Data Processing Agreement
Last updated: 15 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between MailGraf Digital Ltd, a company registered in England and Wales (Company No. 13282175) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, registered with the Information Commissioner's Office under reference ZB250899 ("MailGraf", "we", "us"), and the customer that accepts the Terms ("Customer", "you").
It applies whenever MailGraf processes Customer Personal Data on your behalf while providing the Service. You accept this DPA when you accept the Terms; no signature is needed. If your organisation needs a signed copy, contact us and we will countersign this version.
This version is dated 15 October 2026.
1. Definitions
Words that are not defined here have the meaning given in the Terms or in the Data Protection Laws.
- "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 ("PECR") and, where they apply to the processing, the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), national laws implementing the EU ePrivacy Directive, and the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK").
- "Customer Personal Data" means personal data that you, or people acting for you, upload to or collect through the Service, and that MailGraf processes on your behalf. Annex 1 describes it.
- "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given in the Data Protection Laws.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- "Sub-processor" means a third party engaged by MailGraf that processes Customer Personal Data.
- "Restricted Transfer" means a transfer of Customer Personal Data to a country that is not covered by adequacy regulations or an adequacy decision under the Data Protection Laws that apply to the transfer.
2. Roles and scope
2.1 You are the controller of Customer Personal Data and MailGraf is your processor.
2.2 Agencies and resellers. If you use the Service for your own clients, you may act as a processor for them. In that case MailGraf is your sub-processor, and you confirm that your clients have authorised you to appoint MailGraf on the terms of this DPA.
2.3 Data MailGraf controls. MailGraf is an independent controller for the personal data of your account users and for billing, support, security and abuse-prevention records about your account. Our Privacy Policy covers that data, not this DPA.
2.4 Annex 1 sets out the subject matter, duration, nature and purpose of the processing and the types of personal data and data subjects.
3. Your obligations
3.1 You are responsible for having a lawful basis for the processing, including any consent that PECR or the ePrivacy rules require before you send marketing emails, and for giving your contacts the information the Data Protection Laws require.
3.2 Emails sent through the Service record opens and clicks with tracking pixels and tracked links. You are responsible for any consent or notice that PECR or the ePrivacy rules require for this tracking.
3.3 You confirm that your instructions to MailGraf comply with the Data Protection Laws and that following them will not put MailGraf in breach of those laws.
3.4 You will not upload special category data, criminal offence data or data about children under 13 unless the processing is lawful and you have agreed it with us in writing in advance.
3.5 You remain responsible for the accuracy of Customer Personal Data and for complying with our Acceptable Use Policy.
4. MailGraf's obligations
4.1 Instructions. We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the settings you choose and actions you take in the Service and through the API. If we believe an instruction breaks the Data Protection Laws, we will tell you. We are not required to follow that instruction, and we may suspend the affected processing until you give an instruction that complies with the law. If the law requires us to process Customer Personal Data for another purpose, we will tell you first unless the law forbids it.
4.2 Processing that keeps the Service safe. Your instructions include the processing we need to:
- deliver your emails and protect deliverability for you and for other customers, for example by handling bounces and complaints, keeping suppression lists, and checking lists and content for spam, phishing and other abuse;
- keep the Service secure and investigate misuse;
- produce aggregated statistics that do not identify you or any data subject, so that we can measure and improve the Service.
4.3 What we will never do. We do not sell Customer Personal Data, use it for our own marketing, or use it to train artificial intelligence models.
4.4 Confidentiality and support access. Everyone at MailGraf who can access Customer Personal Data is bound by a duty of confidentiality and accesses it only as far as their role requires. Our staff open your account only to provide support you ask for, to investigate security or abuse issues, or to keep the Service running, and every such access is recorded in an audit log.
4.5 Security. We maintain the technical and organisational measures in Annex 2. We may update them as technology and risks change, provided that the overall level of protection does not decrease.
4.6 Requests from authorities. If a public authority asks us for Customer Personal Data, we will refer it to you where we can. We will notify you before disclosing anything unless the law forbids it, disclose only what we are legally required to, and challenge requests that we reasonably consider unlawful.
