Black Week30% off your first year on Go and Pro+ monthly dealEnds in 22d 07h 28mSee deals
Sign inGet started

Data Processing Agreement

Last updated 9 October 2026

This Data Processing Agreement ("DPA") is between Ordnary ("Ordnary", "we", "us"), a company registered in the Netherlands (KVK 95732888, D-U-N-S 965740890), and the customer that uses Amelu ("you"). It forms part of the Terms of Service and applies automatically to every Amelu account, on every plan. It sets out how we process personal data on your behalf, as required by Article 28 of the GDPR.

Roles

For the mail and mailbox data you store or send through Amelu, you are the controller and Ordnary is the processor. For your own account and billing details, Ordnary is the controller, and our Privacy Policy applies instead of this DPA.

What we process

  • Subject matter: hosting, sending, receiving, filtering and storing email for the domains you add to Amelu.
  • Duration: for as long as your account is active, plus the deletion period described below.
  • Data subjects: the people who use mailboxes on your domains, and anyone who sends mail to or receives mail from them.
  • Categories of data: email addresses, names, message content and attachments, message headers and metadata, contacts, calendars, forwarding and filter rules, and connection logs such as IP addresses.
  • Special categories: we don't ask for them, but mail you send or receive may contain them. You decide what goes through your mailboxes.

Our obligations

  • We process personal data only on your documented instructions. Your use of Amelu, its settings and these terms are those instructions. If we believe an instruction breaks the GDPR, we tell you.
  • We don't read your mail, scan it for advertising, sell it, or use it for any purpose of our own. Automated spam and abuse filtering is part of the service you instruct us to provide.
  • Everyone at Ordnary with access to personal data is bound by confidentiality.
  • We help you respond to requests from data subjects, and with data protection impact assessments and prior consultations, as far as our role allows.
  • If we are legally required to disclose personal data to an authority, we tell you first unless the law forbids it.

Security

We take appropriate technical and organisational measures under Article 32 of the GDPR, including:

  • Encryption in transit: TLS for IMAP, SMTP submission, the dashboard and the API, and opportunistic TLS for server to server mail.
  • Access control: administrative access to production systems is limited to a small number of named staff and uses key-based authentication.
  • Account protection: hashed passwords, optional sign-in through an Ordnary account, and session cookies scoped to the dashboard.
  • Separation: account and billing data is kept in a separate database from mail data.
  • Logging and monitoring of administrative actions and sign-ins.

Sub-processors

You give general authorisation for us to use the sub-processors below. Each is bound by a data protection agreement with obligations at least as strict as this DPA.

  • OVH GmbH, Germany: servers that run the Amelu mail platform and store mail.
  • Cloudflare, Inc., EU edge and EU-jurisdiction storage: DNS, the dashboard and API edge, the application runtime, and exports and backups.
  • Neon, Inc., EU region: the database for domain, mailbox and alias configuration.
  • Resend, Inc.: transactional account emails such as verification codes and password resets.

We announce new or replacement sub-processors on this page at least 30 days before they start processing your data. If you object on reasonable data protection grounds, tell us through the Ordnary contact page. If we can't resolve it, you may close your account before the change takes effect.

International transfers

Mail is stored in the EU. Where a sub-processor may access personal data from outside the EEA, the transfer is covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.

Personal data breaches

If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any case within 48 hours. We tell you what happened, what data and how many people are likely affected, the likely consequences, and what we are doing about it, and we keep you updated as we learn more.

Deletion and return of data

You can export your mail at any time over IMAP, or with the export tools in the dashboard. When you close your account, we delete your mail and mailbox data within 30 days, unless EU or Dutch law requires us to keep it. Backups containing that data expire on their normal schedule.

Audits

We make available the information you need to show that this DPA is being met. If that isn't enough, you or an independent auditor bound by confidentiality may audit us, at your own cost, once per year, with at least 30 days' notice, during business hours and without disrupting the service for other customers.

Liability and precedence

Liability under this DPA follows the limits in the Terms of Service, unless the GDPR says otherwise. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA takes precedence. This DPA is governed by Dutch law.

Signed copy

This DPA applies without a signature. If your organisation needs a countersigned copy for its records, ask through the Ordnary contact page.