Data processing agreement (dpa) — Bird Email API (formerly SparkPost)

Cited by

Facts read from this source

• DPA last updated Report an error

  “Last updated: 21 November 2024”

• DPA role Report an error

  “1.1 Scope. This DPA governs processing of Customer Personal Data by us as a processor.”

• Breach notification Report an error

  “5.5 Personal Data Breach Response and Notification. Upon becoming aware of a Personal Data Breach, we will without undue delay (i) notify you, (ii) investigate the Personal Data Breach, (iii) provide timely information relating to the Personal Data Breach as it becomes known or as it is reasonably requested by you, and (iv) take commercially reasonable steps to mitigate the effects and prevent recurrence of the Personal Data Breach.”

• Subprocessor list Report an error

  “You agree to the engagement of the Sub-processors in relation to the Services, listed at our overview of Sub-processors, which also contains a procedure for you to subscribe to notifications of changes to our use of Sub-processors.”

• Subprocessor objection period Report an error

  “You may object to a Sub-processor Change provided that (i) the objection is made in writing within ten (10) business days of our notice of the Sub-processor Change”

• Scc modules Report an error

  “the EU Controller-to-Processor (Module Two) of the Standard Contractual Clauses will apply to any such transfer of Customer Personal Data from the EEA. When you are acting as a data processor and we are a sub-processor the Processor-to-Processor (Module Three) of the Standard Contractual Clauses will apply”

• UK scc Report an error

  “9.3.2 The parties agree that the UK Standard Contractual Clauses will apply to Customer Personal Data that is transferred via the Services from the United Kingdom”

• ISO 27001 audit Report an error

  “10.1 Audit Report. Our communication platform shall be regularly audited against the ISO 27001 standard (or equivalent). The audit may, in our sole discretion, be an internal audit, or an audit performed by a third party.”

• ISO 27001 certified Report an error

  “We are ISO 27001 certified, the globally recognised information security standards for Information Security Management Systems (ISMS). All our hosting providers are ISO 27001 certified.”

• Supervisory authority Report an error

  “The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) will be the competent supervisory authority.”

• CCPA Report an error

  “With respect to U.S. Personal Data, we are a service provider under the CCPA and a data processor under other U.S. Data Protection Laws. We shall not sell U.S. Personal Data.”

• US dp framework Report an error

  “We are always up to the date with all applicable laws and regulations, including the General Data Protection Regulation, and the EU-US Data Protection Framework.”

• Penetration testing Report an error

  “we undergo rigorous surveillance as well as certification audits as part of our ISO/IEC 27001 compliance, and regularly execute application vulnerability and penetration testing.”

• Encryption Report an error

  “all Personal Data is encrypted in transit and at rest, and, to the extent relevant from a security standpoint, treated as if it were classified as sensitive data. Information is always transmitted over TLS with up-to-date encryption methodologies by default.”

• Deletion return Report an error

  “Upon termination or expiration of the Agreement, we will (at your election) delete or return to you all Customer Personal Data (including copies) in our possession or control, save that this requirement will not apply to the extent we are required by law to retain some or all of the Customer Personal Data.”

• Retention sms voice Report an error

  “For communication content and traffic data contained in the SMS and Voice Services a retention period of six months applies;”

• Retention video Report an error

  “For Video Services communication content and traffic data are retained for a minimum of 30 days up to the duration as agreed upon with you;”

• Retention email Report an error

  “For Email services communication content and traffic data are retained for 72 hours;”

• Registration Report an error

  “We are also registered with the Dutch Authority for Consumers and Markets.”

• Regulated telecom provider Report an error

  “we’re always accountable and fully transparent with our clients”

• Disclosure request policy Report an error

  “We will notify you as soon as reasonably possible if we receive a request from a governmental or regulatory body to disclose Customer Personal Data, unless such notice is prohibited by law. We will handle disclosure requests in accordance with the disclosure request policy, available on our website in the Disclosure Request Policy page.”

• Remote workforce Report an error

  “All Bird employees work remotely. Due to Bird’s remote working policy, Bird has implemented and enforced a teleworking policy which ensures employees work remotely in a secure manner.”

• Questionnaire frequency Report an error

  “will not exercise this right more than once per year, unless a Personal Data Breach or significant change in our processing activities in relation to the Services require that an additional questionnaire is executed.”

• Security overview Report an error

  “we implement information security and data protection policies in accordance with applicable laws and publish an overview of our ISMS relevant information in our MessageBird Security Overview.”

• Sensitive data Report an error

  “Communication content. Sensitive data may, from time to time, be processed via the Services where you or your End-Users choose to include sensitive data within the communications that are transmitted using the Services.”

5 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Lead Message data, retention & security
• The Agency Lead European sovereignty
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer European sovereignty
• The Shop Operator Message data, retention & security
• The Shop Operator European sovereignty
• The Platform Engineer Message data, retention & security
• The Platform Engineer European sovereignty
• The SaaS Developer Message data, retention & security
• The SaaS Developer European sovereignty
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty