Data processing agreement

1. Parties, scope and priority

This agreement is between you, the customer ("Customer"), and AMMO Solutions, a sole proprietorship (eenmanszaak), Kloosterdijk 6, 1141 PJ Monnickendam, Netherlands, KvK 68679750, VAT NL001694241B13 ("AMMO"). AMMO's privacy contact is privacy@ammo.solutions; security incidents may also be reported to security@ammo.solutions.

This agreement governs personal data in email and webhook captures and related customer content that AMMO processes on the Customer's behalf through ammo.tools ("Customer Personal Data"). The Customer acts as controller, or as a processor authorised by its controller to appoint AMMO as a further processor. AMMO acts as processor or further processor.

AMMO separately determines the purposes of processing account administration, authentication, billing, security and business records where it acts as controller. Those activities are described in the privacy statement.

This agreement forms part of the Terms & conditions and is accepted together with them. It takes priority on Customer Personal Data matters. Any applicable international-transfer clauses take priority where required.

2. Instructions and responsibilities

AMMO will process Customer Personal Data only on documented instructions from the Customer, including instructions concerning transfers. These include the agreed service configuration and actions by users the Customer authorises, such as ingestion, inspection, export, deletion, sharing and webhook replay. AMMO will not sell Customer Personal Data, use it for advertising or train machine learning models on it.

The Customer determines the lawful purposes and basis of processing, provides required notices, and ensures it has authority to submit the data and issue instructions. It controls its authorised users, configured destinations and share links. It should use synthetic or minimised test data wherever possible.

AMMO will inform the Customer immediately if it believes an instruction infringes applicable data protection law and may suspend that instruction while the parties resolve it. If law requires processing outside the Customer's instructions, AMMO will inform the Customer before processing unless that law prohibits notice on important grounds of public interest.

Captured email is not delivered to its addressed recipients. Customer-directed webhook forwarding or replay and disclosure through share links are separate instructions that can disclose data to selected recipients.

3. Confidentiality and security

AMMO will restrict access to persons who need it to provide, support or secure the service or meet a legal obligation. Persons authorised to process Customer Personal Data must be bound by confidentiality obligations or an appropriate statutory duty.

AMMO will implement and maintain technical and organisational measures appropriate to the risk under Article 32 GDPR. Current measures include TLS in transit, access controls, encrypted SMTP credentials at rest, signed short-lived download links for attachments, sandboxed HTML preview for mail, and no outbound relay of captured mail. AMMO may improve measures without materially reducing the agreed protection.

The parties will cooperate on security concerns. The Customer must protect its credentials and select appropriate access permissions and test destinations.

4. Subprocessors

The Customer gives general written authorisation for the subprocessors identified in the register below.

AMMO will notify the Customer by email at least 30 days before adding or replacing a subprocessor, with enough information to assess the change. The Customer may object within that period on reasonable data protection grounds. The parties will seek a workable alternative. If they cannot resolve the objection, the Customer may terminate the affected service before the new subprocessor processes its data and receive a refund of unused prepaid fees for that service.

AMMO will impose contractual data protection obligations on each subprocessor that provide the protection required by this agreement. AMMO remains responsible to the Customer for the performance of its subprocessors' obligations.

Authorised subprocessors

Stripe processes payment data as an independent controller, not as a subprocessor of Customer Personal Data.

5. Locations and international transfers

Application servers, database, and capture object storage run in Germany (Hetzner) and EU-jurisdiction storage (Cloudflare R2). Cloudflare provides DNS only; HTTP traffic is not proxied through Cloudflare.

AMMO will not transfer Customer Personal Data outside the EEA without documented authorisation and a lawful transfer mechanism under Chapter V GDPR. Where needed, the parties will execute the applicable transfer clauses and apply supplementary measures before the transfer begins. AMMO will notify the Customer if a relied-on safeguard becomes ineffective and suspend affected transfers unless a lawful alternative is established.

6. Requests, assessments and regulator cooperation

Taking account of the nature of processing, AMMO will assist the Customer through appropriate measures with requests to access, rectify, erase, restrict, object to processing or port personal data. If AMMO receives a request concerning Customer Personal Data, it will promptly forward it to the Customer and will not respond substantively without instructions unless legally required.

Taking account of the processing and information available to it, AMMO will assist with security obligations, breach assessment and notification, data protection impact assessments and prior consultation with supervisory authorities.

7. Personal data breaches

AMMO will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will send an initial notice even if its investigation is incomplete, followed by updates as facts emerge.

So far as available, notices will describe the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, mitigation taken or proposed, and a contact for further information. AMMO will contain the incident, preserve relevant evidence, document it and assist the Customer's assessment and legally required notifications.

8. Demonstrating compliance and audits

AMMO will make available information necessary to demonstrate compliance with this agreement and Article 28 GDPR, and allow and contribute to audits, including inspections, by the Customer or an auditor it appoints.

The parties will normally begin with relevant documentation and agree proportionate scope, timing and confidentiality arrangements that protect other customers and service security. These arrangements must not make the audit right ineffective.

9. Return, deletion and end of service

During service, the Customer can instruct export and deletion using available controls or request assistance. Retention limits and capacity-based eviction can delete captures sooner, so the Customer should export data it needs before expiry, termination or workspace deletion.

At the Customer's choice, AMMO will return or delete Customer Personal Data after the processing service ends and delete remaining copies unless applicable law requires storage.

Retention and deletion schedule

Deletion of capture files uses queued work and retryable object cleanup. Backups awaiting their agreed expiry are protected and isolated from ordinary use. A restored backup has applicable deletion and restriction instructions reapplied before customer traffic resumes.

10. Liability, changes and law

The service agreement's liability provisions apply between the parties only to the extent permitted by law. They do not reduce data subjects' statutory rights, supervisory powers or either party's non-excludable obligations, including AMMO's responsibility for subprocessors under Article 28(4) GDPR.

Changes require documented agreement, except subprocessor changes handled under section 4 and security improvements allowed under section 3. The governing law and jurisdiction of the service agreement apply, subject to mandatory data protection law. If a provision is unenforceable, the remaining provisions continue so far as they can give effect to this agreement lawfully.

Home