What is the difference between controller and processor?
When you outsource the sending of newsletters, another organisation processes personal data on your behalf. The GDPR distinguishes two roles in this context, each with its own rights and obligations. The difference lies in who determines what happens to the personal data.
The controller determines the purposes and means of processing personal data. If your organisation decides why and how personal data is used, then your organisation is the controller. When sending your newsletter, this is your own organisation.
The processor processes personal data on behalf of the organisation that engages it. Laposta fulfils this role: Laposta processes the data of your subscribers, but you decide what happens to it.
Agreements in the data processing agreement
To avoid assumptions and misunderstandings, the division of roles and the associated rights and obligations must be clear. Laposta has explicitly laid down this relationship of authority and these agreements in a data processing agreement.
As the controller, you are responsible for ensuring that you do not store any data in Laposta other than what has been agreed in the data processing agreement. Laposta broadly checks whether no more personal data is processed than has been agreed.
Laposta is explicitly not suitable for processing special categories of personal data. Examples include medical data, criminal record data, or data concerning religion, sexual orientation, or membership of political organisations.