Data Processing Agreement

1. Roles

For your subscribers' personal information you are the controller and Mujaz LLC is the processor. You decide who is on your list and why; we act on your instructions. For your own account information we are the controller, and the Privacy Policy governs it.

2. Subject matter and duration

We process personal information for as long as your account is open, for the purpose of delivering and measuring the newsletters you send, and providing the platform's related features. The processing ends when you close your account or delete the data.

3. What is processed, and whose

Categories of data subject: your subscribers, and the members of your workspace.

Categories of personal information

• Contact details: email address, and any name or custom fields you collect
• Engagement records: deliveries, opens, clicks, unsubscribes, bounces and spam reports
• Consent records: the IP address, time and source of a subscription
• Any personal information you choose to put into the content of a newsletter

4. Our obligations

• We process personal information only on your documented instructions, which include your use of the platform's features
• We keep it confidential, and bind everyone with access to the same duty
• We apply the security measures in section 5 and keep them under review
• We help you respond to requests from data subjects, and to your obligations on security, breach notification and impact assessments
• We tell you without undue delay if we become aware of a personal data breach affecting your data
• On request we delete or return the personal information at the end of the service, unless the law requires us to keep it
• We make available the information needed to show we meet these obligations, and allow audits as described in section 8

5. Security measures

• Encryption of data in transit, and of sensitive fields at rest
• Passwords stored hashed, never in readable form
• Access to production data limited to staff who need it, and logged
• Workspace isolation, so one customer cannot reach another's data
• Continuous monitoring of sending for abuse, with automatic pausing of accounts that show it
• Regular backups, and a documented process for restoring them

6. Sub-processors

You give general authorisation for us to engage sub-processors: providers of cloud hosting and databases, email delivery, payments, and security, anti-abuse and error-monitoring services. Each is bound by written terms no less protective than these, and we remain responsible for their performance. We will give you at least 30 days' notice before adding or replacing one, by email to your account address. If you reasonably object on data-protection grounds, write to us; if we cannot resolve it, you may terminate the affected service and receive a refund of the unused portion.

7. International transfers

Mujaz runs on infrastructure in the United States and personal information is processed there. Where data originates in the European Economic Area, the United Kingdom or Switzerland, transfers are made under the European Commission's Standard Contractual Clauses, which are incorporated into this agreement by reference.

8. Audits

On reasonable written notice, and no more than once in any 12-month period unless an authority requires otherwise, we will answer your questions about our processing and provide the documentation we hold. Where that is genuinely not enough to demonstrate compliance, we will cooperate with an audit, conducted during business hours in a way that does not disrupt the service or the confidentiality of other customers.

9. Return and deletion

When your account closes we delete the personal information we hold for you within 30 days, except records the law requires us to keep and suppression records — the addresses of people who unsubscribed, bounced or reported spam. Those we keep, because forgetting them would mean emailing someone who has asked never to hear from that publication again.

10. Contact

Data protection questions, including sub-processor notices and audit requests, go to [email protected]