Data Processing Agreement (Auftragsverarbeitungsvertrag)

1. Parties

Data Processor: psquared GmbH, Dametzstraße 2-4, 4020 Linz, Austria (FN 647249m, Landesgericht Linz) — hereinafter "Processor"

Data Controller: The customer who has accepted the InboxMate Terms of Service — hereinafter "Controller"

This Data Processing Agreement ("DPA") forms an integral part of the InboxMate Terms of Service and is automatically binding upon use of the Service.

2. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller in connection with providing the InboxMate service (AI processing of emails in connected mailboxes, ticket system, and the optional Website-Chat module). Processing begins when the Controller starts using the Service and continues for the duration of the service agreement.

3. Nature and Purpose of Processing

The Processor processes personal data for the following purposes:

• Connecting the Controller's mailboxes (Microsoft 365 / Outlook including shared mailboxes, Gmail (beta), IMAP/SMTP, or email forwarding) and reading incoming emails
• Email channel management (receiving, drafting, and sending emails on the Controller's behalf)
• AI classification of emails according to the rules the Controller sets, and routing or forwarding them to the right person or team
• AI-powered reply drafts using the Controller's knowledge base, including placing drafts in the drafts folder of the connected mailbox
• Sending replies approved by the Controller, or sent automatically where a rule of the Controller allows it
• Mailbox actions that the Controller's rules request (for example marking as read, applying categories, moving, archiving, or deleting messages)
• Web research about the sender's company from public websites
• Creating tickets and contacts from emails; ticket management and conversation routing
• Transferring data to systems that the Controller connects (webhooks, API, MCP)
• Logging rule decisions and actions so that the Controller can review them
• Analytics and reporting on usage

The Processor stores only the email threads that it needs for these purposes. It does not copy the full mailbox.

Website-Chat (optional module): If the Controller uses the Website-Chat module, the Processor also processes personal data for these purposes:

• Operating the AI chatbot on the Controller's website (receiving and responding to visitor messages)
• Storing and managing chat conversation history
• Processing visitor-provided contact information (if email collection is enabled)
• AI-powered response generation using the Controller's knowledge base
• Analytics and reporting on chatbot usage

4. Categories of Data Subjects

• Individuals who send emails to the Controller's connected email inboxes
• Individuals to whom emails are sent from the connected mailboxes (recipients, including CC)
• Individuals named in processed emails or their attachments
• The Controller's team members who use the InboxMate dashboard or the connected mailboxes
• Website visitors who interact with the Controller's InboxMate chatbot (Website-Chat module)

5. Types of Personal Data

• Email content of processed threads from the connected mailboxes: sender, recipients (To, CC), subject, body, attachments, and message metadata (timestamps, message identifiers, headers)
• Reply drafts and sent replies
• Rule decisions and action logs (category, rule applied, actions taken, approvals)
• Contact and company records created from emails, including research notes from public websites
• Mailbox access credentials (OAuth tokens, IMAP/SMTP passwords), stored encrypted
• IP addresses (in server logs, retained for 90 days)
• Email addresses (if voluntarily provided by visitors or via email channel)
• Names and contact details (if voluntarily provided)
• Team member names, email addresses, and access logs

Website-Chat (optional module):

• Chat message content and timestamps
• Visitor metadata: browser language, referrer URL, session identifier

6. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions from the Controller (Art. 28(3)(a) GDPR), unless required by EU or Member State law
• Ensure that persons authorized to process the data have committed to confidentiality (Art. 28(3)(b) GDPR)
• Implement appropriate technical and organizational security measures (Art. 32 GDPR), including encryption in transit (TLS 1.2+) and at rest (AES-256), row-level database security, and role-based access control
• Not engage another processor without prior written authorization from the Controller (Art. 28(2) GDPR). The current list of sub-processors is available in the Privacy Policy. The Controller has 30 days to object to new sub-processors
• Assist the Controller in fulfilling data subject rights requests (Art. 28(3)(e) GDPR)
• Assist the Controller with DPIA obligations and prior consultation with supervisory authorities (Art. 28(3)(f) GDPR)
• Delete or return all personal data after the end of the service, at the Controller's choice (Art. 28(3)(g) GDPR). Upon request, provide written confirmation of deletion
• Make available to the Controller all information necessary to demonstrate compliance and allow for audits (Art. 28(3)(h) GDPR)

7. Sub-Processors

The Controller grants general authorization for the Processor to engage sub-processors, subject to the notification and objection mechanism described above. Current sub-processors:

All sub-processors are bound by data processing agreements ensuring equivalent data protection standards.

8. International Transfers

All primary data processing takes place within the EU. For sub-processors incorporated outside the EU (Supabase Inc., OpenAI Inc., Salesforce Inc./Heroku, AlphaAI Technologies Inc./Tavily), data processing is contractually restricted to EU infrastructure. Transfers are governed by:

• The EU-US Data Privacy Framework adequacy decision (where the sub-processor is DPF-certified), or
• Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR

9. Data Breach Notification

The Processor shall notify the Controller without undue delay (and in any case within 48 hours) after becoming aware of a personal data breach affecting the Controller's data. The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

10. Audit Rights

The Controller may request an audit of the Processor's compliance with this DPA. Audits shall be conducted with reasonable prior notice (at least 30 days), during normal business hours, and shall not unreasonably interfere with the Processor's business operations. The Controller bears the costs of audits unless non-compliance is found.

11. Liability

Liability under this DPA is governed by the limitation of liability provisions in the InboxMate Terms of Service.

12. Governing Law

This DPA is governed by Austrian law. The competent courts in Linz, Austria have exclusive jurisdiction for B2B disputes. For consumers, the statutory jurisdiction rules apply.

13. Contact

For questions about this DPA or data processing:

psquared GmbH
Dametzstraße 2-4, 4020 Linz, Austria
Email: office@psquared.dev