Data processing agreement

This is an English translation for your convenience. The German version is legally binding.

This data processing agreement ("DPA") applies when a business customer uses Routira to have personal data processed on its behalf, in particular the mail of its team in a team workspace. It supplements our terms of service.

1. Parties and conclusion#

1.1 The parties are the company, organization or public body that uses Routira ("Customer"), as controller, and Michael Ketzer, Rotkehlchenweg 51, 40789 Monheim am Rhein, Germany ("Routira"), as processor.

1.2 This DPA forms part of the contract under the terms of service. It's concluded when the Customer accepts the terms of service for use on behalf of a business or organisation (sections 3.2 and 4 of the terms), and at the latest when it uses a team workspace. It's concluded electronically (Art. 28 (9) GDPR). On request, Routira sends the Customer a copy in text form.

1.3 This DPA doesn't cover data for which Routira is itself the controller, in particular the user accounts of the Customer's people, sign-in and security data, and Routira's communication with the Customer. The privacy policy applies to that data.

2. Subject matter and duration#

2.1 The subject matter is the provision of Routira: syncing, storing, displaying, searching, sorting, sharing and sending mail from the mailboxes the Customer connects or that Routira receives for the Customer; the AI features; and the related functions for collaboration, notifications and the apps.

2.2 The processing lasts as long as the contract under the terms of service, and afterwards until the data has been deleted under section 13.

3. Nature and purpose of the processing#

3.1 Nature of the processing: collecting mail through the connection to the Customer's mail provider (IMAP and SMTP) and through Routira's receiving addresses; storing; organizing and structuring; adapting (for example preparing messages for display); reading; analyzing with AI models (classifying, prioritizing, summarizing, extracting agreements and deadlines, answering questions, building a search index); using; disclosing to the Customer's authorized users; transmitting (sending mail on a user's instruction, notifications); restricting; and erasing.

3.2 Purpose: providing Routira to the Customer in accordance with the terms of service.

4. Types of personal data#

• Contact and identification data contained in mail, such as names, email addresses, phone numbers and signatures;
• content and metadata of mail, such as subject, message text, attachments, date, headers, folders and flags;
• content the Customer's users create in Routira, such as notes, mentions, assignments, projects, labels and drafts;
• data derived from mail, such as categories, priorities with their reasons, deadlines, summaries, extracted agreements with their quotes, and the search index, including embeddings;
• access data for mailboxes (server addresses, usernames, passwords), stored encrypted;
• data about the use of the workspace by the Customer's users, such as access rights, activity and audit log entries;
• any other data contained in mail. This can include special categories of personal data (Art. 9 GDPR) if senders include them in their messages.

5. Categories of data subjects#

• The Customer's employees and other people who use Routira for the Customer;
• people who exchange mail with the Customer, such as customers, prospects, suppliers, partners and applicants;
• people mentioned in mail or attachments.

6. The Customer's instructions#

6.1 Routira processes personal data only on the Customer's documented instructions, including with regard to transfers to third countries, unless EU or member state law requires otherwise. In that case, Routira informs the Customer of that legal requirement before processing, unless that law prohibits such information (Art. 28 (3) (a) GDPR).

6.2 The Customer gives its instructions through the terms of service, this DPA, and its use and configuration of Routira, for example by connecting or disconnecting mailboxes, granting rights, switching the AI features on or off, and deleting content. The Customer can give further instructions in text form to privacy@routira.com.

6.3 If Routira believes that an instruction infringes data protection law, it informs the Customer without delay. Routira may suspend carrying out the instruction until the Customer confirms or changes it.

6.4 The Customer is responsible for the lawfulness of the processing, in particular for having a legal basis, for informing data subjects (for example its employees) and, where required, for involving employee representatives.

7. Confidentiality#

7.1 Routira ensures that everyone authorized to process the personal data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR). At present, only Michael Ketzer has access to Routira's production systems.

7.2 Routira accesses the content of the Customer's mail only where necessary to provide the service, at the request of the Customer or one of its users in a support case, to fix a security problem, or to comply with a legal obligation.

8. Security of processing#

8.1 Routira takes the technical and organizational measures described in Annex 1 (Art. 32 GDPR).

8.2 Routira may adapt the measures to technical progress, provided that the level of protection isn't reduced. The current description is on the security page.

9. Subprocessors#

9.1 The Customer gives Routira general authorization to engage subprocessors. The subprocessors engaged when this DPA is concluded are listed in Annex 2 and on the subprocessor page; they're approved.

9.2 Routira informs the Customer at least 30 days before engaging a new subprocessor or replacing one, by email to the owner of the Customer's workspace and on the subprocessor page. The Customer may object in text form within 30 days of the notice, on important data protection grounds. If the parties can't find a solution, the Customer may terminate the affected contract before the change takes effect.

9.3 If a subprocessor has to be replaced at short notice to maintain security or availability, or if a subprocessor makes changes at shorter notice, Routira informs the Customer without undue delay. Section 9.2 applies accordingly to the right to object.

9.4 Routira imposes the same data protection obligations as in this DPA on every subprocessor in Annex 2 by contract (Art. 28 (4) GDPR) and remains liable to the Customer for its subprocessors.

9.5 The Customer's own mail providers, which Routira accesses on the Customer's instruction, providers that merely transmit data (telecommunications), and Apple, which provides notifications to Apple devices (APNs) and the test builds of the apps (TestFlight) under its own terms as an independent controller, aren't subprocessors.

