Data processing agreement
This is a translation for your convenience. The Dutch version is binding.
Version: 1.0 | Version date: 8 October 2026
This data processing agreement (Art. 28 GDPR) is offered as a standard agreement with the Sendis service and forms part of the agreement between the parties upon acceptance. The version date is solely the calendar date on which this version was issued. This agreement binds the parties from acceptance and never has retroactive effect.
1. Parties and definitions
Processor: Neolyth, a sole proprietorship (eenmanszaak) of Mr Marwand Ayubi, provider of Sendis, KvK number 95055592, established at Graafseweg 274, 6532 ZV Nijmegen, VAT number NL005127223B03, email hello@neolyth.io, represented by Mr Marwand Ayubi, proprietor ("Processor"). The name "Sendis" refers solely to the service and is not a party. Controller: the customer organisation subscribing to the Sendis service ("Controller"). Main agreement: the Agreement between the parties concerning the Sendis service within the meaning of the Processor's General Terms and Conditions, of which this agreement forms part. Terms such as "personal data", "processing" and "personal data breach" have the meaning given in the GDPR.
2. Subject matter and duration
This agreement governs the processing of personal data by the Processor on behalf of the Controller in the context of the Sendis service, for the duration of the main agreement, and thereafter for as long as the Processor processes personal data of the Controller.
3. Nature and purpose of the processing
Facilitating secure message exchange: transport and encrypted storage of messages and attachments, virus scanning of attachments, management of recovery keys and execution of authorised recovery procedures, delivery via the secure portal with recipient verification, notification by email or SMS, an audit trail of actions on messages, and billing for the service.
4. Categories of data subjects and personal data
Data subjects: employees of the Controller; recipients of messages (including patients or clients of the Controller); contact persons.
Personal data: (a) message metadata (sender, recipient, subject, attachment file names and sizes, timestamps, delivery and read status, IP address and device data on access); (b) message content and attachments, stored exclusively as ciphertext. At the levels with in-browser encryption (access code, registered recipient) the Processor cannot decrypt the message text, except through a recovery key the Processor manages: the Processor has the technical ability to decrypt the message text through such a recovery key, and uses it solely in a recovery procedure authorised by the organisation to which that recovery key belongs (Annex C). For the Controller's messages that is the Controller, and for a registered recipient in another organisation also that organisation. A recovery key is created for every team organisation and is managed by the Processor; the organisation cannot currently choose a different recovery model. Attachments are processed unencrypted on upload, solely for virus scanning and encryption and only for the duration of that processing; the virus scanner may create a temporary file on the server for this purpose, which it deletes after the scan. Afterwards attachments are stored exclusively in encrypted form. For messages via the contact link, the sender may opt to receive a copy of their own message by email; that copy is sent unencrypted by the Processor's server, via the email sub-processor, to the email address that sender provided; (c) for delivery with a one-time verification code (email/SMS): the verification code and a per-message unlock secret, which the Processor stores encrypted under a key it controls and releases to the recipient's browser after successful verification. At this level the Processor holds material sufficient to decrypt the message content; successful verifications are recorded in the audit trail. This level is expressly not end-to-end; (d) recipient email address and, for SMS verification, phone number; (e) employee account data.
The data may include special categories (health data) to the extent the Controller sends them, including in subject lines and file names. At the levels with in-browser encryption the Processor does not access the message text, save in an authorised recovery procedure; subject lines, attachment file names and other metadata are accessible to the Processor, as are attachments during virus scanning.
5. Instructions
The Processor processes only on documented instructions from the Controller, as laid down in the main agreement, this agreement and the settings the Controller configures in the service (including expiry periods, security levels and user management), unless Union or Member State law requires processing; in that case the Processor informs the Controller beforehand, unless that law prohibits it. This also applies to transfers of personal data to a third country or an international organisation: the Processor processes personal data exclusively in the EEA and does not transfer personal data outside the EEA, unless the Controller instructs it to do so in writing and Chapter V GDPR is complied with, or Union or Member State law requires it to do so. The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR.
6. Confidentiality
Persons processing personal data under the Processor's authority are bound to confidentiality. Access is limited to what the role requires.
