Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between ModularMail (“ModularMail”, the processor) and the customer (the controller). It applies to personal data that ModularMail processes on the customer’s behalf in providing the Service (“Customer Personal Data”), such as the customer’s contacts and the booking requests patients submit. It applies automatically when the customer accepts the Terms; no signature is needed. A signed copy is available on request at support@modularmail.io.

Terms such as “controller”, “processor”, “personal data”, “processing” and “data subject” have the meaning given in the GDPR (Regulation (EU) 2016/679) and the UK GDPR. Where the Australian Privacy Act 1988, the California Consumer Privacy Act (CCPA/CPRA) or another data protection law applies, the equivalent terms apply and this DPA is read to meet that law’s requirements for the relationship between a business and its service provider.

For personal data about the customer’s own staff and its account, ModularMail is a controller and our Privacy Policy applies instead.

2. Our commitments as processor

ModularMail will:

• process Customer Personal Data only on the customer’s documented instructions, which are the Terms, this DPA, and the customer’s use of the Service, and tell the customer if we think an instruction breaks the law;
• make sure everyone who handles it is bound by confidentiality;
• apply the security measures in section 4;
• not sell it, share it for advertising, or use it for any purpose other than providing the Service (including not combining it with other data, except as the law allows);
• not use Customer Personal Data to market to those individuals;
• process it only for the duration of the Terms, subject to section 8.

3. The customer’s responsibilities

The customer is responsible for having a lawful basis (including consent where required) to give us Customer Personal Data and to email those people, for the notices it must give them, and for the accuracy of what it uploads. It confirms its instructions comply with the law.

4. Security

We maintain technical and organisational measures appropriate to the risk, including those described on our Security page: encryption in transit and at rest; strict separation between customers’ data; access limited to those who need it; protected credentials and signed internal endpoints; and monitoring. We may update these measures if they are not made weaker.

5. Sub-processors

The customer gives general authorisation for us to use the sub-processors on our sub-processors page. We have written agreements with each that require data protection obligations no less protective than this DPA, and we remain responsible for their performance.

We will give at least 30 days’ notice, by email to the account owner and by updating that page, before a new or replacement sub-processor starts processing Customer Personal Data. The customer may object on reasonable data protection grounds in that period by emailing support@modularmail.io. We will then work with the customer in good faith to resolve it. If we cannot, the customer may close its account and receive a refund of any prepaid, unused credits for the affected Service.

6. Helping with individuals’ rights and compliance

Taking into account the nature of the processing, we will:

• give the customer tools to access, correct, export, unsubscribe and erase its contacts, and respond to the customer’s reasonable requests for help with data subject requests. If an individual contacts us directly about Customer Personal Data, we will refer them to the customer, unless the law requires otherwise;
• on request, give reasonable help with the customer’s data protection impact assessments and consultations with regulators, as relates to the Service;
• honour opt-outs automatically: unsubscribed, bounced and complained addresses are suppressed.

7. Personal data breaches

We will tell the customer without undue delay, and within 72 hours, after we confirm a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. Our notice will describe what we know about the breach, the data and people affected, and the steps we are taking, and we will give updates as we learn more. We will take reasonable steps to contain and fix it. Notice of a breach is not an admission of fault.

8. Return and deletion

The customer can export its Customer Personal Data from the Service at any time, and for 30 days after the account closes. After that, we delete or anonymise it within the period stated in our Privacy Policy, unless the law requires us to keep it. To make sure an individual is never emailed again, we keep a one-way hash of the email addresses of people who have unsubscribed or been erased. This is not Customer Personal Data in readable form. Our providers and backups clear it on their normal schedules.

9. Audits and information

We will give the customer the information reasonably needed to show we comply with this DPA, including answers to a reasonable security questionnaire. If that is not enough, or a regulator requires it, we will allow an audit by the customer or an independent auditor under confidentiality, on reasonable notice, no more than once a year (unless a breach occurs), during business hours and without disrupting our business or exposing other customers’ data. Each side bears its own costs.

10. International transfers

We may process Customer Personal Data in countries other than where it was collected, including the United States, Canada, Australia and the European Union. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the parties agree that:

• the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), apply, and are incorporated into this DPA, with Clause 7 (docking) included, the option in Clause 9(a) set to general authorisation with the notice period in section 5, the option in Clause 11 omitted, and Clauses 17 and 18 selecting the law and courts of Ireland;
• for the UK, the UK Addendum to those Clauses (issued by the Information Commissioner) applies, and for Switzerland the Clauses apply with references to the GDPR read as references to the Swiss law;
• the annex to the Clauses is completed by Schedule 1 and the security measures above.

For personal information leaving Australia, we require recipients to handle it consistently with the Australian Privacy Principles. We pass on equivalent transfer protections to our sub-processors.

11. US state privacy laws

For Customer Personal Data covered by the CCPA/CPRA or similar US state laws, ModularMail is the customer’s service provider (processor). We do not sell or share it, will not retain, use or disclose it outside our direct business relationship with the customer or for any purpose other than the business purposes in this DPA, will not combine it with other personal data except as the law allows, will provide the same level of privacy protection the law requires, and will tell the customer if we can no longer meet those obligations.

12. Health information

The Service is designed to send marketing email and take booking requests. It is not designed to hold clinical records, and the customer must not upload clinical information (such as diagnoses, treatment notes or images) as contact data or in booking notes. A patient’s name, contact details and request for an appointment can still be protected health information when a US practice holds them. For a customer whose use involves protected health information regulated by HIPAA, we make a business associate agreement available: contact us at support@modularmail.io before uploading patient contacts.

13. Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the Terms, except where the law, or the Standard Contractual Clauses, say otherwise. If this DPA conflicts with the Terms on personal data, this DPA applies. If it conflicts with the Standard Contractual Clauses, the Clauses apply.

Schedule 1: Details of the processing