Data processing agreement (DPA)

1. Parties and conclusion

The controller is the customer identified in the acceptance record by full legal name, address, registration details, representative and verified account email. The processor is the FinchSend operator identified above. This DPA forms part of the service agreement and takes precedence on entrusted data processing.

Once the operator publishes a final version, the customer enters into the DPA electronically in ‘My DPA’, providing controller details and confirming authority and acceptance of that version. The record includes the date, accepting account, party details and preserved text with annexes. Viewing the page, registering or importing contacts does not conclude a DPA. A draft cannot be accepted.

This agreement covers a customer acting as controller. A customer acting for another controller must separately agree the subprocessor role and obtain the required authorisations before entrusting that controller’s data. This DPA does not replace a lawful basis for collecting contacts or required marketing consent.

2. Subject, duration and instructions

The customer entrusts the data in Annex 1 solely to provide the ordered FinchSend features. Processing runs from conclusion of the DPA throughout the service and then only for the agreed return or deletion period. It is not retroactive and does not legalise earlier processing.

FinchSend processes data only on documented controller instructions. These include authorised actions in the application, form and campaign configuration, and documented directions to the operator within this agreement. This also applies to transfers to third countries.

Where Union or Member State law requires processing, FinchSend informs the controller before processing unless that law prohibits notification on important public interest grounds. FinchSend promptly identifies instructions it considers contrary to data protection law and suspends their execution pending clarification.

3. Controller obligations

The controller determines purposes and legal grounds, provides required privacy information and ensures lawful content and instructions. It supplies only necessary data, maintains accuracy, and respects objections and withdrawal of consent.

The controller secures its accounts and devices, verifies authorised people and keeps privacy and incident contacts current. Special categories under Article 9 GDPR and criminal conviction or offence data under Article 10 must not be entrusted without a separate agreement on suitable safeguards.

4. Confidentiality and purpose limitation

FinchSend permits access only to authorised people to the extent necessary to provide the service, subject to contractual or statutory confidentiality. Confidentiality continues after access and cooperation end.

FinchSend does not sell entrusted lists or use them for its own marketing, its own recipient profiles or model training. It does not combine customer lists for its own purposes. It processes them solely for agreed purposes and instructions.

Customer account, billing and DPA acceptance evidence used for the operator’s own obligations are governed separately by the privacy policy. This does not authorise retention of entire recipient lists for the operator’s own purposes.

5. Security and assistance

FinchSend implements measures appropriate to risk under Article 32 GDPR, considering the nature of the data, the state of the art and the possible impact of a breach. Agreed measures are in Annex 2. Changes must not reduce the agreed protection.

Taking account of the processing and available information, FinchSend assists with Chapter III data subject rights and Articles 32–36 GDPR, including impact assessments, supervisory consultation and breaches. Assistance covers locating, returning, correcting, restricting or deleting data on instructions and providing security and incident information.

Requests received directly from recipients are promptly forwarded to the controller. FinchSend does not determine them independently unless authorised or legally required. Requests go to the operator’s privacy contact; responses and assistance take the controller’s statutory deadlines into account.

6. Personal data breaches

After becoming aware of a breach involving entrusted data, FinchSend notifies the controller without undue delay at the email recorded in the DPA or a subsequently agreed incident contact. Notification is not postponed until a full investigation is complete.

Notification includes the available description, categories and approximate numbers of people and records affected, likely consequences, measures taken or proposed, and a contact point. Missing information is provided in stages without undue delay. FinchSend documents the incident, limits its effects and assists with Articles 33–34 GDPR.

The controller decides on notifications to the authority and individuals. The controller’s 72-hour reporting deadline is not a period FinchSend may wait before notifying the customer.

7. Subprocessors

The controller gives general written authorisation only for subprocessors disclosed in the agreed Annex 3. FinchSend contracts with them on substantially the same data protection obligations and remains responsible to the controller for their performance.

FinchSend gives at least 30 days’ advance email notice of additions or replacements, identifying the entity, tasks, processing locations and transfer safeguards. Before use begins, the controller may raise a substantiated objection based on data protection grounds.

The parties seek a resolution, such as an alternative provider or disabling the affected feature. Customer data is not sent to the disputed new subprocessor before resolution. If no resolution is possible, the customer may end the affected service and instruct return or deletion. On request, FinchSend provides relevant information and contract provisions while protecting others’ data and trade secrets.

8. Transfers outside the EEA

Transfers outside the European Economic Area, including remote access, require documented instructions and compliance with Chapter V GDPR. Annex 3 identifies countries, the applicable transfer mechanism and access to safeguard information.

