Data Processing Addendum

DRAFT. This document is not legal advice. It requires review by qualified counsel before publication.

Version 1.0 (draft), last updated July 29, 2026.

This Addendum is published for review. It has no effect until you accept the Terms of Service when creating an organization, with effect from the date of that acceptance, at which point it forms part of the Agreement. No separate signature is required.

This Data Processing Addendum (“DPA”, “Addendum”) forms part of the Terms of Service (“Terms”) between Mail Tactic Corporation, operating the Service under the mailkube name (“Mailkube”, “we”, “us”), and the customer that accepts the Terms (“Customer”, “you”). It governs the processing of personal data that Mailkube carries out on the Customer’s behalf when the Customer uses the Service.

1. Definitions

Capitalized terms not defined here have the meaning given in the Terms or in Applicable Data Protection Law.

Applicable Data Protection Law means all data protection and privacy laws that apply to the processing of personal data under this Addendum, including the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection, in each case as applicable.

Mailkube means Mail Tactic Corporation, a Delaware C Corporation (file no. 10537478), the entity identified in Exhibit B, operating the Service under the mailkube name.

Customer means the User (as defined in the Terms) and the organization on whose behalf the Terms are accepted.

Controller, Processor, Data Subject, Personal Data, Processing, and Personal Data Breach have the meanings given in the GDPR.

Sub-processor means any processor engaged by Mailkube to process Customer Personal Data on Mailkube’s behalf.

Customer Personal Data means the personal data described in Exhibit A that Mailkube processes as a processor on the Customer’s behalf.

Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission (Implementing Decision (EU) 2021/914), and any equivalent transfer mechanism under the UK GDPR or Swiss law where applicable.

Agreement means the Terms together with this Addendum.

2. Roles and Scope of Processing

Mailkube acts in two distinct roles:

• As processor of Customer Personal Data (the Customer’s audience and contact data, described in Exhibit A). The Customer is the controller of that data.
• As controller of account, billing, and usage data, as set out in Section 12 and governed by the Privacy Policy.

Mailkube processes Customer contact and audience data solely as a processor on the Customer’s documented instructions and for no independent purpose of its own.

The Customer’s complete documented instructions are: the Terms, this Addendum, and the Customer’s configured use of the Service. Any further instructions require agreement between the parties.

Customer obligations. The Customer warrants that it has a lawful basis and any consents required for the personal data it submits and for the engagement tracking it enables, that its instructions comply with Applicable Data Protection Law, and that it is responsible for the accuracy and lawfulness of the contact data it provides.

3. Processor Obligations

Mailkube will:

• Process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers of personal data to a third country, unless required to process by Union or Member State law to which Mailkube is subject. In that case, Mailkube will inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
• Ensure that all persons authorised to process Customer Personal Data, whether employees or contractors, are bound by written contractual confidentiality obligations or an appropriate statutory duty of confidentiality. Those obligations survive the end of their engagement.
• Immediately inform the Customer if, in Mailkube’s opinion, an instruction infringes Applicable Data Protection Law.
• Maintain records of the processing activities carried out on behalf of the Customer, as required by Article 30(2) GDPR.
• Assist the Customer, taking into account the nature of the processing and the information available to Mailkube, with data protection impact assessments and prior consultation with a supervisory authority (Articles 35 and 36 GDPR), bounded as described in Section 6.

4. Security

Mailkube implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. Exhibit C describes the measures in place as at the date of this Addendum. Mailkube may update those measures over time provided the level of protection is not degraded.

5. Sub-processors

The Customer gives Mailkube general authorisation to engage Sub-processors, subject to this Section.

Mailkube imposes on each Sub-processor data protection obligations that are equivalent to those set out in this Addendum, and Mailkube remains fully liable to the Customer for any failure by a Sub-processor to meet its obligations.

The current Sub-processors that process Customer Personal Data are:

• OVH (infrastructure hosting), European Union.
• Cloudflare acts as reverse proxy and TLS termination and CDN (including R2 object storage) and DNS, processing connection data (IP addresses, request metadata) in transit and storing content at rest; EU jurisdiction, US parent entity.
• Sentry (error monitoring), EU region, US parent entity.
• Atlassian (support ticketing via Jira), processing personal data contained in support requests raised through the Service, which may include Customer Personal Data; US parent entity.

The list in this Section is the authoritative current list of Sub-processors. A dedicated sub-processor page is forthcoming; once it is published, that page will hold the current list.

