Mailingbid
How it worksFor agenciesPricingGuidesLog inStart a request
DECSEN

Terms of Service for Mailingbid for Agencies

Version of 3 Nov 2026

The German version is legally binding. German version

Contents

  • Terms of service
  • Data processing agreement
  • Annex 1: Technical and organisational measures
  • Annex 2: Sub-processors
  • Annex 3: Types of data, data subjects and retention
  • Single point of contact under the Digital Services Act

To save or print: print the page and save it as a PDF. The text is also available as an ordinary web page to read and copy.

Terms of service

1. Scope and contracting parties

1.1 These Terms of Service govern the use of Mailingbid for agencies, a tool at mailingbid.com with which businesses send mailing tenders to their own suppliers and collect, compare and award offers (clause 5). The provider is Christoph Salat, sole trader (salat.tech), Sieveringer Straße 94/10, 1190 Wien, Austria, UID ATU72024025 ("Mailingbid", "we", "us").

1.2 The contracting party is the organisation that registers, for example a fundraising or direct marketing agency, a non-profit organisation or another business ("agency").

1.3 These Terms of Service do not apply to the Mailingbid marketplace, through which clients request offers from printers and lettershops selected by Mailingbid, and terms of the marketplace do not apply to Mailingbid for agencies. An agency's tenders are not marketplace requests.

1.4 The Data Processing Agreement under clause 16.7 forms part of the User Agreement. In the event of conflict, the following prevail in this order: an express individual agreement in text form; for the processing of personal data on behalf of the agency, the Data Processing Agreement; then these Terms of Service. Liability is governed solely by clause 19.

1.5 These Terms of Service apply exclusively. General terms and conditions or purchasing terms of the agency do not apply, even if we do not expressly object to them.

2. Definitions

2.1 The User Agreement is the contract between Mailingbid and the agency for the use of the workspace. It is concluded upon registration (clause 4.2), exists independently of any subscription and ends under clause 11.8, 13.1, 16a.3 or 20.3 or under section 9.2 or 9.3 of the Data Processing Agreement.

2.2 A subscription is the paid subscription to a plan (clause 7) within the User Agreement. It is concluded under clause 4.4 and ends under clause 8.3, 9.6, 11.2 to 11.5, 11.7, 13.1, 16a.3 or 20.3 or under section 9.2 or 9.3 of the Data Processing Agreement; whenever the User Agreement ends, the subscription ends with it. A billing period is one month or one year, depending on the payment interval chosen. The trial is the period under clause 8.

2.3 The workspace is the logged-in area of Mailingbid for agencies. A member is a person who belongs to the agency with their account. Owners are members with extended rights (clause 14.3); on registration, this is the person who registers.

2.4 A supplier is a business that the agency enters in its supplier list, for example a lettershop or a printer. A contact is a person at the supplier whom the agency enters with an email address.

2.5 A tender is the description of a mailing for which the agency obtains offers, with parts, countries, quantities, dates, services and files. An invitation is the request to a supplier to submit an offer for a tender. An award is the selection of one or more offers by the agency in the workspace.

2.6 The API is the access to Mailingbid for agencies for the agency's software using an organisation key; webhooks are messages that we send to addresses entered by the agency (clause 15).

2.7 Text form means a legible declaration on a durable medium, in particular an email.

3. Businesses only

3.1 Mailingbid for agencies is intended exclusively for businesses within the meaning of § 1 of the Austrian Consumer Protection Act (KSchG); this includes non-profit organisations and associations insofar as they operate a business. Consumers may not use Mailingbid for agencies.

3.2 Anyone who registers expressly confirms that they are concluding the contract for a business or organisation that has already commenced its economic activity, not for private purposes and not in preparation for an activity that is merely planned, and that they are authorised to represent it.

4. Registration and conclusion of the contract

4.1 The presentation of Mailingbid for agencies on our website does not constitute a binding offer.

4.2 The agency registers using the form on our website. In the form it states the agency's name, the registering person's own name, an email address, the country, the language and the desired plan including payment interval, gives the confirmation under clause 3.2 and agrees to these Terms of Service and the Data Processing Agreement. We send a login link to the address given. The User Agreement and the Data Processing Agreement are concluded when the person opens the link and confirms the login; at that point we create the agency and, if none exists yet, the account. Before registering, the agency can retrieve, save and print these Terms of Service and the Data Processing Agreement in the version in force.

4.3 The User Agreement without a subscription is free of charge. In the workspace the agency can maintain its supplier list and prepare tenders, but cannot send invitations.

4.4 The subscription is taken out by an owner in the workspace: the owner chooses the plan and payment interval and provides a payment method on the page of our payment service provider. The subscription is concluded when the owner submits that page. What is charged, and from when, is set out in clauses 8 and 9; the workspace shows the current status of the subscription.

4.5 An account can belong to only one agency. We may refuse registrations without giving reasons.

5. Services and their limits

5.1 Mailingbid for agencies is a tool. In every plan it includes:

  • a supplier list for the agency, which the agency fills one by one or by CSV file, with up to ten contacts per supplier;
  • the preparation of mailing tenders with parts, several countries and dates, services and files;
  • the sending of invitations by email to the contacts of the selected suppliers, with the tender as a PDF and a personal link to the supplier portal;
  • the submission of offers by suppliers via a form in the supplier portal or as a reply by email (clause 6);
  • reminders before the offer deadline to suppliers whose invitation has not been withdrawn, who have neither declined nor submitted an offer and who were invited at least two working days before the deadline, and a notice to the agency when the deadline is reached;
  • the comparison of offers and the award to one or more suppliers, with a notice of the result to each supplier whose invitation has not been withdrawn;
  • team members, team comments and the API with webhooks (clause 15).

5.2 Tenders are currently possible only for mailings, not for print-only jobs.

5.3 Mailingbid is not a broker. The agency selects the suppliers itself from its own list. We do not suggest suppliers, do not check their suitability, reliability or certifications or their offers, and do not act as agent of the agency or of the suppliers. This relates to the contracts between agency and supplier; it does not affect the fact that, by storing and transmitting the agency's content, we provide an intermediary service within the meaning of Regulation (EU) 2022/2065 (Digital Services Act) (clauses 14.8 to 14.11).

5.4 Mailingbid does not become a party to the contracts between agency and supplier. Whether, when and with what content such a contract is concluded is decided solely by the agency and the supplier. We transmit invitations, reminders and result notices on behalf of the agency. The notice to a selected supplier states that the agency will be in touch and is expressly not yet an order. An award cannot be reversed in the workspace.

5.5 Invitations are sent from the platform's sender address and state the name of the agency and the name and email address of the inviting member for questions. Suppliers do not need an account of their own to submit an offer. An offer made via the form is submitted when it is sent and appears immediately at the agency; the agency can return it to the supplier for correction.

5.6 We provide the workspace in the version available at the relevant time. Changes are governed by clause 20.1.

6. Replies by email and review by us

6.1 Each invitation has its own reply address for offers. If this function is not set up, replies go directly to the inviting member.

6.2 Whatever arrives at a reply address is received first by us, not by the agency. Until handover to the agency, we receive and review the emails under our own responsibility. We decide what an email is:

  • an offer: we record it in the form of the supplier portal and attach selected PDF attachments as a copy. The agency then sees it as an offer received by email; each contact of the supplier on file receives an email asking them to check the entry;
  • a decline: we note it together with the reason, and the agency receives a notice;
  • a question or other message: we forward it with subject, text and selected attachments to those members of the agency who also receive the other notices about the tender;
  • spam, a duplicate or an email of no relevance: we discard it without notification.

6.3 When recording offers we may use technical aids, including automated extraction by a specialised service that we engage as our processor. To the extent that details from the agency's tender are passed to this service for matching, it is a sub-processor under the Data Processing Agreement. Automated extraction produces only a draft; an email becomes an offer for the agency only through our review.

6.4 We do not commit to any time frame for handling incoming emails. The agency takes this into account when setting the offer deadline. We record an offer only as long as the invitation has not been withdrawn, the supplier has not been deactivated, the tender has been neither awarded nor closed, the agency has not been suspended by us and fewer than three offers exist for the invitation.

6.5 The supplier's email including its attachments is authoritative for the content of an offer. We owe careful recording; it is not part of our service that the recording reproduces every detail correctly and completely. We are liable for errors in recording under clause 19. Before making an award, the agency checks an offer received by email against the attached PDF files or by asking the supplier.

6.6 We assess whether an email actually comes from the stated sender on the basis of the technical details of its delivery. We do not owe any further verification of the sender's identity; we are liable for errors in this assessment under clause 19. If we forward a message whose sender is not verified, the forwarded message says so.

7. Plans and limits

7.1 There are three plans. They include all features and differ only in how many tenders the agency can send in one billing period:

PlanTenders with monthly paymentTenders with yearly paymentPrice per monthPrice per year
Starter3 per month36 per year€150€1,500
Team10 per month120 per year€250€2,500
Prounlimitedunlimited€500€5,000

All prices are net, in euros (clause 9.1). With yearly payment the limit is twelve times the monthly limit.

