contract.
At the Processor's request, the Controller shall designate a contact person for data protection matters.
The Controller is obligated to treat all knowledge gained about trade secrets and data security measures of the Processor as confidential. This obligation remains in effect even after this agreement has been terminated.

§ 6 Authorized Persons of the Controller and Recipients of Instructions for the Processor

Authorized Persons of the Controller: The persons authorized to issue instructions on behalf of the Controller are those specified in the customer account's master data.
Recipients of Instructions for the Processor: All administrators of Conbool GmbH are designated as recipients of instructions.
Form of Instructions: Instructions from the Controller must be issued in writing or in text form via the agreed communication channels provided on the website. In urgent cases, instructions may be given by telephone but must be promptly confirmed in writing or text form.
Changes to Authorized Persons: In the event of a change or long-term unavailability of authorized persons, the contracting party must inform the other party without delay and, as a rule, in written or electronic form about successors or representatives.

§ 7 Additional Processors (Subcontractors)

The Controller generally permits the Processor to engage additional subcontractors in accordance with Article 28 GDPR for fulfilling contractual obligations. The Processor ensures that agreements with these third parties include sufficient provisions to guarantee appropriate data protection and information security measures. The Processor publishes the respective current list of processors in Appendix 1; changes will be communicated at least 14 days before use, the right to object according to No. 3 remains unaffected.
The currently engaged subcontractors are listed in Appendix 1. The Controller agrees to their use.
The Controller has the right to object to the engagement of a new subcontractor within 14 days after being notified, provided there is a valid reason for doing so.
In the event of an objection, the Processor may either provide the service without involving the proposed subcontractor or, if this is not feasible, terminate the affected service within a reasonable period (at least 14 days) after receiving the objection. In such cases, the Controller is no longer obligated to pay for services that have been discontinued.
The Processor commits to regularly reviewing subcontractors' compliance with data protection requirements and providing evidence to the Controller upon request.
When engaging additional processors, it is the Processor's responsibility to transfer its data protection obligations under this agreement to those subcontractors. The Processor ensures compliance with technical and organizational measures through regular monitoring.
Contracts with subcontractors must be concluded in written form, which may also include electronic formats (in accordance with Article 28(4) and (9) GDPR).

Within its area of responsibility, the Processor implements appropriate technical and organizational measures to ensure that processing complies with the requirements of the GDPR and guarantees the protection of the rights and freedoms of the Data Subjects. The Controller is responsible for implementing appropriate technical and organizational measures within its own area of responsibility in accordance with Article 32 GDPR, ensuring the confidentiality, integrity, availability, and resilience of systems and services related to processing over the long term.
The current technical and organizational measures are described in Appendix 2 and are binding as part of this Agreement. The Processor may adapt the measures, provided that the level of protection does not fall below the level required by Art. 32 GDPR; essential changes will be documented and made available to the Controller upon request.
The Processor conducts regular reviews of the effectiveness of its technical and organizational measures to ensure the security of processing in accordance with Article 32(1)(d) GDPR.
Over time, the Processor will adapt its implemented measures to account for developments in the state of technology and changes in risk levels. The Processor may modify its technical and organizational measures as long as this does not result in a level of protection below that required by Article 32 GDPR.

§ 9 Liability

Liability and claims for damages are governed by Article 82 GDPR.
In the event that a Data Subject asserts a claim for damages under Article 82 GDPR, the parties agree to support each other in clarifying the underlying facts and circumstances.
In the case of a data protection breach as defined in Article 33 GDPR, the Processor commits to: a. Informing the Controller immediately (no later than within 24 hours). b. Taking all necessary measures to contain the incident and prevent further violations. c. Supporting the Controller in notifying the competent supervisory authority.

§ 10 Miscellaneous

If the property or data of the Controller being processed is endangered by measures taken by third parties (e.g., seizure or confiscation), insolvency or settlement proceedings, or other events, the Processor must inform the Controller without delay.
Should any individual provisions of this agreement be invalid, this shall not affect the validity of the agreement as a whole.
The Processor reserves the right to amend this agreement if required by legal changes or to implement new technical standards. The Controller will be informed in writing at least four weeks before such amendments take effect and has the right to object within this period. In case of an objection by the Controller, the Processor has an extraordinary termination right.
The Controller accepts this agreement as part of the General Terms and Conditions (GTC) for the products they have booked. In case of conflicts, the provisions of this Data Processing Agreement take precedence over those of the Main Contract.
If significant changes occur regarding subcontractors or their data protection measures, the Processor will promptly inform the Controller and adapt this agreement accordingly.
German law applies.

