This agreement covers the personal data inside your organisation’s mailboxes. It forms part of the Terms of service and meets the requirements of Article 28 of the GDPR.
1Roles
Your organisation is the controller of the personal data in its mailboxes. DMU is the processor, and processes it only on your documented instructions: these terms, and how you set up and use DMU Mail.
2What we process
| Purpose | Syncing, storing, indexing, showing and sending email and attachments for your team |
|---|---|
| People | Your members, the people you correspond with, and anyone named in your mail |
| Data | Names, email addresses, message content and attachments, and whatever personal data they contain |
| Duration | For as long as you use DMU Mail, then until deletion under section 8 |
Purpose
Syncing, storing, indexing, showing and sending email and attachments for your team
People
Your members, the people you correspond with, and anyone named in your mail
Data
Names, email addresses, message content and attachments, and whatever personal data they contain
Duration
For as long as you use DMU Mail, then until deletion under section 8
3Our commitments
- Process your data only on your instructions.
- Bind everyone with access to it to confidentiality.
- Help you answer requests from the people in your mail.
- Help with impact assessments and consultations where you need it.
- Give you the information you need to show compliance, and allow reasonable audits.
4Security measures
- Each organisation’s data is kept apart by the database itself, using row-level security, and that separation is tested before every release.
- Mailbox passwords are encrypted with AES-256-GCM, using a key unique to your organisation.
- Email is sanitised on our servers and shown in a sandbox with scripts switched off.
- All traffic is encrypted in transit with TLS.
- Administrative access runs over a private network only; public SSH is closed.
5Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and object storage | Germany (EU) |
| Cloudflare, Inc. | DNS, CDN and DDoS protection | Global, under the EU–US Data Privacy Framework |
| Payment provider | Card payments; billing data only | To be confirmed before launch |
Hetzner Online GmbH
- Service
- Servers and object storage
- Location
- Germany (EU)
Cloudflare, Inc.
- Service
- DNS, CDN and DDoS protection
- Location
- Global, under the EU–US Data Privacy Framework
Payment provider
- Service
- Card payments; billing data only
- Location
- To be confirmed before launch
We’ll tell you before adding or replacing a sub-processor, and you can object.
6Transfers outside the EU
Your mail stays in the EU. Where a sub-processor outside the EU is involved, transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses.
7Personal data breaches
We’ll notify you without undue delay, and in any case within 48 hours of becoming aware of a breach that affects your data, with what we know and what we’re doing about it.
8Return and deletion
When you delete your organisation, you have 30 days to export your data. After that we delete it from our live systems, and from backups as they expire.
9Liability and precedence
Liability under this agreement follows the Terms of service. Where this agreement and the terms disagree about personal data, this agreement wins.
Questions about this page?
Write to privacy@dmu.email, or by post to DMU, Krystalli 7, Marousi 151 25, Attica, Greece.