Data Processing Addendum

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between SendHub LLC, doing business as MailKite ("MailKite", "Processor"), and the customer agreeing to the Terms ("Customer", "Controller"). It applies whenever Customer's use of the Service involves MailKite processing personal data on Customer's behalf — for example, the content, headers, and recipients of email MailKite receives or sends for Customer's domains.

This DPA is incorporated automatically; no separate signature is required to make it effective. If your organization's procurement process requires a countersigned copy, email us and we'll return one.

2. Subject matter and duration

MailKite processes personal data solely to provide the Service described in the Terms — receiving, routing, storing (per Customer's retention settings), and delivering email on Customer's behalf, and the account/billing administration needed to operate the Service. Processing continues for the term of the Terms and ceases (subject to Section 8) on termination.

3. Nature and purpose of processing

Receipt of inbound email addressed to Customer's connected domains and delivery to Customer's webhook; sending of outbound email submitted through Customer's API calls; short-lived storage of message metadata and, depending on Customer's retention settings, message bodies and attachments, for debugging and replay; deliverability analysis of Customer's own sending patterns to route Customer's mail.

4. Categories of data subjects and personal data

Data subjects: Customer's end users and correspondents whose email Customer sends or receives through the Service, and individuals in Customer's synced address book.

Personal data: sender and recipient email addresses and display names, message subject lines and bodies, attachments, headers, and — where Customer connects Google Contacts — the name, email address, and company of Customer's contacts. MailKite does not intentionally process special categories of data (GDPR Art. 9) except to the extent Customer includes such data in email content, which is Customer's choice and responsibility.

5. Processor obligations

MailKite will:

• Process personal data only on Customer's documented instructions, including as set out in the Terms, this DPA, and Customer's configuration of the Service (routing, retention, and encryption settings) — unless required to do otherwise by law, in which case MailKite will inform Customer before processing, unless the law prohibits this.
• Ensure personnel authorized to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures under GDPR Art. 32, including encryption in transit (TLS) for all API and webhook traffic, HMAC-signed webhook deliveries, DKIM/SPF/DMARC-aligned sending, optional per-domain zero-retention passthrough, and optional at-rest encryption of retained message bodies to a customer-supplied public key.
• Not engage a new subprocessor without giving Customer the opportunity to object — see Section 6.
• Taking into account the nature of processing, assist Customer with responding to data subject requests and with Customer's own GDPR Art. 32-36 obligations (security, breach notification, DPIAs), to the extent the information is available to MailKite.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data.
• At Customer's choice, delete or return personal data at the end of the Service relationship (see Section 8), and delete existing copies unless retention is required by law.
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits, including inspections, conducted by Customer or an auditor Customer mandates, subject to reasonable notice and confidentiality.

6. Subprocessors

MailKite's current subprocessors are listed in the "Subprocessors" section of our Privacy Policy, which is incorporated into this DPA by reference. Customer authorizes MailKite's use of these subprocessors. MailKite will update that list when subprocessors change; material changes will be announced to Customer's account contact email, and Customer may object on reasonable data-protection grounds by contacting us within 14 days, in which case the parties will work in good faith to resolve the objection.

7. International transfers

MailKite's subprocessors operate infrastructure that includes the United States. Where personal data is transferred outside the EEA, UK, or Switzerland, the transfer is governed by the EU Standard Contractual Clauses (Module 2: Controller to Processor, and Module 3: Processor to Sub-processor, as applicable), incorporated into this DPA by reference, together with the UK International Data Transfer Addendum for transfers from the UK, and/or the EU-U.S. and UK-U.S. Data Privacy Framework where a subprocessor is self-certified under it.

8. Deletion and return of data

During the Term, Customer controls retention through the per-domain settings described in the Privacy Policy (default auto-expiry, zero-retention passthrough, or at-rest encryption). On termination of the Terms, MailKite will delete Customer's remaining account and message data within a reasonable period, except where retention is required for legal, tax, or accounting purposes as described in the Privacy Policy.

9. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set out in the Terms of Service.

10. Contact

Data protection questions or requests relating to this DPA: support [at] mailkite [dot] dev.

SendHub LLC, doing business as MailKite, 30 N Gould St #59709, Sheridan, WY 82801, USA.