Data Processing Agreement

• Data Protection Laws: the laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act ("CCPA").
• Customer Personal Data: personal data that we process on your behalf to provide the Service, as described in section 4.
• Subprocessor: a third party we engage to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses: the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("SCCs").
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0).
• Other terms such as controller, processor, data subject, personal data and processing have the meanings given in the GDPR.

You are the controller of Customer Personal Data, and we are your processor. If you act as a processor for your own customers, we are your subprocessor, and you confirm that your controller has authorised our processing.

We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the way you configure and use the Service through the dashboard, API, SMTP and other tools. If we believe an instruction breaks Data Protection Laws, we will tell you. If a law requires us to process data in another way, we will tell you first, unless that law forbids it.

You are responsible for having a lawful basis for the processing, for the notices you give to recipients and other data subjects, and for the accuracy of the data you send us.

• Subject matter and purpose: providing the Service under the Terms, which means sending, receiving, routing, tracking and storing email for you, and the features around it such as templates, automations, contacts, suppressions, webhooks and logs. We also process data to keep the Service secure and to prevent abuse of our sending infrastructure.
• Nature of the processing: collection, storage, transmission, structuring, analysis for delivery and abuse prevention, retrieval, and deletion.
• Data subjects: the recipients of email you send; people who send email to your domains through the Service; your contacts; and your own staff and users who use the dashboard or API.
• Categories of data: email addresses and names in message headers; message content, including subject lines, bodies, attachments and template variables; message metadata, such as headers, timestamps and message IDs; event data, such as delivery results, bounces, complaints, unsubscribes, and the IP address and user agent recorded with opens and clicks; inbound messages; contact lists and properties; and suppression lists.
• Special categories of data: the Service is not designed for special categories of personal data. If you send them, you are responsible for having a lawful basis and appropriate safeguards.
• Duration: for as long as you use the Service, plus the deletion period in section 12. Message and event logs are kept for your plan’s retention period and then deleted.
• Frequency: continuous, as you use the Service.

As Article 28(3) of the GDPR requires, we will:

• process Customer Personal Data only on your documented instructions, including for transfers outside the EEA, unless a law requires otherwise;
• make sure everyone authorised to process Customer Personal Data is bound by confidentiality (section 6);
• take the security measures required by Article 32 of the GDPR (section 7 and the annex in section 19);
• engage Subprocessors only as set out in section 8;
• help you respond to requests from data subjects exercising their rights (section 9);
• help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation (sections 7, 10 and 11);
• delete or return Customer Personal Data at the end of the Service (section 12);
• make available the information you need to show compliance with Article 28 of the GDPR, and allow for and contribute to audits (section 13).

We keep Customer Personal Data confidential. Only staff and contractors who need access to provide, support or secure the Service have it, and each of them is bound by a duty of confidentiality.

We do not sell Customer Personal Data or use it for our own purposes, except to keep the Service secure and prevent abuse, and to produce aggregated statistics that do not identify you or any person.

We implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation and the risks to data subjects. The current measures are summarised in the annex in section 19. We may change them over time, but we will not reduce the overall level of protection.

You are responsible for securing your own account, API keys, SMTP credentials and systems, and for the security of data before it reaches the Service.

You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed at groundmail.dev/legal/subprocessors/, and you approve them by accepting this DPA.

Before a new Subprocessor starts processing Customer Personal Data, we will update that page and email everyone who has asked for updates at dpo@groundmail.dev, at least 30 days in advance. You may object on reasonable data protection grounds within that period by emailing dpo@groundmail.dev. We will then work with you in good faith to find a solution. If we cannot, you may end the affected part of the Service, and we will refund any fees you paid in advance for the period after it ends.

We impose data protection terms on each Subprocessor that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for their performance.

The dashboard and API let you find, export, suppress and delete contacts, messages and logs, which covers most requests. Where you cannot answer a request yourself, we will help you, taking into account the nature of the processing.

If a data subject contacts us directly about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to or the law requires it.

We will notify you without undue delay, and in any case within 48 hours, after we become aware of a Security Incident affecting your Customer Personal Data. We will send the notice to your account owner’s email address.

The notice will describe, as far as we know at the time, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the steps we have taken or propose to take. Where we cannot give all of this at once, we will give it in stages as we learn more.

We will take reasonable steps to contain and investigate the incident and to limit its effects, and we will help you meet your own obligations to notify regulators and data subjects. Notifying you of an incident is not an admission of fault or liability.

If you need to carry out a data protection impact assessment or consult a supervisory authority about the processing under this DPA, we will give you the information you reasonably need, to the extent you do not already have it.

