Data Processing Agreement

1. How this applies

This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies automatically, with no separate signature needed, whenever you use zSender to process personal data subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, or an equivalent law.

In it, you are the controller and zSender is the processor. If you require a countersigned copy for your records, write to privacy@zsender.io. Terms such as "personal data", "processing", "data subject", "supervisory authority" and "personal data breach" have the meanings given in the GDPR.

2. Subject matter and details of processing

Required by Article 28(3). This describes exactly what we do with personal data on your behalf:

3. Our obligations as processor

We will:

• Process only on your documented instructions, which consist of these Terms, this DPA, and your use of the service's features and API. If we are required by law to process otherwise, we will tell you first unless the law forbids it.
• Tell you if, in our opinion, an instruction infringes the GDPR or other data protection law.
• Ensure that everyone authorised to process the personal data is bound by an appropriate duty of confidentiality.
• Implement the technical and organisational security measures in section 6.
• Respect the conditions on engaging sub-processors in section 4.
• Assist you, by appropriate technical and organisational measures and taking into account the nature of the processing, in responding to data subject requests (section 5).
• Assist you in complying with your obligations on security, breach notification, data protection impact assessments, and prior consultation, taking into account the information available to us.
• Delete or return the personal data at the end of the service, per section 7.
• Make available the information necessary to demonstrate compliance with Article 28 and allow for audits, per section 8.

We do not use your recipient data for our own purposes: not to build profiles, not to train models, not to market to your recipients, and not to sell to anyone. The only processing we perform beyond your instructions is what is strictly necessary to secure and operate the platform and to detect abuse.

4. Sub-processors

You give general authorisation for us to engage sub-processors. Those currently engaged for customer personal data:

The mail server that transmits your messages is self-hosted software on our own EU infrastructure, not a third-party sub-processor.

We will give you at least 30 days' notice before adding or replacing a sub-processor that processes customer personal data. If you reasonably object on data protection grounds within that period, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees for the unused period. We impose data protection obligations on each sub-processor no less protective than those in this DPA, and we remain fully liable to you for their performance.

5. Data subject requests

The service gives you direct control over the personal data you hold in it: you can search and read messages, export data via the API, manage and delete suppression entries, and delete your account and its data. In most cases this lets you answer a data subject request yourself, which is the fastest route.

If a data subject contacts us directly about data we process for you, we will not respond substantively other than to direct them to you, and we will forward the request promptly. Where you need help we cannot provide through the product, we will assist you at your reasonable request; we may charge for assistance that is disproportionate in scope.

6. Security measures

Taking into account the state of the art, costs, and the nature and risk of the processing, we maintain measures including:

• Encryption of all data in transit (TLS), including opportunistic TLS for mail delivery.
• Passwords and API keys stored hashed; webhook signing secrets and provider credentials encrypted at rest.
• Strict tenant isolation: every query is scoped to the owning account, and a cross-account request returns "not found" rather than leaking existence.
• Cryptographic verification of inbound webhooks, and outbound webhook signing so you can verify what we send you.
• Hardened, firewalled infrastructure: key-only SSH, no password authentication, fail2ban, restricted origin access, and rate limiting.
• Mandatory email verification and CAPTCHA at registration to prevent abuse at scale.
• Access to production data restricted to personnel who need it to operate the service.
• Logging and monitoring of administrative actions in an audit trail.

We may update these measures as technology evolves, provided the level of protection is not reduced.

7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and in any event in time for you to meet your own 72-hour notification obligation. Our notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, and the measures taken or proposed.

Notifying you is not an admission of fault. As controller, you are responsible for notifying your supervisory authority and, where required, the affected data subjects.

8. Deletion and return

On termination of your account, or at your request, we will delete the personal data we process for you within the retention periods described in the Privacy Policy, except to the extent we must retain it to comply with a legal obligation. Backups are overwritten on a rolling cycle rather than selectively edited. Export your data via the API or dashboard before terminating: deletion is not reversible.

9. Audits

We will make available the information reasonably necessary to demonstrate compliance with Article 28, and will contribute to audits conducted by you or an auditor you mandate. To keep this proportionate for a service of our size: audits are limited to once per twelve months unless a supervisory authority requires otherwise or a breach has occurred, require at least 30 days' written notice, must not unreasonably disrupt our operations, are subject to confidentiality, and are at your cost.

10. International transfers

The email data path (API, mail server, and message database) is located in Germany (European Union). Message content and recipient data are not transferred outside the EEA in the course of ordinary service operation.

Where a supporting sub-processor listed in section 4 is established outside the EEA, any transfer of personal data to it is made under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum where relevant, and/or that provider's certification under the EU-US Data Privacy Framework, together with any supplementary measures required. Those providers handle account, billing and edge network data, not the content of the mail you send.

11. Your obligations as controller

You warrant that:

• You have a lawful basis for every instance of processing you instruct, including for contacting each recipient, and can evidence it.
• You have given data subjects the information required by Articles 13 and 14, including that a processor transmits your mail.
• Your instructions to us comply with data protection law and you will not instruct us to do anything that would put us in breach of it.
• You will not send special category or criminal-offence data through the service without our separate written agreement.

Your indemnity in section 12 of the Terms applies to claims arising from a breach of these warranties.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in section 11 of the Terms of Service.

Nothing in this DPA or in the Terms limits any liability that a controller or processor has directly to a data subject or to a supervisory authority under Article 82 GDPR or any other applicable law. Those liabilities cannot be limited by contract, and we do not attempt to.

13. Precedence and changes

If this DPA conflicts with the Terms or the Privacy Policy on the processing of personal data for which you are controller, this DPA prevails. We may update it to reflect changes in law, guidance, or our sub-processors; material changes will be announced and the "Last updated" date revised.

14. Contact

Data protection matters, DPA countersignature requests, and sub-processor objections: privacy@zsender.io.