Data Processing Terms

1. Parties and application

The provider is Storybook OÜ, operating under the Sibly brand (Sibly). The customer is the person identified in the order or service agreement. For personal data processed on the customer's behalf, the customer is generally the controller and Sibly the processor. If the customer is itself a processor, it confirms its authority to appoint Sibly as a subprocessor and issue these instructions.

These terms become an annex to the service agreement by written or electronic agreement between the parties. Visiting the website does not form a contract. The order records the customer, services, package, processing start date and applicable terms version. For conflicts concerning personal data processing, this annex prevails over general service terms; mandatory law always applies.

Sibly's processing of its own account, billing and customer communication data is covered by the privacy policy. This annex does not authorise Sibly to use customer mailbox or website content for its own marketing.

2. Subject matter, purpose and duration

Processing serves delivery, secure operation and recovery of the ordered service and compliance with customer instructions. It may include receiving, storing, organising, transmitting, backing up, restoring, modifying, exporting and deleting data. Processing continues during service delivery and afterwards only as needed for return, deletion or statutory retention.

The customer specifies actual data categories and authorised users. Planned processing of special-category data, offence data or other high-risk content must be agreed separately before it begins, with appropriate measures. The presence of such data does not release Sibly from protecting data already entrusted to it.

AI content processing, long-term archiving and other additional data flows require a separately defined scope, partner, instruction and retention arrangement in the service description. This annex does not grant general permission to send all customer content to AI services.

3. Customer instructions and responsibilities

Documented instructions include the service agreement, selected settings and instructions from authorised users through the customer environment or agreed channel. Sibly verifies authority for sensitive operations. The customer is responsible for the legal basis for collection, notices to individuals, data accuracy, and its users' permissions and devices.

Sibly processes data only on documented instructions, including international transfers. Where EU or Member State law requires otherwise, we inform the customer before processing unless the law prohibits notice. If we consider an instruction to infringe data protection law, we inform the customer immediately and suspend the relevant operation until a lawful solution is found.

Protecting the service may require restricting a compromised account. Restrictions must be necessary and proportionate; the customer receives the reason and next steps as soon as possible. This does not authorise other uses of customer content.

4. Access and security measures

Sibly implements technical and organisational measures appropriate to the risk. The following describes measures to be agreed in the service contract. Security levels are not unilaterally reduced during the service.

Staff access to mailbox or website content must be based on a documented work requirement, customer instruction or legal obligation and limited to necessity. Access and significant administrative actions are logged; passwords and secret keys are not written to logs.

No measure eliminates every risk. Security and appropriate configuration of the customer's devices, accounts and additional applications are also necessary.

5. Email-specific arrangements

Email hosting uses Qboxmail. Spam, antivirus and other security checks involve automated message analysis. Availability and activation of additional measures, such as user multi-factor authentication, IP restrictions and advanced malware protection, are specified in the package.

Mail Time Machine provides daily recovery points up to 15 days old within the partner's described scope. It does not guarantee recovery of messages received and deleted between snapshots. Long-term archiving is a separate service with an agreed retention period, not activated for everyone by default.

Qboxmail may process some usage and security data as an independent controller, as described in its user privacy notice. Services within Sibly's subprocessing chain are based on Qboxmail's data processing agreement; the partner's obligations do not replace Sibly's responsibility to the customer.

6. Subprocessors and data locations

By contractually agreeing to these terms, the customer gives general written authorisation for partners listed in the subprocessor register provided before acceptance. The register identifies each legal entity, processing task, data categories, location and safeguards for any transfers outside the EEA. It forms part of the agreement; a general reference to using partners does not replace it.

We give at least 30 calendar days' notice before engaging a new or replacement subprocessor. The customer may raise a reasoned data protection objection within 14 calendar days of notice. A solution must be agreed before using the disputed partner. If none is found, the customer may terminate the affected service without a termination penalty. Faster engagement requires prior specific authorisation.

Sibly enters into a written agreement passing appropriate data protection duties to the subprocessor and remains responsible to the customer for its performance. A supplier's certificate is not Sibly's own certificate.

Under Qboxmail's agreement, hosted content and backups are held in the EEA. Other locations and partner data flows are specified in the service annex. Transfers outside the EEA require documented instructions and an applicable safeguard, such as an adequacy decision or European Commission standard contractual clauses with necessary supplementary measures. Email to international recipients and customer-selected external applications may involve separate transfers.

The service annex covers: the exact Qboxmail contracting entity and its subprocessors, hosting and backup partners, locations and safeguards. An AI partner is included only when the corresponding service is agreed. Payment and domain partners' roles are assessed by transaction, rather than automatically classifying all as subprocessors.

7. Breach notification and customer assistance

We notify the customer without undue delay of a breach affecting personal data processed on its behalf. The planned internal maximum for initial notice is 24 hours after awareness; this does not permit postponing an earlier possible notice or waiting until an investigation ends.

We describe the known nature of the incident, affected data and individuals, possible impact, measures taken or proposed, and a contact person. Incomplete information is supplemented in stages. We preserve necessary evidence and help contain impact and restore service.

As controller, the customer decides on notification to authorities and individuals; Sibly provides necessary assistance. This does not limit Sibly's own statutory notification duties. The statutory 72-hour authority notification period is not a waiting period for informing Sibly's customer.

Taking account of the processing and information available to us, we assist with data subject requests, security assessments, impact assessments and, where necessary, prior consultation with authorities. Requests concerning customer content received by us are forwarded without undue delay; we do not make a substantive decision without authority or a legal obligation.

Requests and breach reports: info@sibly.pro. The order records the customer's contact and an alternative for urgent notices.

8. Data return, retention and deletion

When the service ends, the customer chooses return or deletion. Return uses a secure, usable standard format, such as an email export or a copy of website files and the database. Export format, delivery channel and any additional work are agreed. After return, Sibly's copies are deleted as below, except for legally required retention.

Qboxmail's public documents describe 30- and 60-day periods for different situations, with backup exceptions. Termination of an entire reseller agreement is not equivalent to closing one customer mailbox. Customers must know the specific periods for their service before a binding agreement.

Safeguards continue until deletion; restricted backups are used only for necessary recovery. Earlier deletion instructions are reapplied before restored data returns to normal use. Deletion is documented and confirmation provided on request, including backup expiry status.

If retention is required by law, processing is limited to that purpose and duration, and the basis is explained unless notification is prohibited. Sibly's obligation to keep its own invoices does not justify retaining an entire customer mailbox or website. Customer evidence is held separately only under documented instructions or an applicable legal basis.

9. Verification and audit

Sibly provides information needed to assess compliance with its processing obligations and permits checks by the customer or its authorised independent auditor. Descriptions of measures, test results and other relevant evidence may be used first.

Where possible, ordinary audits are agreed at least 10 working days in advance. This does not obstruct necessary checks following an urgent breach, reasonable suspicion of non-compliance or an authority's request. Other customers' data and security-sensitive information are protected during audits.

Any reasonable fee for exceptional additional work is agreed in advance; fees and arrangements must not make statutory audit or assistance duties ineffective. Identified shortcomings are assigned an owner and a risk-appropriate remediation deadline.

10. Changes and contractual annexes

We notify material changes before implementation and retain the version applicable to the customer. Changes to purpose, subprocessor or country must follow customer instructions and the agreed procedure. Publishing new website text alone does not replace a required agreement.

Binding use includes the customer and service order, service-specific categories of data and individuals, an agreed security annex, subprocessors and locations, email-specific arrangements, and the return and deletion schedule.