Data Processing Agreement (DPA)

Version: 1.0 · Effective date: Oct. 15, 2026 · Last Updated: Oct. 16, 2026

This Data Processing Agreement ("DPA") explains how BlueFox Email processes personal data on behalf of its customers. It applies when you use BlueFox Email to store contacts, send emails, and track email activity for your own recipients. In that situation you decide why and how the personal data is processed, and we process it for you, following your instructions.

The DPA is written to meet the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). It draws on the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915), adapted to the BlueFox Email service. It is not an unmodified copy of those clauses.

This DPA does not cover personal data that BlueFox Email processes for its own purposes, such as your account details and billing. That processing is described in our Privacy Policy.

1. Parties and Introduction

1.1. This DPA is entered into between:

• Innovaris Group Korlátolt Felelősségű Társaság (short name: Innovaris Group Kft.), a limited liability company registered in Hungary, which uses the English name Innovaris Group LLC and operates the BlueFox Email service ("BlueFox Email" or the "Processor").
  • Registered office: 1095 Budapest, Mester utca 40-44. B. lház. II. emelet 10. ajtó, Hungary
  • Company registration number: 01-09-432032
  • Tax number: 32586174-2-43
  • EU VAT number: HU32586174
  • Contact for data protection matters: hello@bluefox.email
• The person or organization that has accepted the BlueFox Email Terms of Use (the "Customer" or the "Controller").

1.2. Innovaris Group Kft. is a Hungarian company established in the European Union. It is not a United States company.

1.3. This DPA forms part of the Terms of Use (together, the "Agreement"). It applies for as long as BlueFox Email processes Customer Personal Data in connection with the Services.

2. Definitions and Interpretation

2.1. In this DPA:

• "Applicable Data Protection Law" means the GDPR and any national law of an EU or EEA member state that supplements it, to the extent applicable to the processing of Customer Personal Data.
• "Customer Personal Data" means personal data that BlueFox Email processes on behalf of the Customer in connection with the Services, as described in Annex I.
• "Personal Data" has the meaning given to "personal data" in the GDPR.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Services" means the BlueFox Email platform and related services provided under the Terms of Use, including the website application at app.bluefox.email and the BlueFox Email APIs.
• "Subprocessor" means a third party engaged by BlueFox Email to process Customer Personal Data on BlueFox Email's behalf.
• "BYO SES" means the configuration in which the Customer connects its own Amazon Web Services (AWS) Simple Email Service (SES) account to BlueFox Email.
• "Managed SES" means the configuration in which emails are sent through AWS SES infrastructure configured and operated by BlueFox Email.

2.2. Terms such as "controller", "processor", "processing", "data subject", "supervisory authority", and "data protection impact assessment" have the meanings given to them in the GDPR.

2.3. This DPA is interpreted in line with Applicable Data Protection Law. It does not reduce the rights of data subjects or the obligations of either party under Applicable Data Protection Law.

3. Scope and Applicability

3.1. This DPA applies to the processing of Customer Personal Data by BlueFox Email on behalf of the Customer in connection with the Services.

3.2. This DPA does not apply to personal data that BlueFox Email processes as an independent controller, including:

• the Customer's account information, such as the names and email addresses of the Customer's users;
• billing, payment, and invoicing information;
• communications between the Customer and BlueFox Email, including support requests;
• BlueFox Email's own marketing and product communications to the Customer; and
• information about the use of the BlueFox Email website and application that BlueFox Email processes for its own purposes.

That processing is described in the Privacy Policy.

3.3. BlueFox Email also acts as an independent controller when it uses a limited set of information about the Customer's use of the Services, such as bounce and complaint events, sending volumes, and engagement statistics, for the following purposes only:

• preventing spam, fraud, and abuse of the Services;
• protecting the security of the Services and the sending reputation and deliverability of the Services for all customers;
• enforcing the Terms of Use;
• meeting the requirements of its email delivery providers and its legal obligations; and
• producing aggregated statistics that do not identify individual recipients, to operate and improve the Services.

