Contract documents and authorisations

Overview

The contract consists of the quote, the AGB and these annexes: annex 1 – data processing agreement (always); annex 2 – opening and scanning instruction (with the digital mail service); annex 3 – authorisation for formal service and mail authorisation (always, on paper); annex 4 – obligation of secrecy under § 203 StGB (for professionals bound by secrecy, on paper).

For every acceptance and signature we store the date, the version of the document and the evidence (for example your email or the signed original).

Withdrawal and changes

We only enter into contracts with businesses; there is therefore no statutory consumer right of withdrawal.

The client may change or revoke the opening instruction (annex 2), the recipients and the rules at any time in text form – in the client account or by email. This applies to mail that reaches us after the change has been received.

The authorisations (annex 3) expire when the contract ends; before that the client may revoke them in text form, and we then return the signed authorisations. Without an authorisation we can no longer accept registered mail and formal service for the client.

Annex 1 – Data processing agreement (Art. 28 GDPR)

Subject matter and duration: WITOS GmbH (processor) processes personal data on behalf of the client (controller) where it opens, scans, stores and sends the client’s mail to its recipients, provides documents in the client account and processes receipts for its bookkeeping. The agreement applies for the term of the contract.

Data and data subjects: the data subjects are senders, addressees and persons named in mail and receipts. The data processed are names, contact, contract and payment data and all content of the mail – including special categories of personal data (Art. 9 GDPR) where the mail contains them.

Instructions: we process the data only on the client’s documented instructions – the opening instruction, the recipients and rules in the client account and instructions in text form – unless we are legally required to process it. If we consider an instruction unlawful, we tell the client.

Confidentiality and security: we only use staff bound to confidentiality and take the measures required by Art. 32 GDPR, in particular roles with minimal rights and an additional one-time code for staff, encrypted storage of files (AES-256), encrypted backups, a log of every access to files, locked storage of originals and a checking period before scans are sent.

Sub-processors: the client agrees to the use of the following sub-processors: IONOS SE (server, Germany), Backblaze, Inc. (encrypted backups, EU Central region, Netherlands), Google Ireland Limited (sending emails), Cloudflare, Inc. (DNS), [identification service], [document shredding service]. We inform the client in text form in advance about new or replaced sub-processors; the client may object within [14 days].

Support and notifications: we support the client with requests from data subjects, with notifying personal data breaches and with data protection impact assessments. We notify the client of a breach affecting its data without undue delay after becoming aware of it.

Deletion and return: after the end of the contract the client can download its data from the client account for 6 months; after that we delete it unless there is a legal obligation to keep it. Originals are handled under clause 11 of the AGB.

Evidence and audits: we provide the client with the information it needs to demonstrate compliance with Art. 28 GDPR and allow audits by prior arrangement.

Annex 2 – Opening and scanning instruction

The client instructs WITOS GmbH to open letters addressed to it at Cauerstr. 23, 10587 Berlin, scan them in full and send the scans to the recipients it specifies in the client account. The instruction covers mail to the company and to its management in that capacity. Letters that are clearly addressed personally to other persons (for example “personal” or “confidential”) are covered only if those persons themselves agree.

The client may limit the instruction to certain letter types (for example invoices only) and change recipients and rules at any time in the client account.

The client declares that it is entitled to decide on the opening of this mail (§ 202 StGB).

Annex 3 – Authorisation for formal service and mail authorisation (on paper)

“We – [company, address, represented by] – hereby authorise WITOS GmbH, Cauerstr. 23, 10587 Berlin, for the term of the business address contract, to receive all items addressed to us at this address, including registered mail and formal service of documents by courts and authorities (§ 171 ZPO, § 7 VwZG). This authorisation does not entitle it to open the items.”

In addition, the client signs the Deutsche Post mail authorisation (Postvollmacht) and, where necessary, authorisations of other delivery services.

We keep the originals and present them to couriers, courts and authorities on request.

Annex 4 – Obligation of secrecy (§ 203 StGB)

For clients bound by professional secrecy (for example doctors, lawyers, tax advisors): the client obliges WITOS GmbH to keep secret all third-party secrets it learns when receiving, scanning and forwarding the client’s mail (§ 203(4) sentence 2 no. 1 StGB).

WITOS GmbH has been informed that unauthorised disclosure is a criminal offence. It obliges all staff and subcontractors who come into contact with the mail to secrecy in text form and takes note of the content only as far as the service requires.

For these clients we send scans by default only as a link to the client account, not as an attachment.

Last updated: October 2026