GDPR Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between JetEmail Pty Ltd ("JetEmail", "Processor", "we", "us", or "our") and the customer ("Controller", "you", or "your") for the provision of JetEmail's services, including Outbound Email, Inbound Email and the Marketing Suite.

This DPA applies where and to the extent that JetEmail processes Personal Data on behalf of the Controller in the course of providing the Services, and that processing is subject to:

• the General Data Protection Regulation (EU) 2016/679 ("GDPR");
• the UK GDPR and the Data Protection Act 2018;
• the Swiss Federal Act on Data Protection;
• the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles; or
• a United States state privacy law, in which case Section 11 also applies.

Where a term of this DPA conflicts with the Terms of Service, this DPA prevails for matters concerning the processing of Personal Data.

JetEmail implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

The Controller provides general authorization for JetEmail to engage sub-processors for the processing of Personal Data, subject to the following conditions:

• JetEmail maintains a current list of sub-processors on our website
• All sub-processors are bound by data protection obligations equivalent to this DPA
• JetEmail remains fully liable for sub-processor performance
• JetEmail will give at least 30 days' notice before adding or replacing a sub-processor, by email or dashboard notice
• The Controller may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Controller may terminate the affected Services and receive a refund of prepaid fees for the unused term
• Where an urgent replacement is required for security or continuity, we may act first and notify the Controller promptly afterwards

The current list of sub-processors is available at: jetemail.com/legals/gdpr-subprocessors

JetEmail is located in Australia. Personal Data may be processed and stored in Australia, the United States and the European Union, and may transit the global networks of our infrastructure providers.

For transfers to countries without an adequacy decision, JetEmail ensures appropriate safeguards are in place, including:

• The European Commission Standard Contractual Clauses, using the module appropriate to the transfer, which are incorporated into this DPA by reference where they apply
• The UK International Data Transfer Addendum for transfers subject to UK law
• Standard Contractual Clauses with sub-processors
• Additional technical and organizational security measures as required

Where the Controller requires details of where a specific category of data is stored, we will provide them on request.

JetEmail will assist the Controller in fulfilling data subject rights requests where technically feasible and legally required. This includes:

• Right of Access: Providing available Personal Data upon request
• Right to Rectification: Correcting inaccurate Personal Data
• Right to Erasure: Deleting Personal Data where legally required
• Right to Restrict Processing: Limiting processing where applicable
• Right to Data Portability: Providing data in a structured format
• Right to Object: Applying a suppression so that direct marketing stops

Marketing Suite records for one person can exist across contacts, form submissions, delivery logs, engagement events, workflow enrollments, message archives and suppression evidence. The Controller can action most of these itself in the dashboard, including contact deletion and export. Where a request needs our assistance, contact us and we will help within the timeframes the Controller needs to meet its own obligations.

An objection to direct marketing is given effect by recording a suppression. That record is retained rather than erased, because deleting it would allow the person to be re-added by a later import. This is the minimum data needed to honour the objection.

If a data subject contacts JetEmail directly about data we process for a Controller, we will not respond substantively on the Controller's behalf. We will refer them to the Controller and inform the Controller of the request.

The Controller remains responsible for responding to data subject requests and determining the legal basis for any actions taken.

JetEmail will notify the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller's data. The notification will include, to the extent known at the time:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• A contact point for further information

Where full details are not available immediately, we will provide an initial notification and then further information as our investigation progresses, rather than delaying notification until the picture is complete.

The Controller remains responsible for determining whether to notify supervisory authorities and data subjects as required by GDPR Articles 33 and 34, or by the equivalent provisions of another applicable law.

JetEmail will:

• Retain Personal Data only for as long as necessary to provide the Services or as described in our Privacy Policy
• Delete or return Personal Data upon termination of the service agreement, on the schedule set out in our Terms of Service
• Provide, on request, written confirmation of the deletion we have carried out and the categories of data that remain under the exceptions below

JetEmail will:

• Maintain records of processing activities as required by GDPR Article 30
• Provide information necessary to demonstrate compliance with this DPA
• Allow for and contribute to audits by the Controller or an independent auditor it appoints
• Cooperate with supervisory authorities as required

This section applies where the Controller is subject to a United States state privacy law, including the California Consumer Privacy Act as amended, and where JetEmail processes personal information on its behalf. In that case JetEmail is a service provider or processor, and the Controller is a business or controller.

JetEmail:

• Will not sell or share personal information, as those terms are defined in the applicable law
• Will not retain, use or disclose personal information for any purpose other than the business purposes specified in this DPA and the Terms of Service, or as otherwise permitted by law
• Will not retain, use or disclose personal information outside the direct business relationship between JetEmail and the Controller
• Will not combine personal information received from the Controller with personal information received from another source, except as permitted by the applicable law
• Will comply with the obligations applicable to a service provider and provide the same level of privacy protection required of the Controller
• Will notify the Controller if it determines it can no longer meet those obligations
• Will assist the Controller in responding to verified consumer requests, and will apply a suppression to give effect to an opt-out of marketing

The Controller may take reasonable and appropriate steps to stop and remediate unauthorized use of personal information. The Controller must not submit sensitive personal information unless JetEmail has expressly agreed in writing.

Where the Controller is an APP entity or otherwise subject to the Australian Privacy Act, JetEmail handles personal information on the Controller's behalf in a manner consistent with the Australian Privacy Principles, including APP 6 (use and disclosure), APP 8 (cross-border disclosure), APP 11 (security and destruction) and the Notifiable Data Breaches scheme.

The Controller is responsible for its own APP 1 and APP 5 obligations, including maintaining a privacy policy and giving collection notices at the point at which it collects personal information, whether through a signup form, a checkout or any other channel.

Section 6 describes the cross-border disclosures involved in providing the Services and the safeguards we apply.

Each party's liability under this DPA is subject to the limitations and exclusions set out in the main service agreement. JetEmail's total liability for all claims arising under this DPA shall not exceed the total fees paid by the Controller in the 12 months preceding the claim.

The Controller will indemnify JetEmail against claims arising from the Controller's breach of this DPA or applicable data protection laws.

Nothing in this section limits either party's liability where the law does not permit that liability to be limited, including a data subject's right to compensation under GDPR Article 82 and rights under the Australian Consumer Law.

This DPA will remain in effect for the duration of the service agreement. Upon termination:

• JetEmail will cease processing Personal Data except as required by law or permitted under Section 9
• Personal Data will be deleted or returned as instructed by the Controller, subject to the exceptions in Section 9
• Confidentiality obligations will survive termination

This DPA is governed by the laws of New South Wales, Australia. Any disputes will be subject to the exclusive jurisdiction of the courts of New South Wales, Australia.

Where Standard Contractual Clauses apply to a transfer, the governing law and forum stated in those clauses apply to them, and the relevant supervisory authorities maintain their jurisdiction as provided under the GDPR.

For questions regarding this DPA or data protection matters, please contact:

JetEmail may update this DPA from time to time to reflect changes in our processing activities, legal requirements, or business practices. Material changes will be communicated to Controllers with at least 30 days' notice, in line with our Terms of Service, except where an earlier change is required by law or to address a security risk.