BlueFox Email does not use Customer Personal Data to contact the Customer's recipients for its own purposes, or for advertising. This processing is described in the Privacy Policy.

4. Relationship Between Controller and Processor

4.1. For Customer Personal Data, the Customer acts as the controller and BlueFox Email acts as the processor. Where the Customer itself acts as a processor on behalf of a third party (for example, an agency sending on behalf of its clients), the Customer acts as processor and BlueFox Email acts as the Customer's subprocessor. In that case the Customer is responsible for obtaining any authorizations its own controller requires, and for passing on any instructions, notices, and requests between BlueFox Email and that controller.

4.2. The Customer determines the purposes and means of processing Customer Personal Data. The Customer is responsible for having a lawful basis for the processing, for providing any required information to data subjects, and for the lawfulness of the instructions it gives.

5. Subject Matter, Purpose, Nature, and Duration of Processing

5.1. The subject matter, purposes, nature, and categories of the processing are described in Annex I.

5.2. BlueFox Email processes Customer Personal Data only for as long as it provides the Services to the Customer, and afterwards only as needed to return or delete it in line with Section 15.

6. Controller Instructions and Obligations

6.1. BlueFox Email processes Customer Personal Data only on the Customer's documented instructions. The Customer's instructions are:

• the Agreement, including this DPA;
• the Customer's configuration and use of the Services, including through the user interface, the APIs, integrations, and webhooks; and
• any other written instructions that the parties agree in writing.

6.2. Additional instructions that go beyond the functionality of the Services, or that would require BlueFox Email to change the Services, require the parties' written agreement. BlueFox Email may charge for them if the parties agree to that in writing.

6.3. The Customer is responsible for:

• complying with Applicable Data Protection Law and with laws on electronic marketing communications when using the Services;
• ensuring that its instructions are lawful;
• ensuring that it has a lawful basis for each processing activity it instructs, including any required consent;
• the accuracy, quality, and lawfulness of the Customer Personal Data it provides;
• configuring the Services appropriately for the personal data it processes, including user access within its account; and
• responding to data subjects and supervisory authorities, with BlueFox Email's assistance as set out in this DPA.

6.4. The Services are not specifically designed for special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). If the Customer processes such data through the Services, the Customer is responsible for confirming that the measures in Annex II are appropriate for that data before doing so.

7. Processor Obligations

7.1. BlueFox Email will:

• process Customer Personal Data only on the Customer's documented instructions, including regarding transfers to third countries, unless EU or member state law to which BlueFox Email is subject requires otherwise. In that case BlueFox Email will inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest;
• not process Customer Personal Data for any purpose other than the purposes set out in this DPA, except for the limited purposes described in Section 3.3;
• not sell Customer Personal Data;
• implement the technical and organizational measures described in Section 9 and Annex II;
• engage Subprocessors only in line with Section 10;
• assist the Customer as described in Sections 12, 13, and 14;
• return or delete Customer Personal Data as described in Section 15; and
• make available the information described in Section 16.

7.2. Where the Customer's support requests or the maintenance of the Services require it, BlueFox Email administrators may access the Customer's account, limited to what is necessary for that purpose, as described in the Terms of Use.

8. Confidentiality

8.1. BlueFox Email will grant access to Customer Personal Data only to members of the BlueFox Email team and to Subprocessors who are involved in providing, maintaining, securing, or supporting the Services.

8.2. BlueFox Email will ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

9. Technical and Organizational Security Measures

9.1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks for data subjects, BlueFox Email will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

9.2. The measures are described in Annex II. BlueFox Email may update them over time, provided that the updates do not result in a lower overall level of protection of Customer Personal Data.

9.3. The Customer is responsible for the security of its own account credentials, API keys, and any credentials it controls, including credentials for its own AWS account when using BYO SES.

10. Subprocessors

10.1. General authorization. The Customer gives BlueFox Email general authorization to engage Subprocessors. The Subprocessors engaged when this DPA takes effect are listed in Annex III.