7.2 Tenders are counted at the time of sending, within the running billing period of the subscription, that is from one billing day to the next, not per calendar month or calendar year; the count starts again with each new billing period. During the trial, the limit of one month applies for the whole trial, including any extension. If the agency changes plan within a billing period, the new limit applies at once and the count continues; a change of payment interval starts a new billing period and with it a new count. A tender counts when it goes to suppliers for the first time. Inviting further suppliers, resending an invitation, returning an offer for correction or moving the deadline does not count again. If the agency withdraws all invitations of a tender and then sends it again, this counts as a further tender if the tender has been changed in the meantime or an offer had been received in the previous round; otherwise it does not. Moving the offer deadline alone is not a change in this sense.

7.3 Once the limit of the plan has been reached, no further tender can be sent until the next billing period begins or the agency switches to a larger plan. All other functions remain available.

7.4 To protect operations, we limit the number of certain operations per unit of time, for example new tenders, changes, file downloads and API calls. These limits are far above ordinary use; we may adjust them.

8. Trial

8.1 An agency's first subscription begins with a 30-day trial. The payment method is provided at the start; nothing is charged during the trial.

8.2 The first charge is made at the end of the trial, and only if the agency has sent at least one tender by then. From then on the subscription continues as a paid subscription (clause 11).

8.3 If the agency has not sent any tender by shortly before the end of the trial, we extend the trial once, about one day before it ends, by 30 days from its previous end. If the agency does not send any tender by the end of the extension either, the subscription ends automatically without anything being charged.

8.4 Before the end of the trial we send reminders by email to the owners and to the billing email address on file, as a rule 7 days and 1 day beforehand, stating whether an amount will be charged and, if so, which. Each reminder contains a link for cancelling without logging in (clause 11.3). If an unused trial is extended, the notice of the extension takes the place of the last reminder. If a reminder is not sent, this does not affect clauses 8.2 and 8.3.

8.5 A trial is available only with an agency's first subscription. A new subscription taken out after an earlier one has ended begins without a trial; the first amount is charged at the start. The workspace and the payment service provider's page point this out before the subscription is taken out.

9. Prices, billing and payment

9.1 All prices are net, plus statutory VAT. For agencies in Austria, Austrian VAT is added. For agencies in another EU Member State that provide a valid VAT identification number, the tax liability passes to the agency (reverse charge). Our payment service provider determines the tax from the billing address and the VAT identification number that the agency enters there. The agency keeps these details correct and up to date.

9.2 The fee is payable in advance for each billing period. The first billing period begins at the end of the trial or, for a subscription without a trial, at the start.

9.3 We bill through the payment service provider Stripe. Card and SEPA direct debit are available. The agency authorises us to collect amounts due using the payment method on file and keeps that payment method up to date in the payment service provider's customer portal; there it also finds its invoices and changes its billing address and VAT identification number.

9.4 The agency agrees that we issue and transmit invoices exclusively in electronic form.

9.5 Amounts stated in the workspace or in our emails are net plan prices or estimates. The invoice, which includes discounts, prorated amounts and VAT, is authoritative.

9.6 Payment failure. If a collection fails, the payment service provider retries it for a limited time. As a rule, the agency can still send tenders for at least seven days from the start of the unpaid billing period, and after that only once payment has been received.

  • If collection does not succeed, the subscription ends without notice of cancellation and without a payment reminder as soon as the payment service provider gives up its attempts. If a SEPA direct debit is returned, the subscription may end immediately. The User Agreement continues (clause 11.6).
  • For the unpaid billing period, the agency owes the fee only pro rata up to the end of the subscription; we issue a corrective invoice for the remainder.
  • This pro rata amount and any other outstanding amounts remain payable even after the subscription has ended and after cancellation; a new subscription does not settle them.

9.7 In the event of late payment, the agency owes default interest at 9.2 percentage points above the base rate and a lump sum of €40; it reimburses necessary and appropriate collection costs exceeding this amount under § 1333(2) ABGB (Austrian Civil Code). The agency bears the costs of a returned direct debit for which it is responsible.

9.8 The agency may set off only claims that we have acknowledged or that have been established by a court.

10. Promotion codes and founders' discount

10.1 The agency redeems a promotion code when taking out the subscription on the payment service provider's page. Subsequent redemption, payment of the value in cash and the combination of several codes are excluded. The conditions under which we issue the code apply.

10.2 The founders' discount, which we issue as a promotion code, reduces the first paid invoice by 50%: for monthly payment the first month, for yearly payment the first year. Subsequent invoices are issued at the full price. The founders' discount applies only to an agency's first subscription and can be redeemed only when that first subscription is taken out, not later. The trial does not use it up. If the first subscription ends without any invoice having been paid, for example after an unused trial, the discount lapses; a later subscription does not receive it. It is limited to a total of 50 redemptions; thereafter there is no entitlement to it.

11. Term, renewal and cancellation

11.1 The subscription renews automatically at the end of each billing period for a further period of the same length unless it is cancelled beforehand.

11.2 The agency may cancel the subscription at any time with effect from the end of the current billing period, or during the trial with effect from the end of the trial. An owner can cancel in the workspace under "Subscription" or via the link under clause 11.3; if access is suspended under clause 13.2, also in text form to the address in clause 23. Cancellation is not possible in the payment service provider's customer portal. Termination for good cause (clause 13.1) and the switching request under clause 16a remain unaffected.

11.3 The notice of the first charge and the reminders before the end of the trial contain a link through which the subscription can be cancelled without logging in; the link is valid until three days after the end of the trial for which it was issued. Opening the link does not cancel the subscription; only a button on the page does. A cancellation via this link is attributed to the agency under clause 14.2, even if the email was forwarded; an owner can withdraw it under clause 11.4.

11.4 We confirm a cancellation by email to the owners and the billing email address as soon as it has been registered with the payment service provider. Until the subscription ends, an owner can withdraw the cancellation in the workspace.

11.5 Effect of cancellation: the subscription remains usable until the end of the billing period, and nothing further is charged after that. Fees already paid are not refunded pro rata, not even if the subscription ends under clause 16a before the end of the billing period; this does not apply in the cases of clauses 13.3, 18.3 and 20.3 or to termination under section 9.2 or 9.3 of the Data Processing Agreement. If the subscription is cancelled during the trial, it ends with the trial without any charge, even if the agency sends a tender afterwards. Outstanding amounts remain payable (clause 9.6).

11.6 Once the subscription has ended, the agency can no longer send tenders. The User Agreement continues: the agency's data remain readable in the workspace and retrievable via the API (clause 16.4) until the User Agreement ends (clauses 16.5, 16a.3). An owner may take out a new subscription at any time (clause 8.5).

11.7 We may cancel the subscription by ordinary notice in text form, giving three months' notice to the end of a billing period.

11.8 The agency ends the User Agreement by a switching request under clause 16a; any current subscription ends with it. We may terminate the User Agreement in text form with the notice period under clause 11.7 or, if there is no current subscription, with one month's notice. What happens to the data afterwards is governed by clause 16.5.

12. Changing plans

12.1 An owner can change the plan and the payment interval in the workspace as long as the subscription is running, has not been cancelled and no payment is outstanding. Changes are not possible in the payment service provider's customer portal.

12.2 During the trial a change costs nothing; the trial ends on the same day as before, and the new plan is charged with the first charge.

12.3 After the trial, a new plan with the same payment interval applies immediately; the difference for the current period is offset pro rata on the next invoice.

12.4 If the payment interval changes, a new billing period begins immediately. From monthly to yearly, the yearly price is charged immediately, less the prorated value of the unused part of the month. From yearly to monthly, the unused remainder of the year remains as a credit with the payment service provider and is offset against subsequent invoices. Any credit still outstanding when the subscription ends is paid out on request.

12.5 The invoice is authoritative for the amount resulting from a change (clause 9.5).

12.6 If the agency changes to a plan whose limit it has already reached, clause 7.3 applies.

13. Suspension and extraordinary termination

13.1 Either party may terminate the User Agreement or the subscription for good cause without notice, in text form. For us, good cause exists in particular if the agency

  • is more than 30 days in arrears with a payment despite a payment reminder (the subscription ends under clause 9.6 irrespective of this),
  • stores or sends content via Mailingbid for agencies that violates clause 14.8, writes to persons without authorisation, or misuses or attacks the platform, the API or other users,
  • falsely stated at registration that it is a business,
  • commits a material breach of these Terms of Service despite having been called upon to stop.

13.2 Instead of terminating, in these cases we may temporarily suspend the sending of invitations, individual functions, organisation keys or webhook addresses, or the agency's access. We choose the least severe suitable measure and notify the agency of it in text form with our reasons, and, for measures relating to content, with a statement of reasons under clause 14.11. A suspension for which the agency is responsible does not affect the fee.

13.3 If the agency terminates for good cause for which we are responsible, we refund pro rata any fees already paid for the period after the end of the subscription.

14. Obligations of the agency, content and notices

14.1 The agency provides truthful information at registration, in the subscription and in the workspace and keeps it up to date, in particular the billing details.

