Data Processing Addendum

Scope and duration

This Addendum applies when MailerZ processes personal data contained in email content, addresses, routing, delivery records, or service configuration on the customer’s behalf. Processing lasts for the service term plus the limited retention and deletion period described in the Terms, Privacy Policy, and customer plan.

Processing details

• Subject matter: domain email receiving, forwarding, storage, recovery, authenticated SMTP sending, security, and support.
• Purpose: provide and protect the features selected and configured by the customer.
• Data subjects: customer users, senders, recipients, contacts, employees, contractors, customers, and other people whose data appears in messages or routing records.
• Data types: identifiers, contact details, message content and attachments, metadata, IP addresses, authentication and delivery data, and customer configuration.
• Frequency: continuous or occasional according to customer use.

Customer instructions

MailerZ will process customer personal data only on documented instructions contained in the Terms, this Addendum, the customer’s configuration and use, and written support requests, unless law requires otherwise. The customer must ensure its instructions are lawful and that it has the rights, notices, and legal bases required for the processing.

Confidentiality and security

Persons authorized to process customer personal data are bound by confidentiality obligations. MailerZ maintains risk-based technical and organizational controls appropriate to the service, including access restriction, authentication, logging, transport protection, operational monitoring, recovery measures, and procedures for handling security events.

Subprocessors

Customer gives general authorization for MailerZ to use subprocessors needed to provide the service. MailerZ will impose data-protection obligations appropriate to the processing and remains responsible for its obligations under this Addendum. Material subprocessor changes will be handled through the Subprocessor Policy, and customers may raise a reasonable data-protection objection.

Rights and compliance assistance

Taking into account the nature of processing and information available, MailerZ will reasonably assist the customer with data-subject requests, security assessments, personal-data breach obligations, data protection impact assessments, and regulator consultations required by applicable data-protection law. Additional work outside normal service support may be charged at an agreed rate.

Personal-data breaches

MailerZ will notify the customer without undue delay after confirming a personal-data breach affecting customer personal data and provide information reasonably available about the nature, likely consequences, affected data, and mitigation. Notification is not an admission of fault or liability.

Transfers

Where restricted international transfers occur, the parties will use a lawful transfer mechanism applicable to the data and destination, such as an adequacy decision or approved standard contractual clauses. Supplementary safeguards will be considered where required.

Deletion, return, and audits

At the customer’s choice and subject to service functionality, MailerZ will delete or return eligible customer personal data after termination unless law requires retention. Backup deletion follows normal cycles. MailerZ will provide information reasonably necessary to demonstrate compliance and may satisfy audit requests through current reports, documentation, questionnaires, or a scoped independent audit subject to confidentiality, security, and cost controls.

Order and precedence

If this Addendum conflicts with the Terms on processing customer personal data, this Addendum controls. The Terms continue to govern all other matters, including fees, liability, suspension, and dispute resolution.