Data Processing Agreement

1. Scope

This Data Processing Agreement applies to business customers who use Mailopoly to process personal data on their behalf, and forms part of our Terms of Use.

In respect of the contents of accounts you connect to the Service — your messages, their metadata and attachments, and the personal data of the people you correspond with — Mailopoly acts as a data processor on your behalf. You are the controller of that data. How we handle personal data more generally is described in our Privacy Policy and EU/UK Privacy Notice.

2. Our Commitments as Your Processor

Where we act as your processor — for the contents of the accounts you connect — we commit to the following, as required by Article 28(3) of the GDPR.

• Documented instructions: we process the contents of your connected accounts only to provide the Service to you and on your instructions, including for transfers to third countries, unless required otherwise by law.
• Confidentiality: our personnel are bound by confidentiality obligations and access customer content only where necessary to operate or support the Service.
• Security: we maintain the technical and organisational measures described in section 8 of our EU/UK Privacy Notice, appropriate to the risk, as required by Article 32.
• Subprocessors: we engage subprocessors under written terms imposing equivalent obligations, maintain a current list of subprocessors (available on request from privacy@mailopoly.com), and give at least 30 days notice before adding a new one. If you object to an addition, your remedy is to terminate the affected part of the Service before the change takes effect. We cannot route an individual customer's data around a subprocessor.
• Data subject requests: we assist you, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights, and we forward to you any such request we receive directly.
• Breach notification: we notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations under Articles 33 and 34. This is notification to you as controller; notifying affected individuals, where required, remains your decision.
• Assistance: we assist you, taking into account the nature of the processing and the information available to us, with data protection impact assessments and prior consultation under Articles 35 and 36.
• Deletion or return: on termination we delete your data as described in the retention table in section 4 of our EU/UK Privacy Notice, unless retention is required by law. Export of your data before deletion is available on request.
• Audit information: we make available the information reasonably necessary to demonstrate compliance with these obligations, including our security assessment reports, and will respond to reasonable written security questionnaires.

3. International Transfers

We transfer personal data to countries outside the EEA/UK. We ensure adequate protection through:

• EU Standard Contractual Clauses
• UK International Data Transfer Agreement
• Adequacy decisions where applicable
• Additional technical and organizational measures

4. Contact

Questions about this agreement, or requests for our current list of subprocessors:
Email: privacy@mailopoly.com

← Back to Privacy Policy