14.2 Login is by means of links sent to the account's email address. The agency ensures that only authorised persons have access to these mailboxes. Actions taken via its members' accounts, its organisation keys and the cancellation link under clause 11.3 are attributed to the agency unless it proves that it is not responsible for the misuse.

14.3 Owners manage the subscription, invite members, remove them, make them owners and manage webhooks and all organisation keys. Every member can send tenders and make awards. The agency invites only persons who are entitled to act on its behalf and removes members who are no longer so entitled without undue delay.

14.4 Supplier list: The agency alone decides which suppliers and contacts it enters and writes to. It enters only contacts whom it is permitted to contact by email for this purpose, and it is responsible for their data, in particular for the legal basis and for informing the data subjects. The obligations under the Data Processing Agreement remain unaffected.

14.5 Content: Tenders, files, messages to suppliers, comments, own references and labels must not infringe the rights of third parties or statutory provisions. The agency is responsible for this content, including information about its own clients.

14.6 Mailingbid for agencies does not need any personal data of the recipients of a mailing, such as donors' addresses, for a tender. The agency does not upload or enter such data; where necessary, it passes them directly to the supplier it has commissioned.

14.7 The agency does not enter any personal data in the own references that it assigns to tenders and suppliers; these references are passed unchanged to its webhook addresses.

14.8 Prohibited content. Content that violates clauses 14.5 to 14.7 or statutory provisions may be neither stored nor sent in Mailingbid for agencies. This also applies to content that suppliers submit via the supplier portal or by email.

14.9 Moderation. We do not search content without cause. We take action upon a notice under clause 14.10, upon an order from an authority, or if we come across a violation when reviewing incoming emails (clause 6), in the course of operations or when troubleshooting. Decisions on measures are taken by a human being. We do not use automated tools for this, except for the spam rating of incoming emails and the technical check of file type and size on upload. Possible measures, in each case the least severe suitable one, are: blocking or removing content; suspending sending, individual functions, organisation keys or webhook addresses; temporarily suspending access (clause 13.2); terminating the User Agreement (clause 13.1). We decide diligently, objectively and proportionately.

14.10 Notices. Any person may notify us of content they consider to be illegal by email to kontakt@mailingbid.com with the subject “Meldung rechtswidriger Inhalte” (notice of illegal content). The notice should explain why the content is illegal, identify it precisely enough for us to locate it, state the name and email address of the person submitting the notice (except for notices concerning offences under Art 3 to 7 of Directive 2011/93/EU, Art 16(2)(c) of Regulation (EU) 2022/2065) and declare that the information is accurate and complete to the best of that person's knowledge. We confirm receipt, decide promptly and diligently and inform the person who submitted the notice of the decision, together with information on the available means of redress.

14.11 Statement of reasons and objection. If we block or remove content, restrict use under clause 14.9 or terminate the service or the account in whole or in part because of content, including by termination under clause 13.1, we inform the agency in text form of: the type, extent, territorial scope and duration of the measure; the facts on which we rely; whether a notice or our own review gave rise to it; whether automated means were used; the legal provision or the provision of these Terms of Service that the content violates, with an explanation of why the content violates it; and the means of redress. The agency may object to the measure in text form within six months; we then review the case again. Recourse to the courts remains open to the agency irrespective of this.

14.12 The agency indemnifies and holds us harmless if third parties, such as suppliers, their contacts or authorities, assert claims against us because the agency has breached clause 14, to the extent that the agency is responsible for the breach. We inform the agency of such claims without undue delay and do not acknowledge them without its consent.

15. API and webhooks

15.1 Members can create organisation keys, up to 20 valid keys per agency. A key is displayed only once, when it is created, and acts as the member who created it. If that member leaves the agency or is removed, their keys are permanently revoked.

15.2 The API is intended for software running on the agency's servers. The agency keeps keys secret, does not use them in program code that third parties can load, and revokes a key immediately if it believes that an unauthorised person knows it.

15.3 Each key allows at most 120 calls per minute; further limits are set out in the API documentation (clause 7.4).

15.4 Owners can enter webhook addresses using HTTPS. We send signed messages to them containing identifiers and the agency's own references, without names, addresses, prices or texts of suppliers. We reject addresses in private networks. If a delivery fails, we retry it at most eight times, spread over about 24 hours; after eight consecutive failed attempts we deactivate the address and notify the owners. The agency is responsible for the receiving systems and for what they do with the messages.

15.5 Webhooks supplement the API; we do not owe the delivery of every individual message. The API provides the authoritative state.

16. The agency's data

16.1 The supplier list, tenders, files, offers, comments and other content that the agency or its suppliers bring into Mailingbid for agencies remain the agency's and those of the respective rights holders. The agency grants us only the rights we need to provide our services, namely to store and process the content, prepare it as a PDF, transmit it to the invited suppliers and record incoming emails under clause 6; for the term of the User Agreement and thereafter until deletion under clause 16.5 or 16a.3.

16.2 The supplier list remains the agency's own. No other agency and no marketplace customer sees it. We never use it for the marketplace, not even to approach the suppliers entered in it for that purpose, and we do not pass it on. If a supplier is, independently of this, also a provider on the marketplace, that remains unaffected.

16.3 Our administration does not display the agency's supplier list, tenders and comments; the review of incoming emails under clause 6 is excepted. We access stored data only to the extent necessary for operations, security, troubleshooting, supporting the agency, carrying out its instructions, measures under clause 14.9, a switch under clause 16a, deletion or compliance with legal obligations.

16.4 During the User Agreement, including after a subscription has ended, the agency can view its data in the workspace and retrieve it via the API, including as an export under clause 16a.4.

16.5 We delete nothing when the subscription ends. The agency can itself delete tenders that were never sent and suppliers that were never invited; it can remove contacts. If the User Agreement ends under clause 16a, we delete data under clause 16a.3. If it ends in any other way, an owner can still retrieve the exportable data as an export under clause 16a.4 for 30 days after the end; after that we delete the agency with all its data within 30 days. We do not delete data where we must retain them under legal obligations or need them to establish, exercise or defend legal claims; we retain invoices and accounting records in accordance with tax law. Copies in our backups are not deleted separately but are overwritten when the backups expire, at the latest after six months.

16.6 We back up the stored data regularly. The agency additionally keeps important documents itself, for example offers on which an order is based.

16.7 Processing on behalf of the agency. To the extent that we process personal data on behalf of the agency, the Data Processing Agreement in the annex applies, which the agency concludes together with these Terms of Service on registration (clause 4.2). This concerns in particular the supplier list, tenders including their provision in the supplier portal, the sending of invitations, reminders and result notices, the receipt of offers via the form, awards, third-party data in comments and webhooks, and emails after their handover to the agency. As controller in our own right, we process the members' data including the details that the platform records about their actions (such as the author or the inviting, confirming or awarding member), members' accounts and login, data for subscription and billing, data for the accounts and login of contacts in the supplier portal, and data for receiving and reviewing incoming emails until their handover to the agency (clause 6.2); our privacy policy provides information on this.

16a. Switching and data export

16a.1 An owner may at any time request in text form, sent to the address in clause 23, that the agency switch to another provider or to its own systems, or that its exportable data (clause 16a.4) be deleted ("switching request"). The notice period is one month from receipt of the switching request. By the end of the notice period, the agency informs us in text form whether it

a) is switching to another provider, together with the details of that provider required for the switch,

b) is switching to its own systems, or

c) wishes its exportable data to be deleted.

If the agency provides no information by the end of the notice period, this is deemed to be a switch to its own systems.

16a.2 In cases a) and b), a transition period of 30 calendar days begins at the end of the notice period. During this period we make all exportable data available to the agency as an export without undue delay, provide reasonable assistance with the switch to the agency and to third parties designated by it, such as the new provider, continue to provide our services under the User Agreement and inform the agency of known risks to continuity of service. Throughout the switching process and the retrieval period (clause 16a.3) we ensure a high level of security, in particular for the transfer of the data. We also support the agency with its exit strategy, in particular by providing all the information it needs for that purpose. If the transition period is technically unfeasible, we inform the agency of this, with reasons, within 14 working days of receipt of the switching request and specify an alternative transition period of no more than seven months; our services continue until its end. The agency may extend the transition period once by a period it considers appropriate.

16a.3 At the end of the transition period, or upon earlier completion of the switch, a retrieval period of at least 30 calendar days begins during which the agency can still retrieve its exportable data. The User Agreement and the subscription end when the switch is completed and at the latest at the end of the transition period, and in case c) at the end of the notice period; we notify the agency of the end in text form. After the retrieval period, and in case c) after the end of the User Agreement, we completely delete all exportable data and the agency's other data within 30 days; clause 16.5 applies to statutory retention obligations, legal claims and backups.

