- 1. Scope, hierarchy & definitions
- 2. Processing pursuant to Controller instructions
- 3. Confidentiality & personnel commitments
- 4. Technical & organizational security measures (TOMs)
- 5. Authorized subprocessors & objection procedures
- 6. Data subject rights assistance
- 7. Personal data breach notification (48h SLA)
- 8. Data deletion, return & certification
- 9. Audits & regulatory compliance verification
- 10. International transfers & Standard Contractual Clauses
- 11. Frequently asked DPA questions
1. Scope, hierarchy & definitions
This DPA applies whenever and to the extent that Processor processes Personal Data on behalf of Controller in the course of providing email verification services, where such processing is subject to European Data Protection Legislation (including Regulation (EU) 2016/679 (GDPR), the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection).
The terms "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" shall have the meanings ascribed to them in Article 4 of the GDPR. In the event of any conflict between this DPA and the Master Terms of Service, the provisions of this DPA shall prevail regarding data protection obligations.
2. Processing pursuant to Controller instructions
Processor covenants that it shall process Personal Data solely on documented instructions from Controller, including with respect to transfers of Personal Data to a third country, unless required to do so by applicable statutory law. The Master Terms of Service, API calls initiated by Controller, and list files uploaded by Controller constitute Controller's complete documented instructions.
Processor shall immediately inform Controller if, in its reasonable technical opinion, an instruction issued by Controller infringes the GDPR or other applicable data protection legislation.
3. Confidentiality & personnel commitments
Processor guarantees that all employees, contractors, and technical personnel who have access to Personal Data have committed themselves to strict confidentiality through binding non-disclosure agreements, have undergone formal data privacy training, and access customer records solely on a strictly controlled need-to-know basis.
4. Technical & organizational security measures (TOMs)
Processor implements and maintains appropriate technical and organizational measures (TOMs) in accordance with Article 32 of the GDPR to ensure a level of security appropriate to the risk. These measures are detailed in the audit register below and include TLS 1.3 transport encryption, AES-256 rest encryption, ephemeral in-memory socket execution, and regular vulnerability scanning.
5. Authorized subprocessors & objection procedures
Controller provides general authorization for Processor to engage the third-party subprocessors listed in our public Authorized Subprocessors Register. Processor shall enter into written agreements with each subprocessor imposing data protection obligations no less protective than those set forth in this DPA.
Processor shall provide Controller with at least thirty (30) calendar days advance written notice before engaging any new subprocessor. Controller may object to a new subprocessor on reasonable data protection grounds by notifying Processor in writing within thirty (30) days.
6. Data subject rights assistance
Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the GDPR (including rights of access, rectification, erasure, and portability).
7. Personal data breach notification (48h SLA)
In the event of a confirmed Personal Data Breach affecting Controller's Personal Data, Processor shall notify Controller in writing without undue delay and, in any event, within forty-eight (48) hours of becoming aware of the breach.
The notification shall describe: (a) the nature of the breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) the likely consequences of the breach; and (d) remedial measures taken or planned to mitigate potential adverse effects.
8. Data deletion, return & certification
Upon termination of the Services or upon Controller's written request, Processor shall, at Controller's election, securely return or delete all Personal Data processed on behalf of Controller, and delete existing copies unless statutory law mandates continued retention. Deletion is executed via cryptographic shredding within thirty (30) calendar days.
9. Audits & regulatory compliance verification
Processor shall make available to Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and shall allow for and contribute to audits, including inspections, conducted by Controller or an independent certified auditor mandated by Controller, upon reasonable advance written notice of at least thirty (30) days during regular business hours.
10. International transfers & Standard Contractual Clauses
To the extent that the provision of Services involves an international transfer of Personal Data from the European Economic Area or UK to the United States, the parties hereby enter into the Standard Contractual Clauses (Module 2: Controller-to-Processor) adopted under Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference.
The table below summarizes our technical and organizational measures (TOMs) audit register:
| Technical & Organizational Measure | Standard & Implementation | Statutory GDPR Reference | Verification Cadence |
|---|---|---|---|
| In-Flight Data Encryption | Strict TLS 1.3 across all REST endpoints & web traffic | GDPR Article 32(1)(a) | Continuous automated cipher suite audits |
| Rest Data Encryption | AES-256 server-side encryption across AWS S3 and PostgreSQL | GDPR Article 32(1)(a) | Continuous cloud posture monitoring |
| Ephemeral RAM Processing | Diagnostic socket handshakes executed in volatile RAM | GDPR Article 25 (Privacy by Design) | Architectural core requirement |
| Multi-Tenant Isolation | Logical database separation with role-based access control (RBAC) | GDPR Article 32(1)(b) | Quarterly security reviews |
| Automated Data Purge | 30-day automated cryptographic hard-deletion lifecycle | GDPR Article 5(1)(e) (Storage Limitation) | Daily cron purge execution |
| Incident Notification | Mandatory 48-hour customer notification SLA for confirmed breaches | GDPR Article 33 & 34 | Incident response simulated testing |
11. Frequently asked DPA questions
Does this Data Processing Addendum apply automatically to my account?
Yes. If you process personal data of individuals residing within the European Union, European Economic Area, United Kingdom, or Switzerland, this DPA is automatically incorporated into your Terms of Service upon account creation or API usage. Enterprise customers requiring a countersigned bilateral PDF agreement may email legal@mailcheckup.net.
Who is the legal Processor entity under this DPA?
Secuno LLC, a registered United States corporate entity organized under the laws of the State of Wyoming, having its principal registered office at 30 N Gould St, Sheridan, WY 82801, USA. Corporate phone: +1 (315) 961-7074.
What specific personal data categories are processed under this DPA?
The subject matter of data processing is strictly limited to email addresses submitted by Customer for syntax, domain MX, disposable status, and RFC 5321 SMTP deliverability validation, along with associated request timestamps and client IP addresses.
How does MailCheckup assist with Data Subject Access Requests (DSARs)?
Under Section 6 of this DPA, MailCheckup provides self-service workspace tools enabling Customers to search, export, and permanently delete contact records. Where Customer cannot fulfill a DSAR directly, Secuno LLC provides technical assistance within 10 business days.
How are international data transfers from the EU to the US legalized?
Transfers are governed by the European Commission's standard contractual clauses for the transfer of personal data to third countries (Decision (EU) 2021/914, Module 2: Controller-to-Processor), supplemented by technical measures including TLS 1.3 in-flight encryption, AES-256 rest encryption, and ephemeral memory socket buffers.
What happens to customer personal data upon termination of the agreement?
Upon contract termination or workspace deletion, Secuno LLC permanently deletes all customer-uploaded contact lists, intermediate verification tables, and exported result files within 30 calendar days in accordance with Section 8 of this Addendum, providing written certification upon request.