Data processing agreement
Written from the platform's own documentation by its engineer, following the structure of Article 28(3) UK GDPR. It states what the system actually does; it has not yet been reviewed by a lawyer, and the transfer mechanism in section 7 in particular is marked for that review.
1. Parties and roles
This agreement is between the customer named in a signed service contract with Dynamik App Ltd (the controller) and Dynamik App Ltd, company 16723248, 29 Greenaleigh Road, Birmingham, B14 4HY, trading as Postroute (the processor). It forms part of that contract by reference and applies for as long as the contract does.
2. Subject matter, duration, nature and purpose
The processor hosts, receives, stores, filters and delivers electronic mail for the domains the controller places on the service, and provides a portal through which the controller's administrators manage mailboxes and aliases. The purpose is the operation of the controller's email, and nothing else. The duration is the term of the contract, plus the retention periods in section 6.
3. Types of personal data and categories of data subjects
- Data: the content of email messages and their attachments; message headers and metadata (addresses, dates, subjects, message identifiers, IP addresses of sending systems); mailbox and alias names; the names, email addresses and login records of the controller's administrators in the portal.
- Data subjects: the controller's staff and administrators; anyone who sends mail to, or receives mail from, the controller's domains; anyone mentioned in that mail.
4. The processor's obligations
4.1 Instructions
The processor processes the data only on the controller's documented instructions, which are the contract, this agreement, and the actions the controller's administrators take in the portal. If the processor believes an instruction infringes data protection law, it tells the controller before acting on it.
4.2 Confidentiality
Access to the server and to the data on it is limited to the person responsible for the platform, Vlad-Alexandru Minea, who is bound to confidentiality. No other person has access today; if that changes, the controller is told.
4.3 Security (Article 32)
The measures in place, each of which is documented and verifiable on the server:
- mail encrypted at rest on the server;
- TLS in transit wherever the other side supports it, with DANE verification where the receiving domain publishes it;
- access to the portal by passkey only, bound to the portal's origin, with no password anywhere in the application;
- tenancy enforced at the database query layer, so an administrator cannot see or reach another customer's data;
- administrative access to the server by SSH key only, with password authentication disabled;
- a nightly backup, encrypted before it leaves the server, to a storage location in a second data centre, with a rehearsed restore;
- mailbox deletion that archives and verifies before it destroys, with a permanent record of who requested it and when it was carried out.
4.4 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the server; storage of the encrypted backups. | Finland (server), Germany (backups) |
In addition, during filtering the processor queries the Spamhaus blocklists by DNS with the sending IP address, the domains a message carries and hashed forms of addresses. No message content leaves the server for this. Let's Encrypt receives domain names only, to issue certificates.
The processor tells the controller before adding or replacing a sub-processor, and the controller may object on reasonable grounds. Any sub-processor is bound by obligations equivalent to those in this agreement.
4.5 Assistance
The processor helps the controller respond to requests from data subjects — access, rectification, erasure, restriction, portability, objection — within the time the law gives the controller, and helps with the controller's obligations under Articles 32 to 36 (security, breach notification, impact assessments) to the extent the information is in the processor's hands.
4.6 Personal data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, with what is known at the time and updates as more becomes known, so that the controller can meet its own 72-hour duty to the Information Commissioner's Office.
4.7 End of processing
At the end of the contract, or on the controller's instruction, mailboxes are deleted through the archive-then-destroy path: archived, verified, removed, and the archive destroyed 30 days later. Within those 30 days the archive can be returned to the controller. Copies in backups expire on the backup cycle (14 daily, 8 weekly, 12 monthly). Nothing is retained beyond that except where the law requires it.
4.8 Information and audit
The processor makes available the information needed to demonstrate compliance with this agreement: the platform's documentation, the deletion record, and the security measures above. On reasonable notice the controller, or an auditor mandated by the controller, may verify them.
5. The controller's obligations
The controller is responsible for the lawfulness of the data it places on the service, for the instructions it gives, for informing its own staff and correspondents as the law requires, and for the conduct of the administrators it appoints in the portal.
6. Retention
A mailbox is kept for as long as the controller keeps it. A deleted mailbox's archive is kept for 30 days and then destroyed. Backups are kept for 14 daily, 8 weekly and 12 monthly copies. The record of deletions is kept as the record that the deletion happened. The mail server's logs keep the most recent 9,999 lines per service.
7. Transfers
The data is stored in the European Union — Finland and Germany — and is not transferred elsewhere by the processor. The legal mechanism covering transfers from the United Kingdom to the European Union is to be confirmed by the reviewer of this agreement.
8. Liability, term and precedence
Liability between the parties is as set out in the contract. This agreement lasts as long as the processor holds the controller's data. Where this agreement and the contract conflict on the processing of personal data, this agreement prevails; on everything else, the contract does. It is governed by the law of England and Wales.
9. Changes
This agreement is kept in the platform's source repository. Every change is dated and versioned, and the controller is told of any change that affects its obligations or the processor's.