Data processing agreement

1. Parties

This data processing agreement (“DPA”) forms part of the agreement between [OPERATOR LEGAL NAME], a company registered at [OPERATOR POSTAL ADDRESS] under number [OPERATOR COMPANY NUMBER] (“Processor”), and [CUSTOMER LEGAL NAME], registered at [CUSTOMER ADDRESS] (“Controller”), for the Mailprompt email marketing service.

2. Roles and scope

The Controller decides which subscriber data is uploaded and which messages are sent. The Processor processes personal data only to provide the service, on the Controller's documented instructions, and for the purposes in Annex A. The Controller is responsible for having a lawful basis for the data and for the content of each message.

3. Data and data subjects

The personal data may include subscriber name, email address, consent status and consent timestamp, list and segment membership, custom properties, events such as opens and clicks, order attribution data and the content of messages. Data subjects are the Controller's subscribers and prospects. The Processor's own account, billing and support data is covered by the privacy notice.

4. Processor obligations

• Process personal data only on documented instructions, including transfer rules.
• Ensure personnel who access personal data are bound by confidentiality.
• Implement the technical and organisational measures in Annex B.
• Assist the Controller with data subject requests and impact assessments, within reason.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return personal data at the end of the service, subject to legal retention duties.
• Make available the information needed to demonstrate compliance and allow audits as set out below.

5. Sub-processors

The Controller authorises the sub-processors in the sub-processor list. The Processor imposes equivalent data protection obligations on each sub-processor and remains liable for their performance. A new sub-processor that processes personal data is announced before it starts, with an objection window of thirty days. An objection must have a data protection reason; the parties will try to resolve it in good faith, and the Controller may terminate the affected service if no resolution is possible.

6. International transfers

Where personal data is transferred outside the European Economic Area, the parties rely on the standard contractual clauses adopted by the European Commission, or an equivalent mechanism identified for the specific provider. Annex A records the mechanism for each transfer.

7. Security incidents

A breach notification will describe, to the extent known, the nature of the breach, the categories and volume of data affected, the likely consequences, the measures taken and the contact for follow-up. The Processor cooperates with the Controller's notifications to a supervisory authority or to data subjects, but does not make those notifications on the Controller's behalf.

8. Audit and evidence

The Processor makes its security documentation available on request and answers a reasonable security questionnaire once a year. An on-site audit is available where required by law or after a serious incident, on reasonable notice, during business hours and subject to confidentiality. The Processor may satisfy an audit request with a recent independent report where one exists.

9. Return and deletion

At the end of the service the Controller can export contacts, events and templates from the app. After the retention window in the privacy notice, the Processor deletes the account data, including backups on their normal rotation, except where law requires retention or where a suppression record must be kept to honour an opt-out.

10. Liability and term

Liability under this DPA is subject to the limitations in the main agreement. It starts when both parties accept it and continues for as long as the Processor holds personal data for the Controller. The final wording, governing law and signature blocks are pending legal review.

Annex A — Processing details

• Subject matter: email marketing automation for online stores.
• Duration: the term of the subscription plus the deletion window.
• Purpose: storing audience data, drafting and sending approved email, reporting results.
• Categories of data: as described in section 3.
• Special categories: none intended; the Controller must not upload them.
• Transfer mechanism: standard contractual clauses or the provider-specific mechanism confirmed at signature.

Annex B — Security measures

• Encryption in transit with TLS; encryption at rest by the database and storage providers.
• API keys stored as hashes, webhook secrets encrypted with AES-256-GCM.
• Role-based access with approval rights limited to owners and admins.
• Audit log for writes, approvals, key changes and role changes.
• Per-account data isolation in every tenant query.
• Backups with a tested restore, and a documented incident response process.