Data Processing Addendum
Draft for legal review — not in effect
This Data Processing Addendum (the “DPA”) forms part of the Terms and Conditions (the “Agreement”) between Peerborough, Inc. (the “Provider”) and the customer identified in the relevant account or order records (the “Customer”). Upon becoming effective, this DPA shall apply to the processing of personal data by the Provider on behalf of the Customer in connection with Genharden DMARC (the “Service”). “Applicable Data Protection Law” means the data protection laws applicable to that processing, including, where applicable, the EU and UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, applicable US state privacy laws and the Korean Personal Information Protection Act. The Provider’s privacy policy governs processing undertaken by the Provider for its own purposes. This document remains a draft and has no legal effect pending its adoption.
1. Scope and interpretation
“Customer Data” means personal data received or generated by the Provider on behalf of the Customer in the provision of the Service. “Customer Account” means the account through which the Customer and its authorised users access the Service. The Customer shall act as controller of Customer Data or, where it processes Customer Data on behalf of another controller, as processor. In the latter case, the Provider shall act as sub-processor, and the Customer shall obtain the authority necessary to issue instructions and appoint the Provider. The Customer shall be responsible for the lawful collection and disclosure of Customer Data and for providing notices and obtaining authorisations required by Applicable Data Protection Law. The Provider shall act as an independent controller in respect of personal data processed for its own account administration, billing, website operation and customer relationship management. A payment provider acting as merchant of record shall act in its own capacity in respect of payment processing. Once adopted and incorporated into the Agreement, this DPA may be accepted electronically with the Agreement without a separate handwritten signature, subject to applicable law. The applicable version shall remain in effect until amended in accordance with Section 15.
2. Subject matter and scope of processing
Subject matter and purpose: the provision and administration of the Service, including the receipt and assessment of email security information, verification of domain and communication settings, preparation of findings and recommendations, related communications and support, and the anonymisation of Customer Data described in Section 3. Nature of processing: collection, recording, organisation, storage, analysis, retrieval, disclosure in the provision of the Service, and erasure. Processing may involve automated analysis tools. Duration: Customer Data shall ordinarily be retained until completion of the withdrawal and closure of the relevant Customer Account, subject to the earlier deletion requirements and limited exceptions in Section 11. Categories of data subjects: the Customer’s authorised users, persons identified in information submitted or directed to the Service, and contacts of organisations supplying such information. Categories of personal data: contact and account information, online and network identifiers, communication metadata and content contained in information submitted to the Service, and service settings and usage records. Sensitive data: the Service is not intended for the processing of special categories of personal data or other sensitive information. The Customer shall not intentionally submit such information without prior written agreement and a lawful basis. Any such information received incidentally shall remain subject to the protections of this DPA and any additional measures required by Applicable Data Protection Law.
3. Instructions and confidentiality
The Provider shall process Customer Data solely on the Customer’s documented instructions within the purposes and scope of the agreed Service, including in relation to international transfers. Such instructions comprise the Agreement, this DPA, the Customer’s service settings and lawful written requests relating to that processing. The Provider shall not sell Customer Data, and shall not process it for advertising or for other purposes of its own except as set out in the next paragraph. The Customer instructs and authorises the Provider to anonymise or aggregate Customer Data so that the resulting information no longer identifies, and cannot reasonably be linked to, the Customer, its authorised users or any other individual. Information anonymised in this way is not Customer Data. The Provider may retain it and use it to improve the Service and to compile and publish statistics, and shall not attempt to re-identify it. Without limiting mandatory obligations under Applicable Data Protection Law, instructions requiring additional services, material changes to the Service or a separate processing environment shall be subject to a separate written agreement on their scope and any applicable charges. If the Provider cannot reasonably carry out an instruction within the agreed Service, it shall inform the Customer and the parties shall seek a lawful resolution. Where the affected Service cannot reasonably continue in compliance with a lawful instruction, the procedure for discontinuing the affected Service in Section 5 shall apply. Where the Provider considers an instruction to infringe Applicable Data Protection Law, it shall immediately inform the Customer and may suspend the affected processing pending clarification or lawful replacement of the instruction. Processing required by law shall be limited to the extent permitted by Applicable Data Protection Law. The Provider shall notify the Customer of the relevant legal requirement before processing unless notification is prohibited by law. Access to Customer Data shall be restricted to persons authorised to perform the relevant services. Each such person shall be subject to a contractual or statutory duty of confidentiality.
4. Security measures
The Provider shall implement and maintain technical and organisational measures appropriate to the nature, scope and purposes of processing and the risks to individuals, taking into account the state of the art and the costs of implementation. These measures shall address the confidentiality, integrity, availability and resilience of Customer Data and the systems used to process it. This Section, supplemented by the transfer-specific security particulars agreed under Section 8, constitutes Annex II to the Standard Contractual Clauses. The measures shall include access controls and authentication appropriate to the privileges granted, including additional verification for administrative access, logical separation of customer information, protective measures for stored data and data transmitted through channels controlled by the Provider, separation of operational and testing environments, and safeguards for the devices and accounts used to operate the Service. Encryption shall be applied where appropriate to the risks and the communication channels concerned; transmissions initiated by third parties may use channels outside the Provider’s control. The Provider shall maintain appropriate records of relevant security and administrative events, procedures for incident response and recovery, safeguards for backup copies, and proportionate assessment of service providers. Service provider assessment may be based on applicable contracts and reasonably available security information. The effectiveness of the measures shall be reviewed at reasonable intervals and following material changes, and identified vulnerabilities shall be addressed according to their risk. The Provider may modify the measures provided that the overall level of protection is not reduced and the requirements of Applicable Data Protection Law continue to be met.
5. Sub-processors
The Customer grants general written authorisation for the engagement of the following sub-processors, subject to this Section and any additional consent requirement under Section 14. The list constitutes Annex III to the Standard Contractual Clauses. The locations stated below describe principal processing locations; additional locations shall be subject to Section 7. - Supabase Pte. Ltd. (United States): data storage and account access services. - Vercel Inc. (United States; global network): application hosting and delivery. - Amazon Web Services Korea LLC, with Amazon Web Services, Inc. (United States; global network): communication and storage services. - Cloudflare, Inc. (global network): security and abuse prevention services. - Fly.io, Inc. (United States): infrastructure for network verification services. The Provider shall disclose to each sub-processor only Customer Data reasonably necessary for the relevant task and shall not authorise its use for the sub-processor’s own or other independent purposes. Each sub-processor shall be subject to a written agreement, which may comprise its applicable service terms and data processing addendum, imposing data protection obligations equivalent to those applicable to its processing under this DPA. The Provider shall remain responsible to the Customer for the performance of its sub-processors’ obligations. The Provider may use one or more of the sub-processors already listed in this Section within the authorised scope of processing, subject to Applicable Data Protection Law. Before adding or replacing a sub-processor on this list, the Provider shall give at least 30 days’ written notice through the Service or another reasonable written means, identifying the proposed sub-processor, its processing tasks and principal processing locations. The Provider shall update the list when the change takes effect. The Customer may submit a written objection on reasonable data protection grounds within that notice period. Any separate consent required by law shall be obtained in accordance with Section 14. The parties shall seek a reasonable resolution of a timely objection or withheld consent. The Provider shall not use the proposed sub-processor for the Customer’s affected processing while such an objection remains unresolved or any legally required consent is outstanding. The Provider may offer a reasonable alternative but shall not be obliged to maintain separate infrastructure, retain a particular provider or materially alter the Service, except to the extent required by Applicable Data Protection Law. If the affected Service cannot reasonably continue in accordance with the agreed terms and Applicable Data Protection Law, the Provider may discontinue that Service on at least 30 days’ written notice, or such other notice as mandatory law requires. Processing that cannot lawfully continue may be suspended earlier to the extent necessary. These restrictions and any discontinuation shall apply only to the relevant Customer and affected Service and shall not restrict lawful use of the sub-processor for other customers. Return and deletion shall follow Section 11; any payment or refund consequences shall be governed by the Agreement and applicable law.
