Data Processing Agreement (DPA)

Last updated: October 4, 2026

This Data Processing Agreement ("DPA") forms part of the contract between Smailor / Victor André EI ("Processor") and the customer ("Controller") who uses the Smailor service, and governs the processing of personal data by the Processor on behalf of the Controller, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

By using the Smailor service, the Controller accepts the terms of this DPA. A signed version may be requested at [email protected] for enterprise or compliance purposes.

1. Definitions

2. Subject matter and scope

The Processor shall process personal data on behalf of the Controller solely for the purposes of providing the Smailor service as described in the Terms of Service and as instructed by the Controller.

Nature of processing: Hosting, storage, transmission, routing, filtering, indexing, and display of customer support email, attachments, contacts, and associated metadata; authentication of mail clients; outbound submission through the routes the Controller configures; and the optional features described in Section 2.1. When Telecom is enabled, this also includes SMS validation, queuing, routing, delivery receipts, replies, campaigns, and recipient suppression on the Controller's instruction.

Categories of data subjects: End users, employees, and team members of the Controller, and the customers, correspondents, contacts, and website visitors of the Controller who send or receive email or SMS, submit a widget form, or are recorded as contacts in the service.

Categories of personal data: Email addresses, telephone numbers, sender identifiers, names, email and SMS content and replies, subject lines, attachments, contact records, SMS delivery and suppression data, calendar entries where the Controller connects or creates them, IP addresses and technical metadata (including those present in email headers and in mail-client connections), mail-access credential hashes and connection logs, tracking events where the Controller enables tracking, and any other personal data contained in the data the Controller processes through the service.

Special categories: The service is not designed for special-category data (GDPR Art. 9). The Controller must not deliberately configure the service to process it, and accepts that any special-category data appearing incidentally in message content is processed under the same measures as other content.

Duration: For the term of the Controller's subscription and for such retention periods as are set out in the Privacy Policy or required by law, whichever is longer.

2.1 Features the Controller enables, and what they mean for processing

Some processing only happens because the Controller turns a feature on. Enabling it constitutes the Controller's instruction for that processing, and the Controller remains responsible for its lawfulness.

3. Obligations of the Processor

The Processor shall:

3.1 Process only on documented instructions from the Controller, including with regard to transfers outside the EEA. The terms of this DPA, the Terms of Service, and the feature settings the Controller chooses constitute the Controller's documented instructions. If the Processor is required by EU/Member State law to process data otherwise, the Processor shall inform the Controller before processing unless prohibited by law.

3.2 Ensure confidentiality: Persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (GDPR Art. 28(3)(b)).

3.3 Implement appropriate technical and organisational security measures in accordance with GDPR Art. 32, including as described in Section 7 of this DPA.

3.4 Sub-processor controls: Not engage a new sub-processor without giving the Controller reasonable opportunity to object (see Section 5). Where the Processor engages sub-processors, it shall impose the same data protection obligations on them by contract.

3.5 Assist the Controller with responding to data subject requests and with the Controller's obligations under GDPR Arts. 32–36 (security, breach notification, impact assessments), taking into account the nature of processing and the information available to the Processor, as described in Section 6.

3.6 Delete or return all personal data to the Controller at the choice of the Controller after the end of the provision of services, and delete existing copies unless EU or Member State law requires storage.

3.7 Make available all information necessary to demonstrate compliance with GDPR Art. 28, and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor, subject to reasonable notice and appropriate confidentiality protections.

3.8 Marketplace data. This DPA does not govern personal data exchanged between Smailor, marketplace sellers, and marketplace buyers where each party independently determines the purposes and means of its processing. Those relationships are governed by the Privacy Policy, Terms of Service, and Seller Agreement, as applicable.

3.9 Outside this DPA. This DPA does not govern personal data for which the Processor is itself the controller — account registration, account certification documents and review decisions, billing records, security and fraud prevention on its own infrastructure, affiliate participation, and its own marketing and prospecting. Those are described in the Privacy Policy.

4. Obligations of the Controller

The Controller shall:

4.1 Ensure it has a lawful basis for processing and any required consents or notices for the personal data it submits to the service, including for any tracking feature it enables (Section 2.1).

4.2 Ensure that data subjects have been informed of the processing, including that Smailor acts as a processor.

4.3 Provide the Processor with complete and accurate instructions and promptly inform the Processor if instructions change.

4.4 Be responsible for the accuracy, quality, and legality of personal data submitted to the service.

4.5 Ensure that the personal data submitted is limited to what is necessary for the purposes of the service (data minimisation), and that special-category data is not deliberately introduced.

4.6 Administer its own access control: configuring team member permissions, removing access when a person leaves, revoking mail-access credentials, and keeping its account contact details current.

4.7 Carry out its own export before deleting data or terminating, and accept that deletions made through the service — in particular immediate deletion — are irreversible.

4.8 For Telecom/SMS, maintain recipient notices, consent and withdrawal evidence, and suppression lists; classify marketing honestly; and comply with the Telecom and SMS Terms and the law of each destination.

5. Sub-processors

The Controller authorises the Processor to use the following sub-processors, subject to the obligations in Section 3.4. The authoritative, current list is published at smailor.com/trust and in the Sub-processor list document.

Not sub-processors. Where the Controller supplies its own credentials for a sending provider (for example Brevo, Mailjet, Resend, or its own SMTP server), or connects its own third-party account, that provider processes data for the Controller, under the Controller's own agreement with it. The Processor transmits the data on the Controller's instruction but does not appoint that provider and is not responsible for its processing.