16a.4 The following data of the agency are exportable, each with their identifiers, timestamps and links to one another; this list is exhaustive, and the items listed in clause 16a.5 are excluded:

a) the details of the agency: name, type, country, language, billing email address, the plan and payment interval chosen at registration, and whether the agency has been suspended by us;

b) members with name, email address, language, role and time of joining, and team invitations with address, role, inviting member and the times of invitation, expiry, acceptance and revocation;

c) suppliers with all fields that the agency keeps on them (including name, type, country, language, own number, notes, ISO 27001 certification details, active or deactivated), and their contacts with email address, name and telephone number as kept by the agency;

d) tenders with all fields (including title, status, parts, countries with quantities, dates and return addresses, scope of services, offer deadline, payment term, notes, on whose behalf the tender is issued, own reference), with their files, the confirmed steps (step, name of the confirming member, time) and the sending rounds;

e) invitations with the invited supplier, released notes and files, the inviting member, the times of sending, first opening in the supplier portal, decline including the reason, and withdrawal, and the records of which email about the tender was sent and when, including reminders and result notices;

f) offers with all fields (including supplier, scope, price lines, totals and postage, currency and exchange rate, dates and validity, terms, deviations per part, name of a variant), their PDF files, their origin (supplier portal, email, API), their status (submitted or returned for correction) and their times;

g) awards with the selected offers, the awarding member, the time and the internal note;

h) comments with text, author, reference to a part and the times of writing, editing and deletion, together with the read status per member;

i) organisation keys with name, first characters, creating member and the times of creation, last use and revocation; webhook addresses with all fields (including address, name, subscribed events, state, creating member); the deliveries including their log, as long as they are stored (clause 15.4);

j) the subscription with plan, payment interval, status, trial including extension and the time of the first tender sent, current billing period, cancellation and end, and the identifiers at the payment service provider; the invoices are available in the payment service provider's customer portal (clause 9.3);

k) incoming emails that are assigned to the agency and that we have reviewed under clause 6.2 and handed over to it as an offer, a decline or a forwarded message, as long as they are stored, with sender, subject, text, attachments, time of receipt, result of the sender check, the draft from automated extraction where available, and the note of how we handled them.

Beyond this, there are no digital assets within the meaning of Art 25(2)(e) of Regulation (EU) 2023/2854. The export consists of files in JSON format and the stored files in their original form, together as a ZIP archive. We describe the data structures at the address given in clause 16a.7.

16a.5 The following data are not exportable, and this list is exhaustive, because their disclosure would endanger the security of the platform, the agency or third parties, because they serve the internal operation of our service, or because they are attributable not to the agency but to third parties or to us:

a) hash values, checksums and secrets, and the values from which secrets are derived, in particular for access links of invitations and tenders, reply addresses, team invitation links, organisation keys and webhook signing secrets;

b) the members' other account, session and login data, because an account can also be used outside the agency, and the accounts of contacts in the supplier portal including their login data, because such an account applies to all supplier lists in which the person appears;

c) abuse counters, logs of background jobs, error logs, the log of notifications from the payment service provider and our internal records of reconciling the subscription with it;

d) incoming emails that are not assigned to the agency, because they are not attributable to it; emails that we have not yet reviewed, or that we have discarded rather than handed over, because under clause 6.2 the agency receives them only after our review; and the record of which person in our office handled an incoming email.

16a.6 We charge no fees for the switch, the export and the assistance under clause 16a.2. The fee for a current subscription remains owed until the subscription ends; if the subscription ends under clause 16a.3 before the end of the billing period, clause 11.5 applies.

16a.7 The procedure for switching and export, the formats, known limitations, the data structures and the information under Art 28 of Regulation (EU) 2023/2854 (Data Act), namely the jurisdiction to which the ICT infrastructure used is subject and our measures against access by third-country authorities to non-personal data, are published at https://mailingbid.com/agenturen/wechsel-und-export. The API is available free of charge for export and switching, including without a subscription and for receiving providers designated by the agency for that purpose.

17. Availability and maintenance

17.1 We do not owe any particular level of availability and, unless these Terms of Service provide otherwise, no reaction, response or recovery times.

17.2 We may interrupt operations for maintenance, updates and to avert dangers.

17.3 Our service ends at systems outside our sphere of control that we do not use to provide our service, such as the suppliers' mail servers and spam filters or the agency's networks and systems. We owe the proper sending of invitations and notices, not their arrival in the suppliers' mailboxes. Disruptions caused by force majeure do not constitute a breach of our obligations. We are liable under clause 19 for service providers that we use to provide our service, for example for hosting, email sending and payment processing, as for our own actions.

18. Warranty

18.1 We provide the services under clause 5 substantially as described. Insignificant deviations do not constitute a defect.

18.2 The agency reports defects in text form with a comprehensible description. We remedy them within a reasonable period; a workaround that allows use without significant restriction is also sufficient for this purpose.

18.3 If a defect significantly impairs use, the fee is reduced appropriately for the duration of the impairment. If the defect cannot be remedied despite a reasonable additional period, the agency may cancel the subscription for good cause under clause 13.1; we refund pro rata any fees already paid for the period thereafter.

18.4 It is not part of our service that suppliers submit offers, that offers are correct, complete or comparable, or that suppliers are suitable or carry out orders. The comparison in the workspace places the suppliers' details side by side; indications such as "lowest price" are based solely on those details.

19. Liability

19.1 We are not liable for suppliers, in particular not for their offers, their services or the performance of contracts between agency and supplier.

19.2 We are liable only for intent and gross negligence. Liability for slight negligence is excluded, except for personal injury.

19.3 In the case of gross negligence, our liability for all cases of damage within twelve months is limited in aggregate to the fees paid by the agency in the twelve months preceding the first of these damaging events, but to no less than €5,000. This does not apply in the case of intent, gross negligence equivalent to intent, personal injury or breach of our obligations in handling the agency's data (clauses 16, 16a, 21 and the Data Processing Agreement).

19.4 Clauses 19.2 and 19.3 also apply to claims under the Data Processing Agreement, unless mandatory law, in particular Art 82 GDPR, precludes this; the exceptions in the second sentence of clause 19.3 also apply there. We are liable for sub-processors under Art 28(4) GDPR as for our own actions.

20. Changes to services, prices and terms

20.1 We may further develop Mailingbid for agencies and change, replace or discontinue functions, provided that the core services are maintained: supplier list, sending tenders, offers via the form, comparison and award. We notify a change that materially impairs use for the agency, including a change to the API that renders existing integrations unusable, in the same way as an amendment to these Terms of Service (clause 20.3), unless the change is required immediately for security reasons; in that case we notify it without undue delay.

20.2 We notify price changes to the owners and the billing email address in text form at least four weeks in advance. They take effect at the earliest from the first billing period beginning after that period has expired. Until then, the agency may cancel the subscription under clause 11.2 with effect from the end of the current period; we point this out in the notice.

20.3 We may amend these Terms of Service to the extent necessary because of a change in legislation or case law, an order from an authority, a change of functions under clause 20.1, the security of operations or changed terms of the service providers we use to provide our service, or to remove ambiguities. We do not change fees, plan limits (clause 7.1) or the core services under clause 20.1 by this route; clauses 20.2 and 20.4 apply to fees. We notify the owners of amendments in text form at least four weeks before they take effect. If the agency does not object by the time they take effect, the amendments are deemed accepted; we expressly point this out in the notice. If the agency objects, either party may terminate the User Agreement and the subscription with effect from the date on which the amendments take effect; until then the previous version applies, and we refund pro rata any fees already paid for the period thereafter. Alternatively, we may require express consent in the workspace.

20.4 Indexation. The fees are index-linked to the Consumer Price Index 2020 published by Statistik Austria or any index replacing it. The base is the index figure for the month in which these Terms of Service enter into force (clause 25). We may adjust the fees once per calendar year by the change in the index since the base or the last adjustment, for the first time for billing periods beginning more than twelve months after entry into force. We notify an adjustment under this clause to the owners and the billing email address in text form at least four weeks in advance; it is not a price change under clause 20.2 and does not trigger the right of cancellation provided for there. If the index falls, we reduce the fees to the same extent at the agency's request.

21. Confidentiality

21.1 We treat the agency's content as confidential, in particular its supplier list, tenders, offers and prices, and information about its clients. We disclose it only to the suppliers invited by the agency, to the extent intended, and to processors that we have bound accordingly, or where we are legally obliged to do so.

21.2 If an authority of a third country requests access to the agency's data, we inform the agency before complying with the request, unless this would conflict with a law enforcement purpose (Art 32(5) Data Act).

21.3 The obligations under clause 21 continue to apply after the end of the User Agreement.

22. Transfer of the agreement

If another party acquires our business and continues Mailingbid for agencies, in particular a company founded by us, the User Agreement including the subscription and the Data Processing Agreement pass to that party under § 38 UGB (Austrian Commercial Code). We or the acquirer notify the agency of the transfer in text form, pointing out its right to object. The agency may object to the transfer within three months of receipt of this notice; the contractual relationship then continues with us (§ 38(2) UGB).