Where required, FinchSend ensures transfer clauses, transfer assessments and supplementary measures are in place before transfer. This DPA is not itself a transfer mechanism: Decision 2021/915 addresses Article 28 and does not replace the transfer clauses in Decision 2021/914.

9. Information and audits

FinchSend provides information needed to demonstrate compliance with Article 28 GDPR and permits and contributes to audits, including inspections, by the controller or its authorised independent auditor.

The parties arrange the scope and conduct while protecting service security and other customers’ data. Reasonable notice applies where appropriate; urgent incidents or authority requirements must not be blocked by it. Documentation or certificates can assist but do not replace the right to a necessary inspection.

10. Return and deletion

At the end of processing, the controller chooses return followed by deletion of copies, or deletion without return. This covers contact lists, recipient data in queues, content and message history, reports, logs, files and subprocessors to the extent entrusted.

FinchSend carries out the documented instruction and confirms completion within the periods in Annex 4. Backups are isolated from normal operations and expire under the agreed cycle; restoration must reapply completed deletion instructions.

If Union or Member State law requires retention, FinchSend identifies the legal basis, scope and duration, restricts access and uses the data only for that duty. Confidentiality and security obligations continue until deletion is complete. Deleting a contact in the application alone does not confirm deletion of every copy.

11. Annex 1 — processing description

Individuals: newsletter subscribers, customers, prospects and business contacts lawfully placed on the controller’s lists. Data: email addresses, optional first names, contact status, signup, verification and unsubscribe dates, and relationships with campaigns and import records.

Other instructed data: personal information in message content and materials, sender addresses, recipients in send jobs, message identifiers, delivery dates and results, bounces, complaints, opens, clicks and clicked URLs. Technical request data may reach infrastructure and logs according to the agreed configuration.

Operations and purposes: signup collection, import, validation, storage, organisation, access for the controller, campaign preparation and delivery through providers, unsubscribe handling, reporting, return and deletion. Processing is electronic and ongoing during the service, with operations performed on instructions. Articles 9 and 10 data are excluded from this standard scope.

12. Annex 2 — technical and organisational measures

Application controls include authentication of verified accounts, bcrypt password hashes, authorisation and separation of customer data by account. State-changing requests use origin checks and validation; confirmation, unsubscribe and measurement tokens have separate purposes. Administrative access is role-restricted and selected administrative changes are logged.

Production requires HTTPS and protection of secrets, database and file access. Campaign images are intentionally public for email clients and are not a confidential file store. Operational arrangements below must specify personnel access, confidentiality, updates, monitoring, infrastructure encryption, backups and recovery tests, and incident and data-rights assistance procedures.

TO BE COMPLETED: confirmed infrastructure and organisational measures and assistance procedures. This draft does not attest to certifications, encryption at rest, MFA or regular recovery testing.

13. Annex 3 — subprocessors and transfers

The Resend integration delivers messages and reports events, receiving recipient addresses, message content and metadata. The operator has confirmed that the application is hosted on Render. Legal entities, the production region, all access locations and provider processing terms still need to be specified in the agreed list below.

Stripe handles account billing and is not automatically a subprocessor of newsletter lists for that reason. Providers must be listed according to their actual access to entrusted data, including support and backups.

TO BE COMPLETED: the agreed list with legal names and addresses, data scope, operations, processing and access countries and authorisation dates. The Resend and Render references above do not replace this list.

TO BE COMPLETED: mechanisms for each non-EEA transfer, required assessments and supplementary safeguards, and a contact for obtaining copies.

14. Annex 4 — ending processing

The controller sends its choice of return or deletion to FinchSend’s privacy contact. FinchSend agrees a secure way to verify the requester, the return format and delivery channel. Completion confirmation states the scope, date and any remaining copies with their deletion deadline.

TO BE COMPLETED: return deadlines, deletion deadlines for active infrastructure and subprocessors, maximum backup expiry, log retention, and a verified procedure for carrying out and checking instructions. Lack of automation does not remove the operator’s duty to carry out the agreed procedure.

15. Termination and changes

If FinchSend cannot meet its agreed obligations, it promptly informs the controller. The controller may suspend data transfers, require remediation and, for a material or unremedied breach, terminate processing and instruct return or deletion. This does not limit individuals’ rights, supervisory powers or GDPR liability.

Material changes require documented agreement. Publishing a new page does not automatically replace an accepted version; the agreed subprocessor-change procedure is separate. Acceptance records retain their original wording. This is a custom draft DPA, not an unmodified set of Commission standard clauses.

Related documents and sources

• European Commission — controller–processor clauses (2021/915)
• Resend — provider DPA
• Render — provider DPA