The Processor shall notify the Controller at least 14 days in advance of any intended addition or replacement of sub-processors by posting the updated list at smailor.com/trust and (where possible) by email. The Controller may object within that period on reasonable grounds related to data protection by contacting [email protected]. If the parties cannot resolve the objection, the Controller may terminate the relevant services without penalty.

6. Data subject rights and Controller assistance

When the Processor receives a request from a data subject exercising rights under GDPR Chapter III (access, rectification, erasure, restriction, portability, objection), the Processor shall:

• Promptly forward the request to the Controller (within 5 business days); and
• Assist the Controller in fulfilling the request, to the extent technically feasible within the service.

For data breaches affecting personal data processed under this DPA: the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a breach, providing all information available at the time. Further information shall be provided as it becomes available. The Controller is responsible for notifying the relevant supervisory authority and data subjects as required by GDPR. Notification will be sent to the Controller's account contact address, which the Controller must keep current and monitored.

7. Technical and organisational security measures (GDPR Art. 32)

The Processor implements and maintains the following measures, appropriate to the risk:

7.1 Encryption

• All web traffic is encrypted using TLS 1.2 or higher.
• Mail transport uses TLS: implicit TLS on the submission and retrieval ports that require it, and STARTTLS where the protocol negotiates it. Delivery to and from third-party mail systems depends on the remote server supporting TLS, which the Processor cannot guarantee.
• Storage volumes are encrypted at rest by Hetzner's infrastructure layer.
• DKIM keys (RSA-2048) are stored securely and rotated on request.

7.2 Credentials

• Smailor login authentication uses a strong password (bcrypt-hashed) or OAuth (Google, Discord).
• Mail access credentials for POP3 and SMTP are stored as hashes, displayed once at creation, not recoverable by the Processor, individually revocable, and capped per mailbox.
• Secrets that must be replayed to function — third-party sending provider API keys, OAuth access and refresh tokens, and application-specific passwords for calendars — are necessarily held in a recoverable form, protected by access controls and volume-level encryption, and deleted when the Controller disconnects the integration. They are excluded from logs.

7.3 Access controls

• Role-based access controls within workspaces, with a per-route member allowlist for team accounts.
• Session tokens are short-lived and invalidated on logout or security events.
• Administrative access to production systems is limited to the data controller (Victor André).

7.4 Availability and resilience

• Infrastructure hosted on Hetzner with standard availability SLAs.
• Regular automated backups. Backup restoration is tested periodically. Backups serve disaster recovery; they are not a per-item restore service, and data the Controller deletes is not recoverable from them on request.
• Rate limiting and abuse controls to protect service availability, applied per account, per credential, and per authentication.

7.5 Monitoring and incident response

• Security events, login anomalies, and mail-client authentication failures are logged and monitored.
• Logs are retained for up to 24 months unless a longer period is required by law.
• Security incidents trigger the breach notification procedure in Section 6.
• A vulnerability disclosure process is published in the Security Policy.

7.6 Organisational measures

• All persons with access to personal data are bound by confidentiality.
• Sub-processors are assessed before engagement and bound by equivalent obligations (Section 5).

7.7 What is not protected

• Mail is not end-to-end encrypted: it must be readable by the service to be filtered, indexed, searched, routed, and displayed.
• Once a mail client downloads a message, the copy on that device is outside the Processor's control.

8. International transfers

Transfers of personal data outside the European Economic Area (EEA) are made only to sub-processors listed in Section 5 with appropriate transfer mechanisms in place (Standard Contractual Clauses, adequacy decision, or equivalent), or on the Controller's own instruction.

The Controller is specifically informed that, where link and sender safety checks are active, URLs extracted from message content and sender domains and IP addresses may be transmitted to reputation services outside the EEA, including Google Safe Browsing in the United States. This is a security measure and is covered by the mechanisms in Section 5. A Controller who needs this restricted should contact [email protected] before relying on the service for data where such a transfer would be unacceptable.

No other ad-hoc transfers of Controller data outside the EEA are made without the Controller's prior instruction.

9. Audits

The Controller may, with reasonable advance notice (at least 15 business days) and no more than once per calendar year (unless required by a supervisory authority), request an audit of the Processor's data processing activities related to this DPA. Audits shall be conducted at the Controller's cost, during business hours, and subject to a confidentiality agreement. The Processor may satisfy audit requirements by providing up-to-date compliance documentation (e.g. sub-processor DPAs, security policy summaries) in lieu of an on-site visit where this adequately addresses the Controller's concerns.

10. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits liability for matters that cannot be excluded under GDPR or applicable law (e.g. supervisory fines remain the responsibility of the party at fault).

11. Termination and data deletion

Upon termination of the service agreement or at the Controller's written request:

• The Processor shall cease processing and delete or return all personal data within 30 days, except where retention is required by applicable law.
• Return is provided in a commonly used machine-readable format through the export features of the service or, where those are insufficient, by another reasonable means agreed between the parties.
• Anonymised, aggregated, or de-identified data not relating to the Controller may be retained.
• Residual copies in backups are removed as those backups age out on their normal cycle.
• The Processor shall provide a written confirmation of deletion upon request.

12. Governing law

This DPA is governed by the laws of France and, where applicable, EU law (including the GDPR). Disputes shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.

13. Contact

For DPA-related requests, data subject rights, or security matters:

• Privacy: [email protected]
• Security / abuse: [email protected]
• Legal entity: Victor André EI, France

See the Legal Notice for postal and registration details.