Data Processing Addendum

01Scope and roles

This addendum applies where we process personal data on your behalf in providing the service, and it supplements the Terms of Service.

• You are the controller. You decide which recipients to send to, what the messages say, and on what lawful basis.
• We are the processor. We transmit, store and log those messages so they can be delivered and so you can see what happened.

For your own account and billing data we act as a controller, which is covered by the Privacy Policy rather than here.

02Subject matter of the processing

03Our instructions

We process personal data only on your documented instructions. Your use of the API, the SMTP relay and the dashboard constitutes those instructions; additional ones may be agreed in writing.

We will tell you if an instruction appears to breach data protection law, and we may decline to act on it. Where the law requires us to process without your instruction, we will tell you first unless the law forbids it.

04Confidentiality

Access to personal data is limited to staff who need it to operate or support the service. They are bound by confidentiality obligations that survive the end of their engagement, and access to production systems is logged.

05Security measures

Taking account of the state of the art and the risk, we maintain:

• TLS in transit, including enforced TLS to receiving providers that support it;
• encryption at rest for message content and credentials;
• credentials stored hashed and displayed only once, at creation;
• tenant separation enforced at the data layer rather than in application code alone;
• least-privilege access to production, with logging;
• message content retained only as long as delivery and troubleshooting require, then deleted;
• backups, with restoration tested.

06Subprocessors

You give general authorisation for us to engage subprocessors. Each is bound by data protection obligations no less protective than these, and we remain liable to you for their performance.

The current list is available from privacy@bookmyspot.us. We give notice before adding one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected part of the service without penalty.

07Assisting with data subject rights

Taking account of the nature of the processing, we assist you in responding to requests from data subjects. In practice the dashboard lets you search for a recipient, see the messages sent to them, and delete or suppress the address yourself, which answers most requests without involving us.

If a recipient contacts us directly, we will not action the request — we do not have the relationship or the authority — and we will refer them to you and tell you.

08Breach notification

We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting data we process for you. The notification describes what is known, the likely consequences, and the measures taken or proposed.

Reporting to a supervisory authority is your responsibility as controller; we provide the information you reasonably need in order to do it.

09Return and deletion

On termination you may export your delivery records and suppression list for 30 days. After that we delete the personal data we process for you, except where the law requires us to keep it.

One carve-out: we retain suppression records — a hashed address and the date of the opt-out or complaint — indefinitely. Deleting them would mean being unable to honour an objection a person has already exercised, which would be the worse outcome for that person.

10Audits

We make available the information needed to demonstrate compliance with this addendum. We will answer a reasonable security questionnaire once in any twelve-month period.

Where you have a specific, documented reason that this is not sufficient, an audit may be carried out on reasonable notice, during business hours, subject to confidentiality, and in a way that does not compromise other customers' data.

11International transfers

Email is inherently international: addressing a message to a recipient abroad transmits it there, and that transfer is intrinsic to the instruction you gave.

For transfers out of the UK or the EEA to a country without an adequacy decision, the Standard Contractual Clauses apply and are incorporated by reference, together with a transfer risk assessment.

12Putting it in place

This addendum applies automatically to every customer as part of the Terms of Service. For most customers there is nothing to sign.

If your procurement process needs a countersigned copy, or your own processor template, write to legal@bookmyspot.us and we will arrange it.