Data Processing Agreement

1. Status and acceptance

This Data Processing Agreement (DPA) is part of the Terms of Service and forms the contract required by Article 28(3) GDPR between Auxillo and each customer. The customer accepts it when creating an Auxillo account or placing an order, and it applies for as long as Auxillo processes personal data on the customer’s behalf. No separate signature is needed. A customer that needs a signed copy can ask [email protected].

2. Scope and roles

This DPA applies where Auxillo processes personal data on behalf of a customer to provide a hosted service, Aux Mail or Aux Tools. The customer is the controller, or a processor acting for its own controller; Auxillo is the processor or subprocessor. Annex 1 describes the processing for each product: subject matter, nature, purpose, types of personal data, categories of data subjects and duration.

Auxillo’s own processing as controller, for accounts, billing, security and support, is described in the Privacy Policy and is not covered by this DPA. Special categories of data (Article 9 GDPR) require a suitability assessment and appropriate written instructions before use.

3. Documented instructions

We process personal data only on the customer’s documented instructions, including with regard to transfers to third countries. The instructions are this DPA, the Terms of Service, the order, the service settings the customer chooses and support requests the customer authorises. If Union or Member State law requires other processing, we will inform the customer before processing unless that law prohibits it. We will promptly tell the customer if we believe an instruction infringes data protection law, and may pause the affected processing while it is clarified.

4. Confidentiality and security

Auxillo is run by its operator personally. Only the operator, and any person Auxillo later authorises who is bound by a written duty of confidentiality, has access to customer personal data, and only as needed to provide the service.

Auxillo implements the technical and organisational measures in Annex 2, appropriate to the risk of the processing (Article 32 GDPR). We may update them, but not in a way that lowers the overall level of protection. The measures are not a claim of universal end-to-end encryption or a security certification. The customer is responsible for its authorised users, its content, the security of its own credentials and devices, and any encryption keys it controls.

5. Subprocessors

The customer gives general authorisation to the subprocessors listed in Annex 3 and the Subprocessor List. We will give at least 30 days’ notice, by email and on that list, before a new or replacement subprocessor begins processing customer personal data. The customer may object on reasonable data protection grounds during that period by writing to [email protected]. We will work to resolve the objection; if it cannot be resolved, the customer may end the affected service and receive a refund of prepaid fees for the period not yet delivered.

Each subprocessor is bound by a written contract with data protection obligations equivalent to those in this DPA, as Article 28(4) GDPR requires. Auxillo remains fully responsible to the customer for each subprocessor’s performance of those obligations. For Anthropic and OpenAI, listed in Annex 3 for support drafting, this applies from the day that use starts. It will not start until the contract and transfer mechanism are recorded, and not earlier than 30 days after Anthropic and OpenAI were first listed in Annex 3 and the Subprocessor List.

6. International transfers

Auxillo stores customer data on servers in the EU (Germany and Finland). Where a subprocessor processes customer personal data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (including the EU to US Data Privacy Framework for certified recipients) or on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914: Module 3 (processor to processor) between Auxillo and the subprocessor. Where Auxillo transfers personal data as controller, Module 2 (controller to processor) applies. The Subprocessor List states the mechanism for each provider.

Where the customer is established outside the EEA and its use of the service is not subject to the GDPR, the standard contractual clauses Module 4 (processor to controller) apply to data Auxillo returns to it, if the customer asks for them. Lookups that the customer itself requests in Aux Tools are transfers made on the customer’s instruction; the Subprocessor List explains them.

7. Assistance

Taking account of the nature of the processing and the information available to us, we assist the customer with responding to data subject requests, security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 GDPR).

If a data subject contacts us about customer-controlled data, we will not answer on the customer’s behalf unless instructed or required by law. We will pass the request to the customer without undue delay where we can identify it.

8. Personal data breaches

We will notify the customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting customer personal data. The notice goes to the account owner’s email address and states, as far as known: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information we do not yet have follows in stages as it is established. We will take reasonable steps to contain the breach and limit its effects, and keep a record of it.

9. Return and deletion

When a service ends, the customer chooses whether its personal data is returned or deleted, unless Union or Member State law requires us to keep it.