10. Transfers to third countries#

10.1 Routira stores the Customer’s data in the EU. Letterpier sends and receives email using infrastructure in Germany and a Neon database in Frankfurt. OpenAI may keep AI requests in the USA for up to 30 days to detect abuse. Some subprocessors are based in the USA or process data there (Annex 2), in particular OpenAI for AI features.

10.2 Transfers take place only in accordance with Art. 44 et seq. GDPR: on the basis of the EU Standard Contractual Clauses in the subprocessors' data processing agreements and, where the subprocessor is certified, additionally on the basis of the EU-U.S. Data Privacy Framework. Apple isn't a subprocessor (section 9.5) and, according to its privacy policy, bases transfers from the EU on the EU Standard Contractual Clauses; by default, notifications to Apple devices contain no sender or subject, and the Customer can ask its users to keep previews switched off. The Customer instructs Routira to make these transfers.

11. Data subject requests#

11.1 Taking into account the nature of the processing, Routira assists the Customer with appropriate technical and organizational measures in responding to requests from data subjects exercising their rights (Art. 12 to 23 GDPR). Many requests can be handled directly in Routira, for example by finding, deleting or disconnecting data.

11.2 If a data subject contacts Routira directly about data processed for the Customer, Routira forwards the request to the Customer without undue delay and doesn't answer it itself unless the Customer instructs it to.

12. Further assistance and personal data breaches#

12.1 Taking into account the nature of the processing and the information available to it, Routira assists the Customer in meeting its obligations under Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments, prior consultation).

12.2 Routira notifies the Customer of any personal data breach affecting the Customer's data without undue delay, at the latest within 48 hours of becoming aware of it, by email to the owner of the Customer's workspace. The notification contains the information under Art. 33 (3) GDPR as far as available; further information follows as soon as it's known.

13. Deletion and return#

13.1 During the contract, the Customer can delete data in Routira itself at any time, for example by disconnecting or deleting mailboxes or deleting conversations and notes.

13.2 After the contract ends, Routira deletes all personal data processed for the Customer, unless EU or member state law requires it to be stored. At the Customer's request before the end of the contract, Routira returns the data in a common format (Art. 28 (3) (g) GDPR). The mail itself remains with the Customer's mail provider.

13.3 Routira deletes the data from its live systems within 30 days after the contract ends; backups age out within a further 30 days. Routira confirms the deletion in text form on request.

14. Information and audits#

14.1 Routira makes available to the Customer all information necessary to demonstrate compliance with the obligations in Art. 28 GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates (Art. 28 (3) (h) GDPR).

14.2 The Customer announces audits at least 30 days in advance. Audits take place during normal business hours, at most once a year unless there's a specific reason (for example a personal data breach), without disrupting operations, without access to other customers' data, and under an obligation of confidentiality. Auditors may not be competitors of Routira. Where this is sufficient, Routira may instead provide current documentation, such as the description of its measures. Each party bears its own costs.

14.3 The rights of supervisory authorities remain unaffected.

15. Liability#

The parties are liable to data subjects in accordance with Art. 82 GDPR. Otherwise, the liability provisions of the terms of service apply, unless mandatory law provides otherwise.

16. Term and final provisions#

16.1 This DPA applies as long as Routira processes personal data for the Customer.

16.2 In the event of contradictions, this DPA takes precedence over the terms of service in matters of data protection.

16.3 Changes and additions require text form. Changes to this DPA follow the procedure for changes to the terms of service.

16.4 The law of the Federal Republic of Germany applies. The German version of this DPA is binding; the English version is a translation.

Annex 1: Technical and organizational measures#

Encryption

• All connections to Routira and between Routira and its providers use TLS; the web app sends HSTS.
• The database and the object storage are encrypted at rest by the providers.
• Routira itself encrypts original messages and attachments before storing them (AES-256-GCM, a key per workspace), as well as mailbox credentials (a key per mailbox). These keys are in turn encrypted with a master key that is kept as a protected secret in the hosting environment. Disconnecting a mailbox destroys the key of its credentials.

Confidentiality: access control

• Users sign in with one-time codes sent by email (six digits, valid for 10 minutes, five attempts, stored only as a hash). A session ends after 30 days without use, or on sign-out.
• Every request is checked against the user's workspace and rights. Shared mailboxes have the rights Viewer, Member and Manager.
• Only Michael Ketzer has administrative access to production systems, protected by strong authentication. The servers are located in the data centers of the providers named in Annex 2, which ensure physical access control.

Integrity

• Security-relevant events and actions in a workspace are logged.
• Changes to Routira go through automated tests before they're deployed.

Availability and resilience

• Routira runs on managed platforms with redundancy. The database provider keeps a restore history; backups age out within 30 days.
• Mail remains with the Customer's mail provider, so Routira can sync it again if necessary.

Data minimization and separation

• Realtime signals contain only technical IDs. Notifications to Apple devices contain no sender or subject unless a user turns on previews.
• AI requests contain only the text needed for the task; storage at the AI provider is switched off, and the data isn't used for training.
• Files and credentials of different workspaces are encrypted with separate keys; database content is kept apart logically.

Deletion

• Disconnecting a mailbox deletes its credentials immediately and its synced copies within 24 hours; deleted data ages out of backups within 30 days.

Review

• Routira reviews its measures regularly and adapts them to technical progress. An independent penetration test is planned before the public launch.

Annex 2: Subprocessors#

As of 26 September 2026. Details (data, locations, transfer safeguards) are on the subprocessor page.