Application

• This Data Processing Addendum ("DPA") forms part of the BetterMail Terms and applies when BetterMail Limited, a company registered in New Zealand with company number 5178501 and New Zealand Business Number (NZBN) 9429041214237, processes Customer Personal Data on behalf of a customer through the Services.
• If there is a conflict between this DPA and the Terms, this DPA controls for the processing of Customer Personal Data.
• Capitalised terms not defined in this DPA have the meaning given in the Terms.

Roles

• The customer is the controller, agency, business, or equivalent party that determines the purposes and means of processing Customer Personal Data.
• BetterMail is the processor, service provider, or equivalent party that processes Customer Personal Data on the customer's behalf.
• In limited cases BetterMail may process personal information as an independent controller, including account administration, billing, security, abuse prevention, legal compliance, customer communications, and business operations. That processing is covered by our Privacy Policy.

Customer instructions

• BetterMail will process Customer Personal Data only on the customer's documented instructions, including the Terms, this DPA, the customer's use of the Services, order forms, API calls, configuration choices, support requests, and other written instructions.
• BetterMail may also process Customer Personal Data where required by law, provided we notify the customer where legally permitted.
• If BetterMail reasonably believes an instruction breaches applicable privacy or data protection law, we may notify the customer and suspend the relevant processing until the issue is resolved.

Customer obligations

• The customer is responsible for ensuring it has all rights, notices, permissions, consents, lawful bases, and authority required to provide Customer Personal Data to BetterMail and use the Services.
• The customer is responsible for the accuracy, quality, legality, and retention of Customer Personal Data and for responding to recipient, subscriber, and data subject requests unless BetterMail is required by law to respond directly.
• The customer must not provide sensitive personal information, payment card numbers, passwords, bank account numbers, government identifiers, health information, biometric information, children's information, or similar high-risk data unless BetterMail has expressly agreed in writing that the Services may be used for that data.

Processing details

• Subject matter: BetterMail's provision of email, transactional SMS, contact management, campaign, automation, API, reporting, hosted asset, tracking, support, and related Services.
• Duration: the term of the customer's use of the Services, plus the period required for deletion, backup expiry, legal compliance, billing records, suppression records, security records, and abuse prevention.
• Nature and purpose: hosting, storing, transmitting, sending, receiving, importing, exporting, analysing, securing, supporting, monitoring, reporting, suppressing, and otherwise processing Customer Personal Data to provide and protect the Services.
• Categories of data subjects: customer users, administrators, employees, contractors, agents, contacts, subscribers, recipients, prospects, customers of customers, and other people whose information is submitted to or generated through the Services.
• Categories of data: names, email addresses, phone numbers, company details, profile attributes, subscription preferences, list membership, consent records, suppression records, message content, transactional data, API data, import files, delivery events, bounces, complaints, unsubscribes, opens, clicks, IP addresses, device or mail-client data, logs, and support data.
• Special categories: the Services are not intended for special-category, sensitive, or high-risk personal information unless expressly agreed in writing.

Confidentiality

• BetterMail will ensure that people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.
• BetterMail will limit access to Customer Personal Data to personnel and providers who need access to provide, secure, support, monitor, or improve the Services, or to comply with law.

Security measures

• BetterMail will maintain reasonable technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse, and other security risks.
• Measures may include access controls, authentication, encryption in transit, logging, monitoring, backups, network security, vulnerability management, least-privilege access, staff access controls, and operational security processes.
• The customer is responsible for securing its own accounts, users, API keys, endpoints, integrations, devices, domains, DNS records, and systems that connect to BetterMail.

Sub-processors

• The customer authorises BetterMail to use sub-processors to provide, host, secure, support, monitor, analyse, deliver, bill, and operate the Services.
• The current non-exclusive list includes:

  Provider	Purpose	Processing role
  Amazon Web Services	Cloud hosting and infrastructure.	Sub-processor or related service provider.
  Stripe	Payment processing.	Sub-processor or related service provider.
  OpenAI	Some AI features in the BetterMail editor.	Sub-processor or related service provider.