23. Contact, communications and points of contact

23.1 For all declarations and matters relating to Mailingbid for agencies, you can reach us at kontakt@mailingbid.com. Declarations of the agency concerning the User Agreement and the subscription are made by an owner, in the workspace where it provides a function for this, and otherwise in text form to this address; the agency cancels the subscription under clause 11.2. We write to the owners' email addresses, for billing and cancellation additionally to the billing email address on file, and on individual tenders to the members involved.

23.2 The single point of contact under Art 11 and 12 of Regulation (EU) 2022/2065 for users and for the authorities of the Member States, the European Commission and the European Board for Digital Services is kontakt@mailingbid.com. It can be reached by email in German and English; replies come from a human being.

24. Final provisions

24.1 Austrian law applies, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods.

24.2 The place of jurisdiction for all disputes arising from the User Agreement and the subscription is the court having subject-matter jurisdiction for Vienna Inner City (Wien Innere Stadt). We may also bring proceedings at the agency's general place of jurisdiction.

24.3 The German version of these Terms of Service is binding. Translations are provided for ease of understanding; in the event of discrepancies, the German version prevails.

24.4 § 9(1) and (2) and § 10(1) and (2) of the Austrian E-Commerce Act (ECG) do not apply.

24.5 There are no oral side agreements. Amendments and additions require text form.

24.6 Should any provision of these Terms of Service be invalid, the remaining provisions remain valid. The invalid provision is replaced by a valid provision that comes closest to its purpose.

25. Entry into force

These Terms of Service apply from 3 Nov 2026 to every agency that registers on or after that date.


Annex: Data Processing Agreement under clause 16.7.

Data processing agreement

Agreement on the processing of personal data on behalf of a controller under Art 28 GDPR

between

the organisation using Mailingbid for agencies, as stated at registration
– hereinafter the “Controller” –

and

Christoph Salat, sole trader, trading under the brand Mailingbid,
Sieveringer Straße 94/10, 1190 Wien, Austria, UID ATU72024025,
email for the platform: kontakt@mailingbid.com, email of the operator: kontakt@salat.tech
– hereinafter the “Processor” –

together the “Parties”.


1. Subject matter and relationship to the Terms of Service

1.1 The Processor provides Mailingbid for agencies to the Controller in accordance with the Terms of Service for Mailingbid for Agencies (hereinafter the “Terms of Service”). The terms “User Agreement” (the agreement on the use of the workspace) and “subscription” have the meaning given to them in the Terms of Service. This Agreement governs the obligations of the Parties with regard to the personal data that the Processor processes on behalf of the Controller in that context (hereinafter “Client Data”).

1.2 This Agreement is an annex to and forms part of the Terms of Service (ToS 1.4, 16.7). It is concluded when the Terms of Service are accepted at registration (ToS 4.2).

1.3 Terms such as “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “third country” have the meaning given to them in Regulation (EU) 2016/679 (“GDPR”).

1.4 Members of the Controller within the meaning of this Agreement are the persons whom the Controller lists as members of its organisation on the platform; owners are the members with the role “Owner”.

2. Nature, purpose and scope of the processing

2.1 Purpose. The Processor processes Client Data solely in order to provide the Controller with the functions of Mailingbid for agencies: keeping its own supplier list, drawing up tenders for mailings, inviting its own suppliers to them, receiving their offers and declines, discussing them in the team, comparing them and awarding, in each case also via the application programming interface (API) and webhooks.

2.2 Processing on behalf of the Controller. On behalf of the Controller, the Processor processes:

a) the Controller’s supplier list, including contact persons at the suppliers (creating, including by CSV import, storing, changing, deactivating, removing);

b) tenders, including files, parts and countries, including generating the tender as a PDF;

c) sending emails in the Controller’s name to the contact persons of the invited suppliers: invitations, repeat invitations, notices of a new access link, notices that an offer has been handed back for correction, reminders before the offer deadline, requests to check an offer that the Processor has entered from an email (clause 2.4), and notices of the outcome of the award, together with the records of which email was sent to which contact person;

d) making the tender available to the invited contact persons in the supplier portal and receiving their offers and declines, including attachments;

e) awards (chosen offers, time) and internal notes on the award, insofar as these contain data of third parties;

f) data of third parties that members write in comments on tenders;

g) transmitting events to the webhook addresses entered by the Controller, including the delivery log;

h) data that the Controller sends or retrieves via the API, to the same extent as for entries in the workspace, and the export under ToS 16a.4;

i) replies from suppliers received in the mail inbox, from the time they are handed over to the Controller under clause 2.4;

j) emails to members of the Controller, insofar as they contain Client Data (for example notices of offers or declines received or that the deadline has been reached).

2.3 Nature of the processing. Collection, recording, organisation, storage, adaptation, retrieval, use, transmission to the recipients designated by the Controller, provision for export, restriction, erasure.

2.4 Replies by email. Each invitation carries a separate reply address belonging to the Processor. The Processor receives replies sent to these addresses, checks them and hands over to the Controller only content that has been checked: as a recorded offer, as a noted decline or as a forwarded email. Until this handover, the Processor processes the replies on its own responsibility in accordance with its privacy policy; upon handover, the content handed over becomes Client Data. Upon the export under ToS 16a.4(k), the exported emails are also deemed to have been handed over. In doing so, the Processor uses details from the Controller’s tenders only to the extent necessary for matching and extracting the replies, and only on the Controller’s behalf; the Controller gives the instruction to do so by this Agreement.

2.5 The Processor’s own processing. This Agreement does not cover processing for which the Processor is itself the controller and about which it provides information in its privacy policy, in particular:

a) the accounts, login and sessions of members, the organisation itself, the roles in the team and invitations to the team, as well as the details of members that the platform records or uses in connection with their actions (for example the member who created, invited, confirmed or awarded, the author and read status of comments, confirmations of work steps, the name and email address of the inviting member in invitations);

b) the subscription, invoicing and payment processing, including transmission to the payment service provider;

c) the account and login of the suppliers’ contact persons in the supplier portal; a person who appears in several supplier lists has a single shared account there;

d) receiving, checking and extracting replies in the mail inbox until their handover under clause 2.4, including the notices to the Processor’s office about newly received replies;

e) organisation keys for the API, logs of background jobs, counters against abuse, error logs and alerts to the Processor’s office;

f) statistics on the use of the public website (the agencies’ workspace is not covered by them).

2.6 No use for own purposes. The Processor does not use Client Data for its own purposes. In particular, it does not use the Controller’s supplier list for its marketplace and does not disclose it to any other customer.

3. Type of data and categories of data subjects

3.1 The types of data, the categories of data subjects and the respective storage periods are set out in Annex 3.

3.2 The platform is not intended for processing address data of the recipients of mailings (for example donors), special categories of personal data (Art 9 GDPR) or data relating to criminal convictions (Art 10 GDPR). The Controller does not upload such data, whether as a file or in free-text fields. The Processor takes no protective measures for such data beyond those set out in Annex 1.

4. Term

4.1 This Agreement begins upon its conclusion under clause 1.2. It remains in force until the erasure of the Client Data under clause 14 has been completed, including beyond the end of a subscription and of the User Agreement.

4.2 The right of either Party to terminate the User Agreement for good cause (ToS 13.1) remains unaffected.

5. Instructions

5.1 The Processor processes Client Data only on documented instructions from the Controller, including with regard to transfers to a third country, unless it is required to process them by Union or Austrian law. In such a case, it informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art 28(3)(a) GDPR).

5.2 Documented instructions are the Terms of Service, this Agreement and every action that a member of the Controller triggers using the functions of the platform, in the workspace or via the API: for example creating or removing a contact, sending a tender, moving a deadline, deleting a comment, entering a webhook address, retrieving an export. The Processor carries out erasure under clause 14 on the instruction given by this Agreement. The Processor handles notices under Art 16 and statements of reasons under Art 17 of Regulation (EU) 2022/2065 (Digital Services Act) because Union law requires it to do so (clause 5.1). If it blocks or removes content under ToS 14.9, it limits the processing to what is necessary (blocking, securing for evidence purposes, deletion) and informs the Controller in accordance with ToS 14.11.

5.3 Instructions outside the functions of the platform are given by owners in text form (for example email) to kontakt@mailingbid.com. The Processor carries them out insofar as this can reasonably be expected of it technically and organisationally. It may charge a reasonable amount for the effort involved in instructions and support outside the functions of the platform after notifying the Controller in advance, unless the effort results from a breach by the Processor of this Agreement or the GDPR; switching, export and support under ToS 16a are excluded from this (ToS 16a.6).

5.4 If the Processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the Controller without undue delay (second subparagraph of Art 28(3) GDPR). It may suspend carrying out the instruction until the Controller confirms or changes it.

6. Obligations of the Controller

6.1 The Controller is responsible for the lawfulness of the processing of the Client Data, in particular for ensuring that it is entitled to process the contact details of its suppliers and the content of its tenders, comments and notes and to transmit them to the suppliers it chooses.

6.2 The Controller informs the data subjects, in particular the contact persons of its suppliers, in accordance with Art 13 and 14 GDPR. The Processor supports it in this in that every invitation names the Controller as responsible for the contact details and refers to the Controller’s privacy information where the Controller has stored a link to it in the workspace, and every email sent by the platform refers in its footer to Mailingbid’s privacy policy. This support does not replace the information to be provided by the Controller.

