NetSendo Logo

Data Processing Agreement — NetSendo Cloud

Annex 1 to the Terms of Sale for NetSendo Subscriptions and the NetSendo Cloud Service · version 1.0 of 7 November 2026

This is a translation. The Polish version is binding.

§ 1. Parties and conclusion

  1. The parties are:
    1. the Customer who ordered the Cloud Service, as data controller (the "Controller");
    2. NETSENDO PSA, registered office ul. Jana III Sobieskiego 11, lok. E6, 40-082 Katowice, Poland, KRS 0001216341, NIP 6343067171, as processor (the "Processor").
  2. This agreement is concluded together with the Cloud Service contract, by accepting it in the order form. It is a contract within the meaning of Article 28(3) of Regulation (EU) 2016/679 (the "GDPR"), concluded in electronic form (Article 28(9) GDPR).
  3. Capitalised terms not defined here have the meaning given in the Terms of Sale for NetSendo Subscriptions and the NetSendo Cloud Service (the "Terms").
  4. If the Controller uses the Instance solely for purely personal or household purposes, to which the GDPR does not apply (Article 2(2)(c) GDPR), the Processor still applies the measures described in this agreement to that data.

§ 2. Subject matter, nature and purpose of processing

  1. The Controller entrusts the Processor with processing the personal data contained in Customer Data, to the extent and for the purpose needed to provide the Cloud Service.
  2. Processing consists of: storing data on servers, making and restoring backups, installing and updating the Software, monitoring and fixing failures, putting Instances into Dormancy and resuming them (including storing data during Dormancy), performing operations the Controller starts in the Software (in particular sign-ups, imports, sends, automations and statistics), exporting and deleting data.
  3. The Processor processes the data for as long as the Cloud Service is provided, during the Dormancy of the Instance (§ 9(14) of the Terms) and for the time needed to carry out § 10.

§ 3. Types of data and categories of data subjects

  1. Categories of data subjects:
    1. the Controller's subscribers and contacts, including people who sign up through the Controller's forms;
    2. users of the Instance panel (the Controller, its employees and contractors);
    3. other people whose data the Controller places in the Instance, for example in message content.
  2. Types of data:
    1. subscriber data: email address, first name, last name, phone number for SMS, IP address, device and browser data (user agent), approximate location derived from the IP address, activity data (sign-ups and unsubscribes, confirmations, opens, clicks, bounces, complaints), tags, segments, custom field values, consent history and sign-up source;
    2. panel user data: first name, last name, email address, sign-in data (password stored as a hash), IP address, panel activity log;
    3. other data the Controller enters in custom fields or message content.
  3. The Controller does not entrust special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). If it nevertheless places such data in the Instance, it is responsible for the legal basis for processing it and for assessing whether the measures in Schedule A are sufficient for it.

§ 4. The Controller's instructions

  1. The Processor processes data only on the Controller's documented instructions. Instructions are: the Terms, this agreement, the configuration and actions the Controller performs in the Instance, and instructions sent by email from the address given in the order. By accepting this agreement, the Controller instructs the Processor to store the data during the Dormancy of the Instance and to handle unsubscribes during that time, as set out in § 10.
  2. The Processor may process data without instructions where Union or Member State law requires it. It then informs the Controller of that requirement before processing, unless that law prohibits such information.
  3. If the Processor considers that an instruction infringes the GDPR or other data protection law, it promptly informs the Controller and may suspend the instruction until it is confirmed or changed.
  4. The Processor does not process the data for its own purposes; in particular it does not use it for marketing or to train AI models.

§ 5. Obligations of the Processor

  1. The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
  2. The Processor applies the technical and organisational measures described in Schedule A (Article 32 GDPR). It may change them if the new measures provide at least the same level of security.
  3. Taking into account the nature of processing, the Processor assists the Controller:
    1. in responding to requests from data subjects (Articles 15–22 GDPR); the Controller handles most of them itself in the Software (finding, changing, exporting and deleting a contact), and the Processor helps with the rest; during Dormancy, when the Controller has no access to the Instance, the Processor records unsubscribes from links in sent messages and, at the Controller's request, exports or deletes the data;
    2. in meeting its obligations under Articles 32–36 GDPR, including data protection impact assessments.
  4. If a data subject contacts the Processor, the Processor forwards the request to the Controller without undue delay and does not answer it itself unless the Controller authorises it to.

§ 6. Personal data breaches

  1. The Processor notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, by email to the address given in the order.
  2. The notification includes, as far as information is available: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed to address the breach and mitigate its effects. Information that cannot be given at once is provided in phases.
  3. The Controller notifies the supervisory authority and data subjects (Articles 33–34 GDPR). The Processor provides the information needed for this.

§ 7. Sub-processors

  1. The Controller gives the Processor general authorisation to engage sub-processors (Article 28(2) GDPR).

  2. On the date of this agreement the Processor uses the following sub-processors:

    Company Scope Data location
    ADERLO PSA (Aderlo Cloud), ul. Nowogrodzka 50/54 lok. 515, 00-695 Warsaw, Poland, KRS 0000955282, NIP 5492466214 running the Instance servers, backups, network Germany (EU)
    Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, engaged by Aderlo data centre, physical servers, backup server Falkenstein, Germany (EU)

  3. The Processor informs the Controller by email at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may raise a reasoned objection within that period. If the parties do not find a solution, the Controller may terminate the Cloud Service contract with effect from the date of the change and receives a refund of the price for the unused part of the Billing Period.

