This Data Processing Agreement ("DPA") forms part of the SmartMailing Terms of Service between Ionuț-Săndel Badiu, sole proprietor at Nordbahnstraße 13/11, 1020 Vienna, Austria, GISA-Zahl 40104775 ("SmartMailing," "Processor") and the customer using the SmartMailing platform ("Customer," "Controller"). It governs SmartMailing's processing of personal data on behalf of the Customer in connection with the Service.
Where this DPA conflicts with the Terms of Service, this DPA controls for data protection matters. Capitalized terms not defined here have the meaning given in the Terms of Service or in the GDPR (Regulation (EU) 2016/679).
1. Subject matter, nature, purpose and duration
Subject matter: SmartMailing processes personal data of the Customer's subscribers (the "Customer Personal Data") in connection with providing the Service, namely an email-marketing platform that lets the Customer collect, organize, segment, and email subscribers.
Nature of processing: storage, organization, structuring, retrieval, consultation, transmission (sending of emails on Customer's instruction), hosting of Customer content, receipt and storage of inbound replies, AI-assisted drafting and ranking (outputs shown to the Customer for approval), engagement measurement and segmentation, erasure, and destruction.
Purpose of processing: performing the Service Customer subscribed to. SmartMailing does not process Customer Personal Data for its own purposes.
Duration: for as long as the Customer's account is active, and afterwards only as described in Section 11.
2. Types of personal data and categories of data subjects
Data subjects: individuals who have subscribed (or whom the Customer claims have subscribed) to the Customer's mailing lists; recipients of emails the Customer sends through the Service; visitors to the Customer's hosted subscribe form; individuals who reply to emails the Customer sends; visitors to the Customer's hosted confirmation, preference and unsubscribe pages; reviewers the Customer invites to approve a campaign.
Categories of data:
- Contact data: email address, name (if provided), language preference
- Subscription metadata: list memberships, custom fields the Customer defines, opt-in source, IP address at signup (if captured), approximate country (derived from the signup IP address or supplied by the Customer), user agent
- Consent records: text shown to the data subject, source, date, IP, attestation by the Customer
- Email engagement data: send / delivery / open / click / bounce / complaint events with timestamps
- Suppression entries: addresses the Customer must never email (unsubscribed, bounced, complained, GDPR-deleted)
- Reply content: sender address, subject and message text of replies received when the Customer enables reply handling, plus AI-drafted answers derived from them (retained 12 months)
- Sign-up data from forms and hosted pages: IP address and user agent recorded with the consent when a data subject signs up through a hosted page or an embedded form (sign-ups pass a bot check, Cloudflare Turnstile, whose result is checked but not stored)
- Reviewer data: name, email address, comments and decision of persons the Customer invites to review a campaign
- Form registration data: email address, name and answers of persons who register through the Customer's event or waitlist forms (deleted 30 days after the end date, where the Customer sets one)
SmartMailing does not knowingly process special-category data (Article 9 GDPR) on behalf of the Customer. The Customer agrees not to upload such data through the Service.
3. Customer obligations (Controller responsibilities)
- Maintain a lawful basis (Article 6 GDPR) for every subscriber added to the Service. For subscriber lists migrated from another platform, the Customer must attest to prior consent and provide the original consent text via SmartMailing's import flow.
- Provide all required notices to data subjects (privacy notice, opt-in language, unsubscribe mechanism) and respond to data-subject requests directed to the Customer.
- Use Double Opt-In (DOI) where required by applicable law (notably the GDPR ePrivacy framework as transposed in DACH and most of the EU).
- Process only personal data the Customer is authorized to process.
- Issue instructions to SmartMailing only through the documented features of the Service (API, dashboard, etc.). Out-of-band instructions are not effective.
- Inform data subjects about open and click tracking and obtain their prior consent where the law of their country requires it (in particular France and Italy, whose supervisory authorities require consent for open-tracking pixels in marketing email as of 2026), and honour withdrawals. SmartMailing measures opens and clicks only as the Customer configures per brand (all recipients except those who refused, consenting recipients only, consenting recipients only in the EU, EEA and UK and all others elsewhere, or none); a data subject whose recorded answer is no is never measured, and where consent is required only data subjects whose recorded answer is yes are measured. In the regional setting SmartMailing relies on the country stored for each data subject; the Customer is responsible for the accuracy of countries it supplies. Measured emails carry a "Tracking preferences" link through which data subjects can withdraw at any time without unsubscribing. Transactional emails and replies to messages from data subjects are never measured.