6.3 The Controller enters into free-text fields (notes, remarks, names of parts, own references, comments, messages to suppliers) only the personal data necessary for the respective purpose. It is aware that

a) its own references for tenders and suppliers are transmitted unchanged to its webhook addresses,

b) the names of parts and the other details of how a tender is structured are shown to the invited suppliers and used for extracting replies.

6.4 The Controller alone determines where events sent to webhook addresses go. It is responsible for the receiving systems, their location and any associated transfer to a third country.

6.5 The Controller keeps the access credentials of its members and its API keys secret, removes departing members from the organisation and revokes keys that are no longer needed.

6.6 If the Controller detects errors or irregularities in the processing of the Client Data, it informs the Processor without undue delay.

7. Confidentiality and access by the Processor

7.1 The Processor ensures that all persons who have access to Client Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art 28(3)(b) GDPR, § 6 DSG (Austrian Data Protection Act)). This obligation continues after their activity has ended.

7.2 The Processor’s administration interface does not display the Controller’s supplier lists, tenders or comments. The exceptions are the checking of received replies under clause 2.4 and the search across non-revoked invitations by which the office assigns a reply that cannot otherwise be assigned to an invitation (Annex 1, section 1.3). Technically, the Processor is able to access the stored data. It does so only insofar as this is necessary for operation, security, troubleshooting, supporting the Controller, carrying out an instruction, measures under ToS 14.9, a switch under ToS 16a or erasure under clause 14.

8. Technical and organisational measures

8.1 The Processor takes the technical and organisational measures described in Annex 1 in accordance with Art 32 GDPR. The Controller can inspect Annex 1 before concluding the Agreement; it is for the Controller to assess whether they are appropriate for its processing (Art 28(1), Art 32 GDPR).

8.2 The measures are subject to technical progress. The Processor may replace them with equivalent or better measures; the level of protection must not fall as a result. It documents material changes in Annex 1 and provides the current version on request.

9. Sub-processors

9.1 The Controller grants general authorisation to engage other processors (“Sub-processors”) (Art 28(2) GDPR). The Sub-processors engaged or planned at the time the Agreement is concluded are listed in Annex 2; they are deemed authorised.

9.2 If the Processor intends to add or replace a Sub-processor, or to engage for the first time a Sub-processor designated as “planned” in Annex 2, it notifies the owners of this by email at least 30 days in advance (name, registered office, activity, place of processing). The Controller may object in text form within 14 days of receipt of the notification on important data protection grounds. If the Processor maintains the engagement, the Controller may terminate the subscription and the User Agreement with effect from the date of the planned engagement; fees already paid for the period thereafter are refunded pro rata (exception to ToS 11.5).

9.3 If the Processor has to replace a Sub-processor urgently, for example because the Sub-processor unexpectedly ceases its service or security so requires, it notifies the owners as early as possible before the engagement, stating the reasons for the urgency. The Controller may object within 14 days of receipt of the notification and then terminate the User Agreement and the subscription with immediate effect; otherwise clause 9.2 applies.

9.4 The Processor engages only Sub-processors on which, by contract under Art 28(4) GDPR, substantially the same data protection obligations are imposed as on the Processor under this Agreement, verifies this before the engagement and provides the relevant contracts on request. If a Sub-processor fails to fulfil its data protection obligations, the Processor is liable to the Controller for this under Art 28(4) GDPR as for its own conduct (clause 16).

9.5 The following do not constitute sub-processing within the meaning of this Agreement:

a) services in which the third party is given no access to Client Data, for example network and transport services or the provision of software source code and deployment tools;

b) transmissions to recipients designated by the Controller itself, in particular to the invited suppliers and to its webhook addresses;

c) services that the Processor uses for its own processing under clause 2.5, in particular the payment service provider for the subscription, and the receipt, checking and extraction of incoming replies until their handover, insofar as no details from the Controller’s tenders are transmitted in the process (Annex 2).

10. Place of processing and transfers to third countries

10.1 The Processor processes Client Data in the EU or the EEA and in Switzerland (adequacy decision), see Annex 2. It transfers Client Data to a third country or an international organisation only if the conditions of Art 44 to 49 GDPR are met. Annex 2 states which Sub-processors in turn use entities in third countries and on what basis they do so.

10.2 If the Controller invites suppliers established outside the European Economic Area or enters webhook addresses whose systems are located outside it, the transfer there takes place on its instruction. The Controller assesses whether such a transfer is permissible.

11. Assistance with the rights of data subjects

11.1 The Processor assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR (Art 28(3)(e) GDPR). The platform allows the Controller itself to rectify and remove contacts, deactivate suppliers, delete comments, delete tenders that have never been sent and retrieve stored data in the workspace, via the API and as an export.

11.2 If a data subject contacts the Processor with a request concerning Client Data, the Processor forwards it without undue delay to the Controller’s owners and does not respond to it itself, except on the Controller’s instruction.

11.3 Anything the Controller cannot do itself using the functions of the platform, for example deleting tenders that have already been sent, offers received or individual details in them, is carried out by the Processor on instruction in text form; clause 5.3 applies.

12. Assistance with security, notifications and impact assessment

12.1 Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with the obligations under Art 32 to 36 GDPR (security, notification and communication of breaches, data protection impact assessment, prior consultation), in particular by providing information on Annex 1 and Annex 2 and on the platform’s processes.

12.2 Providing existing documents and information is free of charge. The Processor may charge for any effort beyond this in accordance with clause 5.3.

13. Breaches affecting Client Data

13.1 The Processor notifies the Controller of a personal data breach affecting Client Data without undue delay after becoming aware of it, where possible within 48 hours (Art 33(2) GDPR). The notification is sent by email to the Controller’s owners.

13.2 The notification contains, insofar as known, the information under Art 33(3) GDPR: the nature of the breach, where possible the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, plus a contact point. The Processor provides anything not yet known without further undue delay.

13.3 The Processor takes without undue delay the measures necessary to secure the data and to mitigate possible adverse effects. Notifying the supervisory authority and communicating the breach to data subjects are the Controller’s responsibility; the Processor assists it in this in accordance with clause 12.

14. Return and erasure

14.1 During the User Agreement, the Controller can retrieve the Client Data in the workspace and via the API, including as an export under ToS 16a.4, and also after a subscription has ended (ToS 16.4). Sending new tenders requires an active subscription; reading does not.

14.2 After the end of the provision of the processing services, the Processor, at the Controller’s choice, erases all Client Data or returns it to the Controller and deletes existing copies, unless Union or Austrian law requires storage of the data (Art 28(3)(g) GDPR). Return takes place by means of the export under ToS 16a.4, which the Controller can retrieve

a) after a switching request involving a switch to another provider or to its own systems (ToS 16a.1(a) and (b)), during the transitional period and the retrieval period (ToS 16a.2, 16a.3); thereafter the Processor erases the Client Data within 30 days;

b) after a switching request in which erasure is chosen (ToS 16a.1(c)), until the end of the notice period; in that case there is no transitional period and no retrieval period, and the Processor erases the Client Data within 30 days of the end of the User Agreement (ToS 16a.3);

c) if the User Agreement ends in any other way, for a further 30 days after its end; thereafter the Processor erases the Client Data within 30 days (ToS 16.5).

14.3 Client Data in backups is not erased separately. It is overwritten when the retention period of the backups expires (Annex 1, section 3), and until then the Processor uses backups only for restoration after an outage.

14.4 Copies of emails and sending logs held by the email delivery provider are deleted by that provider in accordance with its own retention periods (Annex 2).

15. Evidence and audits

15.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art 28 GDPR (Art 28(3)(h) GDPR). This Agreement with its annexes and written answers from the Processor to specific questions serve primarily as evidence.

15.2 If, in an individual case, the Controller does not consider this evidence sufficient, the Processor allows for audits, including inspections, by the Controller or an auditor mandated by it. Audits must be announced in text form at least 30 days in advance, take place during normal business hours and must not disrupt operations disproportionately; they take place no more than once per calendar year, except where there are indications of non-compliance, after a breach affecting Client Data or by order of a supervisory authority. An auditor must be bound to confidentiality. The Processor may object for good cause to an auditor who is in competition with it.

15.3 The Processor does not operate its own data centres; the servers are located with the hosting provider named in Annex 2. Audits there are limited to the evidence that this provider makes available.

15.4 Each Party bears its own costs of an audit. The Processor may charge for its effort in an audit under clause 15.2 in accordance with clause 5.3, unless the audit reveals a material breach by the Processor of this Agreement or the GDPR.

16. Liability

16.1 Art 82 GDPR applies to liability towards data subjects.

16.2 As between the Parties, ToS 19 applies. Under ToS 19.4, ToS 19.2 and 19.3 also apply to claims under this Agreement, unless Art 82 GDPR or other mandatory law precludes this; the cap under ToS 19.3 does not apply to breaches of the obligations concerning the handling of the Controller’s data, to gross negligence tantamount to intent, or to intent. The Processor is liable for Sub-processors under Art 28(4) GDPR as for its own conduct.