• Return: until the end of the paid period, the customer can export its data itself: files and databases over SFTP or SSH, mail over IMAP, Aux Tools findings and history from Reports, and Aux Mail data from its export. On request, we provide an export in a common format within 14 days.
• Deletion from active systems: within 30 days after the service ends. Deleting the Auxillo account starts the deletion of the customer’s data in Aux Tools, Aux Mail and AMI at once; it is recorded and retried until each product confirms it.
• Recovery copies: encrypted off-site recovery archives are access restricted and follow the Data Retention Schedule. The current recovery preservation hold means we cannot represent all historical archives as expiring within 30 days. Data in an archive is not used except to restore a service, and a restore respects deletion requests already made.

On request, we confirm in writing that deletion is complete. A customer requiring a fixed backup-expiry period must have that requirement confirmed in the service order before placing data in the service.

10. Customer obligations

The customer is responsible for having a lawful basis for the personal data it places in the service, for giving data subjects the information required by Articles 13 and 14 GDPR, and for the lawfulness of its instructions.

Aux Mail. Before sending marketing messages with Aux Mail, the customer must hold a lawful basis for each recipient: prior consent, or for its existing customers the conditions of Article 13-A of Portuguese Law 41/2004 (contact details obtained in a sale, similar products or services, a clear and free opt-out offered at collection and in every message), or the equivalent rule of the law that applies to the customer. The customer records the consent evidence in Aux Mail, which keeps it with the contact. Every campaign carries a one-click unsubscribe, which the customer must not remove or ignore. Open and click tracking is off by default; if the customer switches it on, it must first obtain its recipients’ consent to that tracking. Contact enrichment (Clearbit) is off by default and the customer is responsible for its lawful use if it switches it on.

Aux Tools. The customer uses lookups and monitoring only for domains, IP addresses and systems it owns or is authorised to test, breach checks only for its own or verified email addresses, and the email harvester only on domains it has verified as its own, as the Acceptable Use Policy requires.

11. Information and audits

We make available all information necessary to demonstrate compliance with this DPA and Article 28 GDPR, and allow for and contribute to audits, including inspections, by the customer or an auditor it mandates. The customer gives at least 30 days’ notice of an audit, unless a breach or a supervisory authority requires sooner. Audits take place during business hours, at most once a year unless there is a breach or a regulator’s request, and must protect other customers’ information and the security of the service. Each party bears its own costs. Reasonable scheduling and confidentiality arrangements must not prevent required verification.

12. Contact and precedence

Contact [email protected] for processor instructions or an audit request and [email protected] for an urgent incident. For its data protection subject matter, this DPA prevails over the rest of the Terms of Service; where the standard contractual clauses apply, they prevail over this DPA. Liability under this DPA follows the Terms of Service, except where mandatory law provides otherwise. Portuguese law governs this DPA.

Annex 1: Details of processing

For every product, the nature of the processing is: hosting, storage, retrieval, transmission, backup and deletion of the customer’s data, and support the customer requests. The duration is the term of the service plus the return and deletion period in section 9, and the retention periods in the Data Retention Schedule.

Web Hosting

• Subject matter and purpose: hosting the customer’s websites, their databases and the email for the site’s domain.
• Personal data: whatever the customer’s websites hold or collect, such as visitor form entries, user accounts, orders and comments; website access logs (IP address, time, requested page, browser); mailbox contents.
• Data subjects: the customer’s website visitors, users, customers and staff, and their correspondents.

Email Hosting

• Subject matter and purpose: receiving, storing, filtering for spam and viruses, and sending email for the customer’s domains.
• Personal data: message content and attachments, headers, email addresses, names, contacts, mail server logs (IP addresses, sender and recipient addresses, times).
• Data subjects: the customer’s mailbox users and the people they correspond with.

Database Hosting

• Subject matter and purpose: running and storing the customer’s managed databases.
• Personal data: whatever records the customer stores; connection logs.
• Data subjects: as determined by the customer, typically its own customers, users and staff.

App Hosting

• Subject matter and purpose: running the customer’s applications on a server Auxillo operates.
• Personal data: whatever the customer’s applications process; application and access logs.
• Data subjects: the users of the customer’s applications and the people whose data those applications hold.