6. Public information services
The Provider may consult publicly accessible information services where reasonably necessary to verify information relevant to the Service. Queries shall be limited to the identifiers necessary for that purpose and shall not include information identifying the Customer’s account or its users unless separately authorised. The public availability of information shall not, by itself, exclude the application of data protection law. The role of each recipient and the requirements for disclosure, contracting and international transfer shall be determined by the relevant processing activity. Where a recipient acts as a sub-processor, the requirements of Section 5 shall apply.
7. International transfers
The Provider is established in the Republic of Korea. Customer Data may be stored or processed through the service providers and locations identified in Section 5 and accessed from Korea. Additional processing locations used by international service providers shall be subject to the requirements of Applicable Data Protection Law. The Provider shall ensure that each international transfer is supported by an applicable adequacy decision or another lawful transfer mechanism. Where required, this shall include the Standard Contractual Clauses, the UK Addendum or another legally recognised safeguard, together with any required transfer assessment and supplementary measures. Reliance on a data privacy framework shall be limited to recipients and processing covered by a valid certification. An adequacy decision covering Korea shall not dispense with safeguards required for direct or onward transfers to other countries. The Provider shall disclose Customer Data to a public authority only to the extent lawfully required and shall notify the Customer unless prohibited by law. Where required by Applicable Data Protection Law or applicable transfer safeguards, the Provider shall assess the legality of the request and challenge it where reasonable grounds exist.
8. Transfer safeguards
Where required for a transfer covered by this DPA and within their permitted scope, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (the “SCCs”) shall be incorporated by reference, without modification except as permitted by their terms. The Customer shall be the data exporter and the Provider the data importer. Module Two shall apply where the Customer is a controller and Module Three where the Customer is a processor. The following elections shall apply: Clause 7 shall apply; Clause 9 shall use Option 2, with the notice period in Section 5; the optional provision in Clause 11 shall not apply; the competent supervisory authority shall be determined under Clause 13; and the law and courts of Ireland shall be selected under Clauses 17 and 18. For Annex I, the Customer’s legal name, address, contact details and role shall be those provided in the relevant account or order records or by separate written notice. The Provider is Peerborough, Inc., at 5F v1116, 6, Teheran-ro 79-gil, Gangnam-gu, Seoul, Republic of Korea, with contact email support@genharden.com, acting as processor or sub-processor. The processing and the parties’ relevant activities are described in Sections 1, 2 and 11. Transfers may occur on an ongoing basis as necessary to provide the Service. Section 4, together with the agreed transfer-specific security particulars, constitutes Annex II, and Section 5 constitutes Annex III. Before relying on the SCCs for a transfer, the parties shall supply any missing particulars, including the competent supervisory authority and a sufficiently specific description of the security measures actually implemented for the relevant processing, and record their legally binding acceptance. Such particulars may be documented in a separate written annex without changing the general terms of this DPA. Electronic acceptance may constitute signature to the extent permitted by applicable law. For restricted transfers subject to UK data protection law, the ICO’s International Data Transfer Addendum to the SCCs, version B.1.0 as lawfully revised (the “UK Addendum”), shall apply. Tables 1 to 3 shall be completed by the party, transfer and security particulars described above, with any additional particulars supplied before reliance on the UK Addendum. For Table 4, neither party shall have the option to end the UK Addendum solely as a result of an approved revision. The following are incorporated by reference: “Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.” For transfers subject to Swiss data protection law, the SCCs shall be interpreted to provide the safeguards required by the Swiss Federal Act on Data Protection. The Swiss Federal Data Protection and Information Commissioner shall be the competent authority in respect of those transfers, and the rights of individuals in Switzerland, including applicable rights to bring proceedings in Switzerland, shall be preserved. These adaptations shall not reduce protections required where EU data protection law also applies.
