Data Processing Agreement

This agreement (the “DPA”) sets out the obligations under Art. 28 GDPR for the processing of personal data carried out by becom Systemhaus GmbH & Co. KG, Am Feldkreuz 16a, 35578 Wetzlar, Germany (the “Processor”) within the Astreo service on behalf of the customer (the “Controller”).

The customer is the controller within the meaning of Art. 4(7) GDPR; becom is the processor within the meaning of Art. 4(8) GDPR. This DPA forms an annex to the Terms and Conditions and is concluded in electronic form when the account is set up (Art. 28(9) sentence 2 GDPR); the time, the confirming person and the version are recorded. On request, the Processor will provide a signed copy.

§ 0 What this agreement does not cover

So that the roles do not get muddled, three clarifications up front:

• The Controller’s contract and billing data (company name, address, VAT identification number, payment transactions) is processed by becom as its own controller, not on the customer’s behalf. The privacy policy applies to it, not this DPA. The payment provider named there is therefore not a sub-processor within the meaning of § 5.
• The mailboxes connected by the Controller (e.g. Microsoft 365, Google Workspace, an IMAP server) are services the Controller has engaged itself. Their providers are not sub-processors of the Processor. Astreo is a client: the mail stays with the Controller’s provider.
• The Controller’s staff data that it creates in Astreo itself (user accounts for its team) is processed on its behalf and is covered by this DPA (Annex A).

§ 1 Subject matter, scope and duration

The subject matter is the provision of the Astreo service under the Terms and the edition chosen. The nature, purpose and scope of processing, the types of data and the categories of data subjects are set out exhaustively in Annex A.

This DPA applies for the term of the main contract. It ends with it, but not before the obligations under § 8 (deletion and return) have been fulfilled.

§ 2 Processing on instructions

The Processor processes personal data only on documented instructions from the Controller (Art. 28(3)(a) GDPR). Using the service as contractually intended - in particular any action the Controller or its users take in the application - constitutes an instruction. Instructions beyond that require text form to datenschutz@becom.net.

If the Processor considers an instruction to infringe data protection law, it informs the Controller without undue delay. It may suspend execution until the Controller confirms or amends the instruction.

Where the Processor processes data to comply with a legal obligation (Art. 28(3)(a), second half-sentence, GDPR), it informs the Controller before processing, unless that law prohibits such information on important grounds of public interest.

§ 3 Confidentiality

The Processor engages only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). The obligation survives the end of the respective employment.

Content belonging to the Controller is not accessed routinely, but only where necessary to provide, troubleshoot or secure the service - and then on a need-to-know basis. Mail content is not logged and is not evaluated for advertising or model training.

§ 4 Technical and organisational measures

The Processor implements the measures required under Art. 32 GDPR. Their state as at the date of this agreement is described in Annex B. Measures are subject to technical progress; the Processor may develop them further provided the level of protection is not reduced. Material changes are reflected in Annex B.

§ 5 Sub-processors

The Controller grants general authorisation for engaging further processors (Art. 28(2) sentence 2 GDPR). The sub-processors engaged at the time of conclusion are listed exhaustively in Annex C.

Where the Processor engages a further sub-processor or replaces an existing one, it notifies the Controller without undue delay, at the latest upon the change taking effect, in text form to the billing e-mail address on file, and updates Annex C accordingly. The Controller may object within two weeks of receipt on data protection grounds. If no agreement is reached, the Controller may terminate for cause.

Until 26 August 2026 this agreement required notice four weeks before the change. That period stood in the way of prompt improvement: if a provider turns out to be unsuitable - for instance because it processes outside the EU - the situation would have to continue for four weeks before it could be ended. The Controller loses no rights by this change; objection and termination for cause remain unchanged. It learns of the change at the same time rather than in advance.

The Processor imposes on every sub-processor obligations equivalent to those agreed here and remains liable to the Controller for its conduct (Art. 28(4) GDPR).

§ 6 Data subject rights

The Processor assists the Controller by appropriate technical and organisational measures in fulfilling data subject rights (Art. 28(3)(e) GDPR). Access, rectification, export and erasure can largely be performed by the Controller itself; where that is not sufficient, the Processor assists on request.

If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not answer it itself.

§ 7 Assistance, personal data breaches

The Processor assists the Controller in complying with Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to it (Art. 28(3)(f) GDPR).

The Processor notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware, to the billing e-mail address on file. The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point. Where information is not fully available, it is supplied subsequently without undue delay. Notification to the supervisory authority (Art. 33) and to data subjects (Art. 34) is the Controller’s responsibility.

§ 8 Deletion and return

During the term the Controller can export the data created in the service at any time. Mail remains in the Controller’s own mailbox in any case - Astreo is a client, not a mailbox provider.

After the contract ends, the Processor deletes the data processed on the Controller’s behalf within 30 days, unless the Controller has requested its return beforehand and provided no statutory retention obligation applies. Data in encrypted backups is overwritten as the backup rotation expires, at the latest after 90 days; until then it is excluded from processing.

§ 9 Evidence and audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement and allows for audits (Art. 28(3)(h) GDPR). Evidence may be provided by way of information, by presenting these annexes in their current version, or by certificates from independent bodies.

