This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the KapoMail Terms of Service between you ("Customer", "Controller") and HRMFIRM LTD, a company registered in England and Wales (16785320), trading as KapoMail ("Processor", "we").
It applies whenever KapoMail processes personal data on your behalf as part of the service — principally, the recipient addresses and message content you send through the platform. It reflects Article 28 of the UK GDPR. Where this DPA and the Terms conflict on data-protection questions, this DPA governs.
You are the controller of the personal data contained in the messages you send through KapoMail, and of the recipient data associated with them. You determine why and to whom a message is sent; we do not.
We are the processor of that data. We process it only to provide the service — to relay, authenticate, deliver, and report on your messages — and only on your instructions, which are given by configuring and using the platform (for example, by sending a message to a given address through our API or SMTP relay).
This DPA does not cover KapoMail's processing of your own account and billing data, where we act as controller — that is covered by our Privacy Notice.
| Subject matter | Recipient email addresses, message content and attachments, and associated delivery metadata, submitted by Customer to the KapoMail platform for sending. |
| Duration | For as long as the Terms are in force, plus the retention periods in section 8 below. |
| Nature of processing | Receipt, queuing, authentication (SPF/DKIM/DMARC-related processing), transmission, delivery-status tracking, bounce and complaint handling, suppression-list management, and storage for the retention periods described below. |
| Purpose | Providing transactional email sending, delivery reporting and related diagnostics as described in the KapoMail Terms of Service. |
| Categories of data subjects | The recipients of Customer's transactional messages — typically Customer's own customers, account holders or end users. |
| Categories of personal data | Recipient email address and, where included in the message, name and any other personal data Customer chooses to include in message content (for example, an order number, a partial delivery address, or an account status). KapoMail does not require or request special category data and Customer must not include it in message content sent through the platform. |
We will:
You give KapoMail general written authorisation to engage the sub-processors listed in the Annex below to help provide the service, provided that:
If you object to a new sub-processor on reasonable data-protection grounds, tell us within that 14-day window and we will work with you in good faith to address the objection — including, if we cannot resolve it, allowing you to terminate the affected part of the service without penalty.
Message data is stored and processed in the United Kingdom (AWS eu-west-2, London). Where processing by a sub-processor involves a transfer outside the UK, we ensure the transfer is protected by an adequacy decision or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another mechanism recognised under UK GDPR, before the transfer takes place.
Full detail is published on our Security & Trust page and forms part of this DPA by reference. In summary: encryption of message data in transit and at rest; access to production data restricted to the staff who need it for support or operational reasons, and logged; per-credential sending isolation so a compromised credential cannot access another customer's data; and continuous monitoring for abuse and anomalous access.
We retain categories of data processed under this DPA as follows, and no longer, except where a longer period is required by law:
| Data | Retention |
|---|---|
| Message bodies and attachments | 30 days from send, then deleted (configurable shorter on request) |
| Delivery events (accepted, delivered, bounced, complained, opened) | 90 days, then deleted |
| Suppression list entries (address and bounce/complaint reason only) | Retained while your account is active, to prevent re-sending to an address that has already hard-bounced or complained; minimised to the address and reason, not the original message |
| Audit and security logs of processing activity | 7 years, for fraud and security investigation purposes |
On termination of the Terms, you may export your message history and suppression lists for 30 days. After that window, or earlier on your written request, we delete Customer personal data from active systems, subject to the audit-log retention above and any legal hold.
We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our current sub-processor list and a summary of our security measures. Where you reasonably require a fuller audit, we will agree a mutually convenient time and scope, provide it at your cost beyond a reasonable initial review, and you will keep confidential anything you learn about our systems or other customers in the process.
If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it, with the information we have at that time about: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address it. We will update you as our investigation progresses if the full picture is not yet known at the 72-hour mark.
Liability under this DPA is subject to the liability provisions of the Terms of Service, including the cap described there, except to the extent the law does not permit liability to be limited (for example, liability arising directly from an infringement of Article 28 that the law treats as unlimitable).
This DPA is governed by the law of England and Wales, on the same basis as the Terms of Service.
| Sub-processor | Role | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting and email delivery | Message content, recipient addresses, delivery metadata | eu-west-2 (London), United Kingdom |
| Cloudflare | DNS resolution and content delivery / DDoS protection for the platform | Connection metadata (IP addresses, request headers) in transit; not message content | Global network, UK/EU routing preferred where available |
| Stripe | Payment processing | Customer's own billing data (not message or recipient data) | UK / EU processing region |
We will update this Annex, and notify you as described in section 5, before adding a new sub-processor.
Contact: HRMFIRM LTD, Flat 3 Carradale House, 88 St. Leonards Road, London, England, E14 0SN · privacy@kapomail.com