pursuant to Art. 28 DSGVO (GDPR) between the customer (hereinafter the "controller") and MessingerDesign, Philipp & Werner Messinger GbR, Dahmestraße 10, 12526 Berlin, Germany (hereinafter the "processor"), for the use of the service SpamProtec. This DPA forms an integral part of the main agreement concluded between the parties.
The subject matter is the processing of personal data by the processor for the purpose of the automated detection of spam, phishing and malicious email in the email mailboxes connected by the controller. The duration corresponds to the term of the main agreement; this DPA terminates automatically upon its termination.
Nature and purpose: Retrieval of incoming emails via IMAP, automated classification and
moving of messages identified as spam into the spam folder; provision of quarantine, statistics
and reports.
Categories of data: Email metadata (sender, recipient, subject, headers, timestamps),
email content including the personal data contained therein, as well as technical
connection data.
Categories of data subjects: Communication partners of the controller as well as its
employees whose mailboxes are connected.
Filter self-improvement: To improve detection, pre-anonymized content is converted into a
numerical vector representation on the processor's own infrastructure; only the vectors together with the
screening result are stored — no raw text.
(1) The processor processes personal data exclusively on the documented
instruction of the controller, unless it is legally obliged to carry out the processing.
(2) The configuration of the service by the controller (e.g. connected mailboxes,
retention period, local option) constitutes a documented instruction.
(3) The processor shall inform the controller if it is of the opinion that an instruction
infringes data protection law.
(4) If the processor is legally obliged to transfer data to a third country, it shall inform the
controller of this legal requirement prior to the processing, unless the law in question prohibits this
on important grounds of public interest (Art. 28(3)(a) DSGVO (GDPR)).
(1) The controller generally authorizes the use of the following sub-processors:
| Service provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Hosting / infrastructure | Germany |
| Anthropic PBC | AI classification (pre-anonymized) — only in the "Highest detection" mode | USA (DPF / EU SCC) |
| OpenAI | AI classification (pre-anonymized) — only in the "Highest detection" mode | USA (DPF / EU SCC) |
(1a) "Strictly local" mode: If the controller selects the "Strictly local" mode for a mailbox or group-wide, the aforementioned AI sub-processors (Anthropic, OpenAI) are not used; no transfer of content data to external AI providers or to third countries then takes place — the processing remains on the German/European infrastructure of the processor. This mode is intended for professionals bound by secrecy (§ 203 StGB (German Criminal Code) — including lawyers, physicians, tax advisors). The persons involved on the processor's side are bound to secrecy (§ 203(4) StGB (German Criminal Code)). The controller remains responsible for assessing whether involving third parties is compatible with its professional-law obligations.
(2) The processor shall inform the controller in good time in text form of any intended
changes concerning the addition or replacement of sub-processors. The controller
may object to a change on important data-protection grounds within 14 days.
(3) The processor imposes on each sub-processor, by contract, the same data protection obligations
as those set out in this DPA (Art. 28(4) DSGVO (GDPR)), and remains responsible to the controller for
their compliance.
The processor supports the controller, within the scope of its possibilities, in the fulfillment of data subject rights (Art. 12–22 DSGVO (GDPR)), in ensuring the security of the processing (Art. 32) as well as with data protection impact assessments and prior consultations (Art. 35–36).
The processor shall notify the controller of breaches of the protection of personal data without undue delay after becoming aware of them and shall provide the information required to fulfill the notification obligations pursuant to Art. 33/34 DSGVO (GDPR).
After the conclusion of the processing, the processor shall, at the choice of the controller, delete all personal data or return it, unless there is a statutory retention obligation. IMAP access credentials are deleted upon termination of the connection.
The processor makes available to the controller the information required to demonstrate compliance with Art. 28 DSGVO (GDPR) and enables reviews — including inspections — by the controller or an appointed auditor within a reasonable, operationally acceptable scope and following prior notice.
In the event of conflicts between this DPA and the main agreement, the provisions of this DPA shall prevail with regard to the data processing. German law applies. Acceptance takes place upon conclusion of the main agreement for SpamProtec.
As of: June 2026 · SpamProtec · MessingerDesign GbR