Draft — pending legal review. This document has not yet been reviewed by a lawyer and may change before it takes effect.
Data Processing Addendum
This addendum forms part of the Terms of Service between you ("Customer") and Carnage Group Pty Ltd ("MailWarren", "we"). It applies to personal data contained in Your Content — the email you capture or send through the service — that we process on your behalf. It applies automatically; if you need a countersigned copy, email support@mailwarren.io. Terms such as "controller", "processor", "personal data" and "sub-processor" have the meaning given in the GDPR and UK GDPR or, where those laws don't apply, the equivalent meaning under applicable privacy law (including the Australian Privacy Act).
1. Roles
For personal data in Your Content, you are the controller (or, if you act for someone else, their processor) and MailWarren is your processor (service provider). For our own account, billing and security records we are an independent controller, as described in the Privacy Policy.
2. Details of the processing
| Subject matter and purpose | Providing the MailWarren email sandbox and (if you use it) email sending, as described in the Terms. |
|---|---|
| Duration | While your account is open, plus the deletion period in section 8. |
| Nature of processing | Receiving, storing, displaying, delivering, searching and deleting email messages and attachments. |
| Categories of data subjects | Whoever appears in the email you send: typically your own users, customers or staff, or test personas. |
| Types of personal data | Names, email addresses and any other personal data in message content, headers and attachments. You must not send special-category or sensitive data unless you have told us and we've agreed. |
3. Our commitments
- We process personal data only on your documented instructions — these terms, your use of the service and your settings — unless the law requires otherwise, in which case we'll tell you unless the law prevents it. We'll tell you if we think an instruction breaks the law.
- Everyone we authorise to process it is bound by confidentiality.
- We keep appropriate technical and organisational security measures (section 4).
- We use sub-processors only as set out in section 5.
- We help you, taking into account the nature of the processing and at your reasonable request, to respond to data-subject requests, to run security and breach obligations and to carry out data-protection assessments.
- We give you the information reasonably needed to show compliance with this addendum (section 9).
4. Security measures
- Encryption of connections to the website and API; secure handling of credentials, with passwords stored only as one-way hashes.
- Two-factor authentication for owners, administrators and platform staff, and role-based access so people see only what their role requires.
- Separation of each customer's data at the application level; staff access to Your Content only where needed for support, security or legal reasons.
- Automatic deletion of captured email at the end of your plan's retention period.
- Logging and monitoring of account activity, and abuse and rate-limit controls.
- A process to investigate and contain security incidents.
5. Sub-processors
You authorise us to use the sub-processors below to process Your Content. We are responsible for their acts under this addendum, and bind each to data-protection terms no less protective than these.
| Sub-processor | What it does | Personal data involved |
|---|---|---|
| Amazon Web Services (Amazon SES) | Delivers email you send through the Send API or relay, and our service email. | Content and recipients of email you send (not sandbox captures). |
| Cloudflare | Network delivery and security for our website, API and services. | Traffic in transit, including IP addresses. |
Stripe processes payments for us as a payment provider; it does not receive Your Content. We host our servers and databases with a cloud infrastructure provider; we will add it, and where it processes data, to this table before you are asked to rely on it.
Changes. We'll give at least 30 days' notice (by email or in the service) before adding or replacing a sub-processor. If you reasonably object on data-protection grounds within that time, we'll work with you to resolve it; if we can't, you may cancel the affected service and receive a pro-rata refund of prepaid fees.
6. International transfers
We are in Australia and our sub-processors operate globally, so personal data may be processed in Australia, the United States and other countries. Where GDPR or UK GDPR applies and personal data is transferred to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: controller to processor, and Module Three where you are a processor), and the UK International Data Transfer Addendum, are incorporated and completed as follows: the Customer is the data exporter, MailWarren the data importer; the details in sections 2 to 5 form the Annexes; the governing law and courts are those of Ireland (and, for the UK Addendum, England and Wales); and the competent supervisory authority is the one for your establishment. For transfers under the Australian Privacy Act we take reasonable steps to ensure overseas recipients comply with the Australian Privacy Principles.
7. Personal data breaches
We will tell you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Your Content. We'll tell you what we know about what happened, the data and people affected, the likely consequences and what we're doing about it, and we'll keep you updated. You are responsible for any notice to regulators or individuals that you must give.
8. Return and deletion
You can export or delete Your Content at any time in the service, and it is deleted automatically at the end of your plan's retention period. When your account closes we will delete what remains within a reasonable time, unless the law requires us to keep it. On request we'll confirm deletion in writing.
9. Audits and information
On reasonable written request, and no more than once a year (unless a regulator requires it or after a breach), we will give you information reasonably necessary to show that we comply with this addendum, and allow and contribute to audits. We prefer to satisfy an audit by written responses and documents; an on-site audit needs reasonable notice, must not disrupt the service or other customers, and is at your cost.
10. Liability and order of precedence
Each party's liability under this addendum is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses provide otherwise. If this addendum conflicts with the Terms about personal data, it prevails; if it conflicts with the Standard Contractual Clauses, they prevail.
11. Contact
Data-protection questions: support@mailwarren.io, attention Privacy.