Data processing agreement

Version 2026-10

This agreement is proposed as part of the Terms between [Details pending confirmation] (tax ID [Details pending confirmation], registered office [Details pending confirmation], Romania; “Azimea” or the “Processor”) and the Customer that uses the Service (“Controller”). It applies to personal data that Azimea processes on the Customer’s behalf under the Terms (“Customer personal data”), and meets Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Definitions

“GDPR”, “personal data”, “controller”, “processor”, “processing”, “data subject”, “personal data breach”, “supervisory authority” have the meaning in the GDPR. “Service”, “Terms” are as defined in the Terms. “Sub-processor” is a third party engaged by Azimea to process Customer personal data.

2. Roles and scope

2.1 For Customer personal data, the Customer is the controller and Azimea is the processor. Where the Customer itself acts as a processor for its own clients (for example, an agency), the Customer is a processor and Azimea is a sub-processor, and the Customer confirms that its client has authorised this.

2.2 Azimea is an independent controller for (a) the data described in the Privacy policy (account, billing, security logs, support, website) and (b) the protective suppression list in section 3.4(b). This agreement applies to (b) only to the extent the Customer’s own unsubscribe data is the source.

2.3 Subject-matter, nature, purpose, duration, types of data and data subjects are in Annex 1.

3. Instructions

3.1 Azimea processes Customer personal data only on the Customer’s documented instructions, including with regard to transfers of personal data to a third country, which are this agreement, the Terms, the Customer’s use of the Service and API, and its settings. Azimea does not process Customer personal data for its own purposes, except (a) as section 3.4 describes and (b) as Union or Member State law requires, in which case Azimea tells the Customer before the processing unless that law prohibits it on important grounds of public interest. The Customer may give further instructions in writing through the account owner; Azimea confirms them or says why it cannot follow them.

3.2 Azimea tells the Customer at once if it thinks an instruction breaks data protection law.

3.3 The Customer is responsible for having a legal basis for the processing, for the accuracy and origin of the data, for informing data subjects, for the consent or other basis it needs to email them, and for any consent required under national law implementing Article 5(3) of Directive 2002/58/EC for open and click tracking, which the Customer can switch off in the Service (for the whole workspace: off, opt-in or opt-out; (under verification)).

3.4 Operating the Service. The Customer instructs Azimea to (a) apply bounce, complaint and unsubscribe signals to the Customer’s sending; (b) maintain, as an independent controller and as described in the Privacy policy, a platform-wide protective suppression list (a one-way hash of the address, the reason and the date) so that a person who complained or whose address is invalid is not mailed again through the Service; and (c) compute aggregate statistics that do not identify any person (for example platform-level delivery, bounce and complaint rates) to operate, secure and protect the reputation of the Service.

4. Confidentiality

Azimea ensures that the people it authorises to process Customer personal data are bound by confidentiality, have a need to access it, and are informed of their data protection obligations. Azimea and its sub-processors process Customer personal data only on the Customer’s instructions (Article 29 GDPR). Access by Azimea staff to a customer’s account follows the rules in Annex 2 (read-only, time-limited, recorded and visible to the customer).

5. Security

Azimea takes the technical and organisational measures in Annex 2, appropriate to the risk (GDPR Art. 32). Azimea may update them if the level of protection does not fall.

6. Sub-processors

6.1 The Customer generally authorises Azimea to use sub-processors. The current list, with purpose, data and location, is at azimea.com/security (and in Annex 3).

6.2 Azimea tells the Customer at least 30 days before it adds or replaces a sub-processor, by email to the account owner. The Customer may object on reasonable data protection grounds within [Details pending confirmation] days. If the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of the prepaid fees for the rest of the period.

6.3 Azimea binds each sub-processor by contract to the same data protection obligations as are set out in this agreement, in particular to provide sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to meet its data protection obligations, Azimea remains fully liable to the Customer for the performance of that sub-processor’s obligations.

7. International transfers

7.1 Customer personal data is stored and processed in the European Union (France). Azimea does not transfer it outside the European Economic Area except as 7.2 describes.

7.2 The AI features of the Service send text that the user provides to [Details pending confirmation], which may transfer it onward to affiliates and sub-processors in the United States. These transfers rely on the European Commission’s standard contractual clauses (Decision (EU) 2021/914, Module Two or Three) in the providers’ data processing agreements [Details pending confirmation]. The features are designed not to need personal data of the Customer’s contacts. The Customer instructs Azimea to make these transfers only for text it chooses to submit, and agrees not to include personal data of its contacts in free-text AI requests unless it has a legal basis to do so. Azimea has carried out a transfer assessment for each provider and gives the Customer a copy of the clauses on request. If Azimea cannot rely on the clauses or the framework any more, it stops the transfer and tells the Customer. (under verification)

8. Assistance

8.1 Data subject rights. Azimea provides tools in the Service to find, export, correct and delete a person’s data and to record unsubscribes and objections. If a data subject writes to Azimea about Customer personal data, Azimea tells the person to contact the Customer, passes the request to the Customer without delay, and does not answer it otherwise unless the Customer instructs it or the law requires it. Azimea forwards a request it receives within 3 working days and gives the assistance in this section within 10 working days (under verification).

