Data processing agreement

§ 1 Subject matter and duration

1. The Provider processes personal data on behalf of the Customer in order to provide Postfluss. Nature, purpose, types of data and data subjects are set out in Annex 1.
2. The agreement runs as long as the usage contract and beyond that until all of the Customer’s data have been deleted (§ 10).

§ 2 Instructions

1. The Provider processes the data only on documented instructions from the Customer, including with regard to transfers to third countries. This does not apply to processing required by Union or Member State law. In that case, the Provider informs the Customer of the legal requirement beforehand, unless the law prohibits this.
2. The instructions are set out in this agreement and in the terms. The Customer also gives them through the settings in the app, such as which channels are connected, which functions run and how long enquiries are kept. Further instructions are given in text form.
3. If the Provider considers an instruction unlawful, it tells the Customer without undue delay. It may suspend the instruction until the Customer confirms or changes it.
4. The Provider uses the data for no other purpose. In particular, it does not use them to train AI models, not for other customers and not for advertising. The only exception is Swarm Knowledge under § 11, and only for as long as the Customer has switched it on.

§ 3 Confidentiality

The Provider uses only persons who are bound to confidentiality or subject to a statutory duty of secrecy. They receive access only to the extent their task requires.

§ 4 Security

The Provider takes the technical and organisational measures under Art. 32 GDPR set out in Annex 2. It may adapt them to the state of the art provided the level of protection does not fall.

§ 5 Sub-processors

1. The Customer gives general authorisation to engage sub-processors. Those engaged at the conclusion of the contract are listed in Annex 3. They are deemed approved.
2. The Provider announces a new or replaced sub-processor in text form at least 4 weeks in advance. The Customer may object for an important reason relating to data protection. If no solution is found, the Customer may terminate the usage contract with effect from the date of the change.
3. The Provider imposes on each sub-processor the same data protection obligations as in this agreement. It is liable to the Customer for the sub-processor’s obligations as for its own.
4. Services the Customer connects itself are not sub-processors of the Provider, such as its mailbox provider, its helpdesk, its shop or the push services of its users’ devices. They are governed by the relationship between the Customer and that service.

§ 6 Transfers to third countries

1. The data are stored on servers in the EU. The Provider is established in Georgia. There is no adequacy decision of the European Commission for this country. If the Provider accesses the data from this country for operation, maintenance or support, this is a transfer to a third country.
2. This transfer is governed by the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914), Module 2 (controller to processor). The Customer is the data exporter, the Provider the data importer. The clauses are concluded with this agreement. Annex 4 sets out the options. In the event of a conflict, the clauses prevail over this agreement. If the clauses do not apply because the Provider itself falls under Art. 3 (2) GDPR, it complies with their obligations nonetheless. If the European Commission adopts clauses for this case, they apply from their entry into force.
3. Further transfers to third countries take place only if the conditions of Art. 44 et seq. GDPR are met.

§ 7 Data subject rights

The Provider assists the Customer with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR). This is done mainly through the functions of the app: searching, exporting and deleting enquiries. If a data subject contacts the Provider directly, the Provider forwards the request to the Customer and does not respond on the merits itself.

§ 8 Further assistance, data breaches

1. The Provider assists the Customer with the obligations under Art. 32 to 36 GDPR to the extent it has the necessary information. This concerns security, notifications, data protection impact assessments and prior consultation.
2. The Provider notifies the Customer of a personal data breach without undue delay after becoming aware of it, if possible within 48 hours. The notification contains, as far as known, the information under Art. 33 (3) GDPR. Missing information is provided as soon as it is available.

§ 9 Evidence and audits

1. The Provider makes available to the Customer on request the information necessary to demonstrate compliance with its obligations.
2. The Customer or an auditor it appoints who is bound to confidentiality may check whether the Provider complies with this agreement. As a rule, written information is sufficient. The Customer announces an on-site audit at least 4 weeks in advance. It takes place during business hours, disrupts operations as little as possible and does not inspect data of other customers. Without a specific reason, it takes place no more than once a year.

