Data Processing Agreement (DPA)
Effective Date: October 2026
Legal Basis: Article 28 General Data Protection Regulation (GDPR)
Status: Effective upon electronic conclusion via the inbora.io platform
Preamble & Contracting Parties
This Data Processing Agreement (hereinafter "DPA") specifies the obligations regarding data protection and information security arising from the provision of Software-as-a-Service (SaaS) by:
Georg Hartmann
Keplerstr. 4, 69214 Eppelheim, Germany
Email: [email protected]
(hereinafter "Data Processor")
to the customer and registered user of the inbora.io platform (hereinafter "Data Controller" or "Customer").
Data Processor and Data Controller are hereinafter collectively referred to as the "Parties". This DPA applies to all processing activities in which employees, contractors, or IT systems operated by the Data Processor come into contact with personal data of the Data Controller.
1. Subject Matter, Duration, and Nature of Processing
1.1 Subject Matter
The Processor provides the Controller with a cloud-based software solution for automated, AI-assisted analysis, organization, and drafting of replies for incoming business emails. For this purpose, the system accesses emails from inboxes connected by the Controller via secure protocols (IMAP/SMTP).
1.2 Purpose
Processing is performed exclusively for the purpose of executing the email automation, drafting, and inbox assistance configured by the Customer.
1.3 Duration
The duration of this Agreement corresponds to the term of the software usage agreement between the parties. It terminates automatically upon permanent deletion of the Customer account and all associated data.
2. Categories of Data and Data Subjects
2.1 Categories of Data Subjects
- Communication partners, leads, customers, and prospects communicating with the Controller's connected inboxes.
- Employees and representatives of the Controller.
2.2 Categories of Personal Data
- Master & Contact Data: Names, email addresses, postal addresses, telephone numbers.
- Communication Data: Email content, subject lines, header information, message timestamps, conversation threads.
- Authentication Data: Mail server credentials (IMAP/SMTP), stored strictly encrypted.
3. Authority to Issue Instructions & Controller Obligations
The Controller retains sole responsibility for complying with applicable data protection laws (in particular GDPR), including the legality of data disclosure to the Processor.
The Processor processes personal data solely on documented instructions from the Controller, as specified through the platform settings and UI configurations, unless required to do so by Union or Member State law.
4. Technical and Organizational Measures (TOMs)
The Processor implements state-of-the-art security measures under Art. 32 GDPR to ensure a level of security appropriate to the risk. These include:
All sensitive customer data (including mailbox credentials, email drafts, message logs, and knowledge base content) are stored encrypted at rest using user-specific encryption keys.
Before text excerpts are processed by AI models, an automated server-side filter masks personal identifiers (names, email addresses, phone numbers, IBANs) to minimize exposure.
All data in transit (client-to-server, and server-to-mail-providers) is encrypted using current TLS/SSL standards.
Production server access is strictly restricted, enforced via key-based SSH authentication and 2-factor authentication.
5. Sub-processors
The Controller grants general authorization to engage sub-processors to fulfill the services. The Processor binds sub-processors to data protection obligations at least equivalent to those in this Agreement.
Currently authorized sub-processors:
| Provider | Location | Purpose | Legal Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Server hosting & database infrastructure | DPA under Art. 28 GDPR (German data center) |
| OVHcloud SAS | France (EU) | Cloud infrastructure & AI inference fallback | DPA under Art. 28 GDPR (EU data centers) |
| Google Cloud / Gemini API | USA / EU | AI text generation (unless BYOT) | EU Standard Contractual Clauses (SCCs), DPF, no model training on customer data |
| Cloudflare, Inc. | USA / Global | Bot protection (Turnstile) & DDoS mitigation | EU Standard Contractual Clauses (SCCs) |
Note regarding BYOT (Bring Your Own Token): If the Controller configures their own third-party API keys (e.g. OpenAI, Anthropic), the direct data processing relationship regarding model inference exists directly between the Controller and the respective provider.
6. Rights of Data Subjects & Support Obligations
Taking into account the nature of processing, the Processor assists the Controller through appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests for exercising data subject rights (access, rectification, erasure, restriction, data portability).
If a data subject contacts the Processor directly, the request will be promptly forwarded to the Controller.
7. Termination and Deletion of Data
Upon termination of the service or account deletion by the Controller, the Processor will permanently delete all personal data processed on behalf of the Controller, unless statutory retention obligations under European Union or Member State law apply.
The Customer may export their data (including knowledge base and settings) at any time prior to account deletion via the dashboard export function.
8. Concluding Provisions
Should individual provisions of this Agreement be invalid, this shall not affect the validity of the remaining provisions. This Agreement is governed by the laws of the Federal Republic of Germany.
This Agreement is concluded electronically pursuant to Article 28(9) GDPR upon confirmation during onboarding, registration, or within the inbora.io dashboard.