Annex A – Data Processing Agreement (DPA)

Octotech Solutions, with registered office at Via E. Dandolo, 29 – 76123 Andria (BT), Italy, VAT IT07964530724, operating under the MailSenpai brand, represented by its legal representative pro tempore (“MailSenpai” or “Processor”), and the Client, represented by its legal representative pro tempore (“Controller” or “Client”), have entered into a licence agreement for a “Software as a Service” for sending marketing and transactional communications and for the provision of the Processor’s Services, which involves the processing of personal data (the “Agreement”).

This data processing agreement (including its appendices, the “Data Processing Agreement”) contains the provisions of art. 28 GDPR as interpreted by the European Data Protection Board in Opinion 14/2019.

The Data Processing Agreement is concluded between MailSenpai and the Client and supplements the Agreement. It takes effect, and replaces any other agreement between the parties previously applicable to the same subject matter (including any amendment or addendum on data processing relating to the Processor’s Services), from the Effective Date and for the whole Term.

If you are signing this Data Processing Agreement on behalf of the Client, you warrant that: (a) you have the authority to bind the Client to this Data Processing Agreement; and (b) you are signing it on behalf of the Client. If you do not have such authority, please do not sign it and forward it to the appropriate person.

1. Introduction

This Data Processing Agreement (DPA) reflects the parties’ agreement on the processing of Client Personal Data as governed by European and national legislation.

2. Definitions

2.1 In this Data Processing Agreement, capitalised terms have the following meanings:

Anonymous Count – counting opens with a tracking image that is the same for all recipients of the same campaign, without recording the IP address, device data or subscriber identifiers.

Client Personal Data – the Client’s personal data processed by MailSenpai in providing the Processor’s Services.

Effective Date – the date on which MailSenpai signed, or the parties otherwise agreed the effectiveness of, the Agreement or the Data Processing Agreement.

European and National Legislation – the GDPR and the legislation of the EU Member State applicable to the processing of Client Personal Data.

Additional Instructions – additional instructions reflecting the parties’ agreement on further conditions governing the processing of certain data in relation to specific Processor’s Services.

EEA – the European Economic Area.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

Incident – a breach of MailSenpai’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data on systems managed or otherwise controlled by MailSenpai.

MailSenpai – the party to the Agreement that provides the service.

Notification Email Address – the address entered by the Client in the dedicated privacy contact section of its account, as provided in section 5.3.

Preferences Page – the page reached through the “Tracking preferences” link in every message, where the data subject chooses to receive messages without open tracking, to turn it back on, or to unsubscribe.

Processor’s Services – the services provided under the Agreement and described as a whole in Appendix 1.

Security Documentation – the documentation that MailSenpai makes available in relation to the Processor’s Services and referred to in Appendix 2.

Security Measures – the measures described in section 7.1.1 (Security Measures on MailSenpai’s systems).

Sub-processors – third parties authorised under this Data Processing Agreement to process Client Personal Data in order to provide part of the Processor’s Services and/or any related technical support.

Supervisory Authority – a “supervisory authority” as defined in the GDPR.

Term – the period from the Effective Date until the end of the provision of the Processor’s Services by MailSenpai under the Agreement.

Tracking Data – Client Personal Data generated when messages are opened and links are clicked: date and time, IP address, user agent (email program, browser, device), approximate location derived from the IP address, subscriber and campaign identifiers.

Tracking Rule – the setting chosen by the Client for each list among “automatic”, “consent only” and “never”.

Transfer Mechanisms – a binding decision of the European Commission allowing the transfer of personal data from the EEA to a third country whose legal system provides an adequate level of data protection. Where such a decision does not exist or is not effective, the Standard Contractual Clauses approved from time to time by the European Commission and binding corporate rules (BCRs).

2.2 The terms “Personal Data”, “Data Subject”, “Processor”, “Controller” and “Processing” have the meaning given in the GDPR.

2.3 The terms “include” and “including” are illustrative and are not the only examples of a particular concept.

2.4 Any reference to a law, regulation, statute or other legislative act is a reference to it as amended or re-enacted from time to time.

2.5 This English version is a translation. In case of any discrepancy between the Italian text and this translation, the Italian text prevails.

3. Term

This Data Processing Agreement remains in effect for the whole Term and until the Processor has deleted all Client Personal Data.

4. Scope

4.1 Processor’s Services covered. This Data Processing Agreement applies only to the services for which the parties have agreed its application, i.e. the services indicated in the Agreement.

