Data Processing Addendum

This Data Processing Addendum ("DPA") applies to the processing of personal data by CapySend on behalf of a customer ("Customer") in connection with the CapySend service (the "Service"). It forms part of the Terms of Service. By accepting the Terms of Service, the Customer accepts this DPA.

The CapySend entity entering into this DPA is TO CONFIRM: legal name and registered address of the CapySend operating entity.

1. Definitions

• "Customer Personal Data" means personal data that CapySend processes on behalf of the Customer in connection with the Service, as described in Appendix 1.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Supervisory Authority" and "Personal Data Breach" have the meanings given in the GDPR.
• "GDPR" means Regulation (EU) 2016/679 and, where applicable, the UK GDPR.
• "Sub-processor" means a third party engaged by CapySend to process Customer Personal Data.
• "Security Measures" means the technical and organisational measures described in Section 5.

2. Scope and Roles

2.1 Customer as Controller

For Customer Personal Data in a workspace — including emails, contacts and related data — the Customer is the Controller and CapySend is the Processor. CapySend processes Customer Personal Data only on the Customer's documented instructions, as set out in this DPA and in the Terms of Service.

2.2 CapySend as Controller

For account and billing data (such as the registration email address, name and billing information) and for website access logs, CapySend acts as Controller. That processing is described in the Privacy Policy.

2.3 Customer responsibilities

The Customer is responsible for the lawfulness of its instructions and for having a lawful basis for the processing. The Customer must not use the Service to process special categories of personal data as described in Appendix 1.

3. Processing on Instructions

CapySend processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country, unless required to do otherwise by law. If CapySend is required by law to process Customer Personal Data for another purpose, it will inform the Customer before doing so, unless the law prohibits that information. CapySend will inform the Customer without undue delay if, in its opinion, an instruction infringes the GDPR.

4. Confidentiality

CapySend will ensure that persons authorised to process Customer Personal Data are subject to an appropriate obligation of confidentiality. That obligation continues after the person's engagement with CapySend ends.

5. Security Measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, CapySend implements the following measures:

• Encryption in transit: all traffic to the Service is encrypted using HTTPS.
• Encrypted credentials: stored sending-channel passwords, signing keys and AI keys are encrypted at rest.
• Encrypted backups: backups are made daily and encrypted; the key needed to decrypt them is kept offline, not on CapySend's servers.
• Access control: access to production systems is restricted.
• Approvals and logging: sending is subject to human approval by default, and personal data such as email addresses is masked in parts of the logs.

TO CONFIRM: further technical and organisational measures, including measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems, and the process for regularly testing and assessing the effectiveness of the measures.

6. Sub-processors

6.1 General authorisation

The Customer gives CapySend general written authorisation to engage Sub-processors for the Service.

6.2 Current Sub-processors

• Hostinger — server hosting (application, database, attachments) — United States (Boston)
• Cloudflare — DNS, network and proxy services for the website and workspace, encrypted backup storage (R2) — global network; R2 region TO CONFIRM: Cloudflare R2 storage region
• Amazon Web Services (Amazon SES) — platform system email (registration verification, password reset, billing notices; sent from [email protected]) and the hosted sending add-on — Asia Pacific (Sydney, ap-southeast-2)
• Creem — payments, subscriptions, tax and invoicing (merchant of record) — TO CONFIRM: location of Creem

Customer's own sending channels and AI model providers are chosen and contracted directly by the Customer. They are not CapySend Sub-processors.

6.3 Changes to Sub-processors

CapySend will notify the Customer before adding or replacing a Sub-processor. TO CONFIRM: notice period (proposed 30 days) and method of notice. The Customer may object to a change on reasonable data protection grounds. TO CONFIRM: consequences of a timely objection.

6.4 Sub-processor obligations

CapySend imposes data protection obligations on each Sub-processor that are equivalent to those in this DPA. CapySend remains responsible for the performance of its Sub-processors.

7. Assistance with Data Subject Requests

The Service provides export and deletion functions. A workspace administrator can download a complete export from "Settings → Workspace" at any time. The export consists of a zip file with one JSON Lines file per table and attachments as original files. It does not include credentials such as passwords, key hashes, channel passwords, signing keys, DKIM private keys or AI keys. A workspace owner can close the workspace. The workspace then becomes read-only immediately and can be restored within 90 days; after 90 days all data in the workspace is permanently deleted. Taking into account the nature of the processing, CapySend assists the Customer with appropriate technical and organisational measures in responding to requests by Data Subjects to exercise their rights under the GDPR.

8. Assistance with DPIAs and Supervisory Authorities

Taking into account the nature of the processing and the information available to CapySend, CapySend assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation with Supervisory Authorities.

9. Personal Data Breaches

CapySend notifies the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. TO CONFIRM: notification time limit (proposed: without undue delay and no later than 72 hours). The notification describes, where possible, the nature of the breach, its likely consequences, and the measures taken or proposed. CapySend cooperates with the Customer and takes reasonable steps to mitigate the breach.

10. Deletion and Return of Data

After the Service ends, CapySend deletes Customer Personal Data as described below. The Customer returns data to itself by downloading the export before deletion. The Customer can export workspace data at any time, as described in Section 7. After a workspace is closed, all data in the workspace is permanently deleted 90 days later. Copies in backups are deleted as the backups rotate out. Encrypted backups are kept locally on the server for 14 days and copied to Cloudflare R2. TO CONFIRM: backup retention period and region on Cloudflare R2.

11. Audit and Information

CapySend makes available this DPA and its security information so that the Customer can verify compliance with Article 28 of the GDPR. TO CONFIRM: conditions for on-site audits, including notice period, frequency and confidentiality obligations.

12. International Transfers

The Customer's data is stored in the United States and sent through Amazon SES in Australia. Where Customer Personal Data is transferred outside the EEA or the UK, the transfer relies on appropriate safeguards. TO CONFIRM: whether Standard Contractual Clauses (SCCs) are used, and which module.

13. General

This DPA does not limit or reduce any obligation CapySend has under the Terms of Service. In case of conflict between this DPA and the Terms of Service on the processing of Customer Personal Data, this DPA prevails. Questions about this DPA can be sent to [email protected].

Appendix 1 — Description of Processing

Categories of Data Subjects

• The Customer's contacts
• Recipients of emails sent through the Service
• Senders of emails received through the Service
• The Customer's employees and workspace members

Categories of Personal Data

• Names
• Email addresses
• Email content and attachments
• Metadata
• Delivery, bounce and complaint events

Sensitive Data

The Customer must not process special categories of personal data through the Service.

Nature and Purpose of Processing

CapySend provides an email workspace for B2B teams and their AI agents. Processing includes receiving, storing, drafting and sending email on the Customer's instructions, tracking delivery events, and handling suppressions. Emails are sent from the Customer's own domain, through the Customer's own channel or, if the hosted sending add-on is enabled, through CapySend's Amazon SES account. AI features use the model provider configured by the Customer.

Duration of Processing

Processing continues for the term of the Customer's subscription and until deletion as described in Section 10. Email retention depends on the plan: 90 days on the Free plan and 2 years on the Pro plan. TO CONFIRM: application of the 90-day retention period after a downgrade, and whether the 2-year Pro retention is fully automated.