Data Processing Agreement

1. The parties and the signed copy

The parties are you, the customer who holds the Mailyoto account ("you"), and the Mailyoto company that provides the service ("Mailyoto", "we", "us"). Our full legal name, registration number and registered address are stated in the signed copy of this agreement.

We have already signed this agreement. To download the signed copy, sign in to the dashboard and open Account, then Profile. It is the same text as this page, with our details and signature added. You may sign your copy and keep it for your records.

2. Definitions

Words not defined here have the meaning given to them in the GDPR.

• Customer Personal Data: personal data that we process for you as part of the service. This is mainly the email we receive, forward and send for your domains, and the logs about that email.
• Data Protection Law: the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it applies in the United Kingdom ("UK GDPR") with the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and any other data protection law that applies to the processing.
• Personal Data Breach: a breach of security that leads to the accidental or unlawful destruction, loss, change, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor: another company that we engage to process Customer Personal Data.
• Standard Contractual Clauses or SCCs: the clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

3. Roles

For Customer Personal Data, you are the controller and we are your processor. If you use the service for a client of yours, you are a processor and we are your sub-processor; in that case you confirm that your client has authorised you to give us the instructions in this agreement.

For the data we need to run your account (your sign-in details, billing records, and messages you send to our support), we are a separate controller. Our Privacy Policy covers that data, not this agreement.

Annex I describes the processing: what data, whose data, for what purpose and for how long.

4. Your instructions

We process Customer Personal Data only on your documented instructions. These are the Terms of Service, this agreement, and the choices you make in the dashboard or through the API, such as which addresses forward where and how much each domain logs. If the law requires us to process data in another way, we tell you first, unless that law forbids it.

If we believe an instruction breaks Data Protection Law, we tell you, and we may stop following that instruction until you confirm or change it.

You are responsible for having a lawful basis for the processing you ask us to do, and for giving people any notices the law requires.

5. Confidentiality

Everyone who can access Customer Personal Data on our side is bound by a duty of confidentiality, and has access only as far as their work needs it. A person looks at a message only to investigate abuse, when you ask us about a delivery, or when the law requires it.

6. Security

We keep in place the technical and organisational measures in Annex II. We may change them as technology and risks change, but a change never lowers the overall protection of Customer Personal Data.

7. Sub-processors

You give us general authorisation to use Sub-processors. Annex III of the signed copy names the current ones. This page and our sub-processors page show what each one does and where.

Before we add or replace a Sub-processor, we email the account's address at least 30 days in advance. You may object within those 30 days on reasonable data protection grounds by writing to support@mailyoto.com. We will then work with you in good faith on a solution. If we can't find one, you may close your account before the change takes effect.

Each Sub-processor is bound by a written contract with data protection terms that protect Customer Personal Data at least as well as this agreement does. We remain responsible to you for the work of our Sub-processors.

8. Requests from individuals

If someone asks us to see, correct, delete or move personal data that we process for you, we don't answer the request ourselves. We tell the person to contact you, and we tell you about the request when we can identify your account.

The dashboard lets you find and delete logs, change what each domain logs, and delete aliases and domains. Where you need more help to answer a request, we give it, as far as the nature of the processing allows.

9. Personal Data Breaches

We notify you without undue delay, and in any case within 48 hours, after we become aware of a Personal Data Breach that affects your Customer Personal Data. We send the notice to the account's email address.

The notice describes, as far as we know at the time: what happened, the kinds of data and the approximate number of people and records affected, the likely consequences, what we have done and will do about it, and who to contact for more information. We send further details as we learn them, and we help you meet your own duty to notify regulators and the people affected.

Notifying you of a breach is not an admission of fault.

10. Help with your other obligations

Taking into account the nature of the processing and the information available to us, we help you with data protection impact assessments and with consulting a supervisory authority, where the law requires either for your use of the service.

11. Deletion at the end

You can delete Customer Personal Data at any time in the dashboard. When you delete your account, we delete its domains, aliases, logs and any stored messages within 30 days. Our encrypted backups expire on a rolling cycle, so any copy in them is gone within a further 30 days.

We keep data longer only where the law requires us to, and then only that data, protected under this agreement, for as long as that law requires.

12. Information and audits

We make available the information you need to show that we meet this agreement: this page, our security page, the sub-processor list, and written answers to reasonable security questions.

If that information is not enough, or a supervisory authority requires it, you may audit our compliance once a year. You give us 30 days' written notice and a plan for the audit. The audit takes place during business hours, is carried out by you or an independent auditor bound by confidentiality, does not give access to other customers' data, and is at your cost. After a Personal Data Breach you may hold an extra audit limited to that breach.

