Postfaro Data Processing Agreement

DRAFT — requires review by a qualified lawyer before publication. This text was prepared as a working draft. It has not been reviewed for any specific jurisdiction. Items in [SQUARE BRACKETS] must be completed or decided before publication. The Standard Contractual Clauses module selection and the transfer impact assessment in particular need legal input.

Version: [VERSION] — Last updated: [DATE]

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between [COMPANY LEGAL NAME], [ADDRESS] (“Postfaro”, the “Processor”) and the customer named in the Postfaro account (the “Customer”, the “Controller”). It applies automatically when the Customer accepts the Terms; no separate signature is needed. [OPTIONAL: Customers who need a countersigned copy can request one at [PRIVACY EMAIL].]

It sets out the terms required by Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and equivalent provisions of other data protection laws that apply to the Customer (“Data Protection Law”).

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR.

• Customer Personal Data: personal data that the Customer submits to the Service for sending, mainly recipient email addresses, names and other personal data contained in message headers and content, and personal data contained in replies forwarded to the Customer.
• Sub-processor: any third party engaged by Postfaro that processes Customer Personal Data.
• Suppression Data: recipient email addresses that must not be emailed again (hard bounces, complaints, unsubscribes), with the reason and date.

2. Roles

2.1 The Customer is the controller (or a processor acting on behalf of a controller) of Customer Personal Data. Postfaro is the processor.

2.2 The Customer is responsible for having a lawful basis for its email, for the accuracy of its lists, and for giving recipients the information required by law. Postfaro does not check that the Customer has consent but enforces the Acceptable Use Policy.

2.3 Postfaro acts as an independent controller for its own account, billing and security data about the Customer and its users, as described in the Privacy Policy. [LAWYER TO CONFIRM: whether Postfaro acts as controller or processor for the shared, cross-customer suppression list.]

3. Details of the processing (Annex I)

4. Postfaro’s obligations

Postfaro will:

4.1 process Customer Personal Data only on the Customer’s documented instructions, which are: the Terms, this DPA, the Customer’s configuration of the Service, and the messages the Customer submits. Postfaro will tell the Customer if it believes an instruction breaches Data Protection Law. Postfaro may also process data where required by law, in which case it will inform the Customer unless the law forbids this;

4.2 ensure that its personnel who access Customer Personal Data are bound by confidentiality obligations;

4.3 implement the technical and organisational security measures in Annex II;

4.4 respect the conditions for engaging sub-processors in section 6;

4.5 assist the Customer, taking into account the nature of the processing, in responding to data subject requests (section 7);

4.6 assist the Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to Postfaro;

4.7 delete or return Customer Personal Data at the end of the Service (section 10);

4.8 make available the information necessary to demonstrate compliance and allow for audits (section 9).

5. The Customer’s obligations

The Customer will:

• comply with Data Protection Law and the Acceptable Use Policy for all data it submits;
• ensure it has a lawful basis (normally consent) for each recipient;
• not submit personal data that it is not allowed to process;
• give recipients any information about the processing that the law requires (for example in its own privacy notice), including that it uses an email delivery provider.

6. Sub-processors

6.1 General authorisation. The Customer gives a general authorisation for Postfaro to engage sub-processors. The current list is below and at [URL OF LIVE SUB-PROCESSOR PAGE].

6.2 Changes. Postfaro will notify the Customer of any intended addition or replacement of a sub-processor at least [30] days in advance, by email and/or in the customer panel. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid, unused fees.

6.3 Flow-down. Postfaro will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for their performance.

6.4 Current sub-processors and related third parties

Third parties that are not sub-processors for Customer Personal Data (listed for transparency):

7. Data subject requests

7.1 If Postfaro receives a request from a recipient relating to Customer Personal Data, it will forward it to the Customer without undue delay and will not respond itself, except to confirm the request has been passed on or where the request is an unsubscribe/objection to email, which Postfaro may honour directly by adding the address to Suppression Data.

7.2 The Customer can view and export Suppression Data (“cancelled addresses”) in the customer panel. Because Postfaro does not hold the Customer’s lists, most requests (access, rectification, erasure from lists) must be handled in the Customer’s own systems.

7.3 Erasure versus suppression. If a recipient asks for erasure, the Customer should consider that keeping the address on a suppression list is usually necessary to ensure they are not emailed again. Postfaro will delete a specific address from the Customer’s Suppression Data on the Customer’s written instruction.

8. Personal data breaches

8.1 Postfaro will notify the Customer without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notification will include, as far as known at the time: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases.

8.3 Postfaro will take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.

9. Audits

9.1 On written request, Postfaro will provide information reasonably necessary to demonstrate compliance with this DPA, such as a summary of its security measures [and any certifications or audit reports it holds].

9.2 If that information is insufficient, or if a supervisory authority requires it, the Customer may carry out an audit (itself or through an independent auditor bound by confidentiality), no more than once in any 12-month period, with at least [30] days’ notice, during business hours, at the Customer’s cost, and without disrupting the Service or compromising other customers’ data.

10. Return and deletion

10.1 Because message content and recipient data are processed transiently, there is normally no Customer Personal Data to return at the end of the Service other than Suppression Data, which the Customer can export from the panel at any time before the account is closed.

10.2 Within [30] days after the account is closed, Postfaro deletes the Customer’s Suppression Data and any remaining queued messages, except: (a) data Postfaro must keep by law; (b) addresses on the shared, cross-customer suppression list [CONFIRM]; and (c) data in backups, which are overwritten within [BACKUP RETENTION PERIOD] and are not restored except for disaster recovery.

11. International transfers

11.1 Postfaro’s servers are located in Turkey, which does not have an adequacy decision under the GDPR or UK GDPR.

11.2 To the extent Customer Personal Data subject to the GDPR is transferred to Postfaro outside the EEA, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), Module Two (controller to processor) [and Module Three (processor to processor) where the Customer is itself a processor], with the following choices: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, [30] days’ notice); Clause 11 optional language does not apply; Clause 13 — [COMPETENT SUPERVISORY AUTHORITY]; Clause 17 — governed by the law of [EU MEMBER STATE]; Clause 18 — courts of [EU MEMBER STATE]. Annex I is section 3 of this DPA; Annex II is Annex II below; Annex III is section 6.4. [LAWYER TO CONFIRM — the module and structure depend on where Postfaro itself is established.]

11.3 For UK data, the UK International Data Transfer Addendum to the SCCs applies. For Swiss data, the SCCs apply with the adjustments required by Swiss law.

11.4 Postfaro has carried out a transfer impact assessment [TO BE DONE] and applies the supplementary measures in Annex II.

11.5 [IF THE COMPANY IS ESTABLISHED IN TURKEY: add the KVKK provisions on transfer abroad, and the standard contract notified to the Turkish DPA where required.]

12. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Law does not permit such limitation.

13. Order of precedence and term

This DPA prevails over the Terms on data protection matters. If the SCCs apply, they prevail over this DPA. This DPA lasts as long as Postfaro processes Customer Personal Data.

Annex II — Technical and organisational measures