Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SplashSend (“Processor”) and the customer (“Controller”) for the processing of personal data. This DPA applies where the Processor processes personal data on behalf of the Controller in connection with the services provided.

2. Definitions

“Personal Data”, “Processing”, “Controller”, “Processor”, and “Data Subject” have the meanings given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

3. Scope and purpose of processing

The Processor processes Personal Data on behalf of the Controller solely for the purpose of providing the email marketing services described in the Terms of Service. This includes storing contact data, sending marketing emails, tracking email engagement metrics, and managing subscription preferences.

4. Types of personal data processed

The following categories of personal data are processed: email addresses, names, custom contact properties defined by the Controller, email engagement data (opens, clicks, bounces), subscription preferences, and any additional data the Controller chooses to import or collect via signup forms. Where the Controller has connected Shopify, processing also includes customer purchase history and product catalogue data used solely for audience segmentation, campaign personalisation, and revenue attribution.

5. Duration of processing

Processing continues for the duration of the service agreement. Upon termination, the Controller may export all personal data using the data export feature. All personal data is permanently deleted within 30 days of account closure unless a longer retention period is required by law.

6. Obligations of the Processor

SplashSend shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure that persons authorised to process Personal Data have committed themselves to confidentiality
• Implement appropriate technical and organisational security measures
• Assist the Controller in responding to data subject requests (access, rectification, erasure, portability)
• Delete or return all Personal Data upon termination of the agreement
• Make available all information necessary to demonstrate compliance with these obligations

7. Sub-processors

SplashSend uses the following sub-processors to deliver the service:

• Amazon Web Services (AWS SES) — Email delivery infrastructure. Data processed: email addresses, email content. Region: EU (eu-west-2, London).
• Railway — Application hosting and database infrastructure. Data processed: all personal data stored in the service. Region: EU.
• Clerk — User authentication. Data processed: admin user email and name. Region: US.
• Cloudflare — Image hosting and CDN. Data processed: uploaded media assets. Region: Global CDN.
• Stripe — Payment processing and billing. Data processed: customer name, email address, and payment information. Region: US/EU.

The Controller is deemed to have given general written authorisation for the use of these sub-processors. SplashSend will notify the Controller before engaging any new sub-processor, giving the Controller the opportunity to object.

8. Data transfers

Where Personal Data is transferred outside the European Economic Area (EEA), SplashSend ensures that adequate safeguards are in place — including the EU-US Data Privacy Framework (where the receiving provider is certified) and/or Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Security measures

SplashSend implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: encryption of data in transit (TLS), access controls and authentication, regular security assessments, and incident response procedures.

10. Data breach notification

SplashSend shall notify the Controller without undue delay after becoming aware of a personal data breach, and in any event within 72 hours. The notification shall describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

11. Contact

For questions about this Data Processing Agreement, please contact us at hello@splashsend.com.