13. Transfers outside Europe

Customer Personal Data is processed in the countries listed in Annex III. Where Data Protection Law treats your use of the service as a transfer of personal data to a country without an adequacy decision, the Standard Contractual Clauses apply to that transfer and are incorporated into this agreement as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor.
• Clause 7 (the docking clause) applies.
• In Clause 9, Option 2 (general written authorisation) applies, with 30 days' notice as in section 7 of this agreement.
• The optional wording in Clause 11 does not apply.
• In Clause 13, the competent supervisory authority is the one that Clause 13 names for you. Where you have no establishment and no representative in the European Union, it is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
• In Clause 17, the SCCs are governed by the law of the Netherlands.
• In Clause 18, disputes go to the courts of the Netherlands.
• Annexes I, II and III of this agreement complete Annexes I, II and III of the SCCs.

United Kingdom. For transfers under the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies. Table 1 is completed by Annex I, Table 2 by the choices above, and Table 3 by Annexes I to III. Either party may end the Addendum as allowed by its Section 19.

Switzerland. For transfers under the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and people in Switzerland may bring claims in the courts of their habitual residence.

If the SCCs and the rest of this agreement disagree, the SCCs win.

14. United States privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we act as your service provider. We don't sell or share Customer Personal Data, and we don't use it for any purpose other than providing the service.

15. General terms

This agreement lasts for as long as we process Customer Personal Data for you. Each party's liability under it is subject to the limits in the Terms of Service, except where Data Protection Law or the SCCs do not allow such a limit.

If this agreement and the Terms of Service disagree on data protection, this agreement wins. We may update this agreement to follow changes in the law or in our Sub-processors. We email you at least 14 days before a meaningful change, and we never change it in a way that lowers the protection of Customer Personal Data without your agreement.

Annex I: Description of the processing

A. The parties

• Data exporter: the customer, with the name and email address held on its Mailyoto account. Its activity relevant to the transfer is using the service to receive and send email at its domains. Role: controller, or processor where it acts for a client.
• Data importer: Mailyoto, with the legal name, registration number and address stated in the signed copy. Contact: support@mailyoto.com. Its activity is providing the email forwarding and sending service. Role: processor.
• Both parties accept this Annex by agreeing to the Terms of Service. The signed copy carries our signature.

B. The processing

People whose data is processed

• people who send email to your domains;
• people you send email to through our servers;
• the people who receive mail at your aliases;
• anyone named or described in those messages.

Kinds of personal data

• email addresses and display names in message headers;
• message subjects, bodies and attachments;
• the IP address and hostname of the server that sent a message to us, and the replies of the servers we deliver to;
• log data: times, message IDs, sizes, spam scores and delivery status.

Sensitive data

We don't ask for special categories of data. Messages may contain any data their senders choose to write. The measures in Annex II protect all messages the same way, and we don't keep message bodies after delivery.

How often

Continuously, for as long as you use the service.

What we do with the data, and why

We receive, check for spam and abuse, forward, send, log, and delete email, so that we can provide the service as described in the Terms.

How long we keep it

• Message bodies: only while a message is processed and its delivery is retried. Messages that could not be delivered are kept no longer than their log entry, and only if the domain's log settings allow it.
• Logs: 14 days on Free, up to 60 days on Pro and up to 365 days on Max, or less if you choose.
• Everything: deleted as set out in section 11.

Transfers to Sub-processors

As listed in Annex III, for the purpose shown there and for as long as the service runs.

C. Competent supervisory authority

As set out in section 13 for Clause 13 of the SCCs.

Annex II: Technical and organisational measures

These are the measures in place on the date of this version. Section 6 sets out how they may change.

• Protection in transit and at rest. The website, dashboard, API and mail submission use TLS, and our mail servers use TLS with other mail servers whenever those servers support it. Stored data and backups are encrypted.
• Access to systems. Only authorised staff can reach production systems, with strong authentication, and their access is logged. Each part of the service has only the access it needs.
• Backups and availability. Data is backed up regularly and restores are tested. Mail is queued and retried, so a short outage does not lose it.
• Customer accounts. Passwords and SMTP credentials are stored hashed. Customers can protect sign-in with an authenticator app or a passkey, and can see and sign out their devices.
• Data minimisation. Message bodies are not kept after delivery. Each domain's log settings let the customer log less.
• Monitoring. Automated monitoring alerts us to failures, abuse and unusual activity.
• People. Staff are bound by confidentiality, and access to Customer Personal Data is limited to those who need it.
• Incidents. We investigate security events, record them, and notify customers of breaches as set out in section 9.
• Sub-processors. Each one is bound by a data protection agreement, as set out in section 7.

Annex III: Sub-processors

You authorise the Sub-processors below. The signed copy in your dashboard names each one, and section 7 sets out how this list changes.