- Link the Customer's own privacy notice on subscribe forms and hosted pages so data subjects receive the information required by Article 13 GDPR.
- Not place personal data in images or files uploaded to the Service, because uploaded files are served from public links (see Section 7).
- Acknowledge that enabling reply handling, linking a Telegram chat or using AI features on Customer Personal Data constitutes an instruction to use the corresponding sub-processors listed in the Privacy Policy.
4. Processor obligations (SmartMailing)
SmartMailing will:
- Process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers outside the EEA, except where required by EU or Member State law (in which case SmartMailing informs the Customer in advance unless prohibited from doing so).
- Inform the Customer without delay if, in SmartMailing's opinion, an instruction infringes the GDPR or other EU or Member State data-protection law.
- Ensure persons authorized to process the data are bound by confidentiality.
- Implement appropriate technical and organizational measures (see Section 7).
- Assist the Customer in responding to data-subject requests (Articles 15-22 GDPR) using built-in features and, where needed, technical support.
- Assist the Customer in complying with Articles 32-36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing and the information available to SmartMailing.
- At the Customer's choice, delete or return all Customer Personal Data after the end of the Service (see Section 11).
- Make available all information necessary to demonstrate compliance with Article 28 GDPR.
5. Sub-processors
The Customer authorizes SmartMailing to engage sub-processors to provide the Service. The current list (with location and transfer mechanism) is maintained in the SmartMailing Privacy Policy, Section 3.
SmartMailing will give the Customer at least 14 days' advance notice (by email or in-app notification) before adding or replacing a sub-processor that processes Customer Personal Data. If the Customer objects on reasonable data-protection grounds, the Customer may terminate the affected portion of the Service.
Each sub-processor is bound by data-protection obligations no less protective than those set out in this DPA, by written contract or by reference to applicable framework agreements (e.g. Supabase DPA, Resend DPA, OpenAI Enterprise DPA, Stripe DPA).
Optional sub-processors (currently Telegram for reply notifications and OpenAI for AI-drafted replies and content) process Customer Personal Data only for the features the Customer switches on, and the Customer can stop that processing at any time by disabling the feature. Canva is not a sub-processor of Customer Personal Data: it only receives the Customer's own designs.
6. International data transfers
Customer Personal Data is stored and processed primarily within the EU/EEA and Switzerland: the application servers run in Frankfurt (Vercel), and production email delivery via Amazon SES (EU) and the brand-extraction worker via Hostinger (EU) are in the EEA, while the database is hosted by Supabase in Switzerland, which is covered by an EU adequacy decision (so no SCCs are required for it). Where data is transferred to processors outside the EEA without an adequacy decision (notably the United States via OpenAI, Stripe, Cloudflare, Vercel (support access and edge delivery), and Resend, which sends SmartMailing's own emails, reviewer sign-in codes and test sends), SmartMailing relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) supplemented by technical and organizational safeguards (TLS in transit, encryption at rest, access controls, webhooks verified by signature or secret).
7. Security measures
SmartMailing implements and maintains the following technical and organizational measures:
- TLS 1.2 or higher for all connections to the Service and between our services; email delivered to recipients' mail servers uses TLS whenever the receiving server supports it
- Encryption at rest by our hosting providers (database, backups and file storage)
- Separation between customers in one shared database by two layers: row-level security (RLS) for all access from the customer dashboard, and ownership checks in SmartMailing's server code wherever its servers use the privileged database key, which is never exposed to browsers
- Passwords stored only as hashes (bcrypt, managed by Supabase Auth); optional two-factor sign-in for every account
- Inbound webhooks verified by signature or by a shared secret
- API keys stored only as SHA-256 hashes; plaintext shown to the customer once at creation
- Records of consent, opt-outs, suppressions and GDPR erasures, kept as described in Section 11; delivery events received from the email provider are kept for 90 days
- Each account has a single owner (no shared team roles yet); the privileged database key is used only by SmartMailing's server-side code and background workers and is never exposed to browsers
- Rate limiting and abuse prevention on public endpoints
- Security updates for dependencies applied when vulnerabilities become known
- Two-factor sign-in for SmartMailing administrative access; administrative changes to customer accounts (approvals, pauses, deletions, limit changes, two-factor resets) are logged; staff viewing of data is not logged individually
- Automatic retention clean-up jobs (hourly) enforcing the periods in Section 11 and in the Privacy Policy
Detailed security descriptions are reviewed at least annually and updated as the Service evolves.