  4. The Processor imposes on sub-processors the same data protection obligations as in this agreement, in particular the obligation to implement appropriate security measures (Article 28(4) GDPR). The Processor remains liable to the Controller for the sub-processors' performance.

  5. Providers that the Controller itself chooses and connects to the Instance (email providers, SMS gateways, AI model providers, other integrations) are not the Processor's sub-processors. The Controller concludes contracts with them, including data processing agreements, itself. The Processor sends data to them only on the Controller's instruction resulting from the Instance configuration.

§ 8. Place of processing and transfers

  1. The Processor stores the data in the European Economic Area, in a data centre in Falkenstein, Germany.
  2. The Processor does not transfer the data to third countries or international organisations. If this becomes necessary in future, it will notify the Controller as set out in § 7(3) and use one of the mechanisms in Chapter V GDPR.
  3. Data sent by the Instance to providers chosen by the Controller (§ 7(5)) is a transfer made by the Controller.

§ 9. Audits and information

  1. The Processor makes available to the Controller the information needed to demonstrate compliance with Article 28 GDPR. As a rule it does this by answering the Controller's questions and questionnaires within 14 days.
  2. The Controller may carry out an audit, including an inspection, itself or through an auditor bound by confidentiality. It gives at least 30 days' notice, no more than once a year, unless there has been a personal data breach or a supervisory authority requires it. The audit may not disrupt the infrastructure or breach the confidentiality of other customers' data.
  3. An audit at a sub-processor is carried out through the Processor, on the terms of the Processor's agreement with that sub-processor. Instead, the Processor may provide the sub-processor's audit results or certificates if they allow the security measures to be assessed.
  4. The Controller bears the cost of the audit unless it reveals a material breach of this agreement by the Processor.

§ 10. End of the agreement: Dormancy, return and deletion of data

  1. This agreement ends when the data is deleted under paragraph 4. The confidentiality provisions continue to apply after it ends.
  2. When the Cloud Service contract ends, the Instance goes into Dormancy for 90 days (§ 9(14) of the Terms). During that time the Processor:
    1. stores the data unchanged on a server in the EEA and performs no operations on it other than those described in this paragraph;
    2. keeps unsubscribe links in messages sent from the Instance before Dormancy working and records the unsubscribes in the Controller's data;
    3. at the Controller's request, provides an export of the data (return of the data within the meaning of Article 28(3)(g) GDPR) under § 9(14)(4) of the Terms;
    4. restores the Instance with the data if the Controller resumes the Cloud Service.
  3. The Controller may at any time ask for the data to be deleted before the 90 days end. The Processor then deletes it within 5 Business Days.
  4. After 90 days, or by the deadline in paragraph 3, the Processor deletes the data from the production server. Backups containing the data expire within a further 2 days (§ 9(9) of the Terms) and are not used during that time. At the Controller's request the Processor confirms the deletion by email.
  5. The Processor may keep the data longer only where Union or Member State law requires it, and only to the extent of that requirement.

§ 11. Liability

  1. The parties' liability to data subjects is governed by Article 82 GDPR.
  2. Between the parties, the Processor's liability under this agreement is subject to § 13 of the Terms.

§ 12. Final provisions

  1. Matters not covered here are governed by the GDPR, Polish law and the Terms. If the Terms and this agreement conflict on data protection matters, this agreement prevails.
  2. The Processor amends this agreement in the same way as the Terms (§ 14 of the Terms).
  3. Contact for matters under this agreement, including personal data matters: contact@netsendo.com. Technical help: support@netsendo.com.

Schedule A. Technical and organisational measures

The measures describe the position on the date of the agreement. The Processor ensures that the Hosting Subcontractor also applies them, under its agreement with it.

  1. Encryption in transit. The Instance panel and API are reachable only over HTTPS (TLS). The netsendo.app domain is on the HSTS preload list, so browsers connect to it only over HTTPS.
  2. Separation of Instances. Each Instance runs in separate containers and has a separate database. The Customer has no access to the server or to other Instances.
  3. Access control. Only named, authorised staff of NETSENDO and Aderlo have server access, through individual accounts and keys. Administrative infrastructure panels require multi-factor authentication. Access is revoked when cooperation ends.
  4. Outgoing SMTP blocked. The Instance server does not send mail directly; sending goes through the provider chosen by the Customer.
  5. Backups. A daily, encrypted backup of the whole Instance (files and database) to a server physically separate from the Instance server, in the EU. The two most recent daily backups are kept; the older one is deleted only after the new one has been saved successfully, so at least one backup always exists. Restoring a randomly chosen Instance from backup is tested at least once a quarter.
  6. Infrastructure. Servers in the Hetzner data centre in Falkenstein, with ECC memory and NVMe disks in RAID1.
  7. Updates. The Software and operating system are kept up to date and security patches are applied without undue delay.
  8. Monitoring. Instance availability and server health are monitored automatically. Administrative access logs are kept for 90 days.
  9. Passwords. Panel user passwords are stored as cryptographic hashes.
  10. Confidentiality. People with access to the data are bound by confidentiality.
  11. Dormancy. During Dormancy the Instance containers are stopped; only the information page and unsubscribe handling run (§ 10(2)).
  12. Deletion. Data is deleted from the server when Dormancy ends or at the Controller's request (§ 10); decommissioned storage media are destroyed or wiped by the data centre.
  13. Incident handling. Aderlo reports incidents affecting Instances to NETSENDO within 24 hours of becoming aware of them, which lets NETSENDO meet the deadline in § 6(1).