17. Order of precedence

17.1 In the event of conflict, this Agreement takes precedence over the Terms of Service in matters concerning the processing of personal data on behalf of a controller (ToS 1.4). The annexes form part of this Agreement.

17.2 Mailingbid’s privacy policy informs data subjects; it does not form part of this Agreement.

18. Final provisions

18.1 Amendments and additions to this Agreement must be made in text form. Changes to Annexes 1 and 2 are governed by clause 8.2 and clause 9.

18.2 If mandatory provisions of data protection law change, the Parties adapt this Agreement accordingly.

18.3 Should any provision of this Agreement be or become invalid, the remaining provisions remain valid. The invalid provision is replaced by a valid provision that comes closest to its purpose; in case of doubt, the requirements of Art 28 GDPR apply.

18.4 Austrian law applies, excluding its conflict-of-laws rules. Jurisdiction is governed by ToS 24.2 (the court in Vienna Innere Stadt having subject-matter jurisdiction).

18.5 This Agreement is drawn up in German. Translations are for information purposes only.


Annex 1 – Technical and organisational measures (Art 32 GDPR)

Status as at the entry into force of this Agreement. Where a measure has limits, this is stated.

1. Confidentiality (Art 32(1)(b) GDPR)

1.1 Physical access control

  • The Processor does not operate its own server rooms. The platform runs on a server of Hetzner Online GmbH at the Nuremberg data centre location; backup copies are stored with Hetzner at the Helsinki location (Annex 2). Physical access to the data centres is controlled by Hetzner.

1.2 System access control

  • Login to the server is possible only with an SSH key; password login is disabled. Keys exist for the operator and for the automated deployment of new software versions.
  • Repeated failed login attempts on the server are blocked automatically (fail2ban).
  • An upstream firewall allows only SSH, HTTP, HTTPS and ICMP. The application itself cannot be reached directly from the internet, only via the web server, which handles encryption.
  • Security updates to the operating system are installed automatically.
  • Login to the platform is passwordless, via login links sent by email. A link is valid for 30 minutes and can be used only once; only a hash value is stored. The page for redeeming the link redeems it only after a click.
  • The session is held in an encrypted cookie that cannot be read by the page’s scripts and is valid for no more than 30 days. Each session carries a version that is stored with the account; incrementing the version ends existing sessions on the server side.
  • Write requests from other websites are rejected (protection against cross-site request forgery).
  • API keys are displayed only once, when they are created; a hash value (SHA-256) and the first characters are stored. Keys can be revoked; if a member leaves the organisation or is removed, the organisation keys created by that member are permanently revoked.

1.3 Data access control and tenant separation

  • Each tender, each supplier on the list and each organisation key belongs to exactly one organisation. Only active members of that organisation have access; membership is read from the database on every request, and removing a member or disabling an organisation takes effect with the next request.
  • Roles: owner and member. Only owners can change the team, the webhook addresses and the subscription.
  • For data of another organisation, a member receives the same response as for data that does not exist; the existence of other organisations’ data therefore cannot be inferred.
  • The functions of the Mailingbid marketplace refuse access to data of Mailingbid for agencies for every user, including administrator accounts.
  • The Processor’s administrator accounts are never members of an organisation. The administration interface does not display the organisations’ supplier lists, tenders or comments; the mail inbox is accessible only to administrator accounts. Exception: in order to assign a reply that cannot otherwise be assigned to an invitation, the office can search the non-revoked invitations of all organisations by tender number or supplier name; the search shows the name of the organisation, the name of the supplier, the tender number, the time of sending, any decline and the number of offers.
  • Contact persons of suppliers can reach only the invitations of their own supplier.
  • If the Controller removes a contact person, that person loses access to that supplier’s invitations immediately; at the same time, the access links of all non-revoked invitations of that supplier are renewed and the old links cease to be valid. Remaining contact persons who had already received the invitation by email receive the new link by email for open tenders, insofar as sending limits allow.
  • If the Controller deactivates a supplier, its contact persons lose access to its invitations immediately. The access links are not renewed in this case: if the supplier is reactivated, the previous invitations can be reached again with the old links.
  • Access links to invitations, team invitations and reply addresses are not stored in plain text; they are either stored as a hash value or derived from a stored random value using a server key.
  • Unchecked attachments of received emails are managed separately from the tenders’ files and are accessible only via the administration’s mail inbox. Files are stored on the server under random names.

1.4 Separation from other applications

  • The platform runs in its own container with its own data storage. The server is also used for other applications of the Processor; these run in their own containers, and the platform’s data storage is mounted only in the platform’s container.

1.5 Encryption and pseudonymisation (Art 32(1)(a) GDPR)

  • All connections to the platform use HTTPS with automatically renewed certificates; the web server instructs browsers to access the domain and its subdomains only in encrypted form (HSTS).
  • The platform communicates with the services for sending emails, retrieving attachments and extraction only via HTTPS; backup copies are transferred over an encrypted connection (SFTP).
  • Webhook addresses must use HTTPS; each event is signed with a secret that is not stored but derived when needed.
  • The external backup copies are encrypted. The database, the files and the backups on the server itself are not separately encrypted; they reside in the server’s file system, which is accessible only via the access routes described in section 1.2.
  • Counters against abuse hold IP addresses only in memory and do not store them.

2. Integrity (Art 32(1)(b) GDPR)

2.1 Transfer control

  • Transmissions are made only to the Sub-processors named in Annex 2 and to the recipients designated by the Controller (invited suppliers, webhook addresses).
  • Webhooks are not delivered to addresses in private networks or in the Processor’s own networks; the resolved target address is checked.
  • Webhook events contain only identifiers and the Controller’s own references, and no names, addresses, prices or texts of suppliers.
  • The email delivery provider passes on incoming emails only via a protected, authenticated interface.
  • The platform is able to evaluate sender authentication results (SPF, DKIM, DMARC) from delivery. This evaluation is deliberately not switched on at present, and the email delivery provider does not supply such results. The sender of any incoming email is therefore regarded at most as “not confirmed”; an email with a failed check result in one of its headers or with a high spam score is regarded as “suspicious”. An email forwarded to the Controller therefore does not name a contact as its sender but states the sender address as unconfirmed information.

2.2 Input control

  • The platform records which member created a tender, last invited suppliers, last confirmed a work step and made the award, who wrote a comment and which person at the Processor last processed a received email, in each case with the time. An operation triggered via the API is attributed to the member who created the key.
  • There is no change log. Earlier actors are overwritten, and no record is kept of who removes contacts, moves deadlines or changes content. The platform does not delete members’ accounts; the references remain even if a member leaves the organisation.
  • A submitted offer is final; changes are made only after the Controller has handed it back for correction.
  • Uploaded files are checked by file type and extension (PDF, PNG, JPEG, WebP); archives are not accepted; attachments of received emails are identified by their content, and Office documents and executable files are not accepted.

3. Availability, resilience and recovery (Art 32(1)(b) and (c) GDPR)

  • Every day a consistent copy of the database is taken and checked for integrity; it is stored as an archive together with all stored files. The files themselves are not checked separately in the process.
  • Around 15 daily backup versions are kept on the server. Every day they are transferred in encrypted form to storage at Hetzner at a different location (Helsinki); there the server keeps 7 daily, 4 weekly and 6 monthly versions and deletes older ones itself. The storage can be reached only from Hetzner’s network and is locked as a whole against accidental deletion. Protection against deletion by a compromised server is provided only by the snapshots of the last ten days, which the storage creates itself and which the server cannot delete.
  • In addition, the Hetzner Cloud backup function is enabled for the entire server.
  • Restoring the platform from the external backup is tested regularly; the date and result are recorded.
  • The application is restarted automatically after a crash and is continuously monitored to check that it is functioning. When shutting down, it waits for ongoing operations so that emails already started are not lost.
  • Rate limits and size limits (uploads, stored emails per invitation and per organisation, retrievals of attachments) protect against overload and abuse. Background jobs are retried in the event of errors; jobs that ultimately fail are reported to the Processor.
  • Logs: the application writes only the path of a request to its logs, not its parameters, and removes secret values before writing. The web server keeps no access log; for warnings and errors it writes the time, the IP address and the path of the request to its log, but not the request parameters or any headers that may contain credentials. The logs of the application and of the web server are each limited to three files of 10 MB and are overwritten on a rotating basis.

4. Process for regular testing (Art 32(1)(d) GDPR)

  • Every new software version undergoes automated tests before deployment; among other things, these check for every interface the separation of organisations, the access rules and that the privacy policy matches the behaviour of the platform.
  • Changes to login, access checks, tenant separation, the sending and receiving of emails, webhooks and billing are additionally reviewed before deployment in a second, independent review; the review and its result are recorded with the change proposal.
  • This annex is reviewed and adapted whenever the platform changes materially.