4.2 Additional Instructions. During the Term the Controller may give MailSenpai Additional Instructions, which MailSenpai may not unreasonably refuse if they are necessary to enable the Controller to comply with any obligation under European and National Legislation. In all other cases MailSenpai may negotiate the content of the Additional Instructions with the Controller and is not required to implement them until agreement is reached. Once confirmed by both parties, Additional Instructions form an integral part of this Data Processing Agreement.

4.3 Costs of Additional Instructions. Additional Instructions and/or their supplementation, amendment or reduction must not entail additional costs for MailSenpai; otherwise the Controller acknowledges and agrees that all costs arising, directly or indirectly, from MailSenpai’s adaptation to the Additional Instructions are borne exclusively by the Controller.

5. Processing of data

5.1 Roles, responsibilities and instructions

5.1.1 The parties acknowledge and agree that: (a) Appendix 1 describes the subject matter and details of the processing of Client Personal Data; (b) MailSenpai acts as Processor of Client Personal Data under European and National Legislation; (c) the Client acts as Controller or Processor, as the case may be, of Client Personal Data under European and National Legislation; and (d) each party will comply with the obligations applicable to it under European and National Legislation regarding the processing of Client Personal Data.

5.1.2 Authorisation by a third-party Controller. If the Client acts as Processor on behalf of a Client affiliate or another Controller, the Client warrants to MailSenpai that its instructions and actions regarding Client Personal Data, including the appointment of MailSenpai, have been authorised by the relevant Controller.

5.2 Controller’s instructions. By this Data Processing Agreement the Controller instructs MailSenpai to process Client Personal Data: (a) only in accordance with applicable law; (b) only to provide the Processor’s Services and any related technical support; (c) as further specified by the Client through its use of the Processor’s Services (including changes to settings and/or features of the Processor’s Services) and any related technical support; (d) as documented in the Agreement, including this Data Processing Agreement; (e) in order to ensure a level of security appropriate to the risk, to run automatic screening against predefined control lists, using automated systems able to detect contacts acquired or kept in breach of industry best practices, to detect abuse and to unsubscribe such contacts automatically; (f) for open tracking: to apply the Tracking Rule chosen by the Client for each list; to use the individual tracking image only for subscribers covered by it; to use only the Anonymous Count for the others; to include in every message the link to the Preferences Page and apply the data subject’s choice to all of the Client’s lists; to record consent, withdrawal and reactivation with date, time and source of the choice; (g) to delete Tracking Data 12 (twelve) months after the date of the event, as provided in section 6.1.3; and (h) as further documented in any written instruction given by the Controller to MailSenpai as an additional instruction for the purposes of this Data Processing Agreement.

5.3 MailSenpai’s compliance with instructions. MailSenpai will follow the instructions in section 5.2 unless the European or national legislation to which it is subject requires it to carry out different or additional processing of Client Personal Data (e.g. a transfer of personal data to a third country or an international organisation), in which case MailSenpai will promptly inform the Client at the Notification Email Address (unless such legislation prohibits MailSenpai from doing so on important grounds of public interest).

5.4 Open and click tracking

5.4.1 The Client decides whether to enable tracking and chooses the Tracking Rule for each list. The Client is responsible for informing data subjects, for collecting consent where required and for setting the TRACKING field correctly when importing data or adding it via API.

5.4.2 Clicks on links are recorded individually when the Client keeps link tracking active; the choice made on the Preferences Page concerns opens only.

5.4.3 The data subject’s choice applies to all of the Client’s lists and is not communicated to, or applied for, other MailSenpai clients.

6. Data deletion and export

6.1 Deletion and export during the Term

6.1.1 Processor’s Services with export features. To the extent that the Processor’s Services allow the Controller to export Client Personal Data itself in an interoperable format, MailSenpai undertakes, as far as possible, to ensure that this is available for the whole Term, subject to any further specific provisions of the Agreement. For Tracking Data, export concerns data not yet deleted under section 6.1.3.

6.1.2 Processor’s Services with deletion features. To the extent that the Processor’s Services allow the Client to delete Client Personal Data itself, MailSenpai undertakes, as far as possible, to ensure that such deletion is available for the whole Term, unless European and National Legislation requires longer retention. In that case MailSenpai will process Client Personal Data only for the purposes and periods defined by such legislation. Any further specific provisions of the Agreement remain applicable.

6.1.3 Retention of Tracking Data. Tracking Data are kept for 12 (twelve) months from the date of the event and then deleted automatically. Before deletion the Client may export Tracking Data using the features of the Processor’s Services. For data collected before this section comes into force, MailSenpai will notify the date of the first deletion to the Notification Email Address at least 30 (thirty) days in advance; that date will in any case not be earlier than 1 December 2026. The Client may delete Tracking Data earlier.

