Data Processing Addendum (DPA)

1. Scope and Roles

This Data Processing Addendum (“DPA”) supplements the HandoffMail Terms of Service. In providing the Service, Customer acts as the Data Controller (or Business) and HandoffMail Technologies Inc. acts as the Data Processor (or Service Provider) of Personal Data processed through the platform.

2. Processing Details

• Subject Matter: Provision of autonomous B2B sales email drafting, scheduling, delivery, and reply qualification.
• Duration: The term of Customer's subscription plus any configured retention grace period until permanent data deletion.
• Categories of Data Subjects: Customer employees (users), prospective business contacts, and recipients of B2B outreach.
• Types of Personal Data: Business contact details (names, business email addresses, job titles, employer names), message headers, thread timestamps, and reply text.

3. Processor Obligations

HandoffMail agrees to:

• Process Personal Data only on documented instructions from Customer (including with respect to transfers outside the EEA/UK).
• Ensure all personnel authorized to process Customer Personal Data are bound by strict obligations of confidentiality.
• Implement technical and organizational measures (including AES-256-GCM encryption, TLS 1.3, and multi-tenant isolation) appropriate to the risk.
• Promptly notify Customer upon becoming aware of a confirmed Security Incident involving Customer Personal Data.
• Provide reasonable assistance to Customer in responding to Data Subject access, correction, or deletion requests.

4. Subprocessors

Customer grants general written authorization for HandoffMail to engage the Subprocessors listed on our Subprocessors page. We enforce data protection obligations on each subprocessor that are no less protective than those in this DPA.

5. Deletion or Return of Data

Upon termination of Customer's subscription or upon scheduled workspace deletion, HandoffMail shall permanently delete or anonymize all Customer Personal Data within the configured data retention window (maximum 90 days), unless required by law to retain specific operational logs.