Annex 1: Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

between the Customer ("Controller") and Bergstein Media Ltd, Arch. Makariou III 55, Flat 102, 7550 Kiti, Cyprus ("Processor") — Last updated: October 2026

This is a convenience translation. In case of discrepancies, the German version prevails.

Section 1 Subject Matter and Duration

(1) This agreement specifies the data protection obligations of the parties arising from the main contract for the use of the "Hello Email" software (Terms of Service). It forms part of the main contract; in the event of conflicts, this agreement prevails in data protection matters.

(2) Its term corresponds to the term of the main contract.

Section 2 Subject, Nature and Purpose of Processing; Data Categories; Data Subjects

(1) Subject and purpose: Creation, personalisation and sending of email campaigns and automations for the Controller, including recipient management, segmentation, AI-assisted content creation, performance measurement and deliverability analysis, and, where the Controller activates the respective integration, the synchronisation of recipient segments with the Controller's own advertising accounts (e.g. Meta Custom Audiences, Google Customer Match), the transfer of contacts from the Controller's lead forms (e.g. Meta Lead Ads) and the transmission of purchase and sign-up events to the Controller's own advertising accounts or datasets (e.g. Meta Conversions API).

(2) Categories of data: Email addresses, names, order and revenue data, product and cart data, interaction data (opens, clicks, bounces, unsubscribes), segment and profile data, customer data imported via integrations (in particular Shopify, Klaviyo, Meta Lead Ads), phone numbers, information collected via lead forms (e.g. answers to form questions, consent and disclaimer texts, form, lead, ad and campaign IDs), hashed identifiers (SHA-256), event data (e.g. purchases and sign-ups including time, order value, currency, order and product IDs), technical identifiers (e.g. IP address, browser information, Meta browser, click and lead ID).

(3) Categories of data subjects: Customers, prospects and newsletter recipients of the Controller.

(4) Special categories of personal data (Art. 9 GDPR) are not subject to the processing; the Controller undertakes not to introduce such data into the software.

Section 3 Processing on Documented Instructions

(1) The Processor processes personal data exclusively on documented instructions from the Controller, unless required to process by Union or Member State law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information (Art. 28(3)(a) GDPR). The Controller's use of the software and its features constitutes an instruction.

(2) If the Processor is of the opinion that an instruction infringes the GDPR or other data protection provisions, it shall inform the Controller without undue delay (Art. 28(3), second subparagraph, GDPR).

(3) Where the Controller activates an interface to a third-party provider with which it has concluded its own agreement (in particular advertising networks such as Meta or Google), the transmission of data to that provider and the retrieval of data from it constitute an instruction of the Controller. Such third-party providers are not sub-processors of the Processor within the meaning of Section 6. The Controller is solely responsible for the lawfulness of the transmission. The Processor points out that, according to the German data protection supervisory authorities and case law (Bavarian Higher Administrative Court, decision of 26 September 2018), uploading customer lists to advertising networks requires a separate, documented consent of the data subjects.

Section 4 Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

Section 5 Technical and Organisational Measures

(1) The Processor implements the technical and organisational measures described in Appendix A pursuant to Art. 32 GDPR.

(2) The measures are subject to technical progress; the Processor may further develop them provided that the overall level of protection is not reduced.

Section 6 Sub-Processors

(1) The Controller grants general authorisation (Art. 28(2) GDPR) for the engagement of the sub-processors listed in the current list in the privacy policy at hello-email.com.

(2) The Processor shall inform the Controller in text form (email to the account address) at least 30 days before adding or replacing a sub-processor. The Controller may object to the change within this period on serious data protection grounds. If the parties cannot reach agreement, either party is entitled to terminate the main contract with effect from the planned date of engagement.

(3) The Processor shall impose on each sub-processor, by way of contract, the same data protection obligations as set out in this agreement (Art. 28(4) GDPR) and remains responsible to the Controller for the sub-processor's performance of those obligations.

Section 7 Assistance to the Controller

(1) The Processor shall assist the Controller by appropriate technical and organisational measures in responding to requests from data subjects (Art. 12–23 GDPR), in particular through the software's export, rectification, deletion and suppression functions (Art. 28(3)(e) GDPR). Requests from data subjects received directly by the Processor shall be forwarded to the Controller without undue delay.

(2) The Processor shall further assist the Controller in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor (Art. 28(3)(f) GDPR).

Section 8 Notification of Personal Data Breaches

The Processor shall notify the Controller without undue delay after becoming aware of any personal data breach affecting the data processed on the Controller's behalf and shall provide the information the Controller requires to fulfil its obligations under Art. 33 and 34 GDPR (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed).

Section 9 Anonymised Data; Product Improvement

(1) The Processor is entitled to anonymise data processed under this engagement and to use the anonymised, aggregated data – from which neither the Controller nor data subjects can be identified – for the improvement, further development and statistical analysis of its software and AI features. Anonymisation is carried out in such a way that re-identification is excluded according to the state of the art.

(2) Personal data of the Controller or of its end customers is not used to train AI models.

(3) Data that the Processor obtains via Meta's interfaces (in particular lead data and account information) is excluded from paragraph 1; it is used exclusively to provide the features activated by the Controller.

Section 10 Evidence and Audits

(1) The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR (Art. 28(3)(h) GDPR), primarily through up-to-date documentation, audit reports and certifications.

(2) Where such evidence is insufficient in an individual case, the Controller may, no more than once per year, upon reasonable advance notice, during normal business hours and without disrupting operations, conduct an audit or have one conducted by an auditor bound to confidentiality and not in competition with the Processor. The Controller bears the costs.

Section 11 Deletion and Return after the End of the Engagement

(1) After termination of the main contract, the Processor shall delete all personal data processed on the Controller's behalf from the production systems within 30 days, unless the Controller has previously requested their return (export in a common format) and unless a statutory retention obligation exists (Art. 28(3)(g) GDPR).

(2) To protect against ransomware and data loss, the Processor maintains immutable backups (object lock), which technically cannot be deleted early and are automatically deleted no later than 12 months after their creation. Backup data is used exclusively for recovery; in the event of a restore, previously deleted data will be deleted again without undue delay.

Section 12 Transfers to Third Countries

Processing in third countries takes place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision of the EU Commission (Art. 45 GDPR, such as for the EU-U.S. Data Privacy Framework or for Switzerland) or the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The applicable transfer mechanism is indicated in the sub-processor list.

Section 13 Final Provisions

(1) The choice of law and place of jurisdiction of the main contract apply to this agreement.

(2) Each party maintains its own records of processing activities pursuant to Art. 30 GDPR.

(3) Amendments to this agreement require text form.

Appendix A: Technical and Organisational Measures (Art. 32 GDPR)

Encryption: Transport encryption (TLS) for all data transmissions; encryption of stored data (at rest) at infrastructure level.
Access control: Access to production systems only for authorised persons on a need-to-know basis; two-factor authentication; personalised accounts; role-based permissions.
Tenant separation: Logically separated databases per customer (dedicated database per shop) in the database and analytics layers.
Logging: Central logging and monitoring of systems and processing operations; error and security monitoring.
Availability and resilience: Redundant infrastructure in EU data centres (Germany, Lithuania, Frankfurt, Ireland); immutable backups (object lock) with automatic deletion no later than after 12 months; documented recovery procedures.
Sub-processor control: Careful selection of sub-processors; contracts pursuant to Art. 28(4) GDPR; regular review.
Organisation: Confidentiality obligations for all staff; principle of data minimisation; regular review and further development of the measures.