Data processing agreement

1. Subject and duration

1.1 The Processor writes letters with a real pen for the Controller, by hand or with a pen-guided writing machine, and posts them (the “Service”, as described in the Terms). For this it processes personal data of the Controller’s recipients on the Controller’s behalf.

1.2 This agreement applies as long as the Processor processes such data for the Controller, and ends once the data has been erased or returned under clause 9.

2. Nature, purpose and data

2.1 Purpose: to write, address and post the letters the Controller orders, and to report their status (posted, held, returned, not sent) to the Controller.

2.2 Nature: storing, displaying, writing with a pen (by hand or with a writing machine), addressing, posting, reporting and erasing.

2.3 Types of data: recipients’ first and last names, company, postal address, CRM record ID, any individual message or other column of the list the Controller uploads, the letter text, and the status of each letter with its history and an optional note (for example “address unknown”).

2.4 Data subjects: the recipients chosen by the Controller, typically its business contacts, prospects and customers.

3. Instructions

3.1 The Processor processes the data only on the Controller’s documented instructions, unless EU or German law requires otherwise; in that case it tells the Controller beforehand unless the law forbids this. Instructions are given by the Terms and this agreement, by the orders the Controller places in the app (the approved letters and recipients), and by further instructions in text form (email to florian@projectkant.com).

3.2 The Processor informs the Controller without delay if it believes an instruction infringes data protection law.

4. The Controller’s responsibility

The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis to use the recipients’ data and to send them the letters, and for informing the recipients as required by Articles 13 and 14 GDPR. The Controller does not upload special categories of personal data (Article 9 GDPR), data on criminal convictions (Article 10 GDPR) or data about children; the Processor may delete such data and tells the Controller.

5. Confidentiality

The Processor may involve people who work under its direction to provide the Service, for example in writing or posting letters. It ensures that everyone it authorises to process the data is committed to confidentiality, is instructed in data protection and processes the data only as far as needed for the Service.

6. Security

The Processor takes the technical and organisational measures described in Annex 1 (Article 32 GDPR). It may adapt them to technical progress as long as the level of protection does not fall.

7. Personal data breaches

The Processor notifies the Controller without undue delay, at the latest within 48 hours of becoming aware of a breach affecting the Controller’s data, with the information then available, and supplements it as more becomes known. It supports the Controller in its duties under Articles 33 and 34 GDPR.

8. Support

8.1 The Processor supports the Controller in answering requests from data subjects (Articles 15–22 GDPR). Requests it receives directly are forwarded to the Controller without delay.

8.2 It supports the Controller with Articles 32 to 36 GDPR to the extent of the information available to it.

9. Erasure

9.1 The app erases recipients’ names, addresses, other list columns and the letter texts 90 days after an order is complete (each letter posted or marked as not sent), or 90 days after a refund. Before then the Controller can download the dispatch report. Drafts are erased when the Controller deletes them; campaigns confirmed but not paid keep their data until the Controller deletes them.

9.2 Copies of approved letters that the Processor downloads to write them are deleted by the same date.

9.3 Instead of erasure, the Controller may ask, before the erasure date or when this agreement ends, for its recipients’ data to be returned. The Processor then sends it as a CSV file and erases it afterwards.

9.4 When this agreement ends, the Processor erases the remaining data unless EU or German law requires it to keep it. Order and payment records without recipient data are kept as required by § 147 AO and § 257 HGB. Backups, where the provider’s plan keeps them, are overwritten within the provider’s backup period.

10. Information and audits

10.1 The Processor provides the Controller with the information needed to demonstrate compliance with Article 28 GDPR, primarily through this agreement, Annex 1 and the providers’ certifications and reports.

10.2 Where that is not enough, the Controller, or an auditor bound to confidentiality who is not a competitor of the Processor, may carry out inspections after at least 14 days’ notice, during business hours and without disrupting operations, at most once a year unless there has been a breach or a supervisory authority requires it. Each party bears its own costs.

10.3 Inspections by a competent supervisory authority are not limited by this clause.

11. Sub-processors

11.1 The Controller authorises the sub-processors listed in Annex 2. The Processor binds them to obligations equivalent to this agreement and remains fully liable to the Controller for their performance (Article 28(4) GDPR).

11.2 The Processor announces a new or replaced sub-processor at least 14 days in advance by email or in the app. The Controller may object for important data protection reasons; if no solution is found, either party may end the affected service.

11.3 Postal service providers such as Deutsche Post AG are not sub-processors: they deliver the letters under their own responsibility.

12. Location and transfers

The app’s data is stored in the European Union. Transfers outside the European Economic Area take place only under Articles 44 to 49 GDPR, as described for each sub-processor in Annex 2.

13. Final provisions

13.1 If this agreement and the Terms differ on data protection, this agreement prevails.

13.2 Liability follows Article 82 GDPR and, between the parties, clause 13 of the Terms.

13.3 This agreement is concluded electronically when the Controller’s company accepts the Terms in the app (Article 28(9) GDPR). Its version is recorded with the acceptance.

Annex 1: Technical and organisational measures

• Encryption: all connections use HTTPS; the database connection is encrypted and verified against the provider’s certificate. Login tokens are stored encrypted (AES-256-GCM); session keys only as hashes.
• Separation: each company sees only its own data; every request is checked on the server against the signed-in person’s company.
• Access to the database: not reachable through the provider’s public data interface; row-level security is enabled.
• Passwords: handled by the login provider and never seen by Project Kant.
• Access control: limits on sign-in and password-reset attempts. Operator access is granted only on the server, needs a code from an authenticator app at each login and ends after 8 hours.
• Integrity of payments: payment confirmations are signed by Stripe and verified before use.
• Erasure: automatic erasure as in clause 9, checked every hour.
• Copies for writing: letters downloaded to write them are kept only on computers with an encrypted disk and a password, and deleted by the order’s erasure date. Written letters and envelopes stay with Project Kant, out of reach of others, until posted.
• Logs: error logs record the request method and path and a short error message, never request bodies.
• Availability and recovery: the database runs at a managed provider in the European Union; backups, where the plan in use provides them, follow the provider’s schedule.
• Incidents: suspected breaches are investigated without delay, documented and reported under clause 7.
• Review: these measures are reviewed at least once a year and after every significant change to the app.
• Usage analytics (only with a user’s consent): recordings hide all text, typed values and attribute values; no recipient data is recorded.

Annex 2: Sub-processors