1. Parties, precedence and duration
The Processor is Dansk Online Marketing ApS, Danish company registration (CVR) 45957969, Gunderupvej 16, 9260 Gistrup, Denmark. The Controller is the customer identified in the order and service agreement (Main Agreement). This agreement is made under Article 28 of Regulation (EU) 2016/679 (GDPR). Where customers act for their own clients, we may be a sub-processor with equivalent obligations.
This agreement prevails over the Main Agreement on personal-data protection. It applies for as long as we process personal data on the customer's behalf. Our own account, billing, accounting and statutory identity checks are independent controller purposes described in the Privacy Policy, and are not customer instructions under this agreement.
2. Subject matter, nature and purposes
Processing delivers ordered address and mail services: receipt, recording, notification, scanning, digital storage, forwarding, physical hand-over and deletion. It also covers generation, PDF rendering, delivery, storage and return of digital document drafts based on customer answers, support concerning this content, and closure/retention of telephone messages from historical agreements.
Data subjects may include customer employees, representatives, contacts and users, mail senders and recipients, contracting parties, people named in document drafts and others in correspondence or historical telephone messages.
Data may include names, business/home addresses, emails, telephone numbers, roles, dates of birth, employment and contractual details, customer document answers, document versions, mail/message content and associated delivery details. National identification numbers may be included if customers enter them in relevant documents. Customers must minimise content and use masking where a full number is unnecessary.
Customer-determined content may include special-category data or criminal-offence information, for example in incoming mail. The service does not generally require such data. Customers may instruct processing only where necessary and supported by the required lawful basis. Processing is limited to the ordered handling; content must not be used for our marketing or other independent purposes.
3. Instructions and Processor obligations
We process only on documented customer instructions, including the Main Agreement, this agreement and use of the service, including international transfers. If EU or Danish law requires other processing, we inform the customer beforehand unless prohibited by law. We immediately inform the customer if we believe an instruction infringes data-protection law.
We ensure confidentiality for authorised persons, appropriate Article 32 security measures and compliance with the sub-processor conditions in section 4.
Taking account of the nature of processing, we assist customers with requests under GDPR Chapter III and compliance with Articles 32–36, including security, breach handling, impact assessments and prior consultation. We do not independently answer customer data subjects without instructions unless legally required.
We notify customers without undue delay and in any event within 48 hours of becoming aware of a personal-data breach affecting their data. Notice includes available details of the breach, affected data/people, contact point, likely consequences and mitigation. Missing details are supplied in stages without undue delay.
We provide information necessary to demonstrate Article 28 compliance and allow and contribute to audits and inspections on reasonable notice. Audits must respect other customers' confidentiality and security.
4. Sub-processors and changes
The customer gives general written authorisation for sub-processors providing hosting, database/files, PDF generation, messaging, support and error monitoring. We impose equivalent data-protection obligations and remain liable for their performance. We notify customers of intended additions or replacements so they can object on reasonable grounds before the change. Updating this page does not replace required notification.
Supabase (AWS): database, login and file storage for mail, customer documents and associated records. Primary storage: Ireland (EU). Other provider processing must comply with section 5.
Vercel: application hosting and server functions through which customer content passes when using the service. Runtime: Ireland; other provider processing may take place outside the EU/EEA under section 5.
Hetzner: hosting for our own PDF service, which receives necessary HTML/document content to generate address agreements and document drafts. Specific processing locations and relevant safeguards are available on request; transfers are subject to section 5.
Resend: outgoing notifications and incoming email replies, including sender/recipient, necessary message content and delivery data. Provider processing may occur in the US under section 5.
Sentry: error monitoring and operational security; technical error and event data may include necessary personal data. Primary storage: Germany (EU); other provider processing must comply with section 5.
Stripe, Dinero and Didit are used for our own payment, accounting and customer-due-diligence purposes described in the Privacy Policy. This alone does not make them sub-processors of customer mail or document content. Carriers are used for ordered mail delivery; a carrier may be an independent controller for its statutory transport processing.
5. International transfers
The primary database and file storage are in Ireland. Some provider activities may occur in the US or other countries outside the EU/EEA. Transfers may occur only on documented customer instructions and a valid GDPR Chapter V basis, such as an applicable adequacy decision or European Commission Standard Contractual Clauses with necessary supplementary measures.
Customers may request specific processing locations, transfer mechanisms and relevant safeguards by contacting us. A general reference to EU storage is not a statement that all support and other provider processing occurs in the EU.
6. Controller obligations
Customers are responsible for a valid legal basis, appropriate information to data subjects and lawful instructions. This covers both received mail and data customers or their users enter in documents, support and other content. Customers must minimise data, control their users' access and communicate relevant deletion or return instructions to us.
7. Return, deletion and termination
At the customer's choice, we delete or return personal data after service termination and delete existing copies unless EU or Danish law requires retention. Legally retained information is isolated from ordinary processing and used only for the legal purpose until deletion is possible.
Customers can contact us about export and deletion of mail or paid documents; cancelling a subscription does not itself trigger draft cleanup of all customer documents. Unused drafts are cleaned up after 90 days of inactivity. Paid documents remain available as the delivered version until relevant deletion/termination instructions are handled. Practical return and handling of any backups are agreed when deleting; copies must not be used for new purposes.
8. Liability and governing law
Liability follows the Main Agreement's limits to the extent lawful. Nothing limits data-subject rights or liability that cannot be limited under applicable data-protection law. Danish law applies. Disputes follow the venue agreed in the Main Agreement or, if none is agreed, the Danish courts, subject to mandatory rules.
Annex 1. Technical and organisational measures
Access control: database access rules are scoped by user/organisation and role. Mail scans are stored privately. A scan is released only after server-side ownership checks through a signed link valid for one hour. Customer content requires appropriate authentication and authorisation; staff access is limited to the task.
Encryption: TLS/HTTPS in transit between users, the application and core storage providers. Database and stored mail scans are protected by the storage provider's encryption at rest. Stored third-party keys and OAuth tokens have additional application encryption.
Physical security and confidentiality: physical mail is held in access-controlled premises, handled by authorised staff and securely shredded after its retention period. Staff and sub-processors are bound by confidentiality.
Resilience and incidents: regular backups, ability to restore access and a procedure for detecting, assessing and reporting breaches. Measures must be adapted to risk, the state of the art and the nature, scope and purpose of processing. Data must be limited to its purpose and deleted or returned under section 7.