§ 10 Deletion and return

1. During the term, the Customer can export its data itself at any time (terms § 8).
2. After the end of the usage contract, the Customer can retrieve its data under terms § 8, including during a transition period when switching. After that, the Provider deletes all of the Customer’s data together with its data key. Backup copies expire no later than 30 days after that. If the Provider restores a backup, it deletes the data again in the process. Any obligation to retain data under Union or Member State law remains unaffected.
3. During the term, Postfluss deletes enquiries after the retention period the Customer sets (Annex 1).

§ 11 Swarm Knowledge (participants only)

1. Subject matter: If the Customer switches on “Swarm Knowledge” in the settings, the Provider counts anonymous categories from the Customer’s enquiries. These are exclusively counters and values from fixed lists: the sub-topic of the enquiry in the topic tree, the mood (neutral, annoyed or friendly), the Customer’s broad industry, the month of receipt, the outcome (draft sent unchanged, draft sent edited, sent without a draft, or no reply) and whether the sender followed up within 14 days. The waiting row (para. 3) additionally records whether it was a repeat; this does not go into the counter. This list is exhaustive.
2. Purpose: better suggestions and comparison figures for customers who take part themselves. Those who do not take part receive no swarm figures.
3. Instruction and role: Switching it on is an express, documented instruction and authorisation by the Customer for this processing. The Provider records it in the activity log. Without switching it on, none of this takes place. For forming and using the anonymous counters, the Provider is itself the controller (Art. 6 (1)(f) GDPR). The balancing of interests is documented. Until it is closed, for 14 days at most, the row waits in the Customer’s account and is processed there like the Customer’s other data. After that, only the anonymous counter remains.
4. Never stored are free text, names, addresses, email addresses, telephone, order, customer, email and case numbers, identifiers of any kind, not even encrypted or hashed, nor prices, amounts or terms. Which user replied is not recorded. This applies to the storage of the counters. Processing the enquiry in order to classify it remains as described in Annex 1.
5. Minimum numbers: The Provider evaluates a category only once at least 5 different companies and 50 cases stand behind it and no company contributes more than 40%. It shows comparison figures to customers only from 10 companies and 200 cases and at most 30% from one company. Categories below these thresholds are never visible.
6. Exclusions: Companies in health, law and tax, religion and belief, politics and trade unions, and dating and sexuality cannot take part. The Customer’s own emails, spam and bulk mailings are never counted.
7. Opting out: The Customer can switch Swarm Knowledge off in the settings at any time. This takes effect immediately. The Provider then deletes the waiting rows and all of the Customer’s counters. They also disappear when the account is deleted.
8. No disclosure: The Provider never sells or licenses Swarm Knowledge, never gives it to third parties, never uses it for market research, never to train models and never to draw conclusions about individual companies or persons. Any further use requires a new, express consent from the Customer.
9. Information: The Customer informs its customers and employees about the participation where necessary and involves a works council where the law requires it. The Provider provides a text module for this on the page Swarm Knowledge: what we store, what never.

§ 12 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise the rules of the terms apply.
2. Changes to this agreement are governed by terms § 15. Changes required by law remain possible.
3. If a provision is invalid, the rest of the agreement remains valid.

Annex 1: Processing on behalf

Purpose

Handling the Customer’s customer enquiries with AI support: receiving and storing enquiries from the connected channels, writing reply drafts, building a knowledge base in the Customer’s account from sent replies and corrections, answering questions in the website chat (if switched on), retrieving order and shipment data from connected shops and services, exporting and deleting data.

Nature of the processing

Retrieving, storing, organising, searching, reading, summarising, matching, transmitting to the language model (Annex 3), sending when a user clicks, deleting.

Types of data

• Content of enquiries: sender’s name and address, subject, text, history, attachments and images, identifiers from helpdesks
• Drafts, sent replies, internal notes, tags and text snippets
• Order and shipment data that Postfluss retrieves live from connected shops and from shipment tracking. Postfluss does not store them separately, but they may appear in a draft.
• Website chat: name and email address, if the visitor provides them, and the messages. Postfluss processes the visitor’s IP address only for delivery and counts it against misuse only as a hash value.
• Knowledge base: facts and replies derived from the content. An automatic filter first removes email addresses, IBANs, phone numbers and case numbers, as well as names and postal addresses insofar as it recognises them. It does not recognise every item.
• Names and signatures of users, insofar as they appear in drafts and replies
• Swarm Knowledge, participants only (§ 11): sub-topic, mood, industry, month, outcome and follow-up per enquiry as counters (the waiting row additionally records whether it was a repeat), without content and without identifiers

Special categories (Art. 9 GDPR) are not intended but may occur in free text from senders.