9. Assistance and cooperation
Taking into account the nature of processing and the information available to it, the Provider shall provide reasonable assistance to enable the Customer to comply with obligations concerning data subject rights, security, breach notification, data protection impact assessments and consultation with supervisory authorities, including Articles 32 to 36 of the GDPR where applicable. Requests shall be submitted to the contact specified in Section 16. Assistance may be provided through existing service functions, relevant records or reasonable manual procedures, as appropriate to the request. The parties shall cooperate having regard to applicable statutory deadlines. The Provider shall refer requests received directly from data subjects to the Customer and shall not respond substantively without the Customer’s instructions unless required by law. Where permitted by Applicable Data Protection Law, the parties may agree in advance on reasonable charges proportionate to the assistance required. Such arrangements shall not prevent compliance with mandatory obligations or deter the exercise of statutory rights.
10. Personal data breaches
The Provider shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. Initial notification shall not be delayed pending completion of an investigation and shall include the information then available concerning the nature of the breach, affected data and individuals, likely consequences, remedial measures and the relevant contact. Further information shall be provided as it becomes available without undue delay. The Provider shall take reasonable measures to contain and remediate the breach, preserve relevant evidence and assist the Customer with legally required notifications. Notices under this Section shall be sent to the Customer’s designated contact irrespective of ordinary service notification preferences.
11. Retention, return and deletion
Unless a specific lawful reason requires a different period, Customer Data shall be retained until completion of the Customer’s withdrawal from the Service and closure of the relevant Customer Account. Data that is no longer necessary for the agreed processing purposes, or is subject to a lawful deletion instruction, shall be deleted earlier where required by Applicable Data Protection Law. The Customer may request withdrawal and specify whether Customer Data is to be returned before deletion or deleted without return. Any requested return shall cover Customer Data then held by the Provider and shall be made securely in a commonly used format appropriate to the data. Unless otherwise required by law or separately agreed, return shall be completed by secure transmission to the Customer or by providing secure access to a usable copy for a reasonable period notified to the Customer; actual download or acknowledgement by the Customer shall not be required. Any copy held for that return shall be used solely for that purpose and deleted promptly when the notified access period ends. Return and deletion from the Provider’s active systems shall form part of the withdrawal procedure and shall be completed without undue delay; withdrawal shall not be treated as complete while those steps remain outstanding. Where the relevant processing services end before account closure, the same return or deletion obligations shall apply to the affected Customer Data. The Provider shall provide written confirmation on request. If an authorised user withdraws while the Customer Account remains in use, the Provider shall delete or otherwise lawfully handle that user’s personal data as required by Applicable Data Protection Law and the Customer’s instructions. Such withdrawal shall not, by itself, require deletion of other Customer Data that remains lawfully necessary to provide the Service to the Customer. Following completion of withdrawal, retention shall be limited to data required by applicable law, copies that cannot reasonably be removed immediately from protected backups, or data strictly necessary to complete a return or transition expressly requested by the Customer. Legally retained data shall be restricted to the required purpose and period. Residual backup copies shall be isolated from ordinary use, deleted at the earliest practicable point in the applicable deletion cycle, and subject to renewed deletion if restored. Any requested return or transition shall be limited in scope and duration. These exceptions shall not permit continued use for unrelated purposes or delay mandatory erasure.
