Data Processing Agreement
This is an English translation provided for convenience. In case of any discrepancy, the Croatian version prevails.
This agreement is concluded in accordance with Article 28 of the General Data Protection Regulation (GDPR) and forms an integral part of the Terms of Service. It is concluded electronically, by acceptance at sign-up.
1. Parties
- Controller: the customer of the Inboqo service (the company that signed up).
- Processor: Val, 28040082939.
2. Subject matter, duration, nature and purpose of processing
| Subject matter | Providing the Inboqo service: reading the controller's business inbox, recognizing and categorizing inquiries, notifying team members, reply drafts, statistics. |
|---|---|
| Duration | For the duration of the subscription, plus 30 days after it ends for export or return, after which the data is deleted. |
| Nature of processing | Retrieval, storage, structuring, automated analysis (AI), display, forwarding, deletion. |
| Types of data | Name, email address, phone, company name, content of emails and attachments that customers send to the controller, data about the controller's team members (name, email). |
| Categories of data subjects | The controller's customers and prospective customers, the controller's team members. |
| Special categories of data | Not intended. If customers send them in an email on their own, the controller is responsible for the lawfulness of their processing. |
3. Processor's obligations
- Processes data only on the documented instructions of the controller; the instructions are the settings the controller chooses in the application and this agreement. If it considers an instruction to infringe the law, it informs the controller immediately.
- Ensures that persons authorized to process the data are bound by confidentiality.
- Implements the technical and organizational measures in Annex 1.
- Engages the sub-processors in Annex 2. It informs the controller by email at least 30 days in advance of any intended addition or replacement of sub-processors; the controller may object and, if no agreement is reached, cancel the subscription without charge. It has agreements with sub-processors imposing the same data protection obligations.
- Assists the controller in responding to data subject requests (e.g. finding and deleting a specific person's data) and with impact assessments and consultation with the supervisory authority, to a reasonable extent.
- Notifies the controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information known at that time.
- After the end of the service, at the controller's choice, returns the data (export) and/or deletes it, including copies no later than when the backup retention period expires (maximum 12 months), unless the law requires retention.
- Makes available to the controller the information necessary to demonstrate compliance with this article and allows audits to a reasonable extent, with at least 30 days' notice and as a rule in writing (questionnaire).
4. Controller's obligations
The controller warrants that it has a legal basis for processing the data of its customers and team members and that it has informed the data subjects about the processing, including the use of the Inboqo service and AI processing.
5. Transfers outside the EU
AI processing of email content takes place at the sub-processor Anthropic in the USA. The transfer is based on the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework. Data sent via the API is not used to train models. The controller may also use its own agreement with Anthropic in the application (its own API key).
Annex 1 — Technical and organizational measures
- Each controller has a separate application (separate container) and a separate database; there is no data sharing between customers.
- All traffic is encrypted with HTTPS/TLS; email credentials, sign-in tokens and API keys are stored encrypted; passwords as scrypt hashes.
- Access to the application only with a user account; administrator/member roles; login attempt limits; sign-out on all devices when the password changes.
- Server in the EU (Frankfurt); only the provider has server access, via SSH key.
- Nightly backups, encrypted before leaving the server (EU), with regular restore checks.
- Automated monitoring of applications, disk and backups, with alerts to the provider.
- Only the content needed to process a specific email is sent to the AI sub-processor.
Annex 2 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Infrastructure (server, storage) | EU (Germany) |
| Anthropic, PBC | AI analysis of email content and reply drafts | USA |
| Cloudflare, Inc. | Storage of encrypted backups (EU), DNS | EU |
| Resend (Plus Five Five, Inc.) | Sending system notifications to the controller's team (without inquiry content beyond the summary and draft) | EU (Ireland) |