Data Processing Addendum

• "Data Protection Laws" — all laws applying to the processing of personal data under this DPA, which may include the EU and UK GDPR, the ePrivacy Directive, POPIA (South Africa), the Botswana Data Protection Act, and similar laws elsewhere.
• "Customer Personal Data" — personal data contained in content you submit to the Service for transmission or storage: recipient email addresses and names, message subjects and bodies, attachments, and associated delivery metadata.
• "Controller", "processor", "data subject", "processing", "personal data breach" — as defined in the applicable Data Protection Laws.
• "Sub-processor" — a third party engaged by Sendar to process Customer Personal Data on your behalf.

For Customer Personal Data, you are the controller (or a processor acting for another controller, in which case you warrant you have the authority to bind that controller) and Sendar is your processor. You are responsible for the lawfulness of the personal data you submit and of your sending — including having a valid legal basis and any required consents from your recipients, as also required by our Acceptable Use Policy.

Separately, Sendar acts as an independent controller for the account, billing, and usage data described in our Privacy Policy (for example, your registration details and payment records). That processing is outside the scope of this DPA. Payment data is collected directly by PayPal as an independent service provider and is likewise outside this DPA.

Sendar will process Customer Personal Data only on your documented instructions, which consist of: (a) your use of the Service (each send, schedule, retrieval, or deletion request is an instruction); (b) the Terms of Service and this DPA; and (c) any further written instructions we agree to. We will not use Customer Personal Data for our own purposes, sell it, or use it for advertising. We may process it where required by law — in which case we will inform you before processing unless the law prohibits it — and we will tell you if, in our view, an instruction infringes Data Protection Laws.

We ensure that every person we authorize to process Customer Personal Data is bound by an appropriate duty of confidentiality, and that access is limited to what is needed to operate, support, and secure the Service. Administrative access to customer accounts is logged in an internal audit trail.

You give Sendar general authorization to engage the sub-processors listed in Annex C, and future replacements or additions, to process Customer Personal Data. Each sub-processor is bound by a written agreement imposing data protection obligations no less protective than this DPA, and Sendar remains responsible to you for their performance.

We will update Annex C on this page at least 30 days before a new sub-processor begins processing Customer Personal Data. If you object on reasonable data protection grounds and we cannot offer a workaround, you may terminate the affected Service and delete your account; that is your exclusive remedy for a sub-processor change.

Taking into account the state of the art and the nature of the data, Sendar implements and maintains appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The current measures are described in Annex B. We may update them over time, provided the overall level of protection is not materially reduced.

If Sendar becomes aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay — targeting no later than 72 hours after becoming aware — using the email address on your account and/or your dashboard Messages inbox. The notice will describe, to the extent known, the nature of the breach, the categories and approximate volume of data and data subjects concerned, likely consequences, and the measures taken or proposed. We will cooperate with your reasonable requests to investigate and remediate. Our notice is not an admission of fault.

Taking into account the nature of the processing, Sendar will assist you, by appropriate technical and organizational measures and insofar as reasonably possible, in fulfilling your obligation to respond to data subjects' requests (access, rectification, erasure, restriction, objection, portability). The dashboard and API let you retrieve and review the messages you have sent; for assistance beyond self-serve tooling, contact privacy@sendar.app. If a data subject contacts Sendar directly about your sending, we will forward the request to you without undue delay and will not respond substantively on your behalf unless legally required.

Sendar will provide reasonable assistance with your data protection impact assessments and consultations with supervisory authorities, to the extent they relate to Customer Personal Data processed under this DPA, taking into account the information available to us.

You can delete Customer Personal Data at any time via the Service, and you can export message content via the dashboard and API while your account is active. Upon termination — including self-serve account deletion in Settings — Sendar deletes Customer Personal Data from the live database immediately and permanently, unless retention is required by law. Residual copies in encrypted backups are deleted in the ordinary course as backups rotate.

On written request no more than once per year (or following a personal data breach affecting your data), Sendar will make available the information reasonably necessary to demonstrate compliance with this DPA — such as descriptions of our security measures and sub-processor agreements — and will allow for and contribute to audits conducted by you or your mandated auditor, subject to reasonable confidentiality, scheduling, and scope controls, and provided the audit does not endanger other customers' data.

Customer Personal Data is processed using OVHcloud application hosting, Neon in the United States (database), and South Africa (email transmission), and may be processed in other locations where our sub-processors operate. Where a transfer of personal data protected by EU, UK, or Swiss law requires a transfer mechanism, the parties incorporate the European Commission's Standard Contractual Clauses (module two — controller to processor), with you as data exporter and Sendar as data importer, completed by the details in Annex A and the measures in Annex B; for UK transfers, as modified by the UK Addendum. We rely on equivalent safeguards in our agreements with sub-processors.

The liability of each party under this DPA is subject to the exclusions and limitations of liability in the Terms of Service. In case of conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA prevails; where the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

• Encryption in transit (TLS) for the website, API, and email submission paths.
• Passwords stored as strong one-way hashes (scrypt); API keys stored hashed and displayed only once at creation.
• Signed, HttpOnly session cookies; server-side session invalidation on password change, sign-out, and account deletion.
• Tenant isolation enforced in the application layer: customers can access only their own domains, logs, keys, and messages.
• Sending restricted to domains verified via DNS (DKIM/SPF) as owned by the customer.
• Rate limiting on authentication endpoints; quota enforcement and pacing on sending.
• Continuous abuse monitoring with human-reviewed enforcement; per-endpoint HMAC-signed webhooks.
• Administrative actions logged to an internal audit trail; admin access restricted to authorized personnel.
• Managed, access-controlled database hosting with encrypted backups; self-serve, immediate, permanent account deletion.

PayPal (payments) and Google (optional sign-in) process Customer account data as independent services and are not sub-processors of Customer Personal Data under this DPA.