Appendix 1 Additional Processors

IONOS SE
- Address: Elgendorfer Straße 7, 56410 Montabaur, Germany
- Description of Partial Service: Provision, operation, and maintenance of products, specifically: a. Operation, maintenance, and servicing of the products. b. Provision of the physical environment for operating the Conbool GmbH website and application. c. Operation of the platform and provision of dedicated and virtual servers as well as cloud solutions, including the Conbool Mail mailbox server with the administrative data of the mailboxes. d. S3-compatible object storage (IONOS S3 Object Storage) for files transmitted via SecureFiles and for archived e-mails, where this storage target is set up for the tenant. Locations: Frankfurt and Berlin (Germany) and Logroño (Spain).
Supabase Inc.
- Address: 970 Toa Payoh North #07-04, Singapore
- Description of Partial Service: Backend database used for storing and processing service-relevant data as well as for user management and authentication.
- Data processing primarily takes place on servers within the European Union (e.g., Frankfurt am Main).
- Third-country connection: Supabase Inc. is a company under US law. Even though the data is stored in the EU, the provider may fall under the US CLOUD Act due to its location.
- Supabase ensures, through appropriate technical and organizational measures, that the confidentiality, integrity, and availability of processed personal data are maintained. These measures include, among other things, the encryption of data during transmission and storage and access controls in accordance with GDPR requirements.
- If a transfer to third countries is required, Supabase ensures that all data protection requirements under Articles 44 et seq. GDPR are met, particularly through the conclusion of Standard Contractual Clauses (SCCs).
- A corresponding Data Processing Agreement has been concluded with Supabase Inc.
- The Processor regularly reviews compliance with the contractually agreed data protection measures by Supabase, particularly regarding data transfers to third countries.
Cloudflare Inc.
- Address: 101 Townsend Street, San Francisco, California 94107, USA
- Description of Partial Service: Object storage (Cloudflare R2) exclusively for legacy data from before the change to Impossible Cloud: safety copies of e-mails archived up to 13 September 2026 until they are deleted, files transmitted via SecureFiles up to 12 September 2026 until their retention period ends, and artefacts of bulk export in email archiving. No new data is stored there. Storage takes place exclusively in the EU jurisdiction of Cloudflare R2; the data does not leave the European Union.
- Third‑country connection: Cloudflare Inc. is a company based in the USA. Even though the data is stored in the EU, the provider falls under the US CLOUD Act due to its location. Processing is carried out under EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR. Supplementary measures are the restriction to the EU jurisdiction, encryption in transit (TLS) and at rest (AES-256), object-scoped access keys, and the separation of key and metadata management from the storage itself. Client-side end-to-end encryption that would technically preclude access by the processor is not currently used.
- Storage target of the Controller's own: where the Controller sets up its own S3-compatible storage target for email archiving, for SecureFiles, or for 365 Backup, it is itself responsible for its operation, location, availability, and backup. Such a target is not a further processor of the Processor.
STACKIT GmbH & Co. KG
- Address: Stiftsbergstraße 1, 74172 Neckarsulm, Germany
- Description of Partial Service: S3-compatible object storage (STACKIT Object Storage) as an optional storage target for archived e-mails in email archiving and for files transmitted via SecureFiles, in each case in tenant-specific buckets, and as a per-tenant selectable storage target of the 365 Backup module for heightened data sovereignty requirements. For 365 Backup the backups are held in a shared bucket in which tenants are separated by distinct object prefixes; the per-protection-unit encryption applies unchanged. Processing takes place once that storage target has been set up for the tenant. For email archiving this target supports the Compliance storage class with an object lock (WORM/Object Lock).
- Locations: Germany (region eu01) and Austria (region eu02); the region is determined at set-up. Certified according to C5 Type 2 (Schwarz Group). A data processing agreement has been concluded.
Impossible Cloud GmbH
- Address: Friesenweg 12, Haus 5, 22763 Hamburg, Germany
- Description of Partial Service: S3-compatible object storage as the default storage target for files transmitted via SecureFiles, for archived e-mails in email archiving, and for the backups of the 365 Backup module. Archived e-mails are held there in a shared bucket in which tenants are separated by distinct object prefixes. For 365 Backup the backups are held in a shared bucket in which tenants are separated by distinct object prefixes; each protection unit is additionally encrypted with its own key, which is not held by the storage provider. The target supports per-object lock (WORM/Object Lock). Furthermore for the contents of Conbool Mail mailboxes and their backups, and for Outlook data files uploaded by the Controller for migration until the migration is complete. These are held in separate buckets; only the Processor maps them to mailboxes and tenants.
- Locations: Frankfurt am Main (Germany), region eu-central-2. Other regions of the provider are not used for default storage; where the Controller sets up its own storage target with this provider, it selects the region itself.
- No third-country connection: the provider is established in Germany and is subject exclusively to European law; there is no disclosure obligation under the US CLOUD Act. Certified to ISO/IEC 27001; the data centre is certified to SOC 2 and PCI DSS. A Data Processing Agreement has been concluded.
Hetzner Online GmbH
- Address: Industriestr. 25, 91710 Gunzenhausen, Germany
- Description of Partial Service: S3-compatible object storage (Hetzner Object Storage) for files transmitted via SecureFiles and for archived e-mails, where this storage target is set up for the tenant.
- Locations: Falkenstein and Nuremberg (Germany) and Helsinki (Finland). A data processing agreement has been concluded.
The Spamhaus Project SLU
- Address: Avenida Ricardo Soriano 72, 29601 Marbella, Spain
- Description of Partial Service: reputation lookups to detect spam, phishing and malware. For each message the connecting IP address, the sender domain, the domains of contained links and checksums of attachments are queried. The lookup takes place via the Domain Name System; only the queried value is transmitted, never the content of a message, no subject and no recipient address.
- A domain or address lookup may relate to a person, for example a sender address in its own domain. This is why the service is listed here although no message content is transmitted.
- Locations: European Union. A data processing agreement has been concluded.
- When operated on own hardware (on-premises), these lookups run via a relay service of the Processor so that the access key does not leave the platform. The queried value remains the same.
Fingerprint store for malicious mail
- Description: the Processor operates a cross-tenant store of fuzzy checksums of messages already identified as malicious. When a message is confirmed as malicious for one tenant, its checksum immediately protects all other tenants against the same wave.
- Only fuzzy checksums are stored. The content of a message cannot be reconstructed from them, neither wholly nor in part; they contain no addresses and no subject. Where these checksums relate to a person at all, the Processor processes them to that extent as a controller in its own right on the basis of Art. 6(1)(f) GDPR (security of networks and information systems, Recital 49 GDPR).
- Processing takes place on the Processor's platform; no further processor is involved. It is listed here because tenant separation is deliberately lifted at this point and the Controller should know this.
Stripe Payments Europe, Ltd.
- Address: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
- Description of Partial Service: Payment processing, invoicing, and fraud prevention for paid services. Master, contract, and payment data of customers are processed.
- Processing takes place within the EU. EU Standard Contractual Clauses (SCCs) are in place for any third-country transfers. A data processing agreement has been concluded.
Training of the detection models
- Description: with the Controller's consent under § 4a, MailGuard's AI analysis learns from redacted inbound messages. The trained model protects all tenants.
- Processing takes place on the Processor's platform in Germany; no further processor is involved. It is listed here because tenant separation is deliberately lifted in the trained model and the Controller should know this.