Mailkube will give notice of any intended addition or replacement of a Sub-processor by email to the Customer’s organization owners and admins at least 14 days before the change takes effect. The Customer may object in writing to privacy@mailkube.com within the notice period. If an objection is not resolved through good-faith discussion, the Customer may terminate the affected services or the Agreement before the new Sub-processor starts processing, with a pro-rata refund of any prepaid, unused fees. Continued use of the Service after the notice period is deemed approval of the change.

6. Assistance with Data Subject Rights

Mailkube provides, at no additional cost, self-service export tools within the Service, which the Customer may use to fulfil data-subject access and portability requests: exports of contacts, of suppression entries, and of per-recipient sending logs, each generated as CSV. Deletion and rectification requests are fulfilled by the Customer through the contact and suppression management dashboard and API; the applicable retention periods in Section 11 then apply.

Where the Customer requests assistance that the self-service tools do not provide, Mailkube provides reasonable cooperation, taking into account the nature of the processing and the information available to Mailkube, insofar as this is possible. Assistance that requires material or disproportionate effort may be provided against reasonable, cost-based compensation. A self-service export of all account data is not yet available; until it is, Mailkube commits to assist with such requests on the same basis.

Requests received directly. If Mailkube receives a request from a data subject that relates to Customer Personal Data, Mailkube will, to the extent legally permitted, promptly notify the Customer and forward the request. Mailkube will not respond to the request substantively itself unless the Customer instructs it to or the law requires it, and may direct the data subject to the Customer.

7. Personal Data Breach

Mailkube will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice is given by email to the Customer’s organization owners and admins, sent from privacy@mailkube.com.

The notice will describe, to the extent then known: the nature of the breach, including where possible the categories and approximate number of data subjects and of personal-data records concerned; the likely consequences of the breach; the measures taken or proposed to address it; and a contact point for more information (privacy@mailkube.com). Where the information cannot all be provided at once, it may be given in phases as it becomes available.

Mailkube provides this assistance taking into account the nature of the processing and the information available to Mailkube, insofar as this is possible.

8. International Transfers

Customer Personal Data is stored and processed in the European Union. Where a Sub-processor has a parent entity in the United States (Cloudflare, Sentry), transfers are governed by the Standard Contractual Clauses.

Government access. If Mailkube (including Mail Tactic Corporation itself) or a Sub-processor receives a legally binding request from a public authority for Customer Personal Data, Mailkube will, unless legally prohibited, notify the Customer, will challenge requests that are overbroad or unlawful where reasonably possible, and will disclose only the minimum required.

9. EU Representative (Article 27)

Mail Tactic Corporation has appointed the following representative in the European Union pursuant to Article 27 GDPR as the point of contact for data subjects and supervisory authorities on matters relating to the processing of personal data: Mr. Dimitri Bouazzi, C. Torroja, 5, 28904 Getafe, Madrid, Spain (also reachable via privacy@mailkube.com).

10. Audits

Mailkube will make available to the Customer all information necessary to demonstrate compliance with the obligations in this Addendum, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

Audits are conducted on at least 30 days’ prior written notice, no more than once in any 12-month period unless a Personal Data Breach has occurred or a supervisory authority requires it, subject to confidentiality obligations, and are satisfied in the first instance by Mailkube providing written information and documentation. Each party bears its own costs.

11. Deletion and Return on Termination

At the Customer’s choice, Mailkube returns or deletes Customer Personal Data at the end of the provision of the Service. Return is satisfied by the Customer retrieving its data through the self-service export tools, at no charge, during the applicable retention window described below, with assistance available under Section 6. Deletion then proceeds as set out below.

Personal data is erased from Mailkube’s production systems within the following periods:

• 90 days after organization deletion;
• 90 days after domain deletion;
• for a lapsed subscription, the period defined by the Customer’s plan, up to a maximum of 90 days (currently 45 days, and 45 days where the plan defines no period).

On a lapsed subscription, contacts, engagement and delivery logs, reports, audit data, and data belonging to domains that are no longer active are erased. Suppression entries attached to domains that remain configured are retained until the domain or the organization is deleted, because they are needed to honour prior bounces.

During the subscription term, engagement and delivery-log data and message metadata (including subject lines) are retained on a rolling analytics window defined by the Customer’s plan (currently between 1 and 12 months depending on plan, with a 12-month absolute maximum), and audit data is retained for the plan’s audit window. Data is deleted at the earlier of its rolling window or the applicable period above.

