# Data processing agreement — MiraMail > MiraMail DPA. ## Data Processing Addendum **Effective date:** 2026-05-07 > MiraMail (operated by [Operator Legal Entity Name TBD]) is a technical platform. We process Personal Data only on the documented instructions of the Customer acting as Data Controller. We do not, and are not obligated to, verify the legal basis under which Customer processes Personal Data. Responsibility for compliance with applicable data-protection law lies with the Customer (see §5 and §16 below). This Data Processing Addendum ("DPA") applies when MiraMail (the "**Processor**", operated by [Operator Legal Entity Name TBD]) processes Personal Data on behalf of a customer (the "**Controller**") in providing the Service. It supplements the [Terms of Service](/terms) and [Privacy Policy](/privacy). ### 1. Definitions Terms used here have the meanings given to them under the EU General Data Protection Regulation 2016/679 ("GDPR") and equivalent laws in other jurisdictions (UK GDPR, CCPA, LGPD, etc.). - [object Object] - [object Object] - [object Object] ### 2. Subject Matter and Duration **Subject matter:** Processing of Personal Data uploaded by the Controller to the Service (contact records, email addresses, custom attributes, behavioral events, email content). **Duration:** For the term of the Controller's account, plus the retention periods specified in the Privacy Policy and §13 of this DPA. ### 3. Nature and Purpose of Processing The Processor processes Personal Data only to: - Send emails on the Controller's behalf to the Controller's recipients. - Track email opens, clicks, unsubscribes, and bounces. - Compute segments and trigger automation campaigns based on Controller-defined rules. - Provide analytics and reporting to the Controller. - Store and surface contact records and event history for the Controller's operational use. ### 4. Categories of Data and Data Subjects - [object Object] - [object Object] - [object Object] - [object Object] ### 5. Controller's Obligations The Controller is solely responsible for the lawfulness of the processing it instructs the Processor to perform. Without limiting the generality of the foregoing, the Controller shall: - Ensure a lawful basis (consent, legitimate interest, contractual necessity, or other) exists for every contact record uploaded to the Service and maintain auditable evidence of that lawful basis. - Promptly honor unsubscribe, opt-out, erasure, rectification, portability, restriction, and objection requests from data subjects, in accordance with the laws applicable to each recipient. - Publish and maintain a privacy notice covering the processing performed through the Service, listing [Operator Legal Entity Name TBD] (and its sub-processors) as a processor. - Register as a data controller in jurisdictions that require it; complete data-protection impact assessments where required by Articles 35–36 GDPR. - [object Object] - Comply with all applicable anti-spam laws, including sender identification, functional unsubscribe links, and accurate physical-address disclosure where required. - Configure the Service (sending domain, segments, automation, retention) so that the Processor's processing remains within the Controller's documented instructions. ### 6. Processor's Obligations - Process Personal Data only on the Controller's documented instructions (the Service configuration is the instruction). - Maintain confidentiality — staff access is logged and audited; persons authorized to process Personal Data are subject to confidentiality obligations. - Implement appropriate technical and organizational measures per Article 32 GDPR (see §8). - Assist the Controller in responding to data-subject requests (§9). - Notify the Controller of Personal Data Breaches without undue delay (§10). - Make available all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in §11. ### 7. Sub-Processors The Controller authorizes the Processor to engage: - [object Object] - [object Object] - [object Object] - [object Object] We provide 30 days' notice via email before adding a new sub-processor. The Controller may object on reasonable grounds by emailing [dpo@miramail.io](mailto:dpo@miramail.io); if no resolution is found, the Controller may terminate without penalty. ### 8. Security Measures (Art. 32) - TLS 1.2+ for all data in transit. - At-rest encryption for database storage (managed by hosting provider). - Bcrypt for password hashes; secrets in a dedicated secret-management vault. - Principle of least privilege for staff access; admin actions logged in an append-only audit table. - Automatic backups with 30-day rotation; geographically redundant. - Incident-response runbooks; on-call rotation. - Regular review of measures (Art. 32(1)(d)); adjustments based on the state of the art. ### 9. Data-Subject Requests The Service provides self-service tooling for the Controller to handle subject requests: - [object Object] - [object Object] - [object Object] Requests that cannot be completed via tooling are forwarded to [dpo@miramail.io](mailto:dpo@miramail.io) and actioned within 30 days. ### 10. Personal Data Breach Notification The Processor will notify the Controller without undue delay, and in any event within 72 hours, of becoming aware of a Personal Data Breach affecting the Controller's data, including: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. **The Controller is responsible for any downstream notifications** — to its own recipients, end-users, and to the competent supervisory authority (Article 33 GDPR), where the Controller is the entity required to make such notification. The Processor's notification to the Controller does not discharge the Controller's statutory duties. ### 11. Audit and Inspection On reasonable notice (≥ 30 days, no more than once per year) the Controller may audit the Processor's compliance with this DPA. The Processor provides access to relevant compliance documentation and SOC reports if available. Audits are at the Controller's expense unless they reveal material non-compliance. ### 12. International Transfers Where Personal Data is transferred outside the EU/EEA, the Processor relies on the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and supplementary measures as appropriate. The SCCs are incorporated by reference into this DPA. ### 13. Data Return and Deletion On termination, the Controller may export all data via the self-service export tool. Within 30 days of termination, the Processor deletes all Controller data from production systems. Data may persist in encrypted backups for up to 30 additional days before backup rotation removes it. ### 14. Conflicts In the event of a conflict between this DPA and the Terms of Service, this DPA prevails for matters relating to the processing of Personal Data. ### 15. Governing Law This DPA is governed by the laws of Bulgaria and, where applicable, the European Union. Disputes shall be subject to the exclusive jurisdiction of the courts of Bulgaria, subject to mandatory rules of the Data Subject's jurisdiction. ### 16. Tech-Platform Acknowledgement > Customer acknowledges that [Operator Legal Entity Name TBD] provides infrastructure and tools only. [Operator Legal Entity Name TBD] does not, and is not obligated to, verify the legal basis under which Customer processes Personal Data. Customer is the sole determining party for the purposes and means of processing within the meaning of GDPR Article 4(7), and bears full responsibility under Article 5 for compliance with the data-protection principles (lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability). ### 17. Contact Data Protection Officer: [dpo@miramail.io](mailto:dpo@miramail.io) Operator: [Operator Legal Entity Name TBD], [Registered Address TBD], Bulgaria (reg. [Registration Number TBD]).