Appendix 2 Technical and Organizational Measures (TOMs)

1. Confidentiality

Measures to ensure that only authorized persons have access to personal data:

Physical Access Control at IONOS:

Security gates and video surveillance in IONOS data centers (certified according to ISO 27001).
Access only for authorized persons via electronic access controls (e.g., transponders, biometric scanners).
Visitor registration and accompaniment by authorized personnel.
Regular review and logging of access rights.

Digital Access Control

Multi-factor authentication (MFA) for all administrative accesses.
Strict password policies (regular changes, minimum complexity).
VPN connections for remote access to internal systems.
Encryption of mobile storage devices and endpoints.
Conbool Mail: webmail sign-in with password and second factor; mail clients exclusively with app passwords. A SHA-512-crypt verification value is stored; the plain text is shown once and not stored. Each app password can be revoked individually.

Data Access Control

Role-based permission concept based on the principle of least privilege ("need-to-know principle").
Separation of application and administrative accesses.
Email content is always processed in-stream. When using the message portal, temporary, encrypted storage takes place for display and optional release by the customer. Storage takes place exclusively at the instruction of the controller and is automatically deleted as soon as access has taken place or the release period has expired. When email archiving is used, inbound and outbound e-mails are stored in encrypted form and locked against modification for the retention period configured by the controller, in the Compliance storage class additionally with an object lock at the storage target (WORM / S3 Object Lock); files transferred via SecureFiles are stored in encrypted form until the expiry set by the controller or until deletion.
Logging and monitoring of all access attempts to personal data.
Access to personal data or metadata is restricted to authorized employees with role-based permissions.

Pseudonymization

Pseudonymization of personal data wherever possible.

Data Encryption

Encryption of all stored data at rest (AES‑256), and TLS 1.3 in transit.

Confidentiality Agreements:

All employees are bound by confidentiality and data protection obligations in accordance with Article 28(3) GDPR.

2. Integrity

Measures to ensure the immutability and consistency of data:

Data Integrity:

Use of checksums and hashing methods to validate data integrity.