6.2 Deletion at the end of the Term. At the end of the Term, the Client instructs MailSenpai to delete all Client Personal Data (including existing copies) from MailSenpai’s systems in accordance with applicable law. MailSenpai will carry out this instruction as soon as reasonably possible, unless European and National Legislation requires retention as provided in section 6.3.

6.3 How Client data is deleted. After 10 (ten) days from the expiry or termination of the Agreement for any reason, MailSenpai may delete the data stored on behalf of the Client on the MailSenpai platform, including any remaining credits as specified in the Agreement. Until then the Client can freely view and download such data using the standard features of the MailSenpai Platform. If access to the MailSenpai platform is suspended for administrative irregularities, the Client may access it only after removing the cause of the suspension. Without prejudice to this right of deletion, longer retention may be required for reasons other than those in this Agreement, in particular in case of investigations by the judicial police or bodies in charge of inspections.

7. Data security

7.1 Security Measures and assistance by MailSenpai

7.1.1 Security Measures on MailSenpai’s systems. MailSenpai will implement and maintain technical and organisational measures to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Appendix 2. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing carried out with the Processor’s Services, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Appendix 2 must at all times include security measures designed to: (a) encrypt personal data; (b) help ensure the ongoing confidentiality, integrity, availability and resilience of MailSenpai’s systems and services; (c) help restore personal data promptly after an incident; and (d) regularly test their effectiveness. MailSenpai may update or change the Security Measures provided that such updates and changes do not degrade the overall security of the Processor’s Services.

7.1.2 Security Measures for MailSenpai personnel. MailSenpai will take appropriate steps to ensure compliance with the Security Measures by everyone acting under its authority, including its employees, agents, contractors and Sub-processors to the extent applicable to the services they actually perform, including ensuring that all persons authorised to process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality under European and National Legislation. MailSenpai will also fulfil all obligations relating to the appointment of its staff in charge of managing and maintaining the Processor’s Services as system administrators, in accordance with the Supervisory Authority’s decision of 27 November 2008.

7.1.3 MailSenpai’s assistance on data security. MailSenpai will assist the Controller in ensuring compliance with any Controller obligations regarding the security of personal data and personal data breaches, including (where applicable) the Controller’s obligations under articles 32 to 34 GDPR, by:

(a) implementing and maintaining the Security Measures in accordance with section 7.1.1;

(b) implementing section 7.2 (Data incidents); and

(c) providing the Controller with the Security Documentation in accordance with section 7.5.1 and the information contained in this Data Processing Agreement.

7.2 Data incidents

7.2.1 Professional diligence. MailSenpai applies professional diligence in monitoring the security of Client Personal Data processed in providing the Processor’s Services.

7.2.2 Incident notification. If MailSenpai becomes aware of an Incident, MailSenpai will: (a) inform the Controller promptly and without undue delay; (b) promptly take reasonable steps to minimise harm and protect Client Personal Data; and (c) cooperate with the Controller to investigate the causes and severity of the Incident.

7.2.3 Incident details. Notifications under section 7.2.2 will describe, to the extent known to MailSenpai (including through follow-up notifications), the details of the Incident, including the categories and approximate number of data subjects and personal data records concerned, the likely risks for data subjects and the measures MailSenpai has taken or recommends the Controller to take to address the Incident and mitigate its effects. If it is not possible to provide such information within the required time, MailSenpai will tell the Controller the reasons for the delay and will in any case provide initial information on the breach that is useful for the Controller’s notification.

7.2.4 Delivery of notification. MailSenpai will send notification of any Incident to the Notification Email Address.

7.3 Client’s responsibility and security assessment

7.3.1 Controller’s security responsibilities. Without prejudice to MailSenpai’s obligations under sections 7.1 and 7.2, the Controller agrees that it is solely responsible for its use of the Processor’s Services, including protecting account authentication credentials and the systems and devices it uses to access the Processor’s Services.

7.4 Security certification. To assess and help ensure the continued effectiveness of the Security Measures, MailSenpai may, at its sole discretion, supplement the Security Measures and Security Documentation with certifications, codes of conduct and/or certification mechanisms.

7.5 Reviews and audits

7.5.1 Review of Security Documentation. To demonstrate MailSenpai’s compliance with its obligations under this Data Processing Agreement, MailSenpai will make available to the Client information on the technical, organisational and security measures adopted, as well as any available Security Documentation, that is actually necessary for the Client’s regulatory compliance and that the Client formally requests in writing in order to meet its legal obligations and demonstrate the adoption of appropriate technical and organisational measures.

