Does OneBox work under the GDPR?

In short, yes, OneBox works according to the GDPR.
If detailed:
1. GDPR implies that there is a data controller and there is a processor.
With regard to OneBox, then any of our cloud clients is a data controller, and our OneBox infrastructure is a handler.
2. For each cloud client, we create a separate cloud server (sometimes more than one), where the data of a particular client is stored ONLY on this server. When our client pours the data of his clients into his box, they are stored ONLY within his box, the controller (client) has full control over what happens with this data. For example, if a client deletes or disables their box, we will delete or disable the required server, and the data will automatically become inaccessible.
3. As required by the GDPR, we are responsible for the infrastructure and that without the knowledge of the client, his data is not transferred anywhere.
And within a specific box, the client manages his own data and determines the policies for their storage and processing.
In the simplest terms possible:
- all contacts of clients that get into the box will be only in this box
- the owner of the box himself subscribes clients to his spam or not, what mailings to do or not to do, how to delete and how to unsubscribe
- we (OneBox) do not go into the database of clients of a particular box, do nothing with it, do not subscribe anyone from this database to mailing lists, do not transfer this database anywhere and do not store it anywhere else.