7. Security
The Processor implements appropriate technical and organisational measures pursuant to Art. 32 GDPR, described in Annex C (TOMs), including encryption of content at rest and in transit, hybrid post-quantum key encapsulation (X25519 + ML-KEM-768) for messages between Sendis users, access control, logging aligned with the principles of NEN 7513, and an information security management system that the Processor is setting up using ISO 27001 and NEN 7510 as a guide. The Processor is not certified to ISO 27001 or NEN 7510.
8. Sub-processors
The Controller grants general written authorisation for the engagement of the sub-processors in Annex B. The Processor announces any new or replacement sub-processor, or any change of role or location, at least 30 days before the change date by email to the Controller's administrators and updates the service's sub-processor page at the same time. The Controller may object in writing, stating reasons, within 30 days of the announcement. If the Processor does not resolve the objection by the change date, the Controller may, within 30 days after the change date, terminate the main agreement free of charge, with immediate effect or as of a later date it specifies. The Processor refunds prepaid fees for the period after the end date pro rata; article 12 applies. The Processor imposes on each sub-processor, by written agreement, the same data protection obligations as set out in this agreement and remains fully liable to the Controller for their performance.
9. Assistance
Taking into account the nature of the processing, the Processor provides reasonable assistance with: data subject requests (Art. 12-23 GDPR), security (Art. 32), breach notifications (Art. 33-34), DPIAs (Art. 35) and prior consultation (Art. 36). At the levels with in-browser encryption the Processor does not access the message text, save in an authorised recovery procedure; assistance there concerns metadata, the audit trail and technical cooperation.
10. Personal data breaches
The Processor notifies the Controller of a personal data breach without undue delay and in any event within 48 hours of discovery, with the information of Art. 33(3) GDPR insofar as available, supplemented as soon as known. Notification to the supervisory authority and to data subjects is the Controller's responsibility; the Processor provides support. The Processor's contact point for security matters and personal data breaches is hello@neolyth.io.
11. Audits
The Processor makes available the information necessary to demonstrate compliance (including, once available, certificates and summaries of audit reports) and allows an audit by or on behalf of the Controller at most once per year, or after a breach, announced with reasonable notice, under confidentiality, during office hours and without access to other customers' data. Each party bears its own costs.
12. Return and deletion
Message expiry configured by the Controller (or its users) constitutes a deletion instruction within the meaning of Art. 28(3)(g) GDPR: on expiry the Processor deletes the message content, the attachments and the associated keys, for the recipient as well. Metadata as referred to in article 4(a) and the audit trail may be retained after expiry until the end of the main agreement. The Controller's own statutory retention duties (including the medical record duty of art. 7:454 Dutch Civil Code) remain its own responsibility; the service is not a records system. After the end of the main agreement the Processor provides a 30-day export window. On the Controller's written instruction the Processor decrypts message content for that purpose solely through a recovery procedure as referred to in Annex C, in a form the parties agree in writing. Thereafter the Processor deletes all personal data of the Controller, save for the Processor's statutory retention duties (such as fiscal retention of billing records). Copies in backups are not deleted individually; they expire with the backup after at most 30 days, are used until then solely for recovery after an incident, and after such a recovery the Processor re-applies previously instructed deletions.
13. Liability
Liability is governed by the main agreement (General Terms and Conditions, art. 13), without prejudice to Art. 82 GDPR.
14. Governing law
Dutch law applies; the competent court is as set out in the main agreement.
15. Amendment
The Processor may amend this agreement. It announces an amendment at least 30 days before its effective date by email to the Controller's administrators, with the amended text and a short explanation. An amendment that reduces the level of protection of the personal data does not take effect without the Controller's written consent. If the Controller does not agree with any other amendment, it may terminate the main agreement free of charge as of the effective date; article 8, penultimate sentence (pro rata refund), and article 12 apply mutatis mutandis. An amendment required by law or exclusively to the Controller's benefit may take effect earlier.