Transfer Control:

Encryption of all data transmissions using TLS 1.3 (TLS 1.2 only as fallback where unavoidable).
Use of secure communication protocols such as SFTP for data exchange.
Documentation of all data transfers to the subcontractors listed in Appendix 1.

Input Control:

Protection of logs against manipulation through access restrictions and encryption.
Individual user IDs to ensure traceability of changes.

3. Availability and Resilience

Measures to ensure the availability of systems and services:

Fault Tolerance:

Use of highly available cloud infrastructures at IONOS with redundant servers.
Failover systems to minimize downtime.
Emergency plans for operations during technical disruptions.
Conbool Mail: mailbox server without a standby server; continuous database backup with log archive and a daily full backup in object storage, restore to a replacement server following a documented procedure.

Storage Targets (Object Storage)

The content of the SecureFiles, email archiving and 365 Backup modules is held in S3-compatible object storage of the subcontractors named in Appendix 1: by default with Impossible Cloud GmbH in Frankfurt am Main (ISO/IEC 27001, data centre certified to SOC 2 and PCI DSS), optionally with STACKIT (C5 Type 2), IONOS or Hetzner. Physical and logical access control for these data centres lies with the respective provider and is evidenced by its certification and the data processing agreement.
Transfers to the storage targets take place exclusively via TLS.
365 Backup: each protection unit is encrypted with its own key, which is not held by the storage provider.
Email archiving: integrity is secured by a hash chain with a regularly stored seal. When moving between storage targets, every object is read back from the target and checked against the stored hash before switching. On the default archive storage an object lock (GOVERNANCE) protects every object against deletion for seven days; in the Compliance storage class the storage target locks every object until the retention period ends.
On versioned storage targets deletion is version-exact so that no earlier versions remain.
Conbool Mail: mailbox contents in the object storage of Impossible Cloud GmbH in Frankfurt am Main, administrative data on the Processor's mailbox server. The mailbox server's access key is restricted to its bucket and cannot delete versions; backups use a separate key.
Conbool Mail, migration from Outlook data files: upload directly into a separate bucket with its own key restricted to it; reading without a copy on the Processor's storage media; deletion after the migration is complete, unfinished uploads after seven days.
Conbool Mail: mailboxes are only deleted on record, 30 days after removal or after the end of the contract, immediately after deletion of the tenant. Every deletion is logged.

Resilience:

Load testing to verify system stability under peak loads.
Scalable cloud infrastructure provided by Supabase and IONOS to dynamically respond to increased demands.

Monitoring:

Continuous monitoring of system resources and automated alerts in case of anomalies.

4. Transparency

Measures to ensure traceability of processing activities:

Documentation:

Maintenance of a record of processing activities in accordance with Article 30 GDPR.
Regular Data Protection Impact Assessments (DPIAs) for new processing activities.

5. Data Protection by Design ("Privacy by Design")

Default Privacy Settings ("Privacy by Default"):

Default settings for maximum data minimization in all services.

Data Minimization:

Collection only of data necessary for the specific purpose.
Automatic deletion of unnecessary data after defined retention periods.

6. Training and Awareness

Organizational measures to promote awareness of data protection:

Regular training for all employees on data protection policies and IT security.
Awareness campaigns on handling phishing attacks and social engineering.

7. Incident Response Management

Measures for handling security incidents:

Documented process for detecting, reporting, and addressing data protection breaches.
Notification to the Controller within 24 hours in the event of an incident, as required by Article 33 GDPR.
Collaboration with external experts in cases of severe security incidents.

8. SecureFiles‑specific Measures

Pre‑signed URL mechanism with short TTL (1 hour for upload, 24 hours for download).
Multipart upload signing per part for the gigabyte range.
Postgres advisory lock for quota consistency (race condition protection).
Malware scan pipeline before release – files are only made available after a successful scan.
Audit log for every upload, download, and re‑send (GDPR Art. 30 compliant).
Configurable retention from 1 hour to 365 days.

9. DMARC Reports‑specific Measures

XML parse validation against schema; drop of reports that contain body content.
Storage of reports exclusively within the Customer’s Conbool tenant – no external subcontractors for DMARC data.
Reduced default retention for forensic reports (30–365 days configurable, but standard 90 days due to higher data sensitivity).
Role‑based access control (RBAC) with separate roles dmarcreports.view and dmarcreports.manage.

10. Organizational Measures

Measures to ensure clear responsibilities:

Regular internal audits to verify compliance with data protection regulations.
Continuous updates to security measures according to the state‑of‑the‑art technology standards.
Procedures for exercising Data Subject rights in accordance with Chapter III GDPR.

Data Processing Agreement according to Art. 28 GDPR