8.2 Other duties. Taking into account the nature of the processing and the information available, Azimea helps the Customer meet its obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments, prior consultation). Azimea may charge reasonable costs for assistance that goes beyond what the Service already provides.

9. Personal data breach

9.1 Azimea tells the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data (under verification). Azimea is aware when it has a reasonable degree of certainty that such a breach occurred, including when a sub-processor tells it. Azimea does not wait for an assessment of the risk to the data subjects before it notifies.

9.2 The notice contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact. Azimea gives the information in phases as it becomes available. The notice goes by email to the account owner and to the security contact set in the account.

9.3 The Customer decides whether to notify the supervisory authority and the data subjects. Azimea does not notify them except as the law requires of it.

10. Return and deletion

10.1 During the contract the Customer can export and delete Customer personal data with the tools in the Service.

10.2 When the contract ends, the Customer chooses whether Azimea returns (exports) or deletes Customer personal data. If the Customer makes no choice, it has [Details pending confirmation] days to export its data, after which Azimea deletes Customer personal data and existing copies from the Service, unless Union or Member State law requires storage, in which case Azimea tells the Customer and isolates the data from further processing. The Customer’s own unsubscribe records are part of the export and are deleted with the rest unless the Customer instructs Azimea in writing to keep them; the protective suppression list in 3.4(b) is Azimea’s own and stays. On request Azimea confirms the deletion in writing within 30 days after it has taken place; the record of the deletion (the company’s name, the date, the number of rows removed per table) is kept for that purpose. (under verification)

10.3 Copies in backups are encrypted, are not used for any other purpose and are overwritten when the backup expires (maximum [Details pending confirmation] days). If a restore is needed, Azimea re-applies deletions made after the backup date before the data is used again.

10.4 When a Customer deletes a person (erasure), the data is removed from the Service as described in the documentation: the personal fields of the contact are removed, history that exists only to show the result of sending keeps no identifying detail.

11. Audit and information

11.1 Azimea makes available the information needed to show it follows this agreement, including the descriptions in Annexes 2 and 3 and, on request, answers to the Customer’s reasonable security questionnaire. Azimea keeps the record of processing activities required of processors by Article 30(2) GDPR and gives the Customer the relevant extract on request.

11.2 If that is not enough, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, with 30 days’ written notice, at most once a year (more often after a breach), during working hours, without disturbing the Service or other customers. Azimea may offer a report by an independent third party to answer the Customer’s questions; the Customer may still carry out an audit if the report does not answer its reasonable questions. The Customer chooses the auditor and may contest the scope and method of any audit proposed by Azimea. Each party bears its own costs unless the audit finds a material breach by Azimea.

12. Liability

The limits of liability in the Terms apply to this agreement, to the extent the law allows. Nothing here limits the data subject’s rights or the liability that cannot be limited under the GDPR. (under verification)

13. Term and precedence

This agreement lasts as long as Azimea processes Customer personal data. If it conflicts with the Terms on the processing of personal data, this agreement prevails.

14. Law

Romanian law applies, without prejudice to the GDPR. The Terms’ rules about courts apply.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures (as at the date above)

Statements below are limited to what the Service does today. Where a measure is planned, it is not listed.

Hosting and network

• Servers at OVHcloud in France. The application and database run on separate servers connected by an encrypted tunnel; the database accepts only that connection, with TLS and password hashing.
• SSH by key only, a deny-by-default firewall, intrusion banning, automatic security updates and system audit logging.

Encryption

• TLS for all web traffic and the API; strict transport security; security headers.
• Credentials of connected shops and signing secrets are encrypted at rest and not shown again after saving. Email-signing keys are kept in a separate secrets vault, not in the database.
• API keys are stored as hashes. Passwords are stored as salted hashes.

Access control

• Roles in each company (owner, admin, member, viewer, agency). Access is checked on every request. Data of each customer is separated at the application level and covered by tests.
• Two-factor authentication (TOTP) is available to all users and can be required per company; it is required for Azimea operations staff. Accounts lock after repeated failed sign-ins. Idle sessions end.
• Azimea staff reach a customer account only through a read-only, one-hour support view that the customer can see in its own activity log.
• Production access is limited to the people who need it.

Logging and detection

• An activity log records significant actions with the time, user and IP address; the database refuses changes and deletions of its entries (except redaction of personal identifiers when a person is erased, and deletion by the retention job after 24 months).
• Rate limits protect sign-in, the API and public forms. Operations monitoring of servers and jobs.

Data lifecycle

• Sent emails lose the recipient address and content after 400 days; open and click records lose the browser identification and the link to the person after 25 months.
• Erasure of a contact removes the personal fields, history and events; consent history is replaced by a record without personal data; the next import does not bring the person back.
• Backups: [Details pending confirmation].

Resilience and change

• Controlled deployment with rollback; secrets are not stored in the source code.

Organisation

• Confidentiality commitments for staff; incident handling as section 9; sub-processor contracts.

Annex 3: Authorised sub-processors (as at the date above)

The up-to-date list is at azimea.com/security.