Data Processing Addendum

Effective date: October 29, 2026

The Data Processing Addendum below, under GDPR Article 28, forms part of the Terms of Service. A signed copy is available to business customers on request at hello@simplenewsletter365.com. It covers the roles of the parties, the details of processing, our processor obligations, subprocessors, security measures, breach notification, return and deletion, and audits. Transfers to the United States rely on the EU-US Data Privacy Framework (see Section 8).

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between SimpleSoftware365, Beatrixgasse 27/1/25, 1030 Vienna, Austria (“SimpleNewsletter365,” “Processor”) and the customer (“Controller”). It governs the processing of personal data that the Controller submits to the Service. Full operator details are in the imprint.

1. Roles

The Controller determines the purposes and means of processing its audience data. The Processor processes that data only on the Controller’s documented instructions, which include the Terms, this DPA, and the Controller’s use of the Service’s features.

2. Subject matter and details of processing

• Subject matter: provision of the SimpleNewsletter365 newsletter service.
• Duration: for the term of the agreement, plus the deletion windows below.
• Nature and purpose: storing contacts and audience data, hosting signup forms, composing newsletters, sending them through the Controller’s own Microsoft 365 mailbox, and generating delivery and engagement reports.
• Types of personal data: contact and recipient email addresses, names, organization, custom fields, subscription status, segment membership, signup form submissions (with hashed email and hashed client IP), newsletter content, and delivery outcomes.
• Categories of data subjects: the Controller’s contacts, subscribers, and newsletter recipients.

3. Processor obligations

The Processor will:

• Process personal data only on documented instructions, including for international transfers, unless required by law.
• Ensure personnel authorized to process data are bound by confidentiality.
• Implement appropriate technical and organizational measures (Section 6).
• Assist the Controller, taking into account the nature of processing, with data subject requests and with security, breach notification, and impact assessments.
• Make available information needed to demonstrate compliance.

4. Subprocessors

The Controller authorizes the Processor to engage subprocessors listed at Subprocessors. The core infrastructure subprocessor is Microsoft Corporation (Azure). Newsletters are sent through the Controller’s own Microsoft 365 mailbox using Microsoft Graph; Microsoft 365, Entra ID and Graph are the Controller’s own tenant services, which the Processor accesses on the Controller’s instruction, and are not subprocessors. The Processor imposes data protection obligations on subprocessors that are no less protective than this DPA, and remains responsible for their performance. The Processor will give notice of intended changes to subprocessors and a chance to object.

5. Data subject rights and instructions

Because audience data belongs to the Controller, the Processor will, where feasible, provide self-service tools that let the Controller export and delete account data and honor unsubscribe requests. If the Processor receives a request directly from a data subject, it will refer the request to the Controller.

6. Security measures

The Processor maintains measures including:

• Encryption in transit and at rest.
• Tenant and account isolation: every account-owned record carries tenant and account identifiers and is queried through enforced account scope.
• Microsoft tokens held server-side only; delegated refresh tokens encrypted with ASP.NET Core Data Protection and, in production, wrapped by an Azure Key Vault key accessed through managed identity.
• Logging that uses identifiers, hashes, statuses, counts, and durations rather than email content, recipient lists, tokens, or payloads.
• Public signup endpoints protected by hashing, challenge (ALTCHA), optional double opt-in, origin allowlisting, and rate limiting.
• Least-privilege access controls and audit logging of administrative actions.

7. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide information reasonably available to help the Controller meet its notification obligations.

8. International transfers

Each organization chooses a home region once, when it signs up: EU (Microsoft Azure West Europe, Netherlands) or US (Microsoft Azure Central US). Customer content, files, recipients, activity data and logs that contain any of it stay in the home region. A small global service in West Europe keeps only what routing needs: a keyed hash of your Microsoft tenant ID, your home region, account flags and reserved organization names. It holds no names, email addresses or customer content. Billing data (billing identity, invoices and subscription state) is not bound to the home region: it is processed by our merchant of record, Link, and passes through the global service in West Europe. There is no migration between regions; moving means deleting the account in one region and creating it in the other.

Transfers of personal data to the United States rely on the EU-US Data Privacy Framework (DPF) where the recipient is certified (checked on the official DPF list on October 29, 2026; see Subprocessors for each provider). Plus Five Five, Inc. (Resend), which is listed as active with its re-certification under review, also offers the Standard Contractual Clauses in its public Data Processing Addendum. Lettermint B.V., Netherlands (EU processing, no transfer outside the EEA).

9. Return and deletion

On termination, or on the Controller’s request, the Processor will delete account-scoped personal data and stored image assets. Subscriber history is retained as append-only audit evidence with email and actor email fields anonymized. Encrypted mailbox token material is revoked and deleted and is never exported. Hashed signup-form audit and rate-limit rows are purged on a short cycle (currently seven days). Unsubscribe state is retained as needed to honor opt-outs. The Processor will delete or anonymize remaining data except where retention is required by law.

10. Audits

The Processor will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, subject to reasonable confidentiality and security conditions.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA controls.

Contact

Data protection contact and DPA requests: hello@simplenewsletter365.com.