Data processing agreement
As at 14 August 2026
This agreement under Article 28 GDPR is concluded between the customer (the “controller”) and Bartis.Dev, proprietor Darius Achilles, Goethestr. 30, 39397 Schwanebeck, Germany (the “processor”). It takes effect together with the main contract for Mailwerk.
The German version is the binding one. This English version is a translation provided for information.
1. Subject matter, precedence, term
(1) This agreement sets out the parties' obligations for the processing of personal data that the processor carries out on the controller's behalf under the main contract.
(2) The controller concludes this agreement in its own name. Where it processes on behalf of its own end customers, it concludes the agreement in their name as well and warrants that it is authorised to do so. The processor is a further processor in that respect.
(3) On questions of processing on the controller's behalf, this agreement takes precedence over the main contract.
(4) The term matches that of the main contract.
2. Nature and purpose of the processing
The processor processes personal data solely in order to provide the services agreed. This covers:
- managing the controller's end customers, sites and agents,
- enrolling agents, issuing and renewing their operating licence, and receiving their operating reports,
- storing configuration and encrypted secrets and forwarding them to the agent they are addressed to,
- supporting the controller, to the extent the controller requests or authorises it,
- billing based on the number of sites,
- logging events for evidence and for troubleshooting.
3. Types of data
The following are processed:
- data about the controller's users: name, business email address, role, credentials in a form that cannot be reversed, sign-in times,
- master data about the controller's end customers: company name, site designation and, where the controller records them, the names and business contact details of contacts,
- configuration data: sending domains, the identifier of the app registration in the end customer's tenant, local SMTP user names without passwords, rule sets,
- encrypted secrets, which the processor cannot read,
- operating data about the agents: hostname, version, time of the last report, counters and error codes for delivery attempts, observed sending domains and the identifier of the provider account,
- platform log data: time, acting person, event, IP address.
4. Categories of data subjects
The data subjects are the controller's employees who use the platform, and contacts at the controller's end customers where the controller records them.
5. What is not processed
(1) Message contents, attachments and recipient addresses of messages sent through an agent are not transferred to the platform. The agent hands every message directly to the Microsoft 365 tenant of the end customer concerned.
(2) The agent's log stays with the end customer. Only checksums of it are transferred to the platform, so that a later change becomes detectable.
(3) Where an error message from a third-party system contains details taken from a message in an individual case, such as a recipient address, the processor processes it solely for troubleshooting and deletes it after 30 days at the latest.
(4) Special categories of personal data under Article 9 GDPR are not the subject of this agreement.
6. Instructions
(1) The processor processes the data solely on the controller's documented instructions. The main contract and this agreement are the initial instruction. Further instructions are given in text form to the address stated in the imprint.
(2) If the processor considers an instruction unlawful, it says so without undue delay and may suspend performance of it until the matter is settled.
(3) The processor transfers data to third parties only on instruction or where it is legally required to. In the latter case it informs the controller beforehand, to the extent it is legally permitted to do so.
7. Confidentiality
The processor uses only people who are bound to confidentiality or subject to an appropriate statutory duty of secrecy, and who have been made familiar with the data protection requirements.
8. Technical and organisational measures
(1) The processor takes the measures required by Article 32 GDPR. These include:
(2) The measures are subject to technical progress. The processor may change them as long as the level of protection is not reduced.
- processing exclusively on servers in Germany,
- transport encryption for every connection to the platform and between agent and platform,
- end-to-end encryption of secrets addressed to an agent; the platform stores only a block of data it cannot read,
- authentication of agents by key pair, with every individual request signed,
- two-factor authentication for accounts with owner rights, and graduated roles for other users,
- tenant separation at record level: every record belongs to exactly one account,
- a continuous log of events that cannot be altered after the fact,
- support access to an account's data only after an express, time-limited authorisation by the controller, visible to it and logged,
- regular backups with tested restores,
- regular updates of the components in use.
9. The limit of these measures
The measures under clause 8 are role separation and logging, not technical impossibility. The processor runs the servers itself and therefore has access to the database in principle. What is warranted is this: no role exists that reads an account's customer data, and every support access is time-limited, logged and visible to the controller. What is not warranted is that access is technically impossible.
10. Further processors
(1) The controller consents to the use of the following further processor:
(2) The processor gives at least four weeks' notice in text form of any further processor. Within that period the controller may object for an important data protection reason. If the parties do not reach agreement, either of them may terminate the main contract with effect from the intended date of the change.
(3) The processor imposes on every further processor, in writing, a level of protection matching this agreement, and remains responsible towards the controller.
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: operation of the servers and the data centre, located in Germany.
11. Data subject rights
(1) If a data subject approaches the processor directly, the processor forwards the request to the controller without undue delay and does not answer it itself.
(2) The processor supports the controller with appropriate measures in answering requests under Articles 12 to 23 GDPR, in particular by providing information, rectification, erasure and release of the data.
12. Support and breach notification
(1) The processor supports the controller in complying with Articles 32 to 36 GDPR.
(2) The processor reports a personal data breach to the controller without undue delay and at the latest 48 hours after becoming aware of it, in text form and with the information listed in Article 33(3) GDPR to the extent available to it.
13. Evidence and audits
(1) On request the processor demonstrates compliance with this agreement in an appropriate form.
(2) After four weeks' notice the controller may satisfy itself of compliance during normal business hours, at most once a year and without unreasonably disrupting operations. Where there is specific cause, neither the notice period nor the frequency limit applies.
(3) For audits going beyond the provision of information the processor may charge a reasonable fee for its effort.
14. Erasure and return
(1) After the main contract ends the processor erases the data within 30 days, unless a statutory retention obligation prevents it.
(2) Within that period the processor provides, on request, an export of the data in a common machine-readable format.
(3) Data in backups is overwritten in the course of the backup cycle, at the latest 90 days after the contract ends.
15. Processing outside the EU
Processing takes place in the European Union. Processing in a third country occurs only where it has been notified under clause 10(2) and the requirements of Articles 44 to 49 GDPR are met, in particular on the basis of the standard contractual clauses.
16. Final provisions
(1) Article 82 GDPR is unaffected. Otherwise the liability provisions of the main contract apply.
(2) Declarations under this agreement require text form.
(3) German law applies. The main contract's provision on jurisdiction applies.
(4) If a provision is invalid, the rest of the agreement remains in force.
The commercial terms have a page of their own: Terms and conditions
We answer questions about this using the contact details in the imprint.