Data Processing Agreement (DPA)

Auftragsverarbeitungsvertrag pursuant to Art. 28 GDPR.

This DPA forms an integral part of the JustSendIt Terms of Service and applies automatically whenever the Customer processes personal data through JustSendIt. No signature is required; it takes effect on acceptance of the Terms. A countersigned copy is available on request at simon@justsendit.ai.

1. Parties

Processor: Simon Tautz, Einzelunternehmer, trading as JustSendIt, Albert-Roßhaupter-Straße 70, 81369 München, Germany ("Processor", "we")

Controller: the customer identified in the JustSendIt account ("Controller", "you")

2. Subject matter and roles

You use JustSendIt to read and send messages through messaging accounts you own. In doing so, personal data of your contacts, recipients and correspondents passes through our systems.

• You are the controller. You determine why and how that data is processed. You are responsible for having a lawful basis for the processing, including for outreach to people who have not previously contacted you.
• We are the processor. We process that data only to provide the service, and only on your instructions.

This DPA does not cover data for which we are ourselves the controller — your own account, billing and usage data. That is governed by our Privacy Policy.

3. Duration

This DPA runs for as long as you have a JustSendIt account, and for any period afterwards during which we still hold personal data on your behalf.

4. Nature and purpose of processing

Relaying, in memory and without persistent storage of content, of messages and message metadata between the Controller's connected accounts and the Controller's users or authorised AI agents. Specifically: retrieving messages, chats, folders and account metadata; and sending messages on the Controller's instruction.

5. Types of personal data

Depending on how you use the service:

• Contact identifiers: names, email addresses, messaging handles, profile identifiers
• Message content: subjects, bodies, attachments, timestamps, thread and folder metadata
• Any personal data the Controller or its contacts choose to include in message content

Special categories of data (Art. 9 GDPR) are not intended to be processed. Where they appear inside message content, they pass through the relay without being retained.

6. Categories of data subjects

Recipients, senders and contacts of the Controller; the Controller's employees, users and collaborators.

7. Controller's instructions

Your documented instructions consist of this DPA, the Terms of Service, the configuration you set in the application, and the API and MCP calls made by you or by AI agents you have authorised.

Authorising an AI agent is an instruction. Actions an agent takes within the permissions you granted are treated as your instructions, whether or not you reviewed each one individually. Manage this through the permission scopes in the application.

We will inform you if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law (Art. 28 (3) sentence 3 GDPR), and may suspend execution of that instruction until it is confirmed or amended.

8. Processor's obligations

We will:

1. Process personal data only on your documented instructions, including regarding transfers to third countries, unless required to do otherwise by Union or Member State law — in which case we will inform you before processing, unless that law prohibits it (Art. 28 (3)(a)).
2. Ensure that persons authorised to process the data are bound by confidentiality (Art. 28 (3)(b)). At present the only such person is the sole proprietor.
3. Implement the technical and organisational measures set out in Annex 2 (Art. 32 GDPR).
4. Engage subprocessors only under the conditions in section 9.
5. Assist you, by appropriate technical and organisational measures and insofar as possible, in responding to data subject requests under Chapter III GDPR (Art. 28 (3)(e)). Because we do not retain message content, our practical ability to locate a data subject's data is limited to account and connection records.
6. Assist you with your obligations under Art. 32 to 36 GDPR — security, breach notification, data protection impact assessments and prior consultation (Art. 28 (3)(f)).
7. At your choice, delete or return all personal data at the end of the service, and delete existing copies, unless retention is required by law (Art. 28 (3)(g)).
8. Make available all information necessary to demonstrate compliance and allow for and contribute to audits (Art. 28 (3)(h)); see section 11.
9. Notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the information available to us at that time (Art. 33 (2)).

