This Data Processing Agreement ("DPA") forms part of and is incorporated into the MailCraft Terms of Use between Rujuta Sawant ("the Provider") and the account holder ("the Client"). It applies to all processing of personal data carried out by the Provider on behalf of the Client through the MailCraft application ("the Application").
The terms "personal data", "processing", "data subject", "controller", "processor", "personal data breach" and "supervisory authority" have the meanings given in the UK GDPR. "UK GDPR", "Data Protection Act 2018" and "PECR" mean those laws as in force in the United Kingdom and as amended from time to time.
The Client is the controller and the Provider is the processor in respect of the personal data processed through the Application. The details of the processing are set out in Annex 1. The Client is solely responsible for determining the purposes and means of processing and for establishing a lawful basis for it.
Process the personal data only on the Client's documented instructions, including with regard to transfers of personal data to a third country. The Client's configuration and use of the Application, together with the Terms of Use and this DPA, constitute the Client's complete and documented instructions. The Provider shall inform the Client if, in its opinion, an instruction infringes data protection law.
Ensure that any person authorised to process the personal data is subject to an appropriate duty of confidentiality.
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR. The current measures are described in Annex 2.
The Client provides general authorisation for the Provider to engage the sub-processors listed in Annex 1. The Provider shall impose data protection obligations on each sub-processor equivalent to those in this DPA, and shall inform the Client of any intended addition or replacement of a sub-processor, giving the Client a reasonable opportunity to object.
Taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures, insofar as possible, to fulfil the Client's obligation to respond to requests from data subjects exercising their rights (including access, rectification, erasure, objection and restriction).
Assist the Client in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR (security, breach notification, communication to data subjects, and data protection impact assessments), taking into account the nature of processing and the information available to the Provider.
Notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Client's data, providing the information reasonably available to enable the Client to meet its own breach-reporting obligations.
On termination of the provision of the services, at the Client's choice, delete or return all the personal data and delete existing copies, unless retention is required by law.
Make available to the Client all information necessary to demonstrate compliance with this clause, and allow for and contribute to reasonable audits, including inspections, conducted by the Client or an auditor mandated by the Client, on reasonable prior notice.
The Client acknowledges that email delivery is performed by Resend, whose account data and logs are held in the United States. The Provider relies on the safeguards and transfer mechanisms operated by Resend for that transfer. The Client, as controller, remains responsible for assessing the adequacy of those safeguards and for disclosing the transfer in its own privacy information.
This DPA takes effect on the Client's acceptance of the Terms and continues for as long as the Provider processes personal data on the Client's behalf.
| Item | Detail |
|---|---|
| Subject matter | Provision of a browser-based email campaign tool that transmits the Client's marketing emails for delivery. |
| Duration | The term of the Terms of Use / for as long as the Application is used. |
| Nature and purpose | Receiving uploaded contact data in the Client's browser and transmitting recipient email addresses and campaign content, via the Provider's serverless function, to Resend for delivery. |
| Types of personal data | Recipient email addresses; recipient names; any other personal data the Client includes in an uploaded list or campaign. |
| Categories of data subjects | The Client's customers and marketing contacts. |
| Sub-processors | Resend (resend.com) — email delivery (United States). Vercel (vercel.com) — hosting and serverless functions (United States / EU). |