Data Processing Agreement

This agreement forms part of the Terms of Service between you (the "controller") and [Company legal name pending], [registered address pending]. Contact: [contact e-mail pending] (the "processor"), and meets Article 28 of the UK GDPR and the EU GDPR.

1. Subject matter, nature and purpose

Receiving, storing and analysing DMARC aggregate reports about the controller's domains, to show which servers send e-mail using those domains and whether that e-mail is authenticated.

2. Duration

For as long as the controller's account exists, then until deletion under section 9.

3. Types of data and data subjects

IP addresses and host names of sending servers, domain names, message counts and authentication results. Data subjects are the operators of those servers; where a server is operated by an individual, an IP address can be personal data. Aggregate reports do not contain message content or recipient addresses. The service does not request forensic (ruf) reports; any that arrive are rejected and their raw copy is deleted within 7 days.

4. Processor obligations

• Process the data only on the controller's documented instructions, which are these terms and the controller's use of the service.
• Ensure that people with access are bound by confidentiality.
• Apply appropriate technical and organisational security measures (Annex A).
• Assist the controller with data subject requests and with security, breach notification and impact assessments, as far as the processor's information allows.
• Notify the controller of a personal data breach without undue delay, and where possible within 48 hours of becoming aware of it.
• Make available the information needed to demonstrate compliance and allow reasonable audits [scope and cost to be defined in legal review].

5. Sub-processors

The controller authorises the sub-processors listed in the Privacy Policy. The processor will give at least 30 days' notice by e-mail before adding or replacing one, and the controller may object and close the account.

6. International transfers

[Legal review: transfer mechanisms for each sub-processor outside the UK/EEA, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.]

7. Deletion and return

The controller can export the data at any time and delete it by deleting the domain or the account. Raw reports are deleted after the retention period stated in the Privacy Policy, processed data after about 13 months, and account data immediately when the account is deleted. [Backup retention to be stated once backups are in place.]

Annex A: security measures

• Encryption in transit (TLS) for every connection to the service.
• Reports treated as untrusted input: XML entity processing disabled, size and decompression limits.
• [To add once in place (phase 4): database access limited to the application, with a non-administrative database user.]
• Sign-in tokens and session ids stored only as hashes; no passwords stored.
• [To add once in place (phase 4): daily encrypted backups with tested restores, kept at most 30 days.]
• Dependency auditing and secret scanning on every change.