Data Processing Agreement (DPA)

Version 1.0 · Last updated: October 2, 2026

Effective date	Upon acceptance of the Terms of Service
Parties	Destinatarium (Processor) / Customer (Controller)
Applicable regulations	GDPR Art. 28 · Brazil LGPD · Argentina Law 25,326

1. Definitions

Term	Definition
Controller	The Customer that contracts Destinatarium's services and determines the purposes and means of processing personal data.
Processor	Destinatarium, insofar as it processes personal data on the Controller's behalf and instructions.
Personal Data	Information relating to identified or identifiable natural persons, including names, email and IP addresses, and sending metadata.
Processing	Any operation on Personal Data, automated or otherwise, including collection, recording, storage, transmission, and deletion.
Subprocessor	A third party engaged by Destinatarium to perform part of the Personal Data Processing for the Customer.
Security Incident	A security breach causing destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
GDPR	European Union General Data Protection Regulation (2016/679).
LGPD	Brazil's General Data Protection Law (Law 13,709/2018).
Law 25,326	Personal Data Protection Law of the Argentine Republic.

2. Purpose and scope

2.1 Purpose. This DPA governs Destinatarium's processing of Personal Data as Processor, on the Customer's behalf and documented instructions, while providing bulk and transactional email infrastructure.

2.2 Incorporation. This DPA forms an integral part of Destinatarium's Terms of Service ("ToS"). This DPA prevails over the ToS in the event of a conflict concerning data protection.

2.3 Documented instructions. Destinatarium processes Personal Data only on the Customer's documented instructions unless applicable law requires otherwise, in which case Destinatarium will notify the Customer beforehand unless prohibited by law.

3. Nature and purpose of processing

Data subjects	Final recipients of emails sent by the Customer and contacts on Customer distribution lists.
Data categories	Email address, name if provided, IP address, device data, open/click metadata, and sending timestamps.
Purposes	Bulk and transactional email delivery, deliverability analysis, bounce and complaint management, and anti-spam compliance.
Duration	For the Customer contract term, under the current Data Retention Policy.
Sensitive data	No special categories of data are processed in the ordinary provision of the Service.

4. Destinatarium's obligations

4.1 Confidentiality. Personnel authorized to process Personal Data are bound by contractual or statutory confidentiality duties.

4.2 Technical and organizational security. Destinatarium maintains measures appropriate to the risk, including TLS 1.2+ in transit, logical separation between customers, two-factor authentication for administrative access, and audit logs.

4.3 Subprocessors. Destinatarium may engage Subprocessors only in accordance with section 6 and the current Subprocessors List.

4.4 Assistance. To the extent possible, Destinatarium will assist the Customer with data-subject requests for access, correction, deletion, objection, and portability and with impact assessments (DPIAs) where required.

4.5 Incident notification. After becoming aware of a Security Incident affecting Customer Personal Data, Destinatarium will notify the Customer without undue delay and no later than 72 hours after awareness, with the information then available.

4.6 Deletion or return. After the Service ends, Destinatarium will delete or return all Personal Data as expressly instructed by the Customer unless retention is legally required.

5. Customer (Controller) obligations

5.1 Legal basis. The Customer warrants that it has a valid legal basis for Personal Data sent to Destinatarium, such as consent, contract, legitimate interest, or another applicable basis.

5.2 Data quality. The Customer is responsible for the accuracy, lawfulness, and relevance of Personal Data uploaded or transmitted through the Services.

5.3 Anti-spam compliance. The Customer must comply with applicable anti-spam law, including obtaining recipients' prior consent when required.

5.4 International transfers. For data originating in the EU, Brazil, or another similarly regulated jurisdiction, the Customer warrants that transfers to Destinatarium comply with required mechanisms.

6. Subprocessors

6.1 General authorization. The Customer authorizes Destinatarium to engage Subprocessors subject to the current Subprocessors List.

6.2 Change notice. Destinatarium will give at least 14 days' notice of a new or replacement Subprocessor. The Customer may object during that period.

6.3 Responsibility. Destinatarium is responsible to the Customer for its Subprocessors' data-protection compliance to the same extent as if Destinatarium performed the processing directly.

7. International transfers

Destinatarium processes and stores data on servers in Argentina, which the European Commission recognized as providing adequate data protection in Decision 2003/490/EC. When using Subprocessors outside Argentina or the EU, Destinatarium will ensure appropriate transfer mechanisms under applicable law, such as Standard Contractual Clauses or equivalents.

8. Governing law and jurisdiction

This DPA is governed by the law of the Argentine Republic and is consistent with GDPR Article 28, Brazil's LGPD, and Law 25,326. Any dispute will be submitted to the ordinary courts of [JURISDICTION PENDING — see AUP §24], waiving any other venue.

Annex A — Technical and organizational measures

TLS 1.2 or higher encryption in transit.
AES-256 encryption at rest.
Multifactor authentication for administrative access.
Logical separation of customer data.
Audit logs for access and administrative operations.
Periodic security reviews and vulnerability management.
A documented security incident response plan.
Data-protection training for personnel with access to Personal Data.
Confidentiality agreements with personnel and contractors.
Encrypted backups with restricted access.