DPA

Last updated 2026-09-28 · applies to Envelt at envelt.com

Who this is for. Organisations that use Envelt for their staff or customers and need a processor agreement under the GDPR (Art. 28) or the Swiss FADP. Individuals do not need it. This Data Processing Addendum is part of the Terms of Service and applies automatically to business customers; countersigned copies are available on request.

1. Parties and roles

The customer ("Controller") is the organisation that holds the account(s). WebsiteDev. Solutions GmbH ("Processor") processes personal data on the Controller's behalf as described below. Where the Processor determines purposes itself (operating the Service, billing, security), it acts as an independent controller under the Privacy Policy.

2. Subject matter and duration

Provision of encrypted email mailboxes, forwarding, custom-domain hosting and related features for the term of the customer's use of the Service.

3. Nature and purpose of processing

Receiving, authenticating, spam-scoring, encrypting, storing, listing and transmitting email; storing account, address and domain configuration; processing prepaid plan status.

4. Categories of data and data subjects

Data subjects: the Controller's users and their correspondents. Data: usernames; email addresses and forwarding destinations; encrypted message content (which may contain any category of personal data the Controller's users exchange, unreadable to the Processor); plan and usage counters; hashed spam-training tokens. No special categories are requested by the Service; any that appear inside messages are encrypted to the user's key.

5. Processor obligations

Process personal data only on documented instructions from the Controller, which are these terms and the configuration the Controller's users make in the Service, unless required by law, in which case the Processor informs the Controller where legally permitted.
Ensure persons authorised to process data are bound by confidentiality.
Implement the technical and organisational measures in Section 8.
Assist the Controller with data-subject requests, security-incident notifications and impact assessments, to the extent the Processor's architecture allows (see Section 9).
Notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting the Controller's data.
Delete personal data at the end of the service (account deletion is self-service and immediate) and not retain copies except as required by law.
Make available the information necessary to demonstrate compliance and allow audits, which may be satisfied by documentation and remote review given the Processor cannot expose other customers' data.

6. Sub-processors

The Processor uses the following categories of sub-processors, each bound by written terms providing equivalent protection:

Sub-processor	Purpose	Location
Hosting provider (named on request)	Servers and encrypted disks	Switzerland / EEA
Public blockchain RPC endpoints	Read-only detection of payments to the Processor's own address; no customer data is sent	Various

The Processor will announce new sub-processors on the Service at least 30 days in advance; the Controller may object on reasonable data-protection grounds, in which case either party may terminate.

7. International transfers

Data is stored in Switzerland or the EEA. Email transmitted to third-party providers goes wherever the recipient's provider is, as inherent to email. Any other transfer relies on an adequacy decision or standard contractual clauses.

8. Technical and organisational measures

Client-side key generation; mailbox content encrypted with X25519 + AES-256-GCM to the user's key before storage; the Processor holds no decryption capability for stored content.
Passwords never transmitted; authentication via a derived key hashed with Argon2id.
No IP address collection, no access or mail logs, in-memory sessions.
TLS 1.2+ for all connections; DKIM signing; SPF/DKIM/DMARC verification of inbound mail.
Strict content security policy; no third-party code.
Encrypted disks at the hosting layer; access limited to named administrators with hardware-backed keys.
Secure deletion of message blobs on user deletion.

9. Limits inherent to the design

The Controller acknowledges that the Processor cannot: read, search, export in plaintext, or selectively delete message content; reset user passwords; produce access logs or IP addresses; or identify which natural person uses an account. Data-subject requests concerning message content must be fulfilled by the user through the Service.

10. Liability and precedence

Liability is governed by the Terms of Service. In case of conflict between this DPA and the Terms regarding personal data, this DPA prevails.

11. Contact

Data protection: privacy@envelt.com