Data subjects

Customers, prospects and other senders who contact the Customer; visitors to its website who use the chat; employees and agents of the Customer.

Retention

• Enquiries including drafts, replies and notes, and closed chats: 12 months after the last activity. The Customer can set 3 to 120 months. Enquiries with an open correction remain until the correction is done.
• Knowledge base, text snippets, tags and settings: until the Customer deletes them or the account is deleted
• Exports: 7 days. Events from helpdesks: 7 days after processing.
• Log of actions (identifiers, type and time only): until the account is deleted
• Swarm Knowledge (§ 11): waiting row 14 days at most, anonymous counters until switched off or until the account is deleted
• Backups: 30 days

Annex 2: Technical and organisational measures

Confidentiality

• Servers, database and backups in the EU; language models via AWS Bedrock in EU regions
• Encrypted connections only (TLS)
• Content and access data are sealed in the database (AES-256-GCM) with a separate key per customer. These keys are in turn protected with a master key in AWS KMS (EU). Files are sealed in the same way in file storage. Backups are additionally encrypted (age).
• Tenant separation technically enforced in the database (row level security), with automated tests for every table and every endpoint
• Roles in the account (admin, agent). Passwords as Argon2id hashes, optional second factor (TOTP). Throttling against password guessing. Sign-out after 12 hours without use.
• Access to servers and key management only for named administrators of the Provider, with a personal key. The operator console is reachable only through an encrypted tunnel, shows no enquiry content and requires a second factor for money actions.
• Server logs contain no content, email addresses, tokens or IP addresses, only identifiers.

Data minimisation with the language model

• Before drafts, summaries and classifications, an automatic filter redacts email addresses, IBANs and phone numbers insofar as it recognises them. Names and postal addresses remain so that the reply fits. Questions in the website chat and in the knowledge chat go to the model unredacted.
• Images go to the model only if the Customer switches this on.
• No use of data for training models. Data retention on Bedrock is switched off for the Provider’s AWS account in all regions where processing takes place (mode “none”). According to AWS, inputs and outputs are then not stored and not passed on to the model provider; a model that requires retention is then not available. According to AWS, an automatic check of images for child sexual abuse material is excepted.
• The AI never sends on its own. The exception is the chat assistant if the Customer switches it on: it answers only from approved knowledge and is labelled as AI.

Integrity and availability

• Shops and shipment tracking read-only. Requests to the internet cannot reach internal networks.
• Daily encrypted backup on the same server, kept for 30 days. Restoration is rehearsed at least once a quarter.
• Monitoring of errors and load. Updates in tested steps with automated tests.

Deletion and review

• Deleting an account also removes its key, which makes any remnants unreadable as well. A restored backup deletes deleted accounts again.
• A security register with requirements and the tests that enforce them. Every new function is checked against it beforehand.

Annex 3: Sub-processors

Annex 4: Standard contractual clauses

The transfer under § 6 is governed by the standard contractual clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), Module 2, with these details:

• Clause 7 (docking clause): applies.
• Clause 9 (a): Option 2, general written authorisation; notice at least 4 weeks in advance (§ 5).
• Clause 11 (a): The optional independent dispute resolution body does not apply.
• Clause 13: The competent authority is the supervisory authority competent for the Customer as data exporter (point (a)). If the Customer has no establishment in the EU but a representative under Art. 27 GDPR, it is the authority where the representative is established. If it has no representative either, it is the authority of the Member State in which the data subjects are located.
• Clause 17: The law of the Federal Republic of Germany applies.
• Clause 18: The courts of Germany have jurisdiction.
• Annex I.A: The data exporter is the Customer with the details from the registration, role controller. The data importer is the Provider with the details from the imprint, role processor. Signature: acceptance at registration.
• Annex I.B: see Annex 1. The transfer takes place on a continuous basis while the contract runs.
• Annex I.C: see Clause 13.
• Annex II: see Annex 2. Annex III: see Annex 3.

The European Commission publishes the text of the clauses in the Official Journal.