Contract documents and authorisations

Overview

The contract consists of the quote, the AGB and these annexes: annex 1 – data processing agreement (with the digital mail service and the receipt service); annex 2 – opening and scanning instruction (with the digital mail service); annex 3 – authorisation for formal service and mail authorisation (always, on paper); annex 4 – obligation of secrecy under § 203 StGB (for professionals bound by secrecy, on paper).

For every acceptance and signature we store the date, the version of the document and the evidence (for example your email or the signed original).

Withdrawal and changes

We only enter into contracts with businesses; there is therefore no statutory consumer right of withdrawal.

The client may change or revoke the opening instruction (annex 2) at any time in text form – in the client account or by email; this applies to mail that reaches us after the change has been received. The client changes recipients and rules for scans in the client account; the change applies to scans sent afterwards.

The authorisations (annex 3) apply for the term of the contract and the run-off period under clause 11 of the AGB; before that the client may revoke them at any time in text form. Once they expire, we return the signed authorisations to the client (§ 175 BGB) and no longer accept registered mail or formal service of documents for it.

Annex 1 – Data processing agreement (Art. 28 GDPR)

Subject matter and duration: WITOS GmbH (processor) processes personal data on behalf of the client (controller) where, for the digital mail service, it opens and scans the client’s mail, stores the scans, provides them and sends them to the client’s recipients, and, for the receipt service, processes the client’s receipts. It operates the client account as such as a controller in its own right. The agreement applies for as long as the client uses one of these services and thereafter until its data have been deleted or returned (paragraph “Deletion and return”).

Data and data subjects: the data subjects are senders, addressees and persons named in mail and receipts. The data processed are names, contact, contract and payment data and all content of the mail – including special categories of personal data (Art. 9 GDPR) where the mail contains them.

Instructions: we process the data only on the client’s documented instructions – the opening instruction, the recipients and rules in the client account and instructions in text form – unless we are legally required to process it. If we consider an instruction unlawful, we tell the client.

Confidentiality and security: we only use staff bound to confidentiality and take the measures required by Art. 32 GDPR, in particular roles with minimal rights and an additional one-time code for staff, encrypted storage of files (AES-256), encrypted backups, a log of every access to files, locked storage of originals and a checking period before scans are sent.

Sub-processors: the client agrees to the use of the following sub-processors: IONOS SE (server and email mailbox, Germany), Backblaze, Inc. (encrypted backups, EU Central region, Netherlands; EU-U.S. Data Privacy Framework and EU standard contractual clauses), Google Ireland Limited (sending emails). We inform the client in text form, stating name, task and processing location, at least 30 days before a new or replaced sub-processor – including an external provider for destroying originals – is used; the client may object within this period. If the client objects, we do not use the new sub-processor for the client’s data or, where this is not possible, either party may terminate the options concerned (digital mail service, receipt service) with effect from the date the new sub-processor is to be used. Recipients to whom we send scans and receipts on the client’s instructions – such as its tax advisor or the receipt inbox of its accounting software – are not sub-processors.

Support and notifications: we support the client with requests from data subjects, with notifying personal data breaches and with data protection impact assessments. We notify the client of a breach affecting its data without undue delay after becoming aware of it.

Deletion and return: after the end of the contract the client can download its data from the client account for 6 months; after that we delete it unless there is a legal obligation to keep it. We do not keep receipts for the client’s retention obligations under § 147 AO and § 257 HGB; the client fulfils these in its bookkeeping system or with its tax advisor. Originals are handled under clause 11 of the AGB.

Evidence and audits: we provide the client with the information it needs to demonstrate compliance with Art. 28 GDPR and allow audits by prior arrangement.

Annex 2 – Opening and scanning instruction

The client instructs WITOS GmbH to open letters addressed to it at Cauerstr. 23, 10587 Berlin, scan them in full and send the scans to the recipients it specifies in the client account. The instruction covers mail to the company and to its management in that capacity. Letters that are clearly addressed personally to other persons (for example “personal” or “confidential”) are covered only if those persons themselves agree.

The client may limit the instruction to certain letter types (for example invoices only) and change recipients and rules at any time in the client account.

The client declares that it is entitled to decide on the opening of this mail (§ 202 StGB).

Annex 3 – Authorisation for formal service and mail authorisation (on paper)

“We – the company named below, represented by the undersigned persons authorised to represent it – hereby authorise WITOS GmbH, Cauerstr. 23, 10587 Berlin, for the term of the business address contract and the subsequent run-off period under clause 11 of the AGB, to receive all items addressed to us at this address, including registered mail and formal service of documents by courts and authorities (§ 171 ZPO, § 7 VwZG). This authorisation does not entitle it to open the items. We may revoke it at any time in text form.” On the form, the client enters its company name and address; the persons authorised to represent it sign with name and position.

In addition, the client signs the Deutsche Post mail authorisation (Postvollmacht) and, where necessary, authorisations of other delivery services.

We keep the originals and present them to delivery services, courts and authorities on request. When an authorisation ends, we return the original to the client (§ 175 BGB).

Annex 4 – Obligation of secrecy (§ 203 StGB)

For clients bound by professional secrecy (for example doctors, lawyers, tax advisors): the client engages WITOS GmbH as an assisting person within the meaning of § 203(3) sentence 2 StGB and obliges it to keep confidential all third-party secrets that become known to it when receiving, storing, scanning and forwarding the client’s mail (§ 203(4) sentence 2 no. 1 StGB; for lawyers also an agreement under § 43e BRAO, for tax advisors under § 62a StBerG). The obligation continues after the end of the contract.

WITOS GmbH has been informed that unauthorised disclosure is a criminal offence under § 203(4) StGB. To perform the contract it may use its staff and the sub-processors named in annex 1; beforehand it obliges everyone who may come into contact with the mail to confidentiality in text form and informs them of the criminal consequences. It takes note of the contents of the mail only as far as the service requires.

For these clients we send scans by default only as a link to the client account, not as an attachment.

Last updated: October 2026 · Only the German version is legally binding.