Data Processing Agreement (DPA)

The “Customer”, as controller, is the individual or legal entity identified in the customer contract record in Annex 1. Anyone binding the Customer must have the necessary authority.

The “Provider”, as processor, is MIKE MC FORMATIONS LLC, operator of AgentsMail.io, 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA. Its authorised representative is identified in the applicable contract record. Data protection and incident contact: support@agentsmail.io.

This agreement (“DPA”) supplements the AgentsMail.io service contract identified in Annex 1 (“Main Agreement”). It applies exclusively to personal data processed by the Provider on the Customer’s behalf under that agreement (“Customer Data”). “Processing”, “personal data breach” and “data subject” have their GDPR meanings.

The Customer determines the purposes and essential means. The Provider acts on its behalf for contacts, imports, campaigns, email delivery and statistics only to the extent those features are actually provided and configured. Annex 1 specifies the subject matter, nature, purposes, duration, data and data subjects.

Processing for which the Provider determines its own purposes, including its billing or legal obligations, is identified separately in appropriate information. This does not authorise reuse of the Customer’s lists, content or statistics for the Provider’s campaigns, their sale or disclosure for independent use.

The Provider processes Customer Data only on documented Customer instructions, including for international transfers. This DPA, agreed annexes, service settings and written requests from authorised persons constitute instructions within the Main Agreement’s scope. A new instruction changing the scope requires prior written agreement on implementation.

If processing is required by Union or Member State law binding the Provider, it informs the Customer before processing unless that law prohibits disclosure on important public-interest grounds. Requests under third-country law are assessed under the GDPR, including Article 48, and the applicable transfer mechanism; they do not by themselves constitute Customer instructions.

The Provider immediately informs the Customer if an instruction appears to infringe the GDPR or other Union or Member State data-protection rules. It suspends that instruction pending clarification without unnecessarily suspending lawful processing. It does not determine new purposes in the Customer’s place.

The Customer establishes a valid legal basis, provides required information, minimises data, maintains accuracy and defines appropriate retention periods. It ensures instructions and imported or sent content are lawful and arranges handling of rights requests and objections.

This DPA is neither marketing consent nor approval of a contact list. Being a former student or customer does not by itself authorise every commercial email. Before a campaign, the Customer checks applicable rules, evidence of consent or all conditions of the existing-customer exception. It respects unsubscribes, objections, exclusions and retention limits and does not reimport excluded contacts to circumvent their choices.

The Customer assesses the Provider’s safeguards before entrusting data. This allocation of tasks does not reduce the Provider’s own GDPR obligations.

The Provider limits access to persons who need it for authorised operations and ensures they are bound by suitable contractual or statutory confidentiality obligations and know the instructions and their duties. Confidentiality continues after their involvement ends.

The Provider implements and maintains technical and organisational measures appropriate to risk under GDPR Article 32. As appropriate, these cover confidentiality, integrity, availability, resilience, restoration and regular evaluation of effectiveness. Annex 2 describes service mechanisms and responsibilities; specific measures and evidence of controls are recorded in the security record agreed by the parties.

Specific encryption, backup, restoration and availability commitments are those in the applicable contractual security record. They do not reduce the Provider’s statutory duty to provide appropriate security. Material changes are documented and must not reduce the agreed level of protection.

The Customer gives general written authorisation for the subprocessors named in the applicable contractual Annex 3. Authorisation covers the agreed entities and processing, not every available integration indiscriminately.

Before adding or replacing a subprocessor, the Provider gives written notice of the entity, role, data, processing and access countries, safeguards and intended date. It allows reasonable advance notice enabling an effective objection, as specified in the contract record before the change takes effect. The Customer may object on documented data-protection grounds.

The parties seek a suitable solution: additional safeguards, an alternative provider or no use for the affected data. The new provider does not receive those data while the objection remains unresolved. If no solution is found, the Customer may terminate the affected service and request return or deletion under Article 10. Financial consequences follow the Main Agreement without defeating mandatory rights.

The Provider checks sufficient guarantees and imposes in writing the relevant equivalent data-protection obligations, including security and assistance. It remains fully responsible to the Customer for subprocessor performance. It supplies relevant contractual information with only strictly necessary redaction of information unrelated to the review.