7.5.2 Client’s audit right. The parties agree that:

(a) MailSenpai will also contribute to inspections and audits that the Client wishes to carry out, directly or through another party it appoints;

(b) such activities must be carried out without disrupting MailSenpai’s normal operations;

(c) the use of information that the Controller and any party it appoints learn during the audit must first be governed by a specific confidentiality agreement.

7.5.3 Additional audit conditions. For audits:

(a) the Controller will send MailSenpai the audit request under section 7.5.2(a) as described in section 12.1 (MailSenpai contacts), with at least 30 (thirty) business days’ notice, provided that audits may not take place more than once a year and, in any case, not before 12 (twelve) months have passed since the last audit carried out or commissioned by the Controller;

(b) after receipt of a request under section 7.5.3(a), MailSenpai and the Controller will discuss and agree in advance the start date, scope and duration of, and the security and confidentiality controls applicable to, any audit under section 7.5.2(a);

(c) nothing in this Data Processing Agreement requires MailSenpai or its affiliates to disclose or give the Controller or a third-party auditor access to:

(i) data of any other MailSenpai client;

(ii) MailSenpai’s internal accounting or financial information;

(iii) MailSenpai’s trade secrets and know-how;

(iv) any information that could compromise the security of MailSenpai’s systems or premises, or cause MailSenpai to breach its obligations under European and National Legislation or its security obligations to the Controller or third parties; or

(v) any information that the Controller or third-party auditor seeks to access for reasons other than the good-faith fulfilment of the Controller’s obligations under European and National Legislation;

(d) audits are subject to a specific confidentiality agreement between all parties involved.

7.5.4 The Controller acknowledges and agrees that all costs of audits under this section 7.5 (for example the costs of its own employees and any consultants) are borne exclusively by the Controller.

8. Data protection impact assessments and prior consultation

MailSenpai agrees (taking into account the nature of the processing and the information available to it) to provide reasonable assistance to the Controller in complying with any Controller obligations regarding data protection impact assessments and prior consultation, including the Controller’s obligations under articles 35 and 36 GDPR.

9. Data subjects’ rights

9.1 Responses to data subject requests. MailSenpai ensures appropriate protection of data subjects’ rights by supporting the Client in responding to data subject requests, including requests received by MailSenpai. In that case MailSenpai will tell the data subject to address the request directly to the Controller. The Controller is in any case solely responsible for responding to the data subject’s request.

9.2 MailSenpai’s assistance with data subject requests. MailSenpai agrees (taking into account the nature of the processing of Client Personal Data) to provide reasonable assistance to the Controller in meeting its obligations regarding requests to exercise data subject rights under Chapter III GDPR by: (a) where possible, making specific features available in the Processor’s Services; (b) complying with section 9.1.

9.3 Tools for data subjects’ choices. The Processor’s Services provide the Preferences Page and the unsubscribe link in every message. Data subjects’ choices are applied automatically and remain visible to the Client.

10. Data transfers

10.1 Data storage and processing facilities. The Controller agrees and authorises MailSenpai to process (including through Sub-processors) Client Personal Data inside and outside the EEA provided that such processing is supported by appropriate Transfer Mechanisms, to be indicated in Appendix 3.

11. Sub-processors

11.1 Authorisation to engage Sub-processors. The Controller grants general authorisation to engage Sub-processors to provide the Processor’s Services.

11.2 Information on Sub-processors. MailSenpai agrees to list the up-to-date Sub-processors and related information in Appendix 3 to this Data Processing Agreement.

11.3 Requirements for engaging Sub-processors. When engaging a Sub-processor, MailSenpai:

(a) will ensure, through a written contract or another binding legal act, that:

(i) the Sub-processor accesses and uses Client Personal Data only to the extent necessary to perform the obligations subcontracted to it, in accordance with the Agreement (including this Data Processing Agreement) and with the Transfer Mechanisms;

(ii) data protection obligations equivalent to those in article 28(3) GDPR are imposed on the Sub-processor;

(b) remains fully responsible for all obligations subcontracted to the Sub-processor.

11.4 Right to object to changes of Sub-processors. The parties agree that:

(a) during the Term, MailSenpai will notify the Notification Email Address of its intention to engage new Sub-processors to process Client Personal Data. The notice will include the name, activity, country of establishment of the Sub-processors and the Transfer Mechanism where applicable;

(b) if the Controller considers, with reasons and supporting documents, that the Sub-processor is not suitable to process Client Personal Data, it may object to its engagement by informing MailSenpai within 10 days of the notice.

