---
title: "Data Processing - Emvero"
description: "The processor terms covering verification of personal data on a customer’s behalf, including sub-processors and security measures."
url: https://emvero.io/dpa/
language: en
updated: 2026-09-10
---

Legal

# Data Processing Agreement

Where verification is carried out on your behalf, you are the controller and this service is the processor. This page sets out the shape of that agreement.

**Availability: Available today, signed on request** A standard DPA comes with every account and is executed as part of any enterprise agreement. Request a copy through contact sales

and it comes back countersigned.

## Subject matter and duration

Verification of email addresses supplied by the controller, for the term of the agreement.

## Nature and purpose of processing

Determining whether an address can receive mail, by evaluating syntax, domain configuration, mail routing and the response of the receiving mail server, together with risk signals such as disposable providers and role accounts. **No message is delivered to any address processed.**

## Categories of data and data subjects

Email addresses, and the technical evidence derived from them. Data subjects are the individuals to whom those addresses belong: typically the controller’s customers, users or prospects.

## Security measures

Technical measures that follow from the architecture and can be evidenced today are listed on the [security page](https://emvero.io/security/). The formal annex, including encryption statements and organisational measures, is attached to the agreement as Annex II.

## Sub-processors

The current register is on the security page. Adding capacity at a provider already listed there is not a new sub-processor. Where a new one is added you are told in advance - or as soon as reasonably practicable where an urgent replacement is needed for security or continuity - and you may object on reasonable data-protection grounds; where an objection cannot be resolved, you may terminate the affected service.

## International transfers

Processing stays in the EEA. Where a transfer beyond it cannot be avoided, it runs on the European Commission’s standard contractual clauses.

## Assistance, audit and deletion

We help with data-subject requests inside the deadlines the GDPR sets, open the evidence behind our controls to audit once a year, and return or delete the data within 30 days of termination, whichever you choose.

## Breach notification

You are notified without undue delay and within 72 hours of us becoming aware, with what is known at that point and what is being done about it.