Data processing agreement
Last updated:
This agreement is entered into between the customer, as controller (or as processor acting for its own controllers), and [Legal entity name], as processor, and forms part of the Terms of service. It applies to all personal data the processor handles on the controller's behalf while providing the service, from the creation of the organisation until its data is deleted.
In case of conflict between this agreement and the Terms of service, this agreement prevails for anything concerning personal data.
Subject matter and duration
The processor accepts messages from the controller, delivers them by email from the chosen infrastructure, records their delivery state, and makes configuration and delivery records available in the console. Processing lasts for the term of the Terms of service plus the deletion period set out below under Deletion and return.
Nature and purpose of the processing
Storage, transmission, queuing, delivery and logging of email messages and their delivery events, for the sole purpose of delivering the controller's transactional mail and letting the controller trace it.
Types of personal data and data subjects
Data subjects: the recipients of the controller's messages; the controller's members insofar as they appear as senders or in configuration.
Personal data: email addresses of recipients and senders; message subjects, bodies and custom headers when the message is submitted through the API; delivery events (addresses, timestamps, remote server responses). The controller decides what its messages contain and may include special categories of data only if the order form records that it does and the controller has assessed the risk.
Instructions
The processor processes personal data only on the controller's documented instructions. The instructions are the Terms of service, this agreement, the order form, the settings the controller makes in the console (including node mode and TLS policies) and the requests it sends to the API. The processor informs the controller without delay if it considers an instruction to infringe data protection law, and may then suspend that instruction until it is confirmed or changed.
The processor may process personal data outside these instructions only where EU or member-state law requires it, in which case it informs the controller beforehand unless that law forbids it.
Confidentiality
Persons authorised by the processor to process personal data are bound by a contractual or statutory duty of confidentiality, and only the persons needed to operate the service have access to production systems.
Security
The processor implements the technical and organisational measures in Annex 2, keeps them under review and may improve them, but does not reduce the level of protection during the term. The controller is responsible for the security of its own nodes, credentials and systems that submit mail.
Sub-processors
The controller gives general authorisation for the sub-processors in Annex 3. The processor notifies organisation administrators by email at least 30 days before adding or replacing a sub-processor that handles mail data. The controller may object within that period on reasonable data-protection grounds; if the parties find no solution, the controller may terminate the affected service without penalty before the change takes effect.
The processor imposes on each sub-processor data-protection obligations equivalent to those in this agreement and remains fully liable to the controller for the sub-processor's performance.
Assistance to the controller
- Data subject rights: the console lets the controller search messages by recipient, sender or id and read their events. Export and deletion of message records are performed by the processor on the controller's request, within 10 working days.
- Requests received directly by the processor from a data subject are forwarded to the controller without answering them on the merits.
- Security, breach notification and data protection impact assessments: the processor provides the information it holds about the processing and its measures, taking into account the nature of the processing.
Personal data breaches
The processor notifies the controller's administrators without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the controller's data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information not yet available is provided as it becomes available. The processor documents breaches and cooperates with the controller in its notifications to the supervisory authority and to data subjects.
Deletion and return
Delivery events are deleted 30 days after they are recorded and node status reports are kept to the 100 most recent per node, as part of normal operation. Message records are kept for the life of the organisation unless the order form sets a shorter period.
At the end of the service the controller may export its configuration and Messages log for 30 days. The processor then deletes the organisation's personal data from live systems within 30 days and from backups within a further 90 days, unless EU or member-state law requires it to be kept, and confirms deletion on request.
Audits
The processor makes available the information necessary to demonstrate compliance with Article 28 GDPR: this agreement, its annexes, descriptions of its measures and any third-party audit reports or certifications it holds. Where these are not sufficient, the controller or an auditor mandated by it and bound by confidentiality may audit once per year, on 30 days' notice, during business hours, without disrupting the service and without access to other customers' data. Each party bears its own costs.
International transfers
The processor processes the controller's personal data only in the European Union and the European Economic Area, and does not transfer it to a third country or international organisation without the controller's prior written instruction and appropriate safeguards under Chapter V GDPR.
Own nodes
Personal data that a message carries while it is on the controller's own node — its queue, its logs, its delivery — is processed by the controller on its own infrastructure and is not covered by this agreement. Only the data the node sends to the console (delivery events, status reports) and messages submitted to the API are processed by the processor.
Liability and term
Liability under this agreement follows the Terms of service. This agreement lasts as long as the processor holds personal data on the controller's behalf. Where the controller acts as a processor for its own controllers, it warrants that those controllers have authorised the engagement of the processor and the sub-processors in Annex 3.
Annex 1 — Description of the processing
- Subject matter: delivery and tracing of the controller's transactional email.
- Duration: the term of the Terms of service plus the deletion period.
- Nature: storage, transmission, queuing, delivery, logging.
- Purpose: sending the controller's mail from the infrastructure it chooses and reporting its delivery.
- Data subjects: recipients of the controller's messages; the controller's members and senders.
- Personal data: sender and recipient email addresses; subjects, bodies and headers of API-submitted messages; delivery events and remote server responses.
- Special categories: none, unless recorded in the order form.
- Sending modes in use, retention period for message records and any other deviation: as recorded in the order form.
Annex 2 — Technical and organisational measures
- Location: console, database, backups and shared nodes in EU data centres operated by [Hosting provider of the console and shared nodes, EU data centres].
- Transport encryption: TLS on every connection to the console and API; STARTTLS between console and nodes; per-destination TLS policies (opportunistic, required, DANE) for delivery.
- Credentials: API keys, SMTP passwords and node tokens shown once and stored hashed; user passwords hashed; keys scoped to abilities and optionally to one sender; all revocable at any time.
- Access control: role-based permissions within each organisation; permission checks on every request; API keys limited to the abilities they were given.
- Tenant isolation: every query scoped to the organisation; nodes authenticate with their own token and cannot assert a tenant identity; delivery events attributed server-side.
- Domain control: an ownership TXT record and the DKIM key verified before a domain may send.
- Data minimisation and retention: delivery events pruned after 30 days; status reports capped per node; SMTP submissions to own nodes never reach the console.
- Operations: production access limited to service operators, with individual accounts; encrypted backups; node releases with published checksums; security updates applied promptly; logging and monitoring of the console and shared nodes.
Annex 3 — Sub-processors
- [Hosting provider of the console and shared nodes, EU data centres]: hosting of the console, its database and backups, and the shared sending nodes. Location: European Union.
Cloudflare, Inc. delivers the marketing website your-email.eu only and does not process the controller's mail data.