9. Subprocessors

You give general written authorisation for the engagement of subprocessors under Art. 28 (2) GDPR. The subprocessors in use at the date of this DPA are:

Why the advertising platforms are not listed above

The recipients table in the Privacy Policy is deliberately wider than this annex, and the difference is not an oversight. This annex lists only processors acting on our instruction under Art. 28 GDPR. Three advertising recipients are not processors:

• Google Ads is an independent controller. Google classifies its Ads programmes as controller services under the Google Ads Controller-Controller Data Protection Terms, while Google Analytics and Google Tag Manager are processor services under the Google Ads Data Processing Terms. Only the latter two appear above.
• Meta Platforms Ireland Limited is a joint controller with us under Art. 26 GDPR for the collection and transmission of event data by the Meta pixel and the Conversions API, on the basis of Meta's Controller Addendum incorporated into the Meta Business Tools Terms. Meta's subsequent processing for its own purposes is Meta's sole responsibility and is outside any processor relationship.
• OpenAI, L.L.C. receives conversion events for adverts we run inside ChatGPT, through its advertising Conversions API. It determines the purposes of its own subsequent processing and is therefore not acting on our instruction under Art. 28 GDPR.

None of these engagements involve personal data you entrust to us as a Controller under this DPA: each concerns visitors to our own website, for whom we are the controller.

We will inform you of any intended addition or replacement of a subprocessor at least 30 days in advance by email or in-app notice. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees.

We impose on each subprocessor data protection obligations no less protective than those in this DPA and remain fully liable to you for their performance (Art. 28 (4)).

10. International transfers

Where personal data is transferred outside the EU/EEA, the transfer is based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Three (processor to processor), supplemented by the technical measures in Annex 2. Where a recipient is certified under the EU–US Data Privacy Framework, that adequacy decision applies instead. Copies of the relevant clauses are available on request.

11. Audit rights

You may verify our compliance with this DPA. In the first instance we will provide written information, our documentation of technical and organisational measures, and any third-party attestations we hold.

If that is insufficient, you may conduct an on-site or remote inspection, or appoint an independent auditor who is not a competitor of ours, subject to: 30 days' written notice, no more than once per calendar year (except after a data breach or on the documented instruction of a supervisory authority), during normal business hours, without disrupting operations, and under confidentiality. You bear your own costs; we may charge reasonable costs for effort beyond one working day.

12. Deletion and return

On termination, you may export your account and configuration data through the application. Message content requires no deletion because it is never stored. Account, connection and audit records are deleted or anonymised within 30 days of account closure, except where a statutory retention obligation applies — in which case the data is restricted from further processing until the period expires.

13. Liability

Liability under this DPA is governed by Art. 82 GDPR and by section 11 of the Terms of Service. Liability caps in the Terms do not limit either party's liability to data subjects or to supervisory authorities.

14. Order of precedence

In case of conflict, this DPA prevails over the Terms of Service in matters of data protection. The Standard Contractual Clauses prevail over this DPA.

Annex 1 — Processing details

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

Pseudonymisation and encryption

• TLS for all data in transit
• Encryption at rest for the database, provided by the hosting platform
• Connected-account identifiers stored as keyed hashes (HMAC) rather than plaintext mailbox addresses
• Mailbox OAuth credentials are never held by the Processor; they remain with the Unipile subprocessor

Confidentiality

• Access control: infrastructure hosted in providers' certified data centres; no self-operated physical infrastructure
• System access: authentication via a managed identity provider; hashed credentials; least-privilege service keys; secrets held outside version control
• Data access: row-level security and tenant isolation enforced at the database layer; an additional tenant check on every upstream account access; per-client permission scopes for AI agents
• Separation: logical separation of tenant data; separation of production from development environments

Integrity

• Append-only audit trail of privileged and consequential actions
• Idempotency and guard records on message-sending operations
• Code review and automated verification before deployment

Availability and resilience

• Managed database with automated backups by the hosting provider
• Provider-level redundancy and monitoring

-

Regular testing and evaluation

• Automated test suite and a release gate requiring dated evidence artefacts before production deployment
• Periodic review of these measures, at least annually

Instruction control

• Processing only through documented API and MCP surfaces
• Explicit permission grants required before an AI client can act
• Revocation of grants takes effect immediately

Signature

This DPA is accepted electronically with the Terms of Service. Customers requiring a signed copy should contact simon@justsendit.ai.

Processor: Simon Tautz, JustSendIt · Munich, Germany Controller: as per account registration