Data Processing Addendum
GDPR Article 28 processing terms for organizations using Postbag to process their form submitters' personal data.
Last updated: · Markdown
This Data Processing Addendum ("DPA") forms part of the agreement between Md Afiur Rahman, trading as Postbag ("we", the Processor) and the organization using Postbag (the Controller) for the personal data of that organization's form submitters. It's accepted by using the service once your account processes such data — no signature is required, but a signed copy is available on request; email [email protected].
Subject matter and duration
We process personal data on your behalf for as long as your Postbag account is active, and for the retention period after that described in our Privacy Policy.
Nature and purpose of processing
Receiving, storing and delivering the submissions your forms collect, according to the routes and destinations you configure.
Categories of data subjects
Visitors to your website(s) who submit a form connected to Postbag.
Categories of data
Whatever fields your form collects, plus IP address, user agent, country and timestamp. We don't expect or require special categories of data (health, biometric and similar); please don't route them through Postbag.
Our instructions
We process data only as instructed by you, through the forms, streams, destinations and routes you configure — never for our own purposes.
Confidentiality
Access to production data is limited to the operator, Md Afiur Rahman, who is bound by confidentiality as a condition of operating the service.
Security measures
TLS in transit; HMAC-SHA256-signed webhook deliveries; API keys stored as hashes, never in plaintext; every tenant row scoped by organization at the application level, with a database-level second fence (Postgres row-level security) being rolled out; daily backups retained for 14 days.
Sub-processors
Listed with purpose, data and location on our sub-processors page. We give at least 14 days' notice before adding a new sub-processor, so you can object.
Assistance
We help you respond to data subject requests and to any regulator inquiry, to the extent Postbag's design allows.
Deletion and return
Submission data is deleted per your plan's retention period or on your request; you can delete a submission or a form's data at any time, and export it via the API before you do. On account closure, remaining data is retained for 30 days and then deleted.
Audit
We provide this DPA and our security documentation in place of on-site audits; if you need more, contact us.
International transfers
Data is hosted in Germany (Hetzner Online, Nuremberg — European Union). The operator administers it from outside the EEA; that access is over TLS and limited to the operator.