Data Processing Agreement

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in Regulation (EU) 2016/679 (the “GDPR”). “Customer Data” is the personal data Mailstream processes from the accounts the Customer’s users connect.

2. Subject matter, nature and purpose

We process Customer Data only to provide Mailstream to the Customer’s users: copying mail, calendars and contacts from the connected accounts, showing them and making them searchable, carrying out the actions users take, and sending notifications. Annex 1 describes the processing.

3. Instructions

We process Customer Data only on the Customer’s documented instructions: this DPA, the Terms of service and the use of Mailstream’s features by the Customer’s users. If the law requires us to process it otherwise, we tell the Customer first, unless the law forbids it. We tell the Customer if we believe an instruction infringes data protection law.

4. Confidentiality

Only people who need it to run Mailstream have access to Customer Data, and they are bound by confidentiality.

5. Security

We apply the technical and organisational measures in Annex 2 and keep them appropriate to the risk (Article 32 GDPR).

6. Sub-processors

The Customer gives general authorisation to the sub-processors on the sub-processor list. We announce a new or replaced sub-processor on that page and by email to the Customer at least 30 days before it starts; within that period the Customer may object on reasonable data protection grounds and, if we cannot address the objection, stop using Mailstream. We bind each sub-processor to data protection obligations equivalent to this DPA and remain responsible for it.

The providers the Customer’s users connect (Google, Microsoft, Apple, IMAP servers) are not sub-processors: the Customer chooses them and they hold the data independently.

7. International transfers

Customer Data is stored in the European Union (Ireland). Where a sub-processor processes it outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.

8. Data subjects’ rights

Taking into account the nature of the processing, we assist the Customer in answering data subjects’ requests. Users can remove their accounts and see their activity log themselves; we forward to the Customer any request we receive about Customer Data and do not answer it without the Customer’s instructions.

9. Assistance

We assist the Customer, as far as the information available to us allows, with its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).

10. Personal data breaches

We notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information then available: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed.

11. Deletion at the end

Customer Data comes from, and stays with, the Customer’s mail and calendar providers, so there is nothing to return. When a user removes an account, or the Customer stops using Mailstream, we delete the Customer Data at once from the live systems and from backups within 4 days, unless the law requires us to keep it.

12. Audits

We make available to the Customer the information needed to demonstrate compliance with Article 28 GDPR: this DPA, Annex 2, the sub-processor list and, on request, further documentation. The Customer, or an auditor it appoints who is bound by confidentiality, may audit our compliance once a year with 30 days’ notice, at its own cost and without compromising other customers’ data or the security of the service; for sub-processors’ facilities, their own certifications and reports apply.

13. Liability, term and governing law

Liability under this DPA is governed by the Terms of service, without prejudice to Article 82 GDPR. The DPA stays in force as long as we process Customer Data. It is governed by Italian law; the courts of Bologna have jurisdiction. Where it conflicts with the Terms, the DPA prevails for the processing of Customer Data.

Annex 1 — Description of the processing

Data subjects: the Customer’s users, and the people whose data appears in their mail, calendars and contacts (correspondents, invitees, contacts, colleagues).

Categories of data: account identity (name, email address); credentials of the connected accounts (OAuth tokens or app-specific passwords); messages (sender, recipients, subject, date, folders, labels, flags, text, drafts, scheduled messages); calendar events and colleagues’ busy/free blocks; contacts’ names and email addresses; settings; sessions and activity log (browser, IP address).

Special categories of data: Mailstream does not seek them, but messages may contain them; they are protected like any other content.

Frequency and duration: continuous, while the accounts stay connected; retention as in section 11 of the Privacy Policy.

Annex 2 — Technical and organisational measures

Encryption: TLS for every connection; access tokens, passwords, message text and previews encrypted at rest with AES-256-GCM, with a key per account protected by a master key kept outside the database; backups encrypted with age to keys kept off the server.

Access: the production servers accept web connections only from Cloudflare; the database uses least-privilege roles (the application cannot change the schema); access is limited to the Processor.

Application: every request is limited to the signed-in user’s data; server-side sessions, revocable and stored as hashes; requests that change data check their origin; message HTML is sanitised and shown in an isolated frame without scripts; remote images blocked by default; request rate limits.

Logging: a security activity log per user, kept 12 months and without message content; application logs never contain tokens, passwords or message content.

Resilience: nightly encrypted backups kept 4 days, with a restore drill every 3 months.

Minimisation: only the last 30 days of mail are copied by default; attachments are not stored; least-privilege permissions (no permanent deletion on Gmail).