GDPR Article 28

Data processing agreement

Last updated: 18 June 2026

1. Roles of the parties

The Customer is the data controller. NAM Consult (CBE 0717.544.038), publisher of MailRich, is the data processor within the meaning of Article 28 of the GDPR. The processor only processes data on the documented instructions of the controller.

2. Subject matter, duration, nature and purpose

The purpose of the processing is the provision of the MailRich Service. Its nature consists of collecting, hosting, organizing, consulting and transmitting emails and associated data, for the purpose of managing and overseeing the Customer's mailboxes. The processing lasts for the duration of the contract.

3. Categories of data and data subjects

• Data: content of emails, metadata (sender, recipient, timestamp), attachments, contact data, and any data the Customer chooses to process via the Service.
• Data subjects: the Customer's correspondents, its staff and users, and any person whose data appears in the connected mailboxes.

4. Obligations of the processor

• process the data only on the documented instructions of the controller;
• ensure the confidentiality of the persons authorized to process the data;
• implement the security measures described in article 6;
• comply with the conditions for engaging sub-processors (article 7);
• assist the controller in responding to requests from data subjects;
• assist the controller with regard to security, breach notifications and impact assessments;
• delete or return the data at the end of the contract (article 8);
• make available the information necessary to demonstrate compliance and allow audits.

5. No reuse, in particular for AI

The processor refrains from reusing the Customer's data for its own purposes. In particular, the content of the Customer's emails is not used to train artificial intelligence models, except with the Customer's express agreement and on anonymized data. The assistance features produce proposals subject to human validation.

6. Technical and organizational measures

• encryption of data in transit and at rest;
• access control and named, revocable delegation per operator;
• data segregation by customer;
• logging of accesses and actions;
• secure management of secrets and application passwords;
• backups and restoration procedures;
• periodic access reviews.

7. Sub-processors

The Customer authorizes the use of sub-processors (cloud hosting provider, artificial intelligence provider, email sending service, alerts channel). The processor maintains an up-to-date list, imposes on each of them obligations equivalent to this agreement, and informs the Customer of any addition or replacement, the Customer having a right of reasoned objection. To date, hosting is provided by Vercel Inc. (United States, edge distribution), governed by standard contractual clauses. The complete and up-to-date list of sub-processors (hosting, artificial intelligence, email sending, alerts channel) and their location is maintained by the publisher and provided to the Customer on request as well as upon each addition or replacement.

8. Fate of the data at the end of the contract

At the end of the contract, at the Customer's choice, the processor returns the data in a usable format and then deletes it, or deletes it directly, unless there is a legal retention obligation. The Service allows effective deletion of the data.

9. Transfers outside the European Union

The data is preferably hosted in the European Union. Any transfer outside the EU is governed by a valid mechanism (adequacy decision or standard contractual clauses), accompanied, where applicable, by a transfer impact assessment.

10. Data breaches

The processor notifies the Customer of any personal data breach without undue delay after becoming aware of it, and provides it with the relevant information to enable, where applicable, its notification to the supervisory authority.