Legal
Data Processing Agreement
Where verification is carried out on your behalf, you are the controller and this service is the processor. This page sets out the shape of that agreement.
A standard DPA comes with every account and is executed as part of any enterprise agreement. Request a copy through contact sales and it comes back countersigned.
Subject matter and duration
Verification of email addresses supplied by the controller, for the term of the agreement.
Nature and purpose of processing
Determining whether an address can receive mail, by evaluating syntax, domain configuration, mail routing and the response of the receiving mail server, together with risk signals such as disposable providers and role accounts. No message is delivered to any address processed.
Categories of data and data subjects
Email addresses, and the technical evidence derived from them. Data subjects are the individuals to whom those addresses belong: typically the controller’s customers, users or prospects.
Security measures
Technical measures that follow from the architecture and can be evidenced today are listed on the security page. The formal annex, including encryption statements and organisational measures, is attached to the agreement as Annex II.
Sub-processors
The current register is on the security page. Adding capacity at a provider already listed there is not a new sub-processor. Where a new one is added you are told in advance - or as soon as reasonably practicable where an urgent replacement is needed for security or continuity - and you may object on reasonable data-protection grounds; where an objection cannot be resolved, you may terminate the affected service.
International transfers
Processing stays in the EEA. Where a transfer beyond it cannot be avoided, it runs on the European Commission’s standard contractual clauses.
Assistance, audit and deletion
We help with data-subject requests inside the deadlines the GDPR sets, open the evidence behind our controls to audit once a year, and return or delete the data within 30 days of termination, whichever you choose.
Breach notification
You are notified without undue delay and within 72 hours of us becoming aware, with what is known at that point and what is being done about it.