Data Processing Agreement (DPA)

This Data Processing Agreement (“Agreement”) forms part of the service agreement between you (the “Controller”) and Bruce Apps B.V. (“Bruce Mail”, the “Processor”) and governs the processing of personal data on your behalf, in accordance with Article 28 GDPR. By using Bruce Mail to process personal data you agree to this Agreement.

1. Subject and roles

You determine the purposes and means of the processing and are the controller. Bruce Mail processes personal data solely on your behalf and according to your instructions, as processor.

2. Nature, purpose and duration

• Nature: fetching, storing, analysing (summarising, urgency), drafting replies, scheduling and sending notifications.
• Purpose: providing the Bruce Mail service.
• Duration: for as long as you use the service; this Agreement ends when the service agreement ends.

3. Data types and data subjects

• Data subjects: your customers, contacts, colleagues and anyone who emails you or whom you email.
• Data: names, email addresses, message content and attachments, and other data subjects include in their messages.

4. Instructions

Bruce Mail processes the data only on your documented instructions (including your use of the app features) and not for its own purposes. Email content is not used to train AI models.

5. Confidentiality

Everyone who accesses the data on behalf of Bruce Mail is bound by confidentiality.

6. Security

Bruce Mail implements appropriate technical and organisational measures (Art. 32 GDPR), including HTTPS encryption, encrypted storage of passwords and tokens, access restriction and optional passkey login (Face ID / fingerprint).

7. Sub-processors

You grant Bruce Mail general authorisation to engage sub-processors. These currently are:

• Abacus.AI — hosting, database and AI processing.
• ElevenLabs — text-to-speech.
• Microsoft / Google — connecting the mail accounts you link yourself.

Bruce Mail imposes the same obligations on sub-processors as in this Agreement and informs you of intended changes so you can object.

8. Transfers outside the EEA

If data is processed outside the European Economic Area, this is done with appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs).

9. Assistance

Bruce Mail assists you, as far as reasonably possible, in responding to data subject requests (access, rectification, erasure) and with your obligations regarding security, data breaches and DPIAs.

10. Data breaches

Bruce Mail reports a data breach without undue delay after becoming aware of it, so you can meet your notification duty (Art. 33/34 GDPR).

11. Return and deletion

After termination Bruce Mail deletes the personal data or returns it to you, at your choice, unless legal retention obligations require otherwise. Deletion in principle takes place within 30 days.

12. Audits

On request, Bruce Mail makes available the information needed to demonstrate compliance with Article 28 GDPR and cooperates with reasonable audits.

13. Contact

Questions about this Agreement or need a signed copy? Email [email protected].