Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the Terms of Service between you (the "Customer") and [COMPANY NAME] ("we", the "Processor"). It applies whenever we process personal data on your behalf in providing Mailpitcher, and is your agreement under article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. No signature is needed; it takes effect when you accept the Terms. If you need a countersigned copy, write to privacy@mailpitcher.com.
1. Roles
For Customer Personal Data (defined below), you are the controller and we are your processor. Where you are yourself a processor for a client, we are your sub-processor and you confirm your client has authorised this.
2. Details of the processing
- Subject matter: providing the Mailpitcher email client and outreach features.
- Nature and purpose: connecting to the mailboxes you choose; syncing, storing, indexing and displaying mail; sending messages and campaigns you instruct; managing contacts, lists, suppression lists, templates and projects; and supporting and securing the Service.
- Data subjects: your correspondents, recipients and contacts, and anyone whose data appears in your mail or content.
- Categories of data: names, email addresses and other contact details; message content, headers and metadata; any other data you put into fields, notes, templates or projects. You shouldn't use the Service to process special categories of data (GDPR article 9) unless it appears incidentally in correspondence.
- Duration: for the term of the Terms of Service, and until deletion under section 10.
"Customer Personal Data" means personal data in the content above. It doesn't include your own account data, which we process as a controller under our Privacy Policy.
3. Your instructions
We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and your configuration and use of the Service (for example connecting a mailbox, starting a campaign, or calling the API) are your instructions. We'll tell you if we think an instruction breaks data protection law. If EU or member-state law requires us to process data otherwise, we'll tell you first unless the law forbids it.
You are responsible for the lawfulness of the processing you instruct, including having a lawful basis to contact recipients and giving them the information articles 13 and 14 GDPR require.
4. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by confidentiality. Access is limited to what is needed to run, support and secure the Service; our admin tools don't show message content.
5. Security
We maintain appropriate technical and organisational measures (article 32), including: TLS for all connections; encryption at rest of mailbox credentials, tokens and cached message bodies, with keys held apart from the database; caching of message bodies for 30 days only; two-step sign-in for accounts that connect mailboxes or send; single-use sign-in links; rate limits and abuse controls; separation of customer workspaces; key-only, least-privilege server administration; regular backups kept in the EU; and logging of security events. We review these measures regularly and may improve them, but won't lower the overall level of protection.
6. Sub-processors
You give general authorisation for us to use sub-processors. The current list is in section 6 of the Privacy Policy. We'll announce new or replacement sub-processors on that page and by email at least 14 days before they start; you may object on reasonable data-protection grounds, and if we can't resolve it, you may terminate the affected service and receive a refund of prepaid fees for it. We impose data-protection obligations on each sub-processor equivalent to this DPA and remain responsible for them.
7. International transfers
Customer Personal Data is hosted in the EU. Where a sub-processor processes it outside the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.
8. Helping you
- Data subject requests: the Service lets you find, export, correct and delete data (including suppressing and deleting contacts and disconnecting mailboxes). If a request comes to us directly, we'll pass it to you without answering it ourselves, unless you authorise us to.
- Assessments and authorities: we'll give reasonable help with data protection impact assessments and consultations with supervisory authorities, taking into account the information available to us.
9. Personal data breaches
We'll notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We'll provide the information you need to meet your own notification duties as it becomes available, and take reasonable steps to contain and remedy the breach.
10. Deletion and return
When the Terms end, you can retrieve your data for 30 days. After that we delete Customer Personal Data from live systems, and from backups within a further 30 days, unless EU or member-state law requires us to keep it. Disconnecting a mailbox deletes its synced data straight away.
11. Audits
We'll make available the information reasonably necessary to demonstrate compliance with article 28, including written answers to security questionnaires. If that isn't enough, or a supervisory authority requires it, you may audit us (or appoint an independent auditor bound by confidentiality) once a year with 30 days' notice, during business hours, at your cost, in a way that doesn't compromise other customers' data.
12. General
If this DPA conflicts with the Terms, this DPA prevails on data protection matters. The liability limits in the Terms apply to this DPA as far as the law allows. This DPA is governed by the same law as the Terms.