5. Sub-processors
5.1 General authorisation. You authorise MailGraf to use Sub-processors. The current list, with each Sub-processor's purpose, location and transfer mechanism, is in Annex 3 and on our website.
5.2 Contracts. We impose data protection obligations on each Sub-processor that are no less protective than this DPA. We remain responsible to you for the performance of our Sub-processors.
5.3 Changes. We will give you at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data. We send the notice by email to your account owner and update the list on our website.
5.4 Objections. You may object to a new Sub-processor on reasonable data protection grounds within 15 days of our notice. We will discuss your concerns in good faith and look for a reasonable alternative. If we cannot find one, you may terminate the affected part of the Service by written notice, and we will refund any prepaid fees for the remaining period of that part of the Service.
6. Data subject rights
6.1 The Service lets you find, correct, export and delete contacts, record unsubscribes and manage suppression lists. Your contacts can unsubscribe from every marketing email you send through the Service.
6.2 If a data subject contacts MailGraf about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to.
6.3 We will give you reasonable help with requests that you cannot handle with the Service's own tools. This help is free. If a request is manifestly excessive, we will agree any charge with you before we start.
7. Personal Data Breaches
7.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. This leaves you time to meet the 72-hour deadline that applies to controllers.
7.2 Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. We will send updates as we learn more.
7.3 We will take reasonable steps to contain the breach and reduce its effects, and will help you with notifications you must make to a Supervisory Authority or to data subjects.
7.4 Notifying you of a breach is not an admission of fault or liability.
8. Security, impact assessments and consultation
Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Articles 32 to 36 of the UK GDPR (and of the EU GDPR where it applies): security of processing, notifying Personal Data Breaches, data protection impact assessments and prior consultation with a Supervisory Authority. This help is free unless a request is manifestly excessive, in which case we will agree any charge with you before we start.
9. International transfers
9.1 Where your data is. We host the Service, including its database, on servers in Germany. Emails sent from the Service are processed by sending infrastructure in the United Kingdom and the European Union. Some Sub-processors process data in other countries, as listed in Annex 3.
9.2 Transfers from the United Kingdom. For a Restricted Transfer from the UK we rely on, in this order: UK adequacy regulations (including those covering the European Economic Area); the UK Extension to the EU-US Data Privacy Framework for certified US recipients; or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
9.3 Transfers from the European Economic Area. Where the EU GDPR applies, transfers from the EEA to MailGraf in the UK rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, we will without delay put in place the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable) or another transfer mechanism that the EU GDPR recognises.
9.4 Transfers from Türkiye. Where KVKK applies, we will, at your request, sign the standard contract published by the Turkish Personal Data Protection Authority for transfers abroad. Notifying the Authority of the signed contract is your responsibility as the exporter.
9.5 You authorise the transfers described in this clause and in Annex 3.
10. Information and audits
10.1 We will make available the information you reasonably need to show compliance with Article 28 of the UK GDPR, including answers to a reasonable security questionnaire once every 12 months and our Sub-processors' current certifications or audit reports where we are allowed to share them.
10.2 If that information is not enough, you may carry out an audit, or appoint an independent auditor bound by confidentiality, once in any 12-month period on 30 days' written notice. Audits are carried out remotely, by document review and video meetings, unless a Supervisory Authority requires an on-site audit or the audit follows a Personal Data Breach on our side. Audits must avoid disrupting the Service and other customers' data, and you bear their costs.
10.3 You may audit more often if a Supervisory Authority requires it or after a Personal Data Breach on our side.
11. Return and deletion
11.1 At the end of the Service you choose whether we return or delete Customer Personal Data. You can export your contacts and campaign reports in CSV format at any time through the Service, free of charge, and we will provide an export on request.
11.2 After your account is closed, you have 14 days to export your data or ask us for an export. After that period we delete Customer Personal Data from our active systems. Copies held in backups are deleted when those backups expire in the ordinary backup cycle. We will confirm deletion in writing on request.
11.3 We may keep:
- suppression records of addresses that unsubscribed, complained or hard-bounced, limited to the email address, the reason and the date, kept only for as long as they are needed to stop those addresses being emailed again and used for no other purpose;
- data that the law requires us to keep, which we will protect under this DPA for as long as we hold it;
- anonymised or aggregated data that cannot identify you or any individual.
