Data Processing Agreement (DPA)

1. Subject matter and roles

(1) This agreement governs the processing of personal data by DigifyNow GbR, Grenzweg 9a, 57648 Unnau, Germany (the “Processor”) on behalf of the customer (the “Controller”) in connection with the use of the “EmailFlow OS” platform.

(2) The customer is the controller within the meaning of Art. 4 (7) GDPR for the recipient data (leads) it enters into the platform, for the selection of recipients and for the legal basis of contacting them. The Processor processes this data exclusively on documented instructions from the customer (Art. 28 (3) (a) GDPR).

2. Nature, purpose and scope of processing

(1) Purpose: creation, personalisation, sending and analysis of the customer’s email campaigns, including optional personalised videos.

(2) Categories of data: contact and business data of the recipients entered by the customer (name, business email address, company, website, additional fields imported by the customer) as well as sending and interaction events (delivery, bounce, unsubscribe; opens/clicks only where enabled by the customer).

(3) Data subjects: business contacts / recipients of the customer’s campaigns.

(4) Duration: for the term of the service agreement; deletion pursuant to section 7.

3. Obligations of the Processor

• Processing only on documented instructions from the customer; instructions are given through the functions of the platform.
• Confidentiality: access only by persons bound to confidentiality (Art. 28 (3) (b) GDPR).
• Technical and organisational measures pursuant to Art. 32 GDPR (encryption of stored API keys, access control, tenant-separated data storage, TLS transport encryption).
• Assistance to the customer with data subject rights (Art. 12–23 GDPR) and with the obligations under Art. 32–36 GDPR.
• Notification of the customer without undue delay in the event of a personal data breach.
• Duty to inform (Art. 28 (3) sentence 3 GDPR): the Processor shall inform the customer without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions. It is entitled to suspend the execution of manifestly unlawful instructions (in particular sending without a valid legal basis).

4. Obligations of the customer

• The customer ensures that a valid legal basis exists for every contact (in particular § 7 UWG, Art. 6 GDPR) and documents it (e.g. double opt-in records).
• The customer observes objections and unsubscribes; the platform-wide suppression list must not be circumvented.
• The customer maintains the mandatory company details for the email footer.

5. Sub-processors

(1) The customer gives general authorisation for the use of the following categories of sub-processors: hosting/infrastructure (Railway), email delivery (Brevo — through the customer’s own account), AI text generation (OpenAI), video personalisation (Pitchlane), payment processing (Stripe).

(2) The customer will be informed of intended changes and may object for good cause (Art. 28 (2) GDPR). Where sub-processors are located in third countries, transfers take place on the basis of appropriate safeguards (Art. 44 et seq. GDPR, in particular EU standard contractual clauses / adequacy decisions).

6. Evidence and audits

The Processor makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for reasonable audits (Art. 28 (3) (h) GDPR), as a rule by providing information and suitable documentation.

7. Deletion and return

After termination of the service agreement, the personal data processed on behalf of the customer will be returned or deleted at the customer’s choice, unless statutory retention obligations apply. Suppression list entries (unsubscribes) may be retained in order to permanently honour objections (Art. 21 (3) GDPR).

8. Final provisions

(1) This DPA is accepted electronically during onboarding; the time, IP address and document version are logged. It applies for the entire duration of the use of EmailFlow OS.

(2) German law applies. In all other respects, our Terms of Service apply.