Data Processing Agreement

1. Definitions

For the purposes of this Data Processing Agreement ("DPA"), the following terms shall have the meanings set forth below. Capitalized terms not defined herein shall have the meanings ascribed to them in the Terms of Service.

• "Applicable Data Protection Law" means all laws and regulations relating to the processing of Personal Data that apply to the performance of this DPA, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), the California Consumer Privacy Act ("CCPA"), and any other applicable national, state, or regional data protection legislation, in each case as amended, replaced, or superseded from time to time.
• "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, the Controller is the Customer.
• "Processor" means the natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller. For the purposes of this DPA, the Processor is VENTRYA LTD, a company incorporated in England and Wales under company number 16505638, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, trading as Mail.Land ("MailLand").
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• "Personal Data" means any information relating to a Data Subject that is processed by MailLand on behalf of the Customer in connection with the provision of the Services.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Sub-processor" means any third party engaged by MailLand (or by any subsequent Sub-processor) to process Personal Data on behalf of the Customer in connection with the Services.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by MailLand or its Sub-processors in connection with the provision of the Services.
• "Standard Contractual Clauses" ("SCCs") means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Decision (EU) 2021/914, as may be amended, replaced, or superseded from time to time.

2. Scope and Roles

This DPA applies to the Processing of Personal Data by MailLand on behalf of the Customer in connection with the provision of email delivery and related services (the "Services") as described in the Terms of Service. This DPA supplements and forms an integral part of the Terms of Service.

The Customer acts as the Controller, and MailLand acts as the Processor, with respect to the Personal Data processed under this DPA. Each party shall comply with its respective obligations under Applicable Data Protection Law.

In the event of any conflict or inconsistency between this DPA and the Terms of Service, the provisions of this DPA shall prevail with respect to matters relating to the Processing of Personal Data.

3. Customer Obligations

The Customer, as Controller, represents, warrants, and undertakes that:

1. The Customer has established and shall maintain a valid lawful basis for the Processing of Personal Data in accordance with Applicable Data Protection Law, including but not limited to obtaining all necessary consents or establishing another appropriate legal basis prior to submitting Personal Data to the Services.
2. All Personal Data provided to MailLand is accurate, complete, and up-to-date, and the Customer shall take reasonable steps to ensure the ongoing accuracy of such data.
3. The Customer has provided all required privacy notices and disclosures to Data Subjects in accordance with Applicable Data Protection Law, including information about the use of MailLand as a Processor for email delivery purposes.
4. The Customer has full authority to instruct MailLand to process the Personal Data as contemplated by this DPA and the Terms of Service.
5. The Customer shall comply with all Applicable Data Protection Law in its use of the Services and in any Processing instructions it issues to MailLand.
6. The Customer shall not provide, submit, or otherwise make available to MailLand any sensitive data or special categories of Personal Data (as defined under Article 9 of the GDPR) unless the parties have entered into a separate written agreement explicitly governing the Processing of such data.

4. MailLand Obligations

As Processor, MailLand shall comply with the following obligations with respect to the Processing of Personal Data under this DPA:

1. Processing on Instructions. MailLand shall process Personal Data only on documented instructions from the Customer, including as described in the Terms of Service and this DPA, unless Processing is required by European Union or Member State law to which MailLand is subject, in which case MailLand shall inform the Customer of that legal requirement before Processing, unless such law prohibits such notification on important grounds of public interest.
2. Confidentiality. MailLand shall ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. Access to Personal Data shall be limited to those personnel who require such access to perform the Services.
3. Security Measures. MailLand shall implement and maintain appropriate technical and organizational security measures in accordance with Article 32 of the GDPR, as further described in Section 5 of this DPA, to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage.
4. Sub-processor Engagement. MailLand shall not engage any Sub-processor to process Personal Data without the prior general or specific written authorization of the Customer, subject to the provisions of Section 8 of this DPA.
5. Data Subject Rights. Taking into account the nature of the Processing, MailLand shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection).
6. Data Protection Impact Assessments. MailLand shall provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, where required under Articles 35 and 36 of the GDPR, taking into account the nature of the Processing and the information available to MailLand.
7. Deletion or Return of Data. Upon termination or expiration of the Services, MailLand shall, at the Customer's written instruction and choice, delete or return all Personal Data to the Customer within thirty (30) days, and delete existing copies unless retention is required by applicable law. Where retention is required by law, MailLand shall limit Processing of such retained data solely to the purpose required by law.
8. Audit and Compliance. MailLand shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set forth in this DPA and under Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Such audits shall be subject to reasonable prior notice of at least thirty (30) days, shall be conducted during normal business hours, and shall not unreasonably interfere with MailLand's business operations.
9. Notification of Infringement. MailLand shall immediately inform the Customer if, in MailLand's opinion, an instruction issued by the Customer infringes Applicable Data Protection Law. MailLand may suspend the performance of the relevant instruction until the Customer confirms or modifies such instruction.