Statutory exception. Invoices and billing records (which include VAT and business-address information) are retained for the period required by tax law and are not erased under this Section.

12. Mailkube as Controller

For account, billing, and usage data, including the data of the Customer’s authorized and team users, Mailkube is an independent controller and not a joint controller with the Customer. That data is governed by the Privacy Policy rather than this Addendum.

13. Precedence and Liability

The Terms govern the relationship between the parties generally. In the event of a conflict concerning the processing of personal data, this Addendum prevails over the Terms. Where Standard Contractual Clauses are executed between the parties, those clauses prevail over both the Terms and this Addendum to the extent of any conflict.

Each party’s liability under this Addendum is subject to the limitations and exclusions of liability set out in the Terms, except where Applicable Data Protection Law does not permit such limitation.

14. Term, Survival, and Acceptance

This Addendum takes effect when the Customer accepts the Terms and remains in effect until Mailkube ceases to process Customer Personal Data, notwithstanding the expiry or termination of the Agreement. The obligations in this Addendum survive for as long as any Customer Personal Data is retained under Section 11.

This Addendum is binding on acceptance of the Terms and requires no separate signature.

15. Changes to this Addendum

Mailkube will notify the Customer’s organization owners and admins of any material change to this Addendum, by email, before the change takes effect. This overrides the general amendment mechanism in the Terms for this Addendum.

16. Language

The English version of this Addendum is authoritative. The French translation is provided for convenience only.

17. Contact

For general questions, please raise a ticket via our support portal. For questions about data protection or this Addendum, contact us at privacy@mailkube.com.

Exhibit A. Details of Processing

Categories of data subjects. The Customer’s email recipients and contacts. Other individuals whose personal data the Customer includes in message content or template variables. The data of the Customer’s own account and team users is not processed under this Addendum as processor-scope data; it is addressed in Section 12.

Categories of personal data.

• Recipient email addresses.
• Envelope metadata (from, to, cc, bcc).
• Message subject line (retained, subject to the rolling window in Section 11).
• Template variables supplied by the Customer.
• Engagement events (open, click, bounce), including the recipient network and device data recorded when a tracked open or click occurs (IP address, browser user-agent).
• Contact records (names, email addresses) and topic or segment subscriptions.
• Bounce suppression entries.

Message body and HTML content is processed transiently in the sending (MTA) spool pending delivery and is not retained after the message is sent.

Nature and purpose of the processing. Transactional and marketing email delivery and related analytics, and service security, abuse prevention, and deliverability protection.

Duration. The term of the Agreement, plus the applicable retention windows in Section 11. The rolling retention windows in Section 11 apply during the term.

Retention. As described in Section 11.

Exhibit B. Parties

Data exporter (controller): the Customer.

Data importer (processor): Mail Tactic Corporation, a Delaware C Corporation (file no. 10537478), registered office c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.

Mail Tactic Corporation is incorporated in the United States (Delaware). Customer Personal Data is stored and processed in the European Union, and operational access to it is performed from within the European Union.

Exhibit C. Technical and Organizational Measures

Mailkube maintains the following measures. They are the current description referred to in Section 4 and may be updated provided the level of protection is not degraded.

Access control and authentication. Identity and access management through Keycloak, with support for time-based one-time-password two-factor authentication. Role-based permissions scoped to organization membership. Machine secrets are stored using peppered hashing.

Data access and integrity. Database access is performed exclusively through a parameterized ORM. Tracking tokens are HMAC-signed and verified.

Transmission security. Personal data is encrypted in transit using TLS. The public edge terminates TLS and connects to the origin over an authenticated, encrypted origin connection, with no cleartext hop.

Erasure and retention enforcement. A daily automated job enforces the retention periods in Section 11 across a declarative registry of data surfaces. On erasure, cache entries keyed on personal data are invalidated so that no stale, email-keyed result outlives the data.

Monitoring and logging hygiene. The outcome of each retention run is surfaced through an internal metric so that personal data lingering past its window is visible to operators. A logging-hygiene gate and a backend error-monitoring scrubber keep personal data (including recipient addresses, subject lines, and template variables) out of server-side logs and error reports.

Abuse prevention. Rate limiting and automated evaluation of sending behaviour protect the Service and its recipients from abuse.