10.2. Changes. BlueFox Email will inform the Customer in advance of any intended addition or replacement of a Subprocessor, giving the Customer the opportunity to object. BlueFox Email will give this notice at least 30 days before the new Subprocessor begins processing Customer Personal Data, by email to the BlueFox Email Legal updates mailing list, to which the Customer's account owner is subscribed by default, and by updating Annex III on this page. If the Customer unsubscribes from the Legal updates list, it will not receive these notices by email, and it is responsible for checking Annex III for changes.

10.3. Objection. The Customer may object to a new Subprocessor on reasonable grounds relating to data protection by notifying BlueFox Email within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Services before the new Subprocessor begins processing Customer Personal Data. In that case, BlueFox Email will refund the unused part of any fees the Customer has prepaid for the terminated Services, such as unused sends from send packs and the remaining part of the current billing period of a monthly plan.

10.4. Obligations. BlueFox Email will engage Subprocessors only under a written contract that imposes on them, in substance, the same data protection obligations as this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. BlueFox Email remains responsible to the Customer for the performance of its Subprocessors' obligations.

10.5. Not Subprocessors. The following are not Subprocessors of BlueFox Email, because they receive personal data at the Customer's own instruction or under the Customer's own contracts:

• recipients' email service and mailbox providers that receive the emails the Customer sends;
• endpoints, applications, and services the Customer connects to the Services, such as webhook endpoints, Zapier, Supabase, AI agents, and other integrations the Customer configures; and
• services the Customer configures with its own account, such as a Cloudflare Turnstile widget used on the Customer's signup forms.

10.6. BYO SES. When the Customer uses BYO SES, emails are sent through the Customer's own AWS account under the Customer's own agreement with AWS. BlueFox Email transmits the relevant Customer Personal Data to the Customer's AWS account on the Customer's instruction, and processes the AWS credentials or role information and the delivery events needed to operate the integration. For processing that takes place within the Customer's AWS account, the Customer is responsible for its agreement with AWS, its choice of AWS region, and the safeguards that apply to that processing. AWS processes that data under the Customer's agreement with AWS and is not a Subprocessor of BlueFox Email for that processing.

11. International Personal Data Transfers

11.1. BlueFox Email primarily hosts Customer Personal Data in the European Union and European Economic Area. However, some processing in connection with the Services may take place outside the EEA, for example:

• email delivery and related event processing by Amazon Web Services for Managed SES, in the AWS region selected by the Customer. The available regions are currently eu-central-1 (Germany), which is the default, and us-east-1 (United States). Processing takes place in the United States only where the Customer selects us-east-1;
• delivery of emails to recipients whose email providers are located outside the EEA, which takes place at the Customer's instruction; and
• remote access to Customer Personal Data by independent contractors of BlueFox Email located in Egypt and India, who carry out development, support, and administration of the Services. They are Subprocessors and are listed in Annex III.

11.2. BlueFox Email will transfer Customer Personal Data to a country outside the EEA, or allow a Subprocessor to do so, only where the transfer complies with Chapter V GDPR, for example on the basis of an adequacy decision or appropriate safeguards such as the standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914. The transfer mechanism for each Subprocessor is listed in Annex III.

11.3. When the Customer uses BYO SES, the Customer chooses the AWS region and is responsible for the transfer safeguards under its own agreement with AWS.

12. Data Subject Rights and Assistance

12.1. Taking into account the nature of the processing, BlueFox Email will assist the Customer by appropriate technical and organizational measures, insofar as possible, to fulfil the Customer's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.

12.2. The Services include features the Customer can use to respond to such requests itself, including viewing, editing, exporting, and deleting contacts, managing subscriptions and unsubscribes, and managing the suppression list.

12.3. If BlueFox Email receives a request directly from a data subject about Customer Personal Data, it will promptly forward the request to the Customer, if it can identify the Customer, and will not respond to the request itself unless the Customer authorizes it to do so or the law requires it.

13. Personal Data Breach Notification and Assistance

13.1. BlueFox Email will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach.

13.2. The notification will be sent directly to the email address associated with the Customer's account owner, regardless of the Customer's mailing list preferences, and will include, to the extent available at that time:

• a description of the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned;
• the name and contact details of a contact point at BlueFox Email;
• the likely consequences of the breach; and
• the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

Where it is not possible to provide all of this information at the same time, BlueFox Email will provide it in phases without undue further delay.

