Start free
Home Features Pricing

Resources

Blog Guides Email marketing resources

Company

About Contact Log in Start free

Data Processing Addendum

Version 2026-10-05 · Last updated October 5, 2026

In short: You (the customer) decide why and how your contacts' data is used; PostaraMail processes it only on your instructions, protects it, uses listed sub-processors, helps with data subject requests, tells you about breaches, and deletes it when you leave.

1. Parties and scope

This Data Processing Addendum ("DPA") is part of the Terms of Service between the customer ("Customer", the controller, or a processor acting for its own clients) and PostaraAI LLC ("PostaraAI", the processor). It applies to personal data that Customer or its connected websites load into the Service, or that PostaraMail collects for Customer, such as contacts, their email addresses, names, countries, consent records, and the content and results of emails ("Customer Personal Data").

It applies automatically when Customer accepts the Terms. A signed copy filled in with Customer's details can be downloaded under Settings > Legal & privacy.

2. Definitions

"Data Protection Law" means all data protection and privacy laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act, and laws of other countries such as the UAE, Saudi Arabia, Qatar, Bahrain, Oman, India, Brazil, Canada and Australia. "Sub-processor" means a third party that PostaraAI engages to process Customer Personal Data. "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. "SCCs" means the standard contractual clauses annexed to EU Commission Implementing Decision (EU) 2021/914.

3. Roles and instructions

Customer is the controller of Customer Personal Data (or a processor with authority to instruct us) and PostaraAI is its processor. PostaraAI will process Customer Personal Data only on Customer's documented instructions, which are: this DPA, the Terms, and Customer's use and configuration of the Service. PostaraAI will tell Customer if it believes an instruction infringes Data Protection Law.

PostaraAI may also process some personal data as a controller for its own account, security, billing and legal purposes, as described in the Privacy Policy.

4. Customer's responsibilities

Customer is responsible for having a lawful basis and any consent required to collect and email each contact; for giving notices to them; for the lawfulness of its instructions and content; for choosing the correct regions when sending; and for responding to requests from its contacts, with our help under section 9. Customer should not load special categories of personal data or criminal-offence data, or data of children, into the Service unless necessary and lawful, and it must not use the Service for purchased or scraped lists.

5. Confidentiality

PostaraAI will ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations and only access it as needed to provide and support the Service.

6. Security

PostaraAI will implement and maintain the technical and organisational measures in Annex II, appropriate to the risk, and may update them provided protection is not materially reduced.

7. Sub-processors

Customer gives general authorisation for PostaraAI to engage the Sub-processors listed in Annex III. PostaraAI will bind each Sub-processor to data protection obligations no less protective than this DPA and remains responsible for their performance.

PostaraAI will give Customer at least 30 days' notice of a new or replacement Sub-processor by updating the Sub-processors list on the Trust page and by email to the account owner. Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, Customer may stop using the affected part of the Service or delete its account.

8. International transfers

PostaraAI is based in the United States and processes data in the United States and other countries where its Sub-processors operate. For transfers of Customer Personal Data subject to the EU GDPR to a country without an adequacy decision, the SCCs apply and are incorporated by reference: Module Two (controller to processor) between Customer as exporter and PostaraAI as importer, and Module Three (processor to processor) with Sub-processors. Options: Clause 7 docking clause included; Clause 9(a) Option 2 (general authorisation, 30 days' notice); Clause 11 optional language not used; Clause 17 Option 1, law of Ireland; Clause 18, courts of Ireland. Annexes I to III of this DPA complete the SCCs. The competent supervisory authority is the one for the Customer's establishment or representative in the EEA, or if none, the Irish Data Protection Commission.

For the UK, the UK Addendum to the SCCs (version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018) applies, with the SCCs above as its Approved EU SCCs; the parties and details are as in Annexes I to III; either party may end the Addendum as the Addendum permits; the law of England and Wales and its courts apply. For Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss FADP, the Swiss Federal Data Protection and Information Commissioner as supervisory authority, and Swiss law and courts for Swiss-law matters.

For other countries with transfer rules (for example Saudi Arabia, the UAE, Qatar and India), PostaraAI will cooperate in the transfer assessment or contractual measures those laws require. Where Customer chooses DeepSeek as an AI provider, text Customer enters is processed in China; Customer must not include personal data in it.

9. Assistance

Taking into account the nature of the processing, PostaraAI will provide reasonable assistance to Customer to respond to requests from data subjects (the Service provides export, correction, unsubscribe and deletion tools) and with data protection impact assessments and consultations with authorities. If PostaraAI receives a request directly from a person whose data is Customer Personal Data, it will direct that person to Customer, or pass the request to Customer, unless the law requires otherwise.

10. Security Incidents

PostaraAI will notify Customer without undue delay, and aims to do so within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data, and will give the information it has about its nature, likely consequences and measures taken, and update Customer as it learns more. Notification is not an admission of fault.

11. Return and deletion

During the Agreement Customer can export its contacts as CSV at any time and delete data in the Service. When Customer deletes its account, PostaraAI deletes Customer Personal Data from its live systems immediately. Copies in encrypted backups are deleted when those backups are replaced in the regular cycle, which PostaraAI aims to complete within 90 days. PostaraAI may keep data where the law requires (for example billing records) and minimal records of agreement without name or IP address, and will keep them protected under this DPA.

12. Information and audits

PostaraAI will make available the information reasonably necessary to show compliance with this DPA, including its Trust page and, on request, written answers to a reasonable security questionnaire. Where this is not enough, or an authority requires it, Customer may audit PostaraAI's compliance once a year (or after a Security Incident) on 30 days' written notice, during business hours, without disrupting operations, under confidentiality, at Customer's cost, and without access to other customers' data.

13. US state privacy laws (including CCPA)

For personal information subject to US state privacy laws, PostaraAI acts as Customer's service provider or processor. It will not sell or share the personal information; retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in the Agreement; or combine it with other personal information except as the law allows. It will comply with applicable obligations, give the same level of protection the law requires, tell Customer if it can no longer meet them, and allow Customer to take reasonable steps to stop and remedy unauthorised use.

14. Liability, law and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms, except that nothing limits liability that cannot be limited by law or any party's liability to data subjects under the SCCs. Governing law is as in the Terms, except where the SCCs or the UK Addendum require otherwise. If this DPA conflicts with the Terms about personal data, this DPA prevails; if it conflicts with the SCCs, the SCCs prevail.

Annex I: details of the processing

Annex II: technical and organisational measures

Annex III: Sub-processors

The following Sub-processors are authorised. The live list is on the Trust page.

More: Legal centre · Trust and security · What changed · Privacy request