12. Information and audits
The Provider shall make available information necessary to demonstrate compliance with this DPA and shall allow and contribute to audits and inspections required by Applicable Data Protection Law. The parties shall ordinarily begin with a review of existing policies, relevant records and other reasonably available written information, including service provider assurance materials where available and lawfully disclosable. The Provider may use common compliance materials to address overlapping requests, provided they contain the information reasonably necessary for the Customer’s verification. Where further verification is reasonably necessary, the parties shall ordinarily use remote review before arranging an on-site inspection. The Customer or an independent auditor subject to confidentiality may conduct the necessary audit on reasonable notice, ordinarily at least 30 days, during normal business hours in Korea. Its scope, duration and arrangements shall be proportionate to the processing and the grounds for verification, protect other customers’ information and the security of the Service, and avoid unnecessary duplication or disruption. Routine audits by each Customer shall ordinarily be limited to once in any 12-month period. These procedural limits shall not apply to the extent inconsistent with mandatory law or the SCCs, or where an audit is required by a supervisory authority, a personal data breach or reasonable evidence of material non-compliance. The Customer shall bear its own reasonable audit costs; additional charges, if any, shall be agreed in advance and shall not be excessive or deter the exercise of statutory rights.
13. US state privacy laws
Where applicable US state privacy law requires it, the Provider shall act as the Customer’s service provider, contractor or processor in respect of Customer Data. The business purposes and services for which processing is permitted are specified in Section 2. The Provider shall not sell or share Customer Data, use it for targeted advertising, or retain, use or disclose it outside the direct business relationship with the Customer or for purposes other than those specified in this DPA, except as permitted by the applicable law. Customer Data shall not be combined with personal data obtained from other sources except as that law permits. The Provider certifies that it understands these restrictions and shall comply with them, provide the level of protection required by the applicable law and notify the Customer if it can no longer fulfil its obligations. The Customer may take reasonable steps, including the verification permitted by Section 12, to confirm compliance and to stop and remedy unauthorised use.
14. Korean Personal Information Protection Act
Where the Korean Personal Information Protection Act applies, this DPA shall constitute the agreement governing entrusted processing under Article 26. The Customer shall be the entrusting party and the Provider the entrusted party. The purpose and scope of entrusted processing, safeguards and processing period are set out in Sections 2, 4 and 11 respectively. The Provider shall not process entrusted data beyond the authorised purpose and scope, shall cooperate with reasonable supervision and necessary guidance or training relating to the entrusted processing, and shall bear responsibility for breach in accordance with applicable law. The parties shall also comply with independently applicable disclosure and international transfer requirements. The Customer consents to further entrustment to the sub-processors listed in Section 5 and, to the extent permitted by the Korean Personal Information Protection Act, to additional or replacement sub-processors engaged within the purposes and scope set out in Section 2 in accordance with the change procedure in Section 5. Acceptance of this DPA constitutes agreement to that contractual consent procedure. If separate consent is legally required for particular further entrustment, the Provider shall obtain it before carrying out that processing. An unresolved objection or withheld consent shall be handled under Section 5 and shall affect only the relevant Customer’s processing.
15. Precedence, liability and amendments
Mandatory law shall prevail. In the event of inconsistency between contractual provisions concerning Customer Data, the SCCs and UK Addendum shall prevail to the extent applicable, followed by this DPA and then the Agreement. Contractual liability under this DPA shall be subject to the limitations in the Agreement only to the extent lawful and compatible with the SCCs and UK Addendum. Those limitations shall not restrict liability for a breach of the SCCs or UK Addendum, the enforceable rights of data subjects or liability that cannot lawfully be limited. The governing law and jurisdiction provisions of the Agreement shall not displace those required by applicable transfer safeguards. Amendments shall be made in accordance with the Agreement, with at least 30 days’ prior notice of changes materially adverse to the Customer. Changes to sub-processors shall follow Sections 5 and 14. No amendment shall reduce protections required by Applicable Data Protection Law or alter mandatory transfer clauses beyond their permitted terms.
16. Notices and communications
Instructions, requests and notices under this DPA shall be submitted to support@genharden.com. The Provider shall send notices to the contact designated by the Customer or, in the absence of a separate designation, to the Customer Account owner. The Customer shall keep those details current. Ordinary requests shall be handled within a reasonable period during normal business hours in Korea. No continuous support service or fixed response time is included unless separately agreed. This provision shall not limit statutory deadlines, the obligation to notify a personal data breach without undue delay or any other mandatory obligation. A copy of this DPA for separate written execution may be requested through the same contact.