Version 1.0, effective 13 October 2026.
Data processing agreement
This agreement applies when you use Freehold Mail for a business or organisation and the mail, contacts and calendars you store contain personal data of other people. For that data, you are the controller and we are your processor under article 28 of the General Data Protection Regulation (GDPR). It is part of our terms of service and applies automatically; you don't need to sign anything.
Processor: Thomas van Otterloo, trading as Freehold Mail, Libanonstraat 12, Delft, the Netherlands, privacy@freeholdmail.com.
Controller: the account holder ("you").
1. What we process
| Subject matter and purpose | Providing the email service: receiving, storing, filtering, forwarding, relaying and sending mail, storing contacts, calendars and filter rules, and producing exports |
| Duration | As long as your account exists, plus the deletion periods in section 8 |
| Types of personal data | Whatever you store or exchange: email addresses, names, message content and attachments, contact details, calendar entries, and delivery metadata (senders, recipients, times, server addresses) |
| Data subjects | You, your staff, and the people you correspond with or keep in your contacts and calendars |
| Special categories | Only if you store them; we can't see or select what your mail contains |
2. Your instructions
We process your data only to provide the service as described in the terms, the privacy policy and this agreement, and as you set it up in your account (for example: where mail is forwarded or relayed to). That together is your documented instruction. If we think an instruction breaks the GDPR, we'll tell you. If the law requires us to process data in another way, we'll tell you first unless the law forbids that.
3. Confidentiality
Everyone who has access to your data on our side is bound to confidentiality. We do not read your mail. We only access a mailbox when you ask for support that requires it or to investigate a serious security or abuse incident, and we record the reason in our audit log before doing so.
4. Security (article 32)
We take the following measures, and we keep them up to date:
- mailboxes stored on an encrypted disk (LUKS, AES-XTS); export archives encrypted (AES-256-GCM) and deleted after 7 days;
- encrypted connections for all access, between our own servers, and to other mail servers wherever they support it (TLS);
- servers in a data centre in Germany, separated from other systems on a private network, with firewalls that only open what's needed;
- passwords and sign-in tokens stored only as hashes; administrative access only with personal SSH keys;
- an append-only audit log of account and administrative changes;
- automatic security updates;
- daily backups (7 daily and 4 weekly copies);
- spam, malware and abuse filtering to protect your account and our servers.
5. Sub-processors
You give us general permission to use sub-processors. Our current sub-processors are listed in the privacy policy. We will tell you by email at least 30 days before adding or replacing one. You can object; if we can't solve your objection, you can leave and end this agreement before the change. We bind every sub-processor to the same data protection obligations as in this agreement, and we remain responsible for them.
6. Transfers outside the EU
Our servers and your stored mail are in Germany. Where a sub-processor is outside the European Economic Area, we only use it with a valid transfer basis (an adequacy decision such as the EU-US Data Privacy Framework, or Standard Contractual Clauses). Mail you send or forward goes wherever you send it; that is your choice, not a transfer by us.
7. Helping you
We help you, within reason, to:
- answer requests from data subjects (access, correction, deletion, portability). Most of this you can do yourself with the export and your account settings;
- carry out a data protection impact assessment or consult a supervisory authority, by giving you the information we have.
If a data subject contacts us directly about data you control, we forward the request to you.
8. Personal data breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours, with what we know: what happened, which data and people are probably affected, the likely consequences, and what we are doing about it. We update you as we learn more.
9. End of the agreement
When you leave, you get a complete export first. Your data is deleted from our live servers 30 days after your account is closed, and from backups within a further 5 weeks. We don't keep copies unless the law requires it; then we keep only what's required and protect it in the same way.
10. Audits
We make available the information you need to show that this agreement is followed, by answering your questions in writing. If that isn't enough, you may have an audit done by an independent auditor bound to confidentiality, at your cost, with at least 30 days' notice, no more than once a year, and without access to other customers' data.
11. Liability and precedence
The liability rules of the terms of service apply, as far as the GDPR allows. If this agreement and the terms conflict about personal data, this agreement wins. Dutch law applies.
Version 1.0, effective 13 October 2026.