Scope and Purpose of Personal Data Processing

Subject, Nature, and Purpose

The processing is carried out for the purpose of providing the Service to the Customer based on the Main Agreement and to fulfill Vercom's obligations arising from this Data Processing Agreement, particularly concerning the security of data, including ensuring their integrity and availability.

Duration of Processing

The data processing period will be the same as the period of providing the Services under the Main Agreement, with the understanding that the data processing agreement is in effect until the data is deleted in accordance with its provisions.

Categories of Individuals

The processed personal data pertains to the following categories of individuals: End Users – individuals who are recipients of electronic communication sent by the Customer based on the Main Agreement.

Special Categories of Personal Data

Special categories of personal data processed include the following categories: Not Applicable.

Approved Subcontractors for Processing

To provide services, Vercom collaborates with domestic telecommunications operators (for domestic SMS delivery) and international SMS service providers (for sending SMS messages abroad).

Detailed List of Primary Data Processors

EntityScope of EntrustmentAreaCertificationsDescription sp. z o.o.,

11 Adama Kręglewskiego Street, 61-248 Poznań

Data Centers and Server Rooms (Colocation, Backup.






ANSI TIA 942 Rated4

EN50600 class4

The sole data center in the EU with the highest level of security confirmed by two independent entities: ANSI/TIA-942 Rated 4 certification and EN 50600 Class 4 standard for all server chambers.

NTT Global Data Centers EMEA GmbH Voltastraße 15, 65795 Hattersheim

Data Centers and Server Rooms (Colocation, Backup.


ISO 9001

ISO 22301

ISO 50001

ISO 27001 IT-GS (BSI)


The facility meets the requirements of the international Tier III standard. This ensures a minimum resource availability of 99.999% and redundancy of key elements.

Cyber Folks S.A.

22 Roosevelta Street, 60-829 Poznań

Hosting Services


A backup of Vercom's corporate email, as well as files and databases from the company's websites, is executed and maintained as part of the hosting service provided by Cyber_folks for Vercom.

Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, LU-1855 Luxemburg, R.C.S., Luxemburg: B186284

Data Backup


Data processed as part of the Services is handled on servers owned by VERCOM. In the case of backups, the data is fully encrypted on our end and transferred to our backup servers in the CPD and/or on servers provided by third-party entities (such as Amazon) off-site in the cloud.

Cloudflare, Inc.,

USA 101 Townsend St, San Francisco, CA 94107, USA

Provider of solutions to enhance the security of services provided (WAF service).


If you do not want your data to be processed by Cloudflare, you can opt out of this option. MORE >>

The service provided by Cloudflare, Inc. to Vercom S.A. includes the Web Application Firewall (WAF). The incorporation of WAF into Vercom's services aims to enhance the security of services provided by Vercom to the company's clients.

Vercom has ensured appropriate provisions in the agreement, including, among others:

  • Inclusion of the Data Localization Suite (DLS) option for the WAF service – through DLS, information processed by Vercom as part of the services remains within the European Union;

  • Inclusion of the EU Customer Metadata Boundary option for the WAF service – ensuring that data processed by Vercom for Vercom's clients will not be transmitted outside the European Union.


Does Emaillabs have a DPA for their client?

Yes, please find the agreement template here.

Does Emailabs have cloud email services?

The SMTP server is provided to the Client by a virtual server separated from the physical server belonging to VERCOM, to which is assigned the IP address used for sending e-mail messages. The SMTP server can be shared or dedicated to the client. it is always a VPS (Virtual Private Server).

Diagram of the technical structure of the EmailLabs Service:

I. "Sending" part

The main functionality of the EmailLabs Service is the possibility of mass sending e-mail messages to the address database specified by the customer.

II. Database part

It includes the processing of data on a completed email sent. The data is logically separated.

Therefore, it should be stated that the data contained in e-mail messages sent using the EmailLabs Service are processed on servers belonging to VERCOM.

In the case of backups, the data is encrypted (and stored in this form on servers provided by third parties.

Do you process data outside European Union?

Vercom declares that the Processing of Personal Data shall be performed in the territory of the European Union or the European Economic Area, unless the obligation to transfer the Personal Data to the third country, in the meaning of the GPDR, derives from the Law

What the data processing process at EmailLabs looks like?

The processing of entrusted data (in the context of the GDPR) distinguishes:

  1. Data in transit: data is encrypted with SSL.

  1. Data at rest: we store only the e-mail addresses of e-mail recipients (e-mail logs in the panel). This data is not encrypted due to the computational overhead of processing such databases. However, in 2024 Quarter 1 there will be a functionality of data anonymization.

IS 2FA method available?

Yes, the panel has the ability to manage users and various access levels.

Does user panel has a managing access levels for different users?

Yes, the panel has the ability to manage users and various access levels.

Is there data anonymization available?

In March 2024 we implement the data anonymization option: as injected status will be processed into the database, a log with an anonymized TO address is saved.

When the final email status is processed (OK, harbounce, dropped, etc.), the status is saved to the database and the server logs are also anonymized in a similar way to the logs in the database.

Anonymization could involve, for example, leaving the first character and domain, e.g. instead of "" it would be "j***********". On the customer’s side, the log of such an email would be precisely identifiable by the message_id.

What are system backups look like?

System backups (for the purpose of possible loss of operational data, and system recovery) are encrypted with a number of encryption (including AES256) and compression algorithms, entirely on our side and transferred to our backup servers in CPD. All our CPDs are located ONLY within the EEA.

Last updated