DESign in

Art. 28 GDPR

Data processing agreement

Version 2026-11

This translation is for convenience. If the two versions differ, the German text applies.

Between you as a Mailiy customer (controller) and 26LAB.IO, Christian Gudermann, Hasselbeckstr. 37, 40822 Mettmann (processor, “we”). The agreement applies once you accept it together with the terms when you sign up, and ends with your account. No signature is needed; electronic form is enough (Art. 28(9) GDPR).

1. Subject and duration

We receive submissions from your forms, deliver them by email to your confirmed addresses, store them encrypted if you want, forward them by webhook if you want, and send the sender an automatic reply if you want. The agreement runs as long as your account.

2. Types of data and data subjects

Data subjects are people who submit a form on your websites. We process everything they enter (for example name, email address, message), the time and, if you require it, the time of their consent. You should not collect special categories under Art. 9 GDPR through Mailiy. If your spam filter catches a submission, we keep it for 7 days at most, and only if you have storage turned on. IP addresses you block are stored as part of the form settings.

3. Instructions

We only process the data on your instructions. Your instructions are this agreement and the settings you make in the dashboard or through the API. You send further instructions by email. If we think an instruction is unlawful, we tell you right away. If a law requires other processing, we tell you beforehand, as far as the law allows.

4. Confidentiality

Everyone at our end with access to the data is bound to confidentiality. At present that is only the operator.

5. Security

We take the measures under Art. 32 GDPR listed in annex 1. We may replace them with equivalent or better ones.

6. Sub-processors

You allow us to use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland for servers and the data centre. We send emails through our own mail server on that server, with no further provider. Data does not leave the EU. We announce a new sub-processor by email at least four weeks in advance. You can object for a good data protection reason; if we cannot agree, you can terminate without notice. We bind every sub-processor to the same duties this agreement places on us.

7. Assistance

We help you answer requests from data subjects (Art. 12 to 22 GDPR). You can view, export and delete submissions yourself in the dashboard. If a request reaches us directly, we forward it to you. For security, breach notifications and impact assessments (Art. 32 to 36 GDPR) we support you with the information we have.

8. Personal data breaches

If we notice a personal data breach affecting your submissions, we report it to you without undue delay, within 48 hours at the latest, by email to your account address. The report contains what we know at that point, and we add to it as we learn more.

9. Deletion at the end

When you delete your account, you can restore it for 30 days. After that we delete all submissions and account data. Before that you can export your data in the dashboard. We only keep copies where a law requires it.

10. Evidence and audits

We give you the information you need to check compliance with this agreement. On-site audits are possible by arrangement and with reasonable notice; for Hetzner's data centres you rely on the evidence Hetzner provides.

11. Liability and precedence

Liability follows Art. 82 GDPR and otherwise the terms. If this agreement and the terms conflict on data protection, this agreement prevails.

Annex 1: Technical and organisational measures