5. Data protection by design and by default (Art 25 GDPR)

  • Invited suppliers do not see the title of a tender, the indication of on whose behalf the tender is issued, the own reference, the codes of the country rows or the return addresses; they see remarks and files only insofar as the Controller releases them.
  • A Controller’s supplier list is not visible to any other customer and is not used for the marketplace.
  • An imported CSV file is read only for the preview and the import and is not stored.
  • The member’s message and the PDF of the tender in an invitation are generated only for sending and are not stored separately.
  • No HTML is stored from incoming emails; attachments of emails that cannot be assigned are not retrieved.
  • Automatic erasure periods in accordance with Annex 3.
  • The agencies’ workspace is not covered by the website statistics.

6. Organisational measures

  • The Processor is a sole trader; the operator runs the platform personally. Persons with access to Client Data are bound to confidentiality under clause 7.1 of the Agreement.
  • Sub-processors are engaged only in accordance with clause 9 of the Agreement.
  • Tools and assistants that the operator uses for maintaining the server are given no access to database contents, uploaded files or backup copies; the operator carries out such access personally.

Annex 2 – Sub-processors

Status as at the entry into force of this Agreement.

Sub-processorRegistered officeActivity on behalf of the ProcessorClient Data concernedPlace of processing, third-country aspectsStatus
Hetzner Online GmbHGunzenhausen, GermanyOperation of the server (Nuremberg data centre); storage for encrypted backup copies (Helsinki, Finland); Hetzner Cloud backup functionall Client DataGermany and Finland (EU)engaged
Sendinblue SAS (Brevo)Paris, FranceSending the platform’s emails to contact persons of suppliers and to members; retention of sending logs and copies of the emails in accordance with its own retention periodsname and email address of the recipients, content of the emails including the member’s message and the PDF of the tenderdata centres in France and Belgium. According to Brevo, some of its sub-processors are located outside the EEA, in particular in the USA and India; basis: adequacy decision on the EU-US Data Privacy Framework or standard contractual clauses (Art 46(2)(c) GDPR)engaged
Mistral AI SASParis, FranceAI-assisted extraction of suppliers’ replies; a Sub-processor only insofar as details from the Controller’s tenders are transmitted in the processstructure of the tender: for each country, quantity and posting date; for each part, type, name (up to 120 characters), format, number of units and whether the part is supplied; scope of services; internal numbers of the countries and partsEU endpoint; according to Mistral, processing in data centres in the EU and in EFTA statesengaged since 20 October 2026; data processing agreement with Mistral accepted, use for training switched off
Proton AGPlan-les-Ouates, SwitzerlandReceipt and storage of emails sent to the Processor’s addresses on the domains mailingbid.com and salat.techonly occasionally: messages from the Controller (for example instructions under clause 5.3) and requests from data subjects (clause 11.2), insofar as they contain Client DataSwitzerland; adequacy decision of the European Commission (Art 45 GDPR)engaged

Second-tier sub-processors. The further processors engaged by the service providers named above are set out in their lists as amended from time to time:

  • Hetzner Online GmbH: Annex 3 “Approved Subcontractors” to the Data Protection Agreement, https://www.hetzner.com/AV/DPA_en.pdf (DPA version 1.2 of 17 February 2026, annex version 1.0 of 8 August 2024; retrieved on 3 November 2026)
  • Sendinblue SAS (Brevo): Annex 2 “List of Sub-Processors” to the Data Processing Agreement in the Brevo Terms of Service, https://www.brevo.com/legal/termsofuse/ (version of 1 October 2025; retrieved on 3 November 2026)
  • Mistral AI SAS: https://trust.mistral.ai/subprocessors (Trust Center, undated; referred to in the Data Processing Addendum https://legal.mistral.ai/terms/data-processing-addendum, version of 27 July 2026; retrieved on 3 November 2026)
  • Proton AG: section “Data processors” of the privacy policy, https://proton.me/legal/privacy (version of 12 May 2026; referred to in the DPA https://proton.me/legal/dpa; retrieved on 3 November 2026)

The Processor provides documentation on transfers to third countries (for example standard contractual clauses) on request.

Services that come into contact with Client Data but do not act as Sub-processors under this Agreement (clause 9.5):

  • Brevo receives the replies on the reply domain and holds their attachments ready for retrieval, and Mistral extracts the content of the replies themselves (text, attachments). In doing so, both act as processors of Mailingbid for its own processing until the handover (clause 2.4, clause 2.5(d)). Likewise, Proton receives the notices to the Processor’s office about newly received replies within this framework.
  • Stripe (Stripe Payments Europe, Limited, Ireland): handles the Controller’s subscription. For this purpose, the Processor processes its own contract data (clause 2.5(b)); no Client Data is passed to Stripe.
  • Invited suppliers and systems behind webhook addresses: recipients designated by the Controller (clause 9.5(b)).
  • Services for the source code and deployment of the software: they receive no Client Data (clause 9.5(a)).
  • The Processor runs the website statistics itself on the server listed in row 1; they do not cover the workspace.

Annex 3 – Types of data, data subjects and storage periods

The storage period describes how long the platform stores Client Data during the User Agreement. The following also applies to all rows: copies in backups are overwritten when the backups expire (around 15 days on the server, up to six months in the external storage, Annex 1 section 3); return and erasure after a switching request or after the end of the User Agreement are governed by clause 14.

Details of the Controller’s members (the member who created, invited, confirmed or awarded, the author and read status of comments, confirmations of work steps) are processed by the Processor on its own responsibility (clause 2.5(a)); they are therefore not included in this table.

No.AreaCategories of data subjectsTypes of dataStorage period during the User Agreement
1Supplier listcontact persons at suppliers; suppliers, insofar as they are natural persons (for example sole traders)for each supplier: name, type (lettershop, printer), country, language, own number, internal notes, information on ISO 27001 certification; for each contact person (no more than ten per supplier): email address, optionally name and phone number, as kept by the Controllerfor as long as the Controller keeps the contact. Removal deletes the link to the list immediately. A supplier that has never been invited can be deleted; a supplier that has been invited can only be deactivated, in which case its contacts remain stored until they are removed
2Tenderspersons whom the Controller names in content (for example contact persons of a client, senders in return addresses)title, parts and countries (quantities, dates, formats, specification, names, codes of the country rows), scope of services, offer deadline, payment terms, remarks, return addresses, files, own reference, indication of on whose behalf the tender is issuedfor as long as the organisation exists; no automatic erasure. The Controller can delete a tender that has never been sent, together with its files
3Invitations and emails to supplierscontact persons at suppliersstored: invited supplier, access link (only as a random value or hash value), reply address (only as a hash value), times of sending, of first opening in the supplier portal, of the decline and of revocation, records of which email was sent to which contact person. Not stored, only in the content of the emails sent: the member’s message, the PDF of the tenderstored details for as long as the organisation exists; no automatic erasure. Content of the emails only in the copies held by the email delivery provider, in accordance with its retention periods
4Offers and declinescontact persons at suppliersprices, conditions, comment, PDF files, reason for declining, origin (portal, email), times, handbacks for correctionfor as long as the organisation exists; no automatic erasure
5Award and outcomecontact persons at suppliers (as recipients of the outcome email); third parties named in the internal notechosen offers, time, internal notefor as long as the organisation exists; no automatic erasure
6Team commentsthird parties named in commentsdata of third parties in the text of a commentfor as long as the tender exists. A deleted comment is emptied
7Replies from the mail inbox that have been handed over (clause 2.4)contact persons at suppliers and other senders; persons named in emailsrecorded offer with the PDF attachments selected for it, noted decline with reason; in the case of forwarding, subject, text and selected attachments in an email to the membersoffers and declines as under no. 4; forwarded emails are held in the members’ mailboxes. The received email itself is not Client Data until an export: the Processor processes it on its own responsibility (clauses 2.4, 2.5(d)) in accordance with its privacy policy. The Controller receives emails from which the Processor has recorded an offer, noted a decline or which it has forwarded, together with their attachments, with the export under ToS 16a.4(k); upon export they are deemed to have been handed over (clause 2.4)
8Webhookspersons to whom identifiers and own references indirectly relateaddress, description, subscribed events, status; for each delivery: content of the event (identifiers, own references), attempts, times, status code, error class, excerpt of an unsuccessful response (no more than 200 characters)deliveries are deleted automatically 30 days after the event; the address until an owner deletes it
9Data via the API and exportas nos. 1 to 8as nos. 1 to 8as nos. 1 to 8

Single point of contact under the Digital Services Act

The single point of contact under Art 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act) for users and for the authorities of the Member States, the European Commission and the European Board for Digital Services is the operator of the platform, Christoph Salat (salat.tech).

Email: kontakt@mailingbid.com
Languages: German and English

The point of contact can be reached by e-mail; a human being replies.

Mailingbid

An offering by Christoph Salat · salat.tech

Mailingbid

  • How it works
  • Start a request
  • For agencies
  • Pricing
  • For printers

Guides

  • Guides and calculators
  • API documentation

Legal

  • Imprint
  • Privacy
  • Terms
  • Contact