Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Epostix ("Processor", "we") and the Customer ("Controller", "you") and applies automatically to every customer — no signature is required. If you need a countersigned copy for your records, email [email protected] and we will execute one.

It governs all processing of personal data contained in Customer Content that we carry out on your behalf, as required by Article 28(3) GDPR. In case of conflict, this DPA prevails over the Terms for data protection matters.

1. Definitions

"GDPR" means Regulation (EU) 2016/679; "personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given there. "Customer Content" means the data you submit to the Service for sending and audience management, as defined in the Terms. Where you act as a processor for your own clients, you warrant that you are authorised to engage us as a sub-processor and that your instructions reflect your controller's instructions; references to "Controller" then apply to you accordingly.

2. Subject matter, roles, and instructions

• You are the controller of personal data in Customer Content; we process it exclusively on your behalf. The details of processing are set out in Annex 1.
• We process Customer Content only on your documented instructions, including regarding transfers to third countries, unless required to do otherwise by EU or member-state law — in which case we inform you of that legal requirement before processing, unless the law prohibits it. Your instructions are: the Terms, this DPA, your configuration of the Service, and your use of its APIs. Additional instructions must be agreed in writing.
• We will inform you without delay if, in our opinion, an instruction infringes the GDPR or other applicable data protection law.
• We do not use Customer Content for our own purposes. Aggregate operational signals (bounce, complaint, and block rates) are processed to enforce sending thresholds as part of providing the Service.

3. Confidentiality

Persons authorised to process Customer Content are bound by confidentiality obligations (contractual or statutory) and process it only as needed to perform their role. Access is limited to what each role requires.

4. Security (Art. 32)

We implement and maintain the technical and organisational measures described in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. We may update Annex 2 as technology evolves, provided the changes do not materially reduce the level of protection.

5. Sub-processors

• You grant a general written authorisation to engage the sub-processors listed at /subprocessors, which shows, for each: identity, purpose, location, and transfer mechanism.
• We will give you at least 30 days' notice by email to account owners before adding or replacing a sub-processor. You may object in writing on reasonable data protection grounds within that period; if we cannot offer a workaround, you may terminate the affected services and we refund prepaid fees for the period after termination pro rata.
• We impose on every sub-processor, by written contract, data protection obligations materially equivalent to this DPA, and we remain fully liable to you for their performance.

6. Assistance

Taking into account the nature of the processing, we assist you:

• with data subject rights (Arts. 15–22): the Service provides suppression, export, and deletion tooling; requests reaching us directly that identify your sending are forwarded to you without undue delay, and we do not respond on your behalf beyond confirming you are the controller;
• with security, breach notification, DPIAs, and prior consultation (Arts. 32–36), by providing the information reasonably available to us. Assistance beyond what the Service already provides may be charged at reasonable cost where your requests are excessive or repetitive.

7. Personal data breach

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Content, with the information required by Art. 33(3) GDPR to the extent available (nature of the breach, categories and approximate numbers affected, likely consequences, measures taken), supplementing it as investigation proceeds. Notification is not an admission of fault.

8. Deletion and return

• During the term you can export and delete Customer Content at any time via the dashboard and API.
• On termination of the agreement, we delete all Customer Content within 30 days, and purge it from encrypted backups within a further 60 days, unless EU or member-state law requires continued storage. On request made within those 30 days, we first return the data in a structured, commonly used, machine-readable format, and we confirm deletion in writing on request.
• Suppression records may be retained in hashed form where needed to keep honouring recipients' opt-outs.

9. Audits

On request, we make available the information necessary to demonstrate compliance with Art. 28 GDPR — including Annex 2, sub-processor agreements' relevant terms, and available third-party attestations of our infrastructure providers. Where that is insufficient, you (or an independent auditor you mandate, not a competitor of ours) may audit our processing once in any 12-month period, on at least 30 days' written notice, during business hours, under confidentiality, without access to other customers' data, and at your cost. Where an audit reveals material non-compliance, we remediate at our cost.

10. International transfers

Customer Content is stored and processed in the EU (Hetzner data centres in Germany and Finland). We will not transfer Customer Content outside the EU/EEA except: on your instructions; where the destination benefits from an adequacy decision; or under appropriate safeguards pursuant to Art. 46 GDPR — and in every case subject to the sub-processor notice mechanism in Section 5. Ancillary sub-processors with third-country elements, and their transfer mechanisms, are identified at /subprocessors.

11. Liability, term, and law

Liability under this DPA is subject to the limitations in the Terms, except where the GDPR mandates otherwise (Art. 82). This DPA takes effect with the agreement and remains in force until all Customer Content is deleted under Section 8. Governing law and venue follow the Terms.

Annex 1 — Details of processing

Subject matter. Sending, receiving-related handling (bounces, complaints), storage, and management of email and audience data through the Epostix platform.

Duration. The term of the agreement, plus the deletion periods in Section 8.

Nature and purpose. Transmission of email to recipients designated by the Controller; management of contact lists, segments, and suppression; collection of delivery and engagement events; provision of analytics on the foregoing.

Categories of data subjects. Recipients and intended recipients of the Controller's email: customers, users, subscribers, players (for licensed gambling senders), employees, and other contacts of the Controller.

Categories of personal data. Email addresses; names and salutations; message content and any personal data the Controller includes in it (including template variables); IP addresses and technical metadata of recipient interactions; delivery, open, click, bounce, complaint, and unsubscribe events; consent and suppression records.

Special categories (Art. 9). The Service is not intended for special-category data. The Controller instructs that none be included in Customer Content unless the Controller has a valid Art. 9 basis and has agreed the use with us in writing.

Annex 2 — Technical and organisational measures (Art. 32)

Hosting and physical security. All Customer Content is hosted in ISO 27001-certified data centres in Germany and Finland (Hetzner); physical access controls are operated by the data-centre provider.

Encryption. TLS 1.2+ for data in transit (API, SMTP submission, dashboard); opportunistic TLS for outbound delivery; encryption at rest for storage volumes and backups.

Access control. Role-based access on least-privilege principles; personal accounts with strong authentication for administrative access; secrets and credentials managed in a dedicated vault with audited access; administrative actions logged.

Separation. Logical tenant separation throughout the platform; per-customer sending domains and authentication; dedicated, isolated IP allocations per brand for reviewed sender categories.

Availability and resilience. Redundant infrastructure; encrypted backups stored in the EU with regular restore testing; capacity monitoring; DDoS mitigation at the network edge.

Operations. Centralised logging and monitoring with alerting; vulnerability management and timely patching; change management with peer review; incident-response procedure covering detection, escalation, containment, and customer notification.

Personnel. Confidentiality undertakings; access revoked on role change or departure; data protection awareness as part of onboarding.

Data minimisation and lifecycle. Retention limits on operational logs; deletion and export tooling exposed to the Controller; suppression enforcement at the platform level.

Annex 3 — Authorised sub-processors

The current list, including purpose, location, and transfer mechanism for each sub-processor, is maintained at epostix.com/subprocessors and forms part of this DPA.