Where that is not sufficient in an individual case, the Controller may, on four weeks’ notice and during normal business hours, carry out or commission an on-site audit - as a rule once a year, and more often where there is specific cause. The auditor must not be a competitor of the Processor and is bound to confidentiality. Business operations must not be disrupted more than necessary.

§ 10 Place of processing

Processing takes place exclusively within the European Union. There is no transfer to a third country. Should one become necessary in future, it will only take place under the conditions of Art. 44 et seq. GDPR and following the procedure in § 5.

§ 11 Final provisions

In the event of conflict between this DPA and the Terms, this DPA prevails as far as the processing of personal data on the Controller’s behalf is concerned.

The Processor announces changes to this agreement at least four weeks before they take effect. Changes that restrict the Controller’s rights require its consent; otherwise the procedure in the Terms applies. The version the Controller has agreed to is visible in its account.

Should any provision be invalid, the validity of the remainder is unaffected. German law applies.

Annex A - Description of the processing

Subject matter and purpose: provision of a web-based e-mail client with team features (shared inbox, assignment, internal notes, tasks, reporting) and optional AI assistance, solely to provide the service.

Nature of processing: collection, storage, organisation, retrieval, use, transmission to the mailbox connected by the Controller, restriction, erasure.

Types of personal data:

• The Controller’s user accounts: name, e-mail address, role and permissions, colour, business hours, sign-in data (password hash, TOTP secret), sessions, last activity.
• Mail traffic of the connected mailboxes: sender, recipients, subject, date, message body, attachments, headers and folder assignment.
• Data created in the service: assignments, conversation state, internal notes, tasks, tags, history log (who assigned, replied, closed and when), response metrics, templates, signatures, filters, distribution lists.
• Contacts and calendar, where the Controller uses those features.
• Mailbox credentials (OAuth tokens, IMAP/SMTP passwords), stored encrypted.
• Operational log data (timestamp, IP address, record identifiers) - without mail content.

Categories of data subjects: the Controller’s employees and contractors (users of the service) and its correspondents (senders and recipients of mail, contacts).

Special categories (Art. 9 GDPR): not envisaged. Whether such data appears in mail traffic is determined solely by the Controller; the Processor does not evaluate content.

Duration: for the term of the main contract, thereafter as per § 8.

Annex B - Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access: operated in netcup GmbH data centres in Nuremberg, Germany; physical access control, video surveillance and access logging are the data centre operator’s responsibility.
• System access: sign-in via Google/Microsoft SSO, magic link or password; password sign-in only with a second factor (TOTP). Sign-in attempts are rate-limited per account and per IP address. Sessions can be revoked individually and all at once; session cookies are httpOnly, secure and SameSite.
• Data access: role and permission model per team (viewer, member, admin, owner) with named action permissions for assigning, closing, moving, junk and deletion; permanent deletion for administrators only.
• Separation: tenant separation enforced in one central data-access layer; every query is scoped to the signed-in user and their teams. No database query bypasses that filter.
• Encryption: transport exclusively over TLS; mailbox credentials and OAuth tokens encrypted at rest with AES-256-GCM; backups encrypted.

Integrity

• Transfer control: connections to mailboxes and AI services over TLS only; no transmission to uninvolved third parties.
• Input control: history log per conversation (assignment, state change, note, move, junk) and a separate, durable log of permanent deletions.
• Attachments are scanned for malware before delivery.

Availability and resilience

• Daily encrypted backup of database and configuration, with automatic monitoring of backup age and size and e-mail alerting if a backup fails to appear.
• Service monitoring; separate environments for production and development.

Procedures for review and evaluation

• Data protection by default: mail content is not logged; log data contains no content; AI features always produce an editable draft and never send by themselves.
• Processor control: written instructions, sub-processors bound under Art. 28(4) GDPR, documented review before engagement.
• Deletion concept: self-service deletion of account and data, cascading deletion of dependent records, logged permanent deletion.

Annex C - Sub-processors

As at 26 August 2026. Changes are governed by § 5.

• netcup GmbH, Daimlerstrasse 25, 76185 Karlsruhe, Germany - service: hosting of the application and database. Location: data centre in Nuremberg, Germany.
• Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany - service: custody of an off-site copy of the backup. It is deliberately held outside the data centre the service runs in, so that an outage at the hosting provider does not take the backup with it. Location: Germany. Note: the backup is encrypted by us before transfer. Hetzner receives no key and cannot read the contents; only encrypted data is held there.
• Mistral AI SAS, 15 rue des Halles, 75001 Paris, France - service: processing of the content selected for an AI feature (reply suggestion, translation, grammar), only when those features are used. Location: European Union. Note: inputs and outputs are retained there for 30 days on a rolling basis for abuse detection and are not used to train models.

Not sub-processors: the mailbox providers engaged by the Controller itself (e.g. Microsoft, Google, an IMAP provider) and the Processor’s payment provider - see § 0.

Questions

Questions about this agreement, instructions and data subject requests: datenschutz@becom.net, becom Systemhaus GmbH & Co. KG, Am Feldkreuz 16a, 35578 Wetzlar, Germany.