Public file hosting. Images and files uploaded for use in emails, signatures and hosted pages are stored in a file bucket that serves them from public, unauthenticated links, because email clients must be able to load them. This storage is not intended for Customer Personal Data and the Customer must not store personal data in uploaded files. Customer Personal Data itself (subscribers, consent records, engagement events, replies) is held only in the access-controlled database described above.
8. Personal-data breach notification
SmartMailing notifies the Customer without undue delay, and where feasible within 48 hours, of becoming aware of a personal-data breach affecting Customer Personal Data. The notification includes: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed, and contact details for further information.
The Customer is responsible for notifying its data subjects and the competent supervisory authority where required by Articles 33-34 GDPR; SmartMailing will provide reasonable assistance.
9. Assistance with data-subject requests
SmartMailing provides built-in features that let the Customer self-serve most data-subject requests:
- Access: the dashboard exposes each subscriber's data, consent records, list memberships, and engagement history
- Rectification: editable fields on each subscriber row
- Erasure: "GDPR Delete" button on each subscriber, which removes the subscriber together with their consent records, inbound replies and AI drafts, form registrations and the address in the send history, and writes a do-not-contact entry; a minimal pseudonymised consent proof is kept for 3 years (Section 11)
- Restriction of processing: manual suppression with note
- Portability: export of a single subscriber and of the whole account (the file lists what it contains)
- Object: every email contains a one-click unsubscribe link, and the preference center allows granular opt-outs
Where a request cannot be self-served, SmartMailing assists the Customer at no additional charge for reasonable volumes.
10. Audit rights
Once per calendar year, and at the Customer's expense, the Customer may audit SmartMailing's compliance with this DPA by requesting a written self-attestation accompanied by relevant documentation (privacy policy, security overview, sub-processor list, breach history). If the self-attestation does not suffice, the Customer may, with 30 days' notice and at its own expense, have SmartMailing's compliance audited by an independent auditor bound by confidentiality, during business hours and without access to other customers' data; if the Customer's own regulator demands an audit, SmartMailing will cooperate.
11. Termination: return and deletion
Upon termination of the Service or at the Customer's written request, SmartMailing will:
- Let the Customer export Customer Personal Data (JSON format) at any time before deleting its account; when the Customer deletes its account, delete Customer Personal Data at once (a step that fails is completed within 30 days); when SmartMailing ends the Service, keep the data available for export for 30 days and then delete it within 14 days
- Keep, after deletion, only what the law or this DPA requires: billing records (Austrian §132 BAO, 7 years) and, for 3 years, a minimal pseudonymised proof of consent and opt-outs per address (a one-way hashed address, dates, consent wording and source; no IP address), so that the Customer can evidence consent in a dispute; the suppression list itself is deleted with the brand or the account
- Confirm deletion in writing on Customer request
- Independently of termination: per-message engagement events are deleted 90 days after sending (30 days for transactional email), inbound replies after 12 months, and sign-ups never confirmed by double opt-in after 30 days
Database backups containing Customer Personal Data are kept by Supabase for 7 days and then overwritten, so deleted data can remain in a backup for up to 7 days.
12. Liability
Each party's liability under this DPA is limited as set out in the Terms of Service. Nothing in this DPA limits either party's liability for damages arising from breach of its data-protection obligations to the extent prohibited by law.
13. Governing law and forum
This DPA is governed by Austrian law, excluding conflict-of-laws rules. The competent forum is the courts of Vienna, Austria, to the extent permitted by law.
14. Contact
For data-protection inquiries under this DPA, contact [email protected]. On request, SmartMailing provides a signed copy of this DPA.