While you use the Service, you can export or delete your data through the dashboard and API at any time.

When you close your account, or ask us to delete it, we delete Customer Personal Data within 30 days, unless a law requires us to keep it. Before then, you can export it, or ask us at dpo@groundmail.dev to return it. Copies in backups are deleted as those backups expire on their normal schedule, and this DPA keeps protecting them until then.

On request, we will give you the information you reasonably need to check that we meet this DPA, such as answers to security questionnaires, a description of our security measures, and the security certifications and reports of our main Subprocessors.

If that information is not enough to meet a requirement of Data Protection Laws or of a supervisory authority, or after a Security Incident, you may audit our compliance with this DPA, yourself or through an independent auditor bound by confidentiality. Audits take place at most once a year (unless a supervisory authority requires more), with at least 30 days’ notice, during business hours, at your cost, and in a way that does not disrupt the Service or expose other customers’ data.

We and our Subprocessors process Customer Personal Data in the United States and in the other locations shown on our subprocessor list. Where Customer Personal Data is transferred under this DPA from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the safeguards below apply and are incorporated into this DPA by reference.

EU transfers: the SCCs apply, with Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer. For the SCCs: the optional docking clause in Clause 7 does not apply; under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in section 8 of this DPA; the optional wording in Clause 11 does not apply; under Clause 13, the supervisory authority is the one competent for you under that clause; under Clause 17, Option 1 applies and the governing law is that of Ireland; and under Clause 18, disputes are resolved by the courts of Ireland. Annex I is completed with the parties in section 1 and the description in section 4 of this DPA, Annex II with the security measures in section 19, and Annex III with our subprocessor list.

UK transfers: the UK Addendum applies and amends the SCCs as it sets out. Table 1 is completed with the parties in section 1; Table 2 refers to the SCCs as incorporated above; Table 3 is completed with the information in sections 4, 8 and 19; and for Table 4, either party may end the UK Addendum as its Section 19 allows.

Swiss transfers: the SCCs apply as for EU transfers, with these changes: references to the GDPR also mean the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; "Member State" in Clause 18(c) includes Switzerland, so data subjects there can bring claims where they habitually reside; and the SCCs protect the data of legal entities only to the extent the FADP requires.

If a supervisory authority or court decides that one of these safeguards is no longer valid, we will work with you to put a valid one in place.

Where the CCPA or a similar US state law applies, we act as your service provider or processor. We will not sell or share Customer Personal Data, keep, use or disclose it for any purpose other than providing the Service, or combine it with personal data we receive from others, except as those laws allow. We will tell you if we can no longer meet these obligations.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs do not allow those limitations, including any liability to data subjects under the SCCs.

This DPA lasts for as long as we process Customer Personal Data for you, and the obligations meant to continue after that, such as confidentiality and deletion, do so.

This DPA is governed by the same law, and disputes go to the same courts, as the Terms, except where the SCCs or the UK Addendum require otherwise.

We may update this DPA, for example to reflect changes in law or in the Service. We will not reduce the protection it gives Customer Personal Data without your agreement, unless a law requires it. We will tell you about material changes by email or in the dashboard before they take effect. The current version is always at groundmail.dev/legal/dpa/.

A summary of the technical and organisational measures we take to protect Customer Personal Data:

• Encryption in transit: the dashboard, API, webhooks and documentation are served only over HTTPS (TLS). The SMTP relay supports TLS, and outgoing email is delivered over TLS whenever the receiving mail server supports it.
• Encryption at rest: databases, backups and file storage are encrypted at rest by our hosting provider. Credentials you store with us for other services are encrypted again with our own key.
• Credentials: passwords and API keys are stored only as one-way hashes. API keys can be limited to specific permissions and revoked at any time, and webhook requests are signed so you can check they came from us.
• Access control: access to production systems and Customer Personal Data is limited to staff who need it to run, support or secure the Service, through individual accounts. Team roles in the dashboard let you control what your own users can see and do.
• Logging and monitoring: we log administrative actions on customer accounts, and we monitor the Service for availability, errors and abuse.
• Backups and availability: databases are backed up automatically, and the Service runs on managed cloud infrastructure, with a public status page at status.groundmail.dev.
• Retention: message and event logs are deleted after your plan’s retention period. Open and click tracking stay off until you turn them on for a domain.
• Separation: each account’s data is kept logically separate, and every request is checked against the account it belongs to.
• Abuse prevention: we use automated and manual controls to protect recipients and our sending reputation.
• Incident response: we investigate and contain Security Incidents and notify you as described in section 10.
• Subprocessors: we choose providers with strong security practices and bind them to data protection terms (section 8).