Data processing
Data processing addendum.
The terms on which Mailtruss processes personal data for its customers. It applies automatically when you accept the Terms. Version 1.0, last updated 13 November 2026.
1. Scope and roles
This Data Processing Addendum (“DPA”) is part of the Terms of Service between the customer (“Customer”) and the operator of Mailtruss (“Mailtruss”). Mailtruss is operated from India. It applies when Mailtruss processes personal data on the Customer’s behalf in providing the Service (“Customer Personal Data”), and it is accepted when the Customer accepts the Terms. It satisfies the requirements for a contract with a processor under Article 28 of the GDPR and the UK GDPR, and for a contract with a Data Processor under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
The Customer is the controller (GDPR) or Data Fiduciary (DPDP Act) of Customer Personal Data. Mailtruss is the processor or Data Processor. For personal data about the Customer’s own users and billing, Mailtruss is a controller under its Privacy Policy, and this DPA does not apply to that.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter and nature | Receiving, storing, transmitting and reporting on the outcome of email the Customer sends through the Service; storing the Customer’s contacts, segments, templates and broadcasts. |
| Purpose | To provide the Service to the Customer, as documented in the Terms and the Customer’s configuration and API calls. |
| Duration | The term of the Terms, and afterwards until the data is erased under section 9. |
| Data subjects | The Customer’s recipients, contacts, and end users, and people named in message content. |
| Categories of personal data | Email addresses; names and any other data the Customer puts in messages, contacts or properties; delivery, bounce and complaint events; when the Customer turns tracking on, open and click events (time, user agent, the link clicked); IP address and user agent of API requests; message content and attachments. |
| Special categories | None intended. The Customer must not send special-category or sensitive data unless it has a lawful basis and has taken appropriate safeguards (see the Acceptable Use Policy). |
3. Instructions
Mailtruss will process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA, the Customer’s use and configuration of the Service, and written instructions it gives us that are consistent with the Terms. Mailtruss will tell the Customer if it believes an instruction breaches data-protection law, and may suspend the affected processing until it is resolved. The Customer is responsible for having a lawful basis, including any consent or notice required, for the processing it instructs, and for the accuracy and legality of the data.
4. Confidentiality and personnel
Mailtruss will ensure that people it authorises to process Customer Personal Data are bound by a duty of confidentiality, and will limit access to those who need it to provide and secure the Service.
5. Security measures
Mailtruss maintains the technical and organisational measures below, appropriate to the risk. They are those that exist today; we may change them if the change does not reduce the overall level of protection.
- Access control: role-based access (owner, admin, developer, viewer, billing) enforced on the server; every query is scoped to the organization of the session or API key; API keys are shown once and stored only as one-way hashes; sending-only keys cannot read data.
- Credentials and secrets: passwords are salted and hashed; webhook signing secrets are encrypted at rest; production secrets are held as encrypted platform secrets, not in source code.
- Encryption in transit: TLS for the website, API and between the Service and its providers.
- Data minimisation in logs: API logs redact secrets and shorten large bodies; API keys are never logged.
- Integrity of events: delivery notifications are accepted only after their cryptographic signatures and origin are verified; webhook payloads we send are signed.
- Abuse and resilience: rate limits and quotas, automatic suppression of bounced and complaining addresses, automatic suspension at severe bounce or complaint rates, idempotent sending, and queued, retried delivery.
- Audit trail: changes in an organization are recorded in an audit log the Customer can read.
- Database safeguards: row-level security is enabled on every table and the database’s public API roles have no access.
Mailtruss does not currently hold an independent security certification or audit report, and does not claim to. The Customer is responsible for the security of its own account, keys and systems.
6. Sub-processors
The Customer gives Mailtruss general authorisation to engage sub-processors. The current categories, locations and safeguards are on the sub-processors page, and the names of the providers in each category are given to a Customer on written request to privacy@mailtruss.com. Mailtruss will bind each sub-processor to data-protection obligations no less protective than this DPA, and remains responsible for their performance of them.
Mailtruss will give the Customer at least 14 days’ notice by email before adding or replacing a sub-processor that will process Customer Personal Data. The Customer may object within that time on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may end the affected Service and receive a refund of prepaid fees for the unused period.
7. Assisting the Customer
Taking into account the nature of the processing, Mailtruss will, by appropriate measures and at the Customer’s request, help the Customer respond to requests from data subjects (data principals) to exercise their rights, and help it meet its obligations on security, breach notification, impact assessments and consultation with authorities, insofar as it relates to the Service. Much of this the Customer can do itself in the dashboard and API (export, edit and delete contacts; unsubscribe and suppression lists). If Mailtruss receives a request that concerns Customer Personal Data, it will tell the requester to contact the Customer, and will not respond further except on the Customer’s instruction or as the law requires.
8. Personal data breach
Mailtruss will notify the Customer without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data, to the owner email addresses on the account. The notice will describe, as far as then known, the nature of the breach, the data and approximate number of people affected, likely consequences, and measures taken or proposed, and will be supplemented as more is learned. Notification is not an admission of fault. The Customer decides whether and how to notify authorities and data subjects, and Mailtruss will cooperate reasonably.
9. Return and deletion
The Customer may export its data through the dashboard and API at any time. After the Terms end, or on the Customer’s written request at any time, Mailtruss will permanently erase Customer Personal Data within 30 days of a verified request, and confirm in writing, except for data that law requires Mailtruss to keep, which it will keep confidential, protect and use only for that purpose. Copies in the database provider’s backups are overwritten on the provider’s normal cycle. Deleting an organization in Settings stops access and sending immediately but does not by itself erase the data; the Customer must ask for erasure.
10. Information and audits
On written request, no more than once a year unless a breach has occurred, Mailtruss will give the Customer the information reasonably necessary to show compliance with this DPA, such as a description of its security controls and a written answer to a reasonable security questionnaire. Where that does not satisfy a legal requirement, the Customer or its auditor, under confidentiality and at the Customer’s cost, may carry out an audit on reasonable notice, during business hours and without disrupting the Service or exposing other customers’ data.
11. International transfers
Mailtruss operates from India, and its sub-processors process data in the United States and, for analytics, the European Union. The Customer authorises these transfers. Where the Customer is established in the EEA, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply to transfers of Customer Personal Data to Mailtruss, as follows: Module Two (controller to processor); clause 7 (docking) applies; in clause 9(a) Option 2 (general authorisation) applies with the notice period in section 6; the optional wording in clause 11(a) does not apply; in clause 17 the law of Ireland governs; in clause 18 the courts of Ireland have jurisdiction; Annex I is section 2 of this DPA, with the Customer as exporter and Mailtruss as importer; and Annex II is section 5. Where the Customer is established in the United Kingdom, the UK International Data Transfer Addendum issued by the Information Commissioner, Version B1.0, applies in the same way, with the Standard Contractual Clauses as above. If either is replaced, the replacement applies.
The DPDP Act permits transfer of personal data outside India except to countries the Government of India restricts by notification. Mailtruss does not use a sub-processor in a restricted country.
12. Liability, order of precedence and term
Each party’s liability under this DPA is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses provide otherwise. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. This DPA lasts as long as Mailtruss processes Customer Personal Data. It is governed by the law that governs the Terms, except where the Clauses require otherwise.
Questions about this DPA, or a request for a signed copy: privacy@mailtruss.com. Version 1.0, last updated 13 November 2026.