13.3. BlueFox Email will cooperate with and assist the Customer in meeting its obligations under Articles 33 and 34 GDPR, taking into account the nature of the processing and the information available to BlueFox Email.

13.4. Notification of a Personal Data Breach is not an acknowledgement of fault or liability by BlueFox Email.

14. DPIAs and Supervisory Authority Consultations

14.1. Taking into account the nature of the processing and the information available to it, BlueFox Email will provide reasonable assistance to the Customer with:

• data protection impact assessments under Article 35 GDPR relating to the Customer's use of the Services; and
• prior consultations with supervisory authorities under Article 36 GDPR.

14.2. BlueFox Email will primarily provide this assistance by making available the information in this DPA and its annexes. Further assistance may be agreed in writing.

15. Return and Deletion of Customer Personal Data

15.1. Return. During the term of the Agreement, the Customer can export Customer Personal Data using the functionality available in the Services: contacts and suppression lists can be exported, templates can be downloaded, and email events can be received as they happen through webhooks. The Customer is responsible for exporting any data it wishes to keep before deleting its account or before the Agreement ends. If the Customer needs a copy of Customer Personal Data that it cannot export itself, such as historical email events, it may request it at hello@bluefox.email before deleting its account. BlueFox Email will then provide the data in a common machine-readable format within 30 days.

15.2. Deletion from active systems. When the Customer deletes its BlueFox Email account, BlueFox Email deletes the Customer Personal Data associated with that account from its active production systems immediately. Data the Customer deletes within the Services during the term (for example, individual contacts) is deleted from active production systems in line with the functionality of the Services.

15.3. Backups. BlueFox Email creates backups of its production systems to protect against data loss. Customer Personal Data deleted from active production systems may remain in existing backups until those backups are deleted in the ordinary backup cycle, which will be no later than 13 months after deletion from active systems. Backups are kept on the following schedule: hourly backups for up to 48 hours, daily backups for 7 days, weekly backups for about 1 month, and monthly backups for 12 months, after which they are deleted automatically. While Customer Personal Data remains in backups, BlueFox Email will:

• keep it protected by the measures in Annex II;
• restrict access to it to personnel who need that access to maintain or restore backups; and
• not process it for any purpose other than storage and, where necessary, restoration of the Services.

By accepting this DPA, the Customer instructs BlueFox Email to keep Customer Personal Data in backups for the limited period and under the conditions set out in this Section 15.3, solely for disaster recovery.

15.4. Restoration from backups. If BlueFox Email restores data from a backup, for example after an incident, it will take steps to ensure that Customer Personal Data that had already been deleted from active systems before the restoration is not reinstated in active systems and is deleted again without undue delay. To do so, BlueFox Email keeps a record of deletions outside its backups and applies it after any restoration.

15.5. Legal retention. BlueFox Email may retain Customer Personal Data where EU or member state law requires it to do so. In that case, the protections of this DPA continue to apply to the retained data, and BlueFox Email will process it only for the purpose for which retention is required.

16. Audit Rights and Compliance Information

16.1. BlueFox Email will make available to the Customer the information necessary to demonstrate compliance with the obligations set out in Article 28 GDPR and this DPA. BlueFox Email will primarily do so by providing this DPA, its annexes, and written answers to reasonable questions from the Customer about the processing of Customer Personal Data.

16.2. Where this information is not sufficient to demonstrate compliance, or where a supervisory authority requires it, BlueFox Email will allow for and contribute to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer, subject to the following:

• the Customer gives reasonable advance written notice and a proposed scope;
• the audit is conducted during normal business hours, without unreasonably disrupting BlueFox Email's operations, and respects the confidentiality of other customers' data and of BlueFox Email's security information;
• any auditor is bound by appropriate confidentiality obligations and is not a competitor of BlueFox Email; and
• unless the audit is required by a supervisory authority or follows a Personal Data Breach, audits take place no more than once in any 12-month period, and each party bears its own costs.

