1. Preamble & applicability

SharpMailserver is self-hosted software. In normal operation iqmeta GmbH ("Processor") does not process any personal data contained in the Customer's ("Controller") mail system. This DPA applies only where the Processor gains access to such data, in particular when the Controller grants remote support access, transmits log files, diagnostic bundles or sample messages, or commissions installation, migration or managed services. It forms part of the license contract and becomes effective upon acceptance of the Terms and Conditions. A signed copy can be requested at any time.

2. Subject, nature and purpose

Subject: support, troubleshooting, installation, migration and (if commissioned) operation of SharpMailserver. Nature: access, reading, copying for analysis, deletion. Purpose: fulfilment of the support and service obligations. Duration: the term of the license contract or the respective service order.

3. Categories of data and data subjects

Data: email metadata and content, attachments, address books, calendar entries, account and log data (IP addresses, timestamps, user names). Data subjects: the Controller's employees and users, their communication partners and contacts. Special categories (Art. 9 GDPR) may be contained in message content; the Controller should minimise their transfer.

4. Instructions

The Processor processes personal data only on documented instructions of the Controller, including with regard to third-country transfers, unless required by Union or Member State law. Instructions are given by the support ticket, remote session or service order. The Processor informs the Controller without delay if it considers an instruction to infringe data protection law.

5. Obligations of the Processor

Confidentiality: all persons authorised to process data are bound to confidentiality (Art. 28 (3) (b) GDPR).
Security: implementation of the technical and organisational measures in Annex 1 (Art. 32 GDPR).
Assistance with data subject requests, data protection impact assessments and consultations (Arts. 32 to 36 GDPR).
Notification of personal data breaches without undue delay, at the latest within 48 hours of becoming aware.
Deletion or return of all data after completion of the service, unless retention is legally required; support data is deleted at the latest 30 days after closing the ticket.
Provision of all information necessary to demonstrate compliance and toleration of audits, normally by submitting documentation; on-site audits with 30 days' notice during business hours.

6. Sub-processors

The Controller grants general authorisation to engage the sub-processors listed in the sub-processor list. The Processor informs the Controller of intended changes at least 30 days in advance by updating the list and, on request, by email; the Controller may object on reasonable data protection grounds. The Processor imposes the same data protection obligations on each sub-processor. For pure remote support no sub-processor receives customer mail data.

7. International transfers

Customer mail data is processed only within the European Union. Remote support is carried out from Germany. Any transfer to third countries requires prior instruction and an appropriate safeguard under Arts. 44 ff. GDPR.

8. Annex 1: Technical and organisational measures

Access control (physical): servers in ISO/IEC 27001 certified data centers in Germany; office access restricted.
System access: individual accounts, strong passwords and multi-factor authentication, automatic screen lock, full-disk encryption on all end devices.
Data access: role-based least-privilege permissions; remote support only in sessions initiated and observable by the Controller; no permanent access.
Transfer control: TLS 1.2+ for all transmissions; diagnostic files exchanged only via encrypted channels (for example Encrypted File Share with AES-256-GCM).
Input control: logging of support sessions and ticket history.
Availability: backups, patch management, malware protection, monitoring.
Separation: customer data is stored separately per ticket and deleted after completion.
Review: regular review of measures, staff training on data protection and confidentiality.

9. Final provisions

In case of conflict, this DPA takes precedence over other agreements regarding data protection. Liability is governed by Art. 82 GDPR and the Terms and Conditions. German law applies; place of jurisdiction is Stuttgart.

Data Processing Agreement (DPA)