Data processing agreement (summary)

1. Roles

The customer is the controller of the data about its contacts and users. We are the processor and process it only on the customer's behalf.

2. What the processing covers

• Purpose: providing the service, that is storing contacts, sending email from the customer's mailboxes, fetching and sorting replies and writing reply drafts.
• Data subjects: the customer's contacts and recipients, and the customer's users.
• Data: name, email address, job title, website, the content of email and whether the contact has unsubscribed.
• Duration: while the subscription runs, and after that until the data has been deleted.

3. The customer's instructions

We process the data only on the customer's instructions, which are the terms of service and the settings the customer makes in the service. If we believe an instruction breaks data protection law, we say so.

4. Confidentiality and security

People who work with the data are bound by confidentiality. We protect it with technical and organisational measures, including encrypted traffic, separated customer data and restricted access.

5. Sub-processors

We use the providers listed in the privacy policy. We tell the customer at least 30 days before adding or replacing a provider that processes the customer's personal data, and the customer may object. Every sub-processor has the same obligations as we do.

6. Transfers outside the EU and EEA

Where a sub-processor processes data outside the EU and EEA, only under the safeguards the sub-processor offers, for example the European Commission's standard contractual clauses.

7. Helping the customer

We help the customer respond when a data subject uses their rights, and with impact assessments where needed. The service blocks an address that has asked for no more email across the customer's whole account.

8. Personal data breaches

We notify the customer without undue delay, and no later than 48 hours after discovering a breach affecting the customer's data, with what we know about what happened and what is being done.

9. When the agreement ends

The customer can get its data within 30 days after the subscription ends. 90 days after the subscription has ended we delete it, except what the law requires us to keep for bookkeeping.

The data may remain in the database backups until those copies are overwritten; the backups are used only to restore the service after a failure. What is held by the provider we send email through (campaigns, contacts and mailboxes there) is not removed by the deletion in our database; it is removed at that provider separately.

10. Audits

We provide the information the customer needs to show that the obligations are met, and take part in a reasonable audit by agreement.