• This list is not exclusive. BetterMail may use other providers where reasonably necessary to provide, secure, support, or operate the Services.
• BetterMail will use reasonable care when selecting sub-processors and will require them to protect Customer Personal Data under terms that are materially no less protective than this DPA, as applicable to the services they provide.
• BetterMail remains responsible for sub-processors' processing of Customer Personal Data to the extent required by applicable law and this DPA.
• If a customer reasonably objects to a new sub-processor on privacy or security grounds, the customer may stop using the affected Services or contact us to discuss commercially reasonable alternatives.

Overseas transfers

• Customer Personal Data may be processed in New Zealand and other countries where BetterMail or its sub-processors operate.
• Where the New Zealand Privacy Act 2020 applies, BetterMail will take reasonable steps to ensure overseas recipients protect personal information in a way that is comparable to the safeguards required by New Zealand privacy law, unless an exception or informed authorisation applies.
• Where United States, Australian, Singapore, Canadian, United Kingdom, European Union, or similar transfer rules apply, the customer and BetterMail will use legally recognised transfer mechanisms or safeguards where required.

Security incidents

• A Security Incident means a confirmed breach of BetterMail's security that results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data in BetterMail's systems.
• BetterMail will notify the customer without undue delay after confirming a Security Incident, unless notification is prohibited by law, security obligations, or confidentiality obligations.
• BetterMail will provide information reasonably available to help the customer assess the Security Incident and meet notification obligations.
• BetterMail's notification or cooperation is not an admission of fault or liability.

Assistance

• Taking into account the nature of the Services and information available to BetterMail, we will provide reasonable assistance to help the customer respond to data subject requests, privacy complaints, regulatory requests, security incidents, and data protection impact assessments where required by applicable law.
• We may charge reasonable fees for assistance that is outside standard support or caused by the customer's instructions, systems, breach, or non-compliance.

Deletion and return

• During the account term, customers may access, export, update, and delete many types of Customer Data through the Services.
• After termination or written request, BetterMail will delete or return Customer Personal Data within a reasonable period, unless retention is required or permitted by law, the Terms, backup cycles, billing obligations, security, dispute resolution, suppression, deliverability, or abuse prevention.
• Backup copies will be protected and deleted in accordance with ordinary backup retention cycles.

Audits and information

• BetterMail will make available information reasonably necessary to demonstrate compliance with this DPA where required by applicable law.
• The customer, or an independent third-party auditor reasonably acceptable to BetterMail, may audit BetterMail's compliance with this DPA no more than once in any 12-month period, or more often where a Security Incident has occurred or where required by applicable privacy or data protection law or a competent regulator.
• To request an audit, the customer must provide a detailed proposed audit plan at least 14 days before the proposed audit date. BetterMail and the customer will work together to agree a final audit plan, scope, schedule, participants, and confidentiality requirements.
• Audits must take place during BetterMail's regular business hours, be reasonable and proportionate, avoid unnecessary disruption to the Services, and not compromise BetterMail's security, other customers' data, third-party confidential information, or legal obligations.
• Where documentation, certifications, reports, security summaries, or written responses provided by BetterMail reasonably address the requested audit scope, the customer must use those materials before requiring a direct audit or inspection.
• Audits are at the customer's expense. The customer will reimburse BetterMail for time spent by BetterMail or its sub-processors in connection with an audit and for reasonable out-of-pocket expenses.

Government requests

• If BetterMail receives a legally binding request for Customer Personal Data, we may comply with that request.
• Where legally permitted and reasonably practicable, we will notify the customer before disclosing Customer Personal Data so the customer may seek protection or challenge the request.

Liability

The liability limits and exclusions in the Terms apply to this DPA unless applicable law requires otherwise.

Contact

Contact us about this DPA at privacy@bettermail.com.