Data Processing Addendum
Effective date: 2026-05-07
MiraMail (operated by [Operator Legal Entity Name TBD]) is a technical platform. We process Personal Data only on the documented instructions of the Customer acting as Data Controller. We do not, and are not obligated to, verify the legal basis under which Customer processes Personal Data. Responsibility for compliance with applicable data-protection law lies with the Customer (see §5 and §16 below).
This Data Processing Addendum ("DPA") applies when MiraMail (the "Processor", operated by [Operator Legal Entity Name TBD]) processes Personal Data on behalf of a customer (the "Controller") in providing the Service. It supplements the Terms of Service and Privacy Policy.
1. Definitions
Terms used here have the meanings given to them under the EU General Data Protection Regulation 2016/679 ("GDPR") and equivalent laws in other jurisdictions (UK GDPR, CCPA, LGPD, etc.).
- "Controller" means the Customer (account holder) of MiraMail, who determines the purposes and means of processing the Personal Data uploaded to the Service.
- "Processor" means [Operator Legal Entity Name TBD], which processes Personal Data on behalf of the Controller as set out in this DPA.
- "Personal Data", "Data Subject", "Processing", and "Personal Data Breach" have the meanings given to them in GDPR Articles 4.
2. Subject Matter and Duration
Subject matter: Processing of Personal Data uploaded by the Controller to the Service (contact records, email addresses, custom attributes, behavioral events, email content).
Duration: For the term of the Controller's account, plus the retention periods specified in the Privacy Policy and §13 of this DPA.
3. Nature and Purpose of Processing
The Processor processes Personal Data only to:
- Send emails on the Controller's behalf to the Controller's recipients.
- Track email opens, clicks, unsubscribes, and bounces.
- Compute segments and trigger automation campaigns based on Controller-defined rules.
- Provide analytics and reporting to the Controller.
- Store and surface contact records and event history for the Controller's operational use.
4. Categories of Data and Data Subjects
- Identification: email address, name, custom attributes set by Controller.
- Behavioral: opens, clicks, unsubscribes, custom events.
- Contact metadata: created_at timestamps, last activity.
- Data subjects: the Controller's recipients, subscribers, end-users, and any natural persons whose data the Controller uploads to the Service.
5. Controller's Obligations
The Controller is solely responsible for the lawfulness of the processing it instructs the Processor to perform. Without limiting the generality of the foregoing, the Controller shall:
- Ensure a lawful basis (consent, legitimate interest, contractual necessity, or other) exists for every contact record uploaded to the Service and maintain auditable evidence of that lawful basis.
- Promptly honor unsubscribe, opt-out, erasure, rectification, portability, restriction, and objection requests from data subjects, in accordance with the laws applicable to each recipient.
- Publish and maintain a privacy notice covering the processing performed through the Service, listing [Operator Legal Entity Name TBD] (and its sub-processors) as a processor.
- Register as a data controller in jurisdictions that require it; complete data-protection impact assessments where required by Articles 35–36 GDPR.
- Notify recipients and the competent supervisory authority of any Personal Data Breach affecting the Controller's data, within the statutory deadlines applicable to the Controller. The Processor's notification to the Controller (§10) does not discharge the Controller's downstream notification duties.
- Comply with all applicable anti-spam laws, including sender identification, functional unsubscribe links, and accurate physical-address disclosure where required.
- Configure the Service (sending domain, segments, automation, retention) so that the Processor's processing remains within the Controller's documented instructions.
6. Processor's Obligations
- Process Personal Data only on the Controller's documented instructions (the Service configuration is the instruction).
- Maintain confidentiality — staff access is logged and audited; persons authorized to process Personal Data are subject to confidentiality obligations.
- Implement appropriate technical and organizational measures per Article 32 GDPR (see §8).
- Assist the Controller in responding to data-subject requests (§9).
- Notify the Controller of Personal Data Breaches without undue delay (§10).
- Make available all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in §11.
7. Sub-Processors
The Controller authorizes the Processor to engage:
- Resend (outbound email delivery) — Delaware, USA. SCCs in place.
- Hosting provider (compute / database) — varies by region; SCCs in place where applicable.
- Paddle (payment processing) — UK + USA; SCCs in place.
- Sentry (error monitoring) — PII stripped at source; SCCs in place.
We provide 30 days' notice via email before adding a new sub-processor. The Controller may object on reasonable grounds by emailing dpo@miramail.io; if no resolution is found, the Controller may terminate without penalty.
8. Security Measures (Art. 32)
- TLS 1.2+ for all data in transit.
- At-rest encryption for database storage (managed by hosting provider).
- Bcrypt for password hashes; secrets in a dedicated secret-management vault.
- Principle of least privilege for staff access; admin actions logged in an append-only audit table.
- Automatic backups with 30-day rotation; geographically redundant.
- Incident-response runbooks; on-call rotation.
- Regular review of measures (Art. 32(1)(d)); adjustments based on the state of the art.
9. Data-Subject Requests
The Service provides self-service tooling for the Controller to handle subject requests:
- Access / Export: Settings → Account → "Export my data".
- Erasure: delete a contact in the dashboard; the platform's PII redaction worker erases payloads in audit-event tables while preserving event metadata for compliance.
- Rectification: edit contact attributes via the dashboard or API.
Requests that cannot be completed via tooling are forwarded to dpo@miramail.io and actioned within 30 days.
10. Personal Data Breach Notification
The Processor will notify the Controller without undue delay, and in any event within 72 hours, of becoming aware of a Personal Data Breach affecting the Controller's data, including: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
The Controller is responsible for any downstream notifications — to its own recipients, end-users, and to the competent supervisory authority (Article 33 GDPR), where the Controller is the entity required to make such notification. The Processor's notification to the Controller does not discharge the Controller's statutory duties.
11. Audit and Inspection
On reasonable notice (≥ 30 days, no more than once per year) the Controller may audit the Processor's compliance with this DPA. The Processor provides access to relevant compliance documentation and SOC reports if available. Audits are at the Controller's expense unless they reveal material non-compliance.
12. International Transfers
Where Personal Data is transferred outside the EU/EEA, the Processor relies on the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and supplementary measures as appropriate. The SCCs are incorporated by reference into this DPA.
13. Data Return and Deletion
On termination, the Controller may export all data via the self-service export tool. Within 30 days of termination, the Processor deletes all Controller data from production systems. Data may persist in encrypted backups for up to 30 additional days before backup rotation removes it.
14. Conflicts
In the event of a conflict between this DPA and the Terms of Service, this DPA prevails for matters relating to the processing of Personal Data.
15. Governing Law
This DPA is governed by the laws of Bulgaria and, where applicable, the European Union. Disputes shall be subject to the exclusive jurisdiction of the courts of Bulgaria, subject to mandatory rules of the Data Subject's jurisdiction.
16. Tech-Platform Acknowledgement
Customer acknowledges that [Operator Legal Entity Name TBD] provides infrastructure and tools only. [Operator Legal Entity Name TBD] does not, and is not obligated to, verify the legal basis under which Customer processes Personal Data. Customer is the sole determining party for the purposes and means of processing within the meaning of GDPR Article 4(7), and bears full responsibility under Article 5 for compliance with the data-protection principles (lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability).
17. Contact
Data Protection Officer: dpo@miramail.io Operator: [Operator Legal Entity Name TBD], [Registered Address TBD], Bulgaria (reg. [Registration Number TBD]).