Data processing agreement (dpa) — MailPace

Cited by

Facts read from this source

• Data location Report an error

  “MailPace is a European company and our data infrastructure is based in France covered by the EU’s strong data privacy laws.”

• DPA status Report an error

  “This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service between MailPace and the customer.”

• Controller processor roles Report an error

  “customer is the data controller and MailPace is its data processor in relation to transactional email data that is processed in the course of providing the service. Where customer is acting as a processor (or equivalent service provider) for its own customer, MailPace may process personal data on behalf of that customer and, in that scenario, MailPace acts as a sub-processor in the processing chain.”

• Data encryption Report an error

  “For encryption, we use https in transit and encryption at rest. In addition to this, we use strict firewall rules and private encrypted networking. We keep offsite backups with replication including strong bcrypt passwords.”

• Data residency Report an error

  “All of the data that we store to process transactional email is kept fully secured, encrypted and hosted in France. This ensures that all of the data is being covered by the European Union’s strict laws on data privacy. Your transactional email data never leaves the EU and EU-owned cloud infrastructure, execpt for actually sending each email, which is sent via SMTP servers based in the UK”

• Data ownership Report an error

  “You own all right, title, and interest to your transactional email data. We obtain no rights from you to your transactional email data.”

• Data categories Report an error

  “The categories of personal data processed under this agreement consist of the contents and related metadata of transactional emails as determined by the controller.”

• Special category data Report an error

  “Where the customer chooses to include special categories of personal data within the meaning of Article 9 GDPR, the customer remains responsible for ensuring that it has a valid condition for that processing and MailPace will process such data only on the customer's documented instructions”

• Article28 info Report an error

  “MailPace will also make available to the customer, on request and subject to commercial confidentiality and reasonable security safeguards, the relevant information necessary to demonstrate compliance with Article 28 of the GDPR”

• Scc and notification Report an error

  “With each vendor, we assess their commitment to privacy and we sign a data processing agreement with them that include the controller-processor Standard Contractual Clauses. Any such subcontractors will be permitted to process data only to deliver the services MailPace has retained them to provide”

• Objection right Report an error

  “MailPace shall notify the controller when modifying the list of subprocessors using our email, privacy policy page, and/or blog. The controller is able to legitimately object and may terminate the agreement.”

• Retention Report an error

  “All transactional emails sent or received are retained for a maxmimum of 37 days. Retained emails are available to view in the dashboard, with all emails auto-deleted and removed from the dashboard after 30 days, and removed from backups 7 days later.”

• Deletion Report an error

  “All your transactional emails will be permanently deleted immediately when you delete your MailPace account or when you delete your domain or organisation. We cannot recover this information once it has been permanently deleted.”

• Dpia assistance Report an error

  “MailPace will also provide assistance to the controller for DPIAs. Where a data subject asserts their rights as a data subject, this request will be forwarded to the controller without delay.”

• Liability Report an error

  “Each party indemnifies the other and holds them harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the indemnified party and arising directly or indirectly out of or in connection with a breach of this DPA.”

• Effective date Report an error

  “The DPA is effective as of October 11th, 2022 and replaces and supersedes any previously agreed data processing agreement between you and MailPace relating to the GDPR.”

• Signature required Report an error

  “By using our product you are agreeing to our terms of service, and you are automatically accepting our DPA and do not need to sign a separate document.”

• Publicly available Report an error

  “Yes. The DPA is a publicly available document and customers who wish to share it with their customers to confirm our security measures and other terms may feel free to do so.”

• No notification required Report an error

  “No. You are not required to notify us or any third party upon accepting our DPA though, as mentioned above, you are free to do so.”

• Last updated Report an error

  “Last updated: October 8th, 2026”

• Staff training Report an error

  “MailPace shall ensure that all MailPace personnel required to access the transactional email data are trained in GDPR and data privacy, informed of the confidential nature of the data and comply with the obligations sets out in this agreement.”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Lead Message logs, events & webhooks
• The Agency Lead Message data, retention & security
• The Agency Lead Reliability, accounts & support
• The Agency Lead European sovereignty
• The Data Protection Officer Message logs, events & webhooks
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer European sovereignty
• The Shop Operator Message logs, events & webhooks
• The Shop Operator Message data, retention & security
• The Shop Operator Reliability, accounts & support
• The Shop Operator European sovereignty
• The Platform Engineer Message logs, events & webhooks
• The Platform Engineer Message data, retention & security
• The Platform Engineer Reliability, accounts & support
• The Platform Engineer European sovereignty
• The SaaS Developer Message logs, events & webhooks
• The SaaS Developer Message data, retention & security
• The SaaS Developer European sovereignty
• The Skeptic Message logs, events & webhooks
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty