Data Processing Agreement

1. Scope and parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller” or “Business”) and MailToucan (“Processor” or “Service Provider”). It applies to personal data that MailToucan processes on the customer’s behalf in providing the Services (“Customer Personal Data”). It applies automatically; no signature is needed. A countersigned copy is available on request at hello@mailtoucan.com.

2. Roles and instructions

• The customer is the controller and MailToucan is the processor. The customer determines the purposes and means of processing.
• MailToucan will process Customer Personal Data only on the customer’s documented instructions, which are the Terms, this DPA and the customer’s use of the Services’ features, unless required by law (in which case we will tell the customer unless prohibited).
• We will tell the customer if we believe an instruction infringes data-protection law.

3. Details of processing

4. Confidentiality

MailToucan ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.

5. Security

MailToucan maintains appropriate technical and organisational measures described in Data and Security, including encryption in transit and at rest, access control, network protection and regular security reviews.

6. Sub-processors

The customer gives general authorisation for MailToucan to engage the sub-processors listed on our Sub-processors page. We bind each to data-protection terms no less protective than this DPA. We will notify customers at least 14 days before adding or replacing a sub-processor; the customer may object on reasonable data-protection grounds, and if unresolved may cancel the affected Services.

7. Data subject requests

MailToucan will, taking into account the nature of the processing, provide the tools and reasonable assistance the customer needs to respond to requests to exercise data-subject rights. If a data subject contacts us directly we will refer them to the customer.

8. Personal-data breaches

MailToucan will notify the customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, with the information reasonably available to help the customer meet its obligations.

9. Assistance

MailToucan will provide reasonable assistance with data-protection impact assessments and consultations with supervisory authorities relating to the Services.

10. International transfers

The customer authorises transfers of Customer Personal Data to countries outside the EEA/UK. Where required, the parties incorporate the EU Standard Contractual Clauses (Module Two: controller to processor) and the UK International Data Transfer Addendum, which apply as described in the Privacy Policy and take precedence in case of conflict.

11. Deletion and return

On termination, the customer may export Customer Personal Data. After 30 days MailToucan deletes it (including from backups on a rolling schedule), unless law requires retention.

12. Audits

On reasonable written request (no more than once a year unless required by a regulator or following a breach) MailToucan will provide information necessary to demonstrate compliance, such as summaries of its security measures, and will allow audits by the customer or its auditor under reasonable confidentiality terms and notice.

13. US state privacy laws

For the purposes of the CCPA/CPRA and similar laws, MailToucan is a service provider/processor. We will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, or combine it with other data except as permitted by law.

14. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms. If there is a conflict between this DPA and the Terms regarding personal data, this DPA prevails.

15. Contact

Data-protection questions: hello@mailtoucan.com