Legal

Data Processing Agreement

Translation notice: This English version is provided for convenience. The German version is the legally authoritative version.

This agreement under Article 28 GDPR is entered into between the customer (“Controller”) and CSTN Labs, proprietor Constantin Hartmann, Martinstrasse 60, 77855 Achern, Germany (“Processor”). It forms part of the contract when a business customer subscribes.

1. Subject matter and duration

The Processor sorts emails in the mailboxes connected by the Controller, as described in § 2 of the Terms and Conditions. This agreement remains in force for the duration of the subscription.

2. Nature, purpose and scope of processing

• Nature: retrieving, reading and assessing emails using AI; storing metadata and results; moving and flagging emails in the mailbox
• Purpose: organising the inbox by importance
• Types of data: sender, recipient, subject, date, email text, technical headers and attachment names on a transient basis; AI summary, assessment, read and reply status of sorted emails; recipients of sent emails with a verification value for the display name; rules and corrections; mailbox credentials
• Data subjects: mailbox users, senders and recipients of emails, and people named in emails
• Special categories under Article 9 GDPR: may occur in emails but are not specifically evaluated

3. Instructions

The Processor processes data only on documented instructions. Instructions comprise this agreement, the Terms and Conditions, and settings made in the account, including rules, corrections, disconnecting mailboxes and deletion. If the Processor considers an instruction unlawful, it will notify the Controller without undue delay.

The Controller also instructs the Processor to generate daily aggregate figures across all customers from assessments, including the number of sorted emails by category, classifications by rules, corrections, active accounts and active mailboxes. These totals contain no reference to individual customers, people, addresses or content. The Processor may use them as anonymous data for its own purposes, including improving the service and reporting on ehmAIl.

4. Obligations of the Processor

1. Ensure that all people authorised to process the data are bound by confidentiality.
2. Maintain the technical and organisational measures set out in Annex 1.
3. Assist with data subject rights and the Controller’s obligations under Articles 32 to 36 GDPR.
4. Notify the Controller of personal data breaches without undue delay and, where possible, within 48 hours of becoming aware of them.
5. Provide evidence of compliance and permit audits on prior notice, primarily through self-assessment and documentation.

5. Sub-processors

The Controller authorises the sub-processors listed in Annex 2. The Processor will notify the Controller by email at least four weeks before adding or replacing a sub-processor. The Controller may object for an important reason and may then terminate the subscription for cause.

6. Third countries

Email content is processed exclusively in the EU. Transfers to third countries take place only as set out in Annex 2 and on the basis of Articles 44 et seq. GDPR.

7. Deletion and return

When the contract ends or the account is deleted, the Processor deletes all data immediately and backup copies within no more than 30 days. Mailbox credentials are deleted immediately when a mailbox is disconnected. Stored assessments will be provided on request made before deletion.

Annex 1: Technical and organisational measures

• Encryption: TLS for all connections, including HSTS; mailbox credentials encrypted using AES-256-GCM; keys held only in the cluster’s secret store.
• Data minimisation: email text is held only in memory; attachments and link destinations are not retrieved; logs contain no email content, tokens or passwords.
• Access: accounts are protected by passwords, checked against known breaches, and login attempts are rate-limited; servers are accessed only using SSH keys; Kubernetes API access is restricted to approved administrator IP addresses.
• Separation: every record is assigned to a customer and queries are restricted to the customer’s own account; network rules isolate the application within the cluster.
• Mailbox integrity: no deletion, sending or permanent removal, including no IMAP EXPUNGE; read status remains unchanged.
• Availability: database backups every six hours, retained for 14 days, and daily backups retained for 30 days.
• Containers: no root privileges, read-only file system and minimum permissions.
• Testing: security review before every major change and automated tests.

Annex 2: Sub-processors

Version: 22 October 2026