Data processing agreement (dpa) — Mailgun

Cited by

Facts read from this source

• DPA version Report an error

  “Version 8 – Date of release: 29 October 2025”

• ISO 27001 Report an error

  “Sinch has also applied an Information Security Management System (ISMS), according to ISO/IEC 27001:2022.”

• Breach notification Report an error

  “Sinch shall notify the Customer without undue delay once Sinch becomes aware of a personal data breach affecting the Customer’s Personal Data.”

• Data deletion period Report an error

  “Within ninety (90) days following termination of the account, Sinch shall delete all personal data processed pursuant to this DPA, unless Customer requests the return of personal data as described in Paragraph 11(a) above.”

• Subprocessor notice Report an error

  “Sinch shall notify the Customer, through such mechanism, thirty (30) days’ in advance of any intended changes concerning the addition or replacement of any Sub-processor.”

• Subprocessor list URL Report an error

  “The current sub-processors for the Services are set out at https://sinch.com/legal/data-protection-agreement-sub-processors/”

• Subprocessor objection window Report an error

  “If, within ten (10) business days of receipt of that notice, the Customer notifies Sinch in writing of any objections on reasonable grounds to the proposed appointment, Sinch shall not appoint that proposed sub-processor”

• Transfer safeguards Report an error

  “the following safeguards are taken: (i) Standard Contractual Clauses as per European Commission’s Decision 2021/914/EU of June 4, 2021, (2) for Sinch Email, the EU-US Data Privacy Framework (EU-US DPF) and the UK Extension to the EU-U.S DPF, as set forth by the U.S Department of Commerce (3) UK Addendum, and (4) additional safeguards with respect to security measures including data encryption”

• Scc supervisory authority Report an error

  “For the purpose of Clause 13 (Supervision), IMY, the Swedish Data Protection Authority (Integritetsskyddsmyndigheten) shall act as competent supervisory authority;”

• Scc governing law Report an error

  “Option 1 of Clause 17 (Governing law) shall apply and the laws of Sweden shall govern the Standard Contractual Clauses;”

• Tom encryption Report an error

  “Encrypt data at rest on servers, applications, and databases (AES256 Minimum). Encrypt data in transit (TLS 1.2 or higher).”

• Tom pen test Report an error

  “Manual blackbox Pen test conducted every 12 months”

• Tom vulnerability scan Report an error

  “Vulnerability Scan every 7 days.”

• Tom backup Report an error

  “Backup restore tests shall be performed at least quarterly for business-critical systems and at least annually for all others”

• Tom access review Report an error

  “Access rights to offices, information and systems are reviewed quarterly.”

• Tom dr testing Report an error

  “The Disaster Recovery Plans are tested annually.”

• Tom password policy Report an error

  “Password minimum length of 12 characters with complexity enforced”

• Data retention policy Report an error

  “Established a data retention policy, which clearly defines the specific types of data that will be collected, how long it will be retained, and when it will be deleted.”

• Independent controller for transmission Report an error

  “when processing personal data in the course of providing communication services as part of the Services, including the transmission and exchange of SMS via telecommunications networks and other messages and communications, including emails, voice, and other media via other communication platforms, regardless of whether Customer acts as a controller or processor, Sinch acts as an independent data controller, and not as joint controller”

• Data subject request tools Report an error

  “Sinch provides specific tools in order to assist customers in replying to requests received from data subjects. These include our APIs and interfaces to search event data, suppressions, and retrieve message content.”

• Encrypted storage Report an error

  “Information uploaded to the Services, including message content, is stored in an encrypted format when processed by the Sinch Infrastructure.”

• DPA precedence Report an error

  “in the event of inconsistencies between the provisions of this DPA and any other agreements between the parties, including the Principal Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this DPA, the provisions of this DPA shall prevail.”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Lead Message data, retention & security
• The Agency Lead European sovereignty
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer European sovereignty
• The Shop Operator Message data, retention & security
• The Shop Operator European sovereignty
• The Platform Engineer Message data, retention & security
• The Platform Engineer European sovereignty
• The SaaS Developer Message data, retention & security
• The SaaS Developer European sovereignty
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty