Data Processing Agreement (template)
About this template
This Data Processing Agreement (DPA) is for business customers who use Domailfix to check, find or clean email addresses and phone numbers of other people. It covers the points that data protection laws such as the GDPR (Article 28) and India's Digital Personal Data Protection Act, 2023 expect such an agreement to cover.
How to sign it: print it or save it as a PDF, fill in your details, sign it and email it to support@domailfix.com. We countersign and send it back. Have your own adviser review it; this template is not legal advice, and changes can be discussed.
1. Parties
Customer (the "Controller" or "Data Fiduciary"): ____________________ (company name), ____________________ (address), ____________________ (contact email).
Achivix, operating Domailfix, 69, Mayur Vihar Phase III, Kondli, New Delhi, Delhi 110096, India (the "Processor").
This DPA forms part of the Domailfix Terms of Use (the "Agreement") between the parties. If they conflict about personal data, this DPA wins.
2. What is processed and why
- Purpose: to provide the service the Customer uses: verifying email addresses, finding work email addresses from a name and company website, checking phone numbers, cleaning lists in the Customer's tools, enriching lists, and the related reports.
- Personal data: business email addresses, names, company websites, phone numbers and other columns the Customer chooses to upload; the results of checks; bounce and delivery outcomes the Customer shares.
- People concerned: the Customer's contacts, prospects, leads, customers and sign-ups.
- Special categories: none are needed. The Customer will not upload them.
- Duration: for as long as the Agreement runs, then as set out in section 9.
3. Instructions
The Processor processes the personal data only to provide the service and on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's use of the service. If the Processor believes an instruction breaks the law, it will tell the Customer. The Customer is responsible for having a lawful reason to process the data and to have it checked.
4. Confidentiality
Everyone the Processor allows to work on the personal data is bound to keep it confidential, and access is limited to the people who run the service.
5. Security
The Processor keeps appropriate technical and organisational measures, including:
- the service is served only over encrypted connections (HTTPS);
- passwords, API keys and sign-in tokens are stored as hashes; keys to the Customer's tools that are kept for automatic checks, and tool connections, are stored encrypted;
- uploaded lists and their results are held in the server's memory and deleted within 2 hours of finishing; check history is kept for 90 days, and the Customer can clear it at any time;
- access to the server is limited and protected;
- the Processor reviews these measures as the service and risks change.
6. Service providers (sub-processors)
The Customer allows the Processor to use these service providers. Each one is bound by terms that protect the data at least as well as this DPA:
- Hosting provider: runs the server the service lives on.
- Email provider (Google Workspace): sends account emails.
- Payment providers (Razorpay, Cashfree Payments, PayPal): only for the Customer's own purchases.
- Web search provider: used when public web sources are searched for an address or a name and company website.
- The mail servers of the addresses being checked: contacted to see whether a mailbox exists. No email is sent to the person.
The Processor will tell the Customer before adding or replacing a service provider, so the Customer can object. If the objection cannot be resolved, the Customer may stop using the service.
7. Helping the Customer
The Processor helps the Customer answer requests from the people concerned (to see, correct or delete their data), and with security, breach notification and data protection impact assessments, as far as it reasonably can given what it processes.
If a person contacts the Processor directly about data it processes for the Customer, the Processor will point them to the Customer, unless the law requires otherwise.
8. Personal data breaches
The Processor tells the Customer without undue delay after becoming aware of a breach affecting the Customer's personal data, with the information the Customer reasonably needs to meet its own duties, and takes reasonable steps to contain it.
9. Deletion at the end
When the Agreement ends, or when the Customer deletes its account, the Processor deletes the Customer's personal data, except records the law requires it to keep (such as invoices). Data the Customer wants to keep can be downloaded before then, from the account page.
10. Information and audits
The Processor makes available the information reasonably needed to show that it meets this DPA, and answers the Customer's reasonable written questions. Any audit beyond that is agreed in advance, at the Customer's cost, with reasonable notice and confidentiality.
11. Transfers
Where personal data from the EU, the UK or another country with transfer rules is processed outside it, the parties will use the transfer safeguards that law requires, such as the European Commission's standard contractual clauses, which the Processor will sign on request.
12. Liability and law
Each party's liability under this DPA is as set out in the Agreement. This DPA is governed by the laws of India, like the Agreement, unless the parties agree otherwise in writing.