Taking account of the nature of processing, the Provider assists through appropriate technical and organisational measures, insofar as possible, with information, access, rectification, erasure, restriction, portability, objection and applicable automated-decision requests.

It forwards requests received directly concerning Customer Data to the Annex 1 contact without undue delay and does not answer their substance unless instructed or legally required. It preserves useful evidence, helps locate data and performs lawful requested actions. The Customer leads identity checks, decisions and replies within statutory deadlines.

Taking account of the processing and information available, the Provider assists with GDPR Articles 32–36: security, breaches, impact assessments and prior consultation. It supplies useful documentation and technical information. Practical arrangements or assistance fees may be agreed in the Main Agreement but must not obstruct a legal duty, urgent action or effective exercise of rights.

The Provider notifies the Customer of a breach affecting Customer Data without undue delay after becoming aware of it. It does not wait for the investigation to finish before initial notification. Contacts and operational escalation arrangements are those in the contractual security record; an agreed period does not permit unjustified delay.

As information becomes available, notification includes the incident’s nature, approximate categories and numbers of affected people and records, follow-up contact, likely consequences and measures taken or proposed to remedy and mitigate it. Further information is supplied progressively without undue delay.

The Provider contains the incident, preserves necessary evidence, documents facts and cooperates in analysis and remediation. The Customer decides notifications to authorities and data subjects under its legal obligations. The Provider makes them on the Customer’s behalf only on instruction, unless independently required by law.

The Provider supplies information needed to demonstrate compliance with GDPR Article 28 and this DPA. It allows and contributes to audits, including inspections, by the Customer or its mandated independent auditor.

The parties reasonably organise scope, confidentiality, access and timing to protect other customers and service security. Recent documents may be a first step but do not replace a necessary inspection. No frequency limit, notice period or fee may prevent a review justified by an incident, serious compliance concern or authority request. The Provider remedies non-compliance for which it is responsible and documents agreed action.

Each party keeps records and cooperates with competent authorities to the extent required by the rules applicable to it.

Annex 3 and contractual transfer records identify hosting, backup and remote-access countries, including those of the US operator and support teams where relevant. Choosing a European provider region alone does not establish that no transfer occurs outside the European Economic Area (“EEA”).

The Provider makes transfers subject to GDPR Chapter V only on documented Customer instructions and after identifying a valid mechanism for the flow. Annex 3 specifies exporters, importers, countries, data, access, transfer basis and necessary checks.

An adequacy decision may be relied on only when it actually covers the recipient entity and processing. Data Privacy Framework participation is not presumed. Where Article 46 safeguards are needed, the parties establish the appropriate instrument, transfer assessment and necessary supplementary measures before transfer.

Decision (EU) 2021/914 standard clauses are not automatically incorporated by this DPA. Their scope, including GDPR Article 3 as it applies to the importer’s processing, and the relevant module, options and annexes are determined for the flow concerned. Another valid mechanism is used where those clauses do not apply.

The Provider reports without undue delay if it can no longer comply with applicable safeguards and suspends the affected flow until resolved. Subject to legal prohibitions, it informs the Customer of authority access requests, assesses their lawfulness and limits disclosure to what is legally required.

The DPA takes effect on its last valid acceptance with the applicable contractual annexes. It applies throughout processing for the Customer and until full return or deletion under this article. It does not retroactively legalise previous unlawful processing or transfers.

At the end of services, at the Customer’s documented choice, the Provider returns Customer Data in an agreed format then deletes remaining copies, or deletes them directly, unless Union or Member State law requires retention. Arrangements and periods, including for backups and subprocessors, are set in Annex 1. It confirms completion in writing on request.

Pending deletion, retained data remains protected, isolated from ordinary use and not reused. If a backup is restored, applicable deletion and objection instructions are reapplied. Exceptional legal retention is limited to the required data, purpose and period and communicated to the Customer unless legally prohibited.

Where provisions conflict concerning Customer Data protection, this DPA prevails over the Main Agreement. Mandatory GDPR provisions and, where applicable, validly concluded transfer clauses prevail over incompatible terms.

The Main Agreement’s governing law, jurisdiction and liability terms apply only insofar as compatible with individuals’ mandatory rights, authorities’ powers and the parties’ legal duties. No contractual cap reduces data subjects’ rights or a supervisory authority’s powers.

Material changes to this DPA or its annexes are documented and validly accepted; Article 5 governs subprocessor changes. Invalidity of one provision does not affect others insofar as they can lawfully remain in force.