AI Hosting

• Subject matter and purpose: running the customer’s AI agents and models on a server Auxillo operates.
• Personal data: prompts, files, conversations and data the customer’s agents process; logs. AI providers the customer connects to its own server act under the customer’s own agreement with them and are not Auxillo subprocessors.
• Data subjects: as determined by the customer.

Game Hosting (when available)

• Subject matter and purpose: running game servers the customer orders.
• Personal data: player names and identifiers, IP addresses in server logs, in-game chat and server files.
• Data subjects: the customer and the players who join its servers.

Aux Mail

• Subject matter and purpose: a mail workspace for the customer: reading and sending mail, managing contacts and lists, sending campaigns, collecting sign-ups through forms, and optional AI features run by AMI on Auxillo hardware.
• Personal data: mail content, contact details (names, email addresses, organisation and any fields the customer adds), consent evidence, unsubscribe and bounce records, form submissions with IP address and browser details (shortened after 30 days), campaign open and click events where the customer has switched tracking on (kept 13 months, IP addresses shortened), enrichment data if the customer switches on Clearbit.
• Data subjects: the customer’s contacts, campaign recipients, form submitters, correspondents and users of the workspace.

Aux Tools monitoring

• Subject matter and purpose: diagnostics, monitoring, alerting and reporting on the domains, IP addresses, mail configuration and services the customer enters, and optional AMI analysis of the results.
• Personal data: domains, IP addresses and email addresses the customer enters; public DNS and registration records, which can contain names and contact details; breach check results for the customer’s own or verified addresses; DMARC and TLS reports, which contain sending server IP addresses; team member names, email addresses and audit log entries.
• Data subjects: the customer’s staff and team members, holders of the email addresses checked, and registrants of the domains checked.

Annex 2: Technical and organisational measures

These are the measures in place. They are described plainly, including their limits.

• Location: Auxillo servers are in Hetzner data centres in Germany and Finland (EU). AMI runs on hardware Auxillo owns and operates.
• Encryption in transit: public connections to Auxillo services use TLS. Traffic between Cloudflare and Auxillo servers runs through encrypted tunnels.
• Encryption of credentials: account passwords are stored as hashes. Mailbox, connection and API credentials that a feature needs are stored encrypted and are not shown again after entry.
• Encryption at rest: off-site recovery archives are encrypted before they are stored. Live disks and databases are not all encrypted at rest; we do not claim they are.
• Access control: administrative access to servers is limited to the operator, uses individual keys and is not shared. Customers can turn on two-factor sign-in, and Aux Tools teams have roles. Customer accounts are separated by authentication and access checks on every request.
• Logging: the Auxillo account, Aux Tools and Aux Mail keep audit logs of sign-ins and security-relevant changes. IP addresses in audit logs are shortened after 90 days.
• Retention: the periods in the Data Retention Schedule are enforced automatically by the services.
• Network protection: Cloudflare provides DNS, protection against denial of service attacks and filtering of malicious traffic. Servers expose only the ports their services need.
• Maintenance: operating systems and software are kept up to date with security patches.
• Backups and recovery: encrypted off-site recovery archives, with access restricted, as described in the Data Retention Schedule.
• Incidents: security reports go to [email protected]; the Vulnerability Disclosure Policy invites outside reports. Customers are notified of a breach within 48 hours of Auxillo becoming aware of it (section 8).
• Minimisation: AMI receives account events without IP addresses; push notifications carry only an opaque identifier; lookup services receive only the target being checked.

Annex 3: Subprocessors

The authorised subprocessors are those named in the Subprocessor List, with the role, data, location and transfer safeguard stated there. At the date of this DPA they are: Hetzner Online GmbH (hosting, Germany and Finland), Cloudflare, Inc. (network, tunnels, protection and encrypted recovery archives), Stripe (billing records), Google LLC (Firebase Cloud Messaging, push delivery), Clearbit (Aux Mail contact enrichment, only if the customer switches it on), Internet Security Research Group (certificates) and Anthropic and OpenAI (AI models for Auxillo’s support desk, on minimised ticket text only and only once their agreements and transfer safeguards are recorded; relevant to this DPA only where a support ticket contains customer personal data). The lookup services Aux Tools queries on the customer’s request are listed there as well.