Data Processing Addendum

This DPA forms part of the Terms of Service. For personal data contained in the emails and customer information you process in MilerMail (“Customer Personal Data”), you are the controller (or fiduciary) and MilerMail is your processor. Details of the processing are in Annex 1.

We process Customer Personal Data only on your documented instructions — which include the Terms, your use of the service’s features and this DPA — unless law requires otherwise, in which case we will tell you unless prohibited.

Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations and receives data-protection training.

We implement appropriate technical and organisational measures, including encryption in transit, role-based access, access logging and secure development practices, as described on our Security page.

You give general authorisation for the sub-processors listed in our Privacy Policy. We bind each to data-protection obligations no less protective than this DPA, remain responsible for them, and will give you at least 30 days’ notice of new sub-processors so you can object on reasonable data-protection grounds.

Taking into account the nature of processing, we will help you respond to data-subject requests and meet your obligations on security, breach notification, impact assessments and prior consultation.

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a breach affecting Customer Personal Data, with the information we then have, and will keep you updated.

On termination, you can export your data for 30 days, after which we delete Customer Personal Data (including from backups on their normal cycle) unless law requires retention.

We will provide information reasonably necessary to demonstrate compliance and allow audits by you or your auditor on reasonable notice, no more than once a year, subject to confidentiality and without unreasonable disruption.

Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties incorporate the European Commission’s Standard Contractual Clauses (and the UK addendum where relevant), with the controller-to-processor module, which are deemed signed on acceptance of this DPA.

Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA prevails.

• Subject matter and purpose: providing the MilerMail email CRM service.
• Duration: the term of your subscription plus the deletion period above.
• Nature: hosting, syncing, displaying, storing and transmitting emails and ticket data.
• Data subjects: your employees, customers, prospects and other correspondents.
• Types of data: names, email addresses, email content and attachments, and any personal data in them.