Annex A - Processing details
| Item | Detail |
|---|---|
| Processing locations | EU (Germany and the Netherlands) |
| Key management | Processor's EU-hosted key management system; end-user private keys leave the client only in encrypted form: under a password-derived key; where set up, under a key derived from a personal recovery code; and, for organisations with a recovery key, as a recovery copy encrypted to the organisation's recovery key, which the Processor manages on its systems |
| Retention of transport copies | until expiry (Controller setting) or end of agreement (art. 12) |
| Audit trail | actions on messages, hash-chained, available to the Controller's administrators |
Annex B - Sub-processors
| Sub-processor | Role | Data | Location | Safeguards |
|---|---|---|---|---|
| IONOS SE | Hosting of the service and the database, edge gateway, key management system, storage of messages, attachments and backups | all service data; messages, attachments and backups encrypted | Germany; object storage region eu-central-4 | data processing agreement with the sub-processor; processing exclusively in the EU (Germany); message text is encrypted at the sender, attachments are encrypted server-side after the virus scan |
| Cyso Cloud B.V. | Sending notification emails and verification codes | recipient email address, sender and practice name, links, verification codes and, in the reminder email sent before a message expires, the subject of that message; never attachments or keys; message text only in a copy of their own message requested by the sender via the contact link | Netherlands | data processing agreement with the sub-processor; processing exclusively in the EU (Netherlands) |
| Amazon Web Services EMEA SARL | SMS delivery of one-time verification codes only | recipient phone number (E.164 format) and the ephemeral 6-digit code; message bodies, attachments, decryption keys and any clinical content never transit AWS | eu-central-1 (Frankfurt, Germany), region-pinned | AWS data processing terms incorporating the European Commission's standard contractual clauses; parent company in the United States, expressly disclosed |
The safeguard "data processing agreement with the sub-processor" in the table means a written data processing agreement with the sub-processor, concluded before it first processes the Controller's personal data.
Not a sub-processor: Mollie B.V. (Netherlands) processes payments as an independent controller; the Processor is itself the controller for billing data. Operational log files are kept on the Processor's own infrastructure in the Netherlands. Worldstream B.V. (Netherlands): hosting of the website sendis.eu, the visitor statistics and the waiting list. Not a sub-processor for the service: messages, attachments and account data of the service do not pass through this server.
SMS OTP delivery: Amazon Web Services EMEA SARL (AWS), region eu-central-1 (Frankfurt, Germany). Data transferred: recipient phone number (E.164 format) and ephemeral 6-digit OTP code. Message bodies, attachments, decryption keys, and any clinical content never transit AWS infrastructure.
Annex C - Technical and organisational measures (TOMs)
- Encryption of message content with AES-256-GCM; per-message key encapsulation with X25519 + ML-KEM-768 (hybrid post-quantum) for messages between Sendis users. At the access-code level the message key is encrypted with a key derived from the access code (Argon2id, AES-256-GCM).
- For delivery with a one-time verification code (email/SMS), unlocking is server-mediated: the Processor stores a per-message unlock secret, encrypted under a key it controls, and releases it after successful verification. At this level the Processor holds material sufficient to decrypt the message content; successful verifications are recorded in the audit trail. Message content remains stored encrypted at this level as well; this level is expressly NOT end-to-end.
- Attachments: processed unencrypted on upload, solely for virus scanning and encryption and only for the duration of that processing; the virus scanner may create a temporary file on the server for this purpose, which it deletes after the scan. Afterwards stored exclusively in encrypted form (AES-256-GCM, per-file key). Attachments are not covered by in-browser encryption.
- Recovery: a recovery key is created for every team organisation. Every message sent by a member also receives a recovery envelope encrypted to the organisation's recovery key. The Processor uses the recovery key solely in a recovery procedure authorised by the organisation: after approval by one administrator of the organisation, and by a second administrator where the organisation has more than one, and after a waiting period has elapsed. Recovery requests, approvals and use of the recovery key are recorded in the audit trail. The waiting period is 72 hours by default. Processing pursuant to a legal obligation as referred to in article 5 may take place without a waiting period; the Processor gives prior notice of it, unless the law prohibits this.
- TLS (version 1.2 or higher) for all internet connections to the service; HSTS; modern cipher suites.
- Access control with role-based authorisation per organisation, two-factor authentication (TOTP, SMS) and passkeys (WebAuthn).
- Hash-chained audit trail of actions on messages and keys, aligned with the principles of NEN 7513 (access logging).
- Per-message security levels selectable by the sender; expiry periods; message revocation.
- ISMS being set up using ISO 27001 and NEN 7510 as a guide (not certified); vulnerability management, change management, EU-based backup and recovery.
- At the Processor, access to personal data is limited to the proprietor and persons who have been screened beforehand and bound to confidentiality in writing, on a need-to-know basis.