Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and Postbox, Inc. ("Postbox," "we"), and applies where we process personal data on your behalf in providing the Service. It takes effect when you accept the Terms. Where you require a signed copy, contact [email protected].

In this DPA, Customer is the controller (or a processor acting for its own customers) and Postbox is the processor of the mail and related personal data that Customer routes through the Service. Terms such as personal data, processing, controller, processor, and data subject have the meanings given in applicable data-protection law, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and, where applicable, US state privacy laws such as the California Consumer Privacy Act ("CCPA").

1. Scope and roles

This DPA applies to the processing of personal data by Postbox on Customer's behalf. The subject matter, duration, nature and purpose of processing, and the types of personal data and categories of data subjects are described in Annex 1. Customer is responsible for the accuracy and legality of the personal data it provides and for having a lawful basis for the processing it instructs.

2. Customer instructions

Postbox will process personal data only on Customer's documented instructions, including as set out in the Terms, this DPA, and Customer's configuration and use of the Service, unless required to act otherwise by law (in which case we will inform Customer, unless the law prohibits it). We will tell Customer if, in our opinion, an instruction infringes applicable data-protection law.

3. Confidentiality

We ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations and are limited to those who need access to provide the Service.

4. Security

We implement appropriate technical and organizational measures to protect personal data, taking into account the state of the art and the risks of the processing. These measures are summarized in Annex 2 and include encryption in transit and at rest, scoped and short-lived access credentials, least-privilege internal access, and monitoring for abuse.

5. Sub-processors

Customer provides general authorization for Postbox to engage sub-processors to process personal data. Our current sub-processors are listed at postboxapp.cloud/subprocessors. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give Customer a way to receive notice of new sub-processors before they begin processing, and Customer may object on reasonable data-protection grounds; if we cannot resolve the objection, Customer may terminate the affected Service.

6. International transfers

Where processing involves transferring personal data across borders (for example, to the United States), we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses and the UK Addendum, which are incorporated into this DPA by reference where they apply. Customer can pin a project to the EU to keep processing within that region.

7. Assisting the Customer

Taking into account the nature of the processing, Postbox will:

• assist Customer, by appropriate technical and organizational measures and insofar as possible, in responding to requests from data subjects exercising their rights;
• assist Customer in meeting its obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities;
• where we receive a data-subject request relating to personal data processed on Customer's behalf, refer the data subject to Customer rather than respond directly.

8. Personal data breach

We will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer's personal data, and provide the information Customer reasonably needs to meet its own notification obligations. Notification is not an acknowledgment of fault.

9. Deletion and return

On termination of the Service, and at Customer's choice, we will delete or return the personal data we process on Customer's behalf, and delete existing copies, unless law requires continued storage. Customer can also delete mailboxes and their contents at any time during the term. Routine backups are overwritten on our standard cycle.

10. Audits

We will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor it mandates, subject to reasonable confidentiality, notice, and frequency limits. Where available, we may satisfy audit requests by providing third-party certifications or reports.

11. US state privacy laws

Where the CCPA or a similar US state law applies, Postbox acts as a "service provider" (or "processor") and processes personal information only to provide the Service. We do not sell or share personal information, and we do not retain, use, or disclose it for any purpose other than performing the Service or as permitted by law.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.

Annex 1: Details of processing

• Subject matter: provision of API-first mailbox infrastructure (sending, receiving, storing, and reading mail).
• Duration: for the term of the Terms and until deletion or return under Section 9.
• Nature and purpose: routing, delivery, storage, retrieval, deliverability management, abuse prevention, and support.
• Categories of data subjects: Customer's users, senders, and recipients of mail processed through the Service.
• Types of personal data: email addresses and sender/recipient identifiers, message content and attachments, and delivery and event metadata, as determined by Customer's use.
• Special categories: not intended; Customer should not route special-category data unless it has a lawful basis and appropriate safeguards.

Annex 2: Technical and organizational measures

• Encryption of personal data in transit (TLS) and at rest.
• Access control through project-scoped API keys and short-lived, single-mailbox tokens.
• Least-privilege internal access limited to personnel who need it.
• Suppression, reputation, and abuse controls that limit unsafe sending.
• Logging and monitoring of platform and delivery events.
• Use of reputable infrastructure providers under data-protection terms.

Annex 3: Sub-processors

The current list of sub-processors is maintained at postboxapp.cloud/subprocessors and is incorporated into this DPA.

Contact

Data-protection questions or to request a signed DPA: [email protected]. Postbox, Inc., 2261 Market Street, STE 46197, San Francisco, CA 94114, USA.