Data Processing Addendum
Effective [EFFECTIVE DATE]
This Data Processing Addendum ("DPA") is part of the Terms of Service between Send At ("Sendat," the "Processor") and the customer who accepted those Terms (the "Customer," the "Controller"). It applies when Sendat processes personal data in Your Content on the Customer's behalf and a data protection law such as the GDPR, the UK GDPR, or the California Consumer Privacy Act applies. Capitalized terms not defined here have the meaning given in the Terms.
1. Roles and scope
The Customer is the controller (or business) of the personal data in Your Content. Sendat is the processor (or service provider). Sendat is the controller of account, billing, and security data, which our Privacy Policy covers.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing the email sending, receiving, and storage Service |
| Duration | The term of the Terms, plus the deletion period in section 9 |
| Nature and purpose | Hosting, transmitting, storing, and delivering email, and detecting spam and abuse |
| Types of personal data | Email addresses, names, message content, attachments, and delivery metadata |
| People affected | The Customer's users, and people who send mail to or receive mail from the Customer |
| Special categories | None intended. The Customer must not send special-category data unless it has legal grounds and tells us. |
3. Our commitments
Sendat will: 1. Process personal data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use of the Service are those instructions. We will tell the Customer if we think an instruction breaks the law. 2. Make sure people who handle the data are bound by confidentiality. 3. Keep appropriate security measures in place (section 5). 4. Help the Customer answer requests from people exercising their rights, as far as reasonably possible. 5. Help the Customer with security, breach notices, impact assessments, and regulator consultations, as far as reasonably possible. 6. Make available information needed to show we meet this DPA (section 8).
We will not sell personal data, and we will not use it outside our direct business relationship with the Customer.
4. Subprocessors
The Customer gives general authorization for Sendat to use the subprocessors on our Subprocessors page. We will give at least 30 days' notice of any new subprocessor by updating that page and emailing account owners who have asked for notices. The Customer may object in writing on reasonable data protection grounds within that period, and we will work in good faith to find a solution. We remain responsible for our subprocessors and bind them to data protection terms at least as protective as this DPA.
5. Security
We maintain measures that include: - encrypted connections to our website and API - hashed passwords and API keys - access controls limiting who can reach production systems - logging of access to production systems - a process for finding, ranking, and fixing security issues
6. Personal data breaches
We will tell the Customer without undue delay after we confirm a personal data breach affecting Your Content, and we will give the information we have to help the Customer meet its own notice duties.
7. International transfers
Where personal data from the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: controller to processor) apply, with the UK International Data Transfer Addendum for UK transfers. The Customer is the "data exporter" and Sendat is the "data importer." The optional docking clause applies, the general authorization option for subprocessors applies with the notice period in section 4, and the supervisory authority and governing law are those of [EU MEMBER STATE, TO BE CHOSEN BY COUNSEL]. Annex I is section 2 of this DPA, and Annex II is section 5.
8. Audits and information
On reasonable written request, no more than once a year unless there has been a breach, we will give the Customer information needed to confirm we meet this DPA, such as our security descriptions and relevant reports. Any on-site audit needs our agreement on scope, timing, and confidentiality.
9. Deletion and return
When the Customer's account ends, the Customer may export Your Content for 30 days. After that, we delete it from our active systems within 30 days, and from backups on their normal cycle, unless the law requires us to keep it.
10. California
For the CCPA, Sendat is a "service provider." We will not sell or share personal data, will not retain, use, or disclose it outside the business purposes in the Terms, and will not combine it with other data except as the law permits. We will tell the Customer if we can no longer meet our CCPA obligations.
11. Liability and order of precedence
This DPA is subject to the limits on liability in the Terms, to the extent the law allows. If this DPA conflicts with the Terms about personal data, this DPA controls. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses control.