MailSenpai may, at its discretion, (i) not engage the Sub-processor to process Client Personal Data; or (ii) terminate the Agreement by notifying the Client within 30 days of the notice described in section 11.4(a), it being understood that the Client remains liable to pay the full fee due under the Agreement;

(c) if no objection is raised as described in section 11.4(b), MailSenpai will send the updated Appendix 3 to the Notification Email Address, and it will form an integral part of this Data Processing Agreement.

12. MailSenpai contacts

12.1 MailSenpai contacts. The Controller contacts MailSenpai about everything in this Data Processing Agreement, alternatively and in order, at the email/certified email (PEC) address: a) indicated by MailSenpai in the Agreement; b) used by MailSenpai while providing the Processor’s Services to receive certain Controller notifications relating to this Data Processing Agreement. Written notices may also be sent by post to MailSenpai’s registered office: Via E. Dandolo, 29 – 76123 Andria (BT), Italy.

13. Conflicts

13.1 Conflicts between the parties’ agreements. In case of conflict or inconsistency between the Agreement, the Data Processing Agreement and the Additional Instructions, unless otherwise stated in this Data Processing Agreement, the following order of precedence applies: (a) the Additional Instructions; (b) the remaining provisions of the Data Processing Agreement; and (c) the remaining provisions of the Agreement. Subject to any amendments to the Data Processing Agreement, the Agreement remains fully valid and effective.

13.2 Breaches of laws or regulations. Any provision of the Agreement, the Data Processing Agreement and/or the Additional Instructions that conflicts with European and National Legislation is deemed not written and fully replaced by the breached rule where that rule cannot be derogated from by agreement between the parties.

14. Jurisdiction

For disputes concerning the performance or interpretation of this Data Processing Agreement, the parties submit to the exclusive jurisdiction of the court provided for in the Agreement, expressly derogating from any different provision of laws or international conventions.

Appendix 1 – Processing: subject matter and details

Subject matter

Providing a platform that allows the user to manage marketing campaigns and online communications directly and independently, using the messaging channel as further defined in the Agreement.

Duration of processing

For the Term plus the following period until MailSenpai has deleted all Client Personal Data in accordance with the Data Processing Agreement and the Agreement.

Nature and purpose of processing

MailSenpai will process Client Personal Data to provide the Processor’s Services in accordance with the instructions in the Data Processing Agreement. Depending on the Processor’s Services chosen in the Agreement, Client Personal Data may include the personal data listed below.

Categories of data subjects

Recipients of communications sent by the Client through the Processor’s Services and subscribers to its lists.

People who fill in sign-up forms, preferences pages or unsubscribe pages hosted by the platform on behalf of the Client.

Personal data processed

Identification and contact data (e.g. first name, last name, email address, phone number, address) and other fields defined by the Client.

Subscription and consent data: date, source and IP address of the subscription, consent wording, tracking choices with date and time.

Tracking Data, when tracking is enabled: date and time of opens and clicks, IP address, user agent (email program, browser, device), approximate location (country and city) derived from the IP for clicks and unsubscribes, subscriber and campaign identifiers.

Technical delivery data: outcome, bounce reason, spam complaints.

Data that cannot be determined in advance, entered by the Client.

Retention of Tracking Data: 12 months from the date of the event (section 6.1.3). Other data: for the Term and as set out in section 6.

The parties may update the list of personal data processed in providing the Processor’s Services from time to time.

Appendix 2 – Security measures

From the Effective Date, MailSenpai implements and maintains the Security Measures described at the following link: Infrastructure and security.

For open and click tracking MailSenpai applies in particular: Anonymous Count without recording the IP address or device data; automatic deletion of Tracking Data after 12 months; access to data limited to authorised staff; encrypted connections.

MailSenpai may periodically change or update these Security Measures, provided that such changes and updates do not degrade the overall security of the Processor’s Services or otherwise reduce the agreed level of security.

Appendix 3 – Sub-processors

Sub-processors carry out part of the activities that allow MailSenpai to provide the Processor’s Services:

Cloudflare

Processor’s Services concerned or description of subcontracted activity: network support services and storage of images uploaded by clients, including CDN (Content Delivery Network) and web proxy services

Place of establishment: European Union

Transfer mechanism (where applicable): N/A

Aruba

Processor’s Services concerned or description of subcontracted activity: provision of servers on which the Processor’s Services are based

Place of establishment: European Union

Transfer mechanism (where applicable): N/A

Hetzner

Processor’s Services concerned or description of subcontracted activity: provision of servers on which the Processor’s Services are based

Place of establishment: European Union

Transfer mechanism (where applicable): N/A

Register

Processor’s Services concerned or description of subcontracted activity: provision of servers on which the Processor’s Services are based

Place of establishment: European Union

Transfer mechanism (where applicable): N/A