5. Security Measures

MailLand implements and maintains the following technical and organizational security measures to protect Personal Data in accordance with Article 32 of the GDPR. These measures are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing.

6. Data Breach Notification

In the event of a Data Breach, MailLand shall comply with the following notification and cooperation obligations:

1. Timely Notification. MailLand shall notify the Customer of a Data Breach without undue delay, and in any event within seventy-two (72) hours after becoming aware of the Data Breach. Such notification shall be directed to the Customer's designated security contact or, if none has been designated, to the Customer's primary account contact.
2. Content of Notification. The notification shall include, to the extent reasonably available at the time of notification:
   • A description of the nature of the Data Breach, including the categories of Personal Data and the approximate number of Data Subjects affected;
   • The name and contact details of MailLand's point of contact from whom further information may be obtained;
   • A description of the likely consequences of the Data Breach;
   • A description of the measures taken or proposed to be taken by MailLand to address the Data Breach, including measures to mitigate its potential adverse effects.
3. Phased Disclosure. Where it is not possible to provide all required information within the seventy-two (72) hour period, MailLand shall provide the information in phases without further undue delay, as such information becomes available.
4. Cooperation. MailLand shall cooperate with the Customer and take all commercially reasonable steps to assist in the investigation, mitigation, and remediation of the Data Breach.
5. Documentation. MailLand shall document all Data Breaches, including the facts relating to the Data Breach, its effects, and the remedial actions taken, and shall make such documentation available to the Customer and, upon request, to supervisory authorities.

7. International Data Transfers

Personal Data processed under this DPA may be transferred to, and processed in, countries outside of the European Economic Area ("EEA") and the United Kingdom ("UK"). MailLand shall ensure that any such transfer is carried out in compliance with Applicable Data Protection Law and is subject to appropriate safeguards, as follows:

8. Sub-processors

The Customer hereby provides general written authorization for MailLand to engage Sub-processors to process Personal Data in connection with the provision of the Services, subject to the following conditions:

1. List of Sub-processors. MailLand shall maintain an up-to-date list of Sub-processors, which is set forth in Schedule A below.
2. Prior Notification. MailLand shall notify the Customer at least thirty (30) days in advance of any intended addition of, or replacement of, a Sub-processor. Such notification shall include the identity of the proposed Sub-processor, the nature of the Processing to be performed, and the location of Processing.
3. Objection Right. The Customer may object to the appointment of a new Sub-processor by providing MailLand with written notice of such objection within thirty (30) days of receiving notification. The objection must be based on reasonable grounds relating to data protection. MailLand shall make commercially reasonable efforts to address the Customer's objection. If the parties are unable to resolve the objection within a reasonable timeframe, the Customer may terminate the affected Services without penalty by providing written notice to MailLand.
4. Contractual Obligations. MailLand shall impose data protection obligations on each Sub-processor by way of a written contract that provides, at a minimum, the same level of protection for Personal Data as is set forth in this DPA.
5. Liability. MailLand shall remain fully liable to the Customer for the performance of each Sub-processor's obligations with respect to the Processing of Personal Data.

9. Term and Termination

This DPA shall become effective on the date on which the Customer agrees to the Terms of Service and shall remain in effect for the duration of the service agreement between the Customer and MailLand.

10. Governing Law

This DPA shall be governed by and construed in accordance with the laws that govern the Terms of Service, specifically the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction over any dispute arising out of or in connection with it, as provided in Section 15 of the Terms of Service.

Notwithstanding the foregoing, to the extent that matters arising under this DPA are subject to the GDPR, the laws of the EU member state in which the Customer is established shall apply with respect to such matters. To the extent that matters arising under this DPA are subject to the UK GDPR, the laws of England and Wales shall apply with respect to such matters.

Any disputes arising out of or in connection with this DPA shall be resolved in accordance with the dispute resolution provisions set forth in the Terms of Service.