The reference contractual document is the AgentsMail.io DPA, version 1.0 dated 12 October 2026, with Annexes 1–3 and, where necessary, the separate transfer instrument identified in the contract record.

For each Customer, the contract record and acceptance evidence identify the parties, authorised signatories and capacities, Main Agreement, annex versions, actual acceptance date and corresponding signature or electronic act. These details belong to the individual contractual relationship and are not published on this general page.

The parties should retain the applicable version and acceptance evidence. The publication date above does not replace the individual acceptance date. Merely viewing this page, creating an account or selecting a plan does not by itself demonstrate acceptance of this DPA. Copies of applicable documents may be requested from support@agentsmail.io.

The Customer’s contract record identifies its name or legal identity, address, authorised representative, instruction, rights and incident contacts, AgentsMail organisation and Main Agreement. It specifies authorised features and campaigns, purposes and service duration.

Subject matter and operations: contact management and email delivery through selected features; import, recording, organisation, storage, consultation, selection, updating, delivery, handling of unsubscribes and delivery incidents, authorised statistics, export and deletion. Open or click tracking requires suitable instructions and a lawful basis; concluding this DPA alone does not authorise it.

Data subjects: prospects, subscribers, customers and other contacts lawfully held by the Customer, and authorised organisation members. Particular categories, including minors where relevant, and necessary precautions are specified in the customer record.

Data: first and last names, email addresses, lists, tags and relevant Customer-supplied attributes, source, consent or objection status and evidence, message content and delivery or interaction data needed for authorised features. Other fields and metadata are limited to the agreed scope.

Excluded data: GDPR Article 9 or 10 data, identity documents, medical information, detailed financial information or detailed educational records, unless specifically agreed in writing following risk and safeguard assessment.

The record specifies retention and its starting event for each category: contacts, campaigns and statistics, logs, minimal suppression list and backups. It specifies end-of-service choice, return format and channel, export and active-deletion periods, backup-deletion cycle and any legal exception, its purpose, access and duration. This general annex sets no uniform period or immediate erasure of all backups.

Access and separation: the service includes accounts, distinct organisations, roles and server-side authorisation checks, plus API/MCP access permissions. The Customer allocates member and agent access, protects credentials and revokes unnecessary access. The Provider controls its personnel’s access and confidentiality.

Data lifecycle: the service provides export and deletion mechanisms, unsubscribe and bounce/complaint management. The Customer defines instructions and supplies necessary information. Assistance and incident requests go to support@agentsmail.io and the Customer contact in the contract record.

The applicable security record describes each measure’s scope, responsible person, evidence reference and check date: administrative privileges and authentication; environment separation and secrets; protection in transit and storage; backup and restoration; logging and alerts; maintenance and vulnerabilities; rights and deletion propagation; incidents and escalation.

Specific restoration, retention, availability and notification objectives are those expressly agreed in that record. Necessary checks and corrections are documented. Article 4 applies independently of particular objectives; this annex does not attribute SOC 2 or another certification to AgentsMail.

Vercel hosts and runs the website: requests, IP addresses, logs and data processed by requested functions may be involved. Vercel Inc. publishes the address 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Delivery networks and access may be international.

Supabase provides the database and associated storage as used: relevant accounts, organisations, contacts, content, events and files. The operator identifies Ireland for the database; this region does not describe all support access and backups.

Amazon Web Services, through Amazon SES, delivers email: senders, recipients, content, metadata, bounces and complaints. The operator identifies Ireland for sending; other processing, logs and access require their own assessment.

The Subprocessors page describes other providers by function, including payment, orchestration, diagnostics, application emails and optional integrations. The contract record identifies entities actually used, addresses, roles, data, storage and access countries, retention, applicable DPAs and versions. A tool connected directly by the Customer is distinguished from a Provider-selected supplier.

Each transfer record specifies exporter and importer roles, countries and access, data and purposes, GDPR territorial scope, Chapter V mechanism and evidence, required assessment and supplementary measures, and validation date and owner. It separately covers the Customer–MIKE MC FORMATIONS LLC relationship and supplier flows. Article 9 applies before each relevant transfer.

• AgentsMail subprocessor list
• Vercel — DPA
• Supabase — DPA
• AWS — subprocessors