12. Liability
Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits the rights of data subjects under the Data Protection Laws, or any liability that cannot be limited under the law of England and Wales.
13. Term, precedence and changes
13.1 This DPA applies for as long as MailGraf processes Customer Personal Data, including during the deletion period in clause 11.
13.2 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. If transfer clauses put in place under clause 9 conflict with this DPA, those clauses prevail.
13.3 We may update this DPA to reflect changes in the law, our Sub-processors or the Service. We will tell you about material changes in advance in the same way as changes to the Terms. A change will not reduce the protection that this DPA gives Customer Personal Data.
13.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, as set out in the Terms.
Annex 1. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Provision of the MailGraf email marketing platform under the Terms. |
| Duration | For the term of your account, plus the deletion period in clause 11. |
| Nature and purpose | Storing, importing and organising contacts; managing lists, tags and segments; creating, sending and personalising emails and automations; recording deliveries, bounces, opens, clicks, unsubscribes and complaints; hosting sign-up forms, pop-ups and landing pages; recording website activity where you install our tracking code; verifying email addresses; syncing data with integrations you connect; producing reports; AI-assisted writing and design features; support you request. |
| Data subjects | Your contacts, subscribers, prospects and customers; people who submit your forms, pop-ups and landing pages; visitors to websites where you install our tracking code; your end customers whose order data you sync from a connected store. |
| Personal data | Email address, name and other contact details you hold; custom fields you define; consent and subscription records (source, date and time, IP address, double opt-in confirmation); list, tag and segment membership; email engagement (sends, deliveries, bounces, opens, clicks, unsubscribes, complaints) with related IP address, device and browser data; form and pop-up submissions; website activity events; order and product data from connected stores; the content of your emails and forms. |
| Special category data | Not intended. See clause 3.4. |
| Frequency | Continuous, for as long as you use the Service. |
Annex 2. Technical and organisational measures
Hosting and separation
- The application and database run on servers in Germany operated by Hetzner Online GmbH, whose data centres are certified to ISO/IEC 27001.
- Each customer account is separated from every other account at database level by row-level security policies, in addition to checks in the application.
Access
- Role-based access inside your account (owner, admin, editor, restricted and custom roles).
- MailGraf staff access production systems only where their role requires it. Support access to a customer account and administrative actions are recorded in an audit log.
- User passwords are stored only as salted hashes.
Transmission and storage
- The application, API, forms and tracking links use encrypted connections (TLS).
- Emails are delivered over TLS where the receiving server supports it.
Availability and recovery
- Scheduled database backups.
- Application error monitoring is configured not to collect personal data by default.
Abuse and deliverability controls
- Bounce and complaint handling, with automatic suppression of addresses that unsubscribed, complained or hard-bounced.
- Sending limits and reviews of new senders.
- Bot protection and rate limiting on public forms and endpoints.
Data minimisation
- Email verification receives email addresses only, never names or other fields.
- AI features receive the content and instructions you submit and aggregated campaign statistics. They do not receive your contact lists.
People and process
- Confidentiality duties for everyone with access.
- An incident response process that meets the 48-hour notice in clause 7.
- Data protection review of Sub-processors before they are engaged.
Annex 3. Sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, database and sending servers | Germany | UK adequacy regulations (EEA) |
| Amazon Web Services | Cloud infrastructure for email delivery | United Kingdom | No restricted transfer |
| Cloudflare, Inc. | File and image storage, content delivery, bot protection | United States and global network | UK Extension to the EU-US Data Privacy Framework, or IDTA |
| EmailListVerify | Email address verification (email addresses only) | Poland | UK adequacy regulations (EEA) |
| Functional Software, Inc. (Sentry) | Application error monitoring | United States | UK Extension to the EU-US Data Privacy Framework, or IDTA |
| OpenAI | AI-assisted writing, design and report summaries | United States | UK Extension to the EU-US Data Privacy Framework, or IDTA |
Payment processors such as Stripe process billing data for which MailGraf is the controller. They do not process Customer Personal Data and are covered by our Privacy Policy.
