Data Processing Agreement
This Data Processing Agreement (“DPA”) is part of the Terms of Service between the Customer (the controller) and ITOPI AB, organization number 559075-1052, Tellusvägen 3 f, 191 47 Sollentuna, Sweden (the processor). It applies to personal data that ITOPI AB processes on the Customer’s behalf when providing Alltended. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR where applicable.
1. Subject matter, duration, nature and purpose
ITOPI AB receives, stores, organizes, displays, transmits, exports and deletes the Customer’s correspondence and related records to provide Alltended under the Terms. Processing lasts for the term of the service and until the data is deleted under section 10.
2. Categories of data subjects and personal data
Data subjects: the Customer’s members (staff and contractors), people who correspond with the Customer, and people mentioned in correspondence, attachments, notes or contact records.
Personal data: names, email addresses and other contact details; email content, headers and attachments; contact and company records; internal notes; reply drafts; conversation assignments, statuses and activity history; delivery status of outgoing email; and connection records for integrations the Customer authorizes.
The Customer must not intentionally use Alltended to process special categories of personal data or data about criminal convictions as a records system (see section 8 of the Terms). Such data may appear incidentally in correspondence, and ITOPI AB protects it in the same way as other Customer Data.
3. Instructions
ITOPI AB processes personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration and use of the product, including its retention settings, exports, deletions and integration grants, are the Customer’s instructions. ITOPI AB informs the Customer if it believes an instruction breaches data protection law, and does not process personal data for its own purposes. Where law requires other processing, ITOPI AB informs the Customer first unless the law prohibits it.
4. Confidentiality
Only people who need access to provide, secure or support the service may access Customer Data, and they are bound by confidentiality. Routine operational tools show metadata, not message content. Access to message content for support happens only at the Customer’s request or where needed to investigate a security incident or abuse, and is recorded in an operator audit log.
5. Security
ITOPI AB implements the technical and organizational measures in Annex 1 and keeps them appropriate to the risk. It may update the measures if the overall level of protection is not reduced.
6. Subprocessors
The Customer gives general authorization for ITOPI AB to engage subprocessors. The current list is published at alltended.com/legal/subprocessors. ITOPI AB:
- imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance;
- notifies administrators by email at least 30 days before adding or replacing a subprocessor and updates the published list; and
- allows the Customer to object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service before the change takes effect and receive a refund of prepaid fees for the remaining period.
Integrations and AI assistants that the Customer chooses to connect are not ITOPI AB’s subprocessors. The Customer selects that provider and its arrangement; ITOPI AB is responsible only for disclosing data within the permissions the Customer grants.
7. International transfers
ITOPI AB processes Customer Data in the European Economic Area. Where a subprocessor or its group may access personal data from outside the EEA, ITOPI AB relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission’s standard contractual clauses, with supplementary measures where required. The subprocessor list states the safeguard used.
8. Assistance with data subject requests
The Customer is responsible for responding to requests from data subjects. Alltended provides administrators with tools to find, export and erase a person’s data across conversations, contacts and notes (Settings → Privacy). ITOPI AB forwards to the Customer any request it receives directly about Customer Data, without responding to it except to redirect the requester, and provides further reasonable assistance on request.
9. Personal data breaches
ITOPI AB notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. ITOPI AB provides further information as it becomes available and assists the Customer with its notifications to supervisory authorities and data subjects.
ITOPI AB also assists the Customer, taking into account the information available to it, with data protection impact assessments and prior consultations relating to Alltended.
10. Return and deletion
During the service, administrators can export the organization’s data in portable formats (JSON, CSV and original attachment files) at any time. When email processing ends, the organization is read-only for 30 days for export. ITOPI AB then deletes Customer Data from the live service, unless law requires retention. An administrator can request earlier deletion by closing the organization. Backup copies are overwritten or expire within 90 days of deletion. If a backup is restored, ITOPI AB reapplies recorded deletions before the service is made available again.
The Customer’s archive-retention setting deletes archived conversations and contacts after the chosen period during the service. It does not apply to active conversations.
11. Audits and information
ITOPI AB makes available the information needed to demonstrate compliance with Article 28, including this DPA, its security measures and its subprocessor list, and answers reasonable written questions. The Customer, or an independent auditor bound by confidentiality, may audit compliance once a year with 30 days’ notice, or after a personal data breach, during business hours and without access to other customers’ data. Each party bears its own audit costs.
12. Liability and precedence
The liability provisions of the Terms apply to this DPA, except where data protection law does not allow liability to be limited. If this DPA conflicts with the Terms on data protection matters, this DPA prevails.
Annex 1 — Technical and organizational measures
Hosting and isolation. The service runs on dedicated servers in the EU operated by our hosting subprocessor. Every request is scoped to one organization and checked against current membership and mailbox permissions. Integration keys and MCP connections are limited to the mailboxes and actions an administrator grants and are rechecked on every call.
Encryption. All traffic to the app and API uses TLS with HTTP Strict Transport Security. Email between our email provider and other mail servers uses TLS when the other server supports it. Passwords are hashed. API keys and OAuth tokens are stored as hashes. Backups stay within the hosting provider’s EU infrastructure; any copy stored elsewhere is encrypted first.
Access control. Production access is limited to named ITOPI AB personnel using SSH keys and multi-factor authentication on provider accounts. Services run as separate unprivileged users; only the email service holds email-provider credentials. Operator actions on customer organizations require a reason and are recorded.
Application security. Session cookies are HTTP-only, secure and same-site. Cross-site request forgery protection, a restrictive Content Security Policy, rate limits on authentication, sign-up, invitations, API and MCP operations, sanitization of received HTML, and attachment type checks are applied. Attachments are downloaded only by authorized members and are never executed.
Email safety. Incoming email is scanned for spam and viruses by our email provider. Messages with a virus verdict are refused; messages with a spam verdict are held for review. Automatic acknowledgements are suppressed for automated, bulk and failed-verification mail to prevent loops. Bounced and complained recipients are suppressed.
Availability and recovery. Daily backups of databases and attachments are integrity-checked and kept for 14 days on the server, with machine-level backups at the hosting provider. Restores are rehearsed. Health, queue age, failed deliveries, disk usage and backup age are monitored with alerts to the operator.
Data minimization and retention. Account email payloads containing links are erased once delivered or expired. Logs exclude message content, credentials and tokens, and are kept for 30 days. Retention periods for each store are published in the Privacy Policy.
Incident response. A documented incident and breach procedure covers detection, containment, credential rotation, assessment, customer notification and lessons learned, and is rehearsed.