16.3. Nothing in this Section limits the rights of supervisory authorities under Applicable Data Protection Law.

17. Handling Unlawful Instructions

17.1. BlueFox Email will immediately inform the Customer if, in its opinion, an instruction from the Customer infringes Applicable Data Protection Law. BlueFox Email is not required to carry out such an instruction until the Customer confirms or changes it, and BlueFox Email may suspend the affected processing in the meantime.

17.2. If BlueFox Email cannot comply with this DPA for any reason, it will inform the Customer without undue delay. The Customer may then suspend the transfer of Customer Personal Data to BlueFox Email until compliance is restored, or terminate the affected Services if compliance is not restored within a reasonable time.

18. Liability and Relationship with the Terms of Use

18.1. This DPA forms part of the Terms of Use. Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability in the Terms of Use, to the extent permitted by Applicable Data Protection Law.

18.2. Nothing in this DPA limits the rights of data subjects, including their right to compensation under Article 82 GDPR, or the powers of supervisory authorities.

18.3. If there is a conflict between this DPA and the Terms of Use regarding the processing of Customer Personal Data, this DPA prevails. If there is a conflict between this DPA and Applicable Data Protection Law, Applicable Data Protection Law prevails.

19. Governing Law, Disputes, and Mandatory Data Protection Law

19.1. This DPA is governed by the laws of Hungary, in line with the Terms of Use. Disputes arising out of or in connection with this DPA are resolved by the courts of Hungary.

19.2. This Section does not affect any mandatory provisions of Applicable Data Protection Law, the rights of data subjects, or the competence of supervisory authorities.

20. Entry into Force, Contractual Acceptance, and Amendments

20.1. Acceptance. This DPA is incorporated into the Terms of Use. A Customer that accepts the Terms of Use also accepts this DPA. No separate signature is required. Acceptance of the Terms of Use, including electronically, satisfies the requirement in Article 28(9) GDPR that this DPA be in writing.

20.2. Entry into force. This DPA takes effect on the effective date stated at the top of this page for Customers who accept the Terms of Use on or after that date. For Customers who accepted the Terms of Use before that date, BlueFox Email gives at least 30 days' notice by email, and this DPA applies to them from Nov. 16, 2026. Continued use of the Services after Nov. 16, 2026 constitutes acceptance of this DPA. A Customer that does not agree may close its account before that date.

20.3. Amendments. BlueFox Email may update this DPA:

• to reflect changes in Applicable Data Protection Law, guidance from supervisory authorities, or court decisions;
• to reflect changes to the Services or to Subprocessors, in line with Section 10; or
• for other reasons, provided that the update does not materially reduce the protection of Customer Personal Data.

BlueFox Email will notify the Customer of material changes by publishing the updated DPA on this page and by email to the Legal updates mailing list at least 30 days before they take effect, unless a shorter period is required by law. If the Customer unsubscribes from the Legal updates list, it will not receive these notices by email, and it is responsible for checking this page for changes. Each version of this DPA is identified by its version number and effective date at the top of this page. If the Customer does not agree to a material change, it may terminate the Services before the change takes effect, and BlueFox Email will refund the unused part of any prepaid fees as described in Section 10.3. Continued use of the Services after the change takes effect constitutes acceptance.

20.4. Severability. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions remain in effect.

Annex I: Description of Processing

Item	Description
Controller	The Customer (or, where the Customer acts as a processor for its own client, that client, with the Customer acting as processor)
Processor	Innovaris Group Kft. (Innovaris Group LLC), operating BlueFox Email
Subject matter	Provision of the BlueFox Email email platform to the Customer
Duration	The term of the Agreement, and afterwards until Customer Personal Data is returned or deleted in line with Section 15
Frequency	Continuous, for as long as the Customer uses the Services

Purposes of processing

• Storing and managing the Customer's contacts, mailing lists, contact properties, and subscription preferences.
• Creating, editing, and storing email templates and email content.
• Sending transactional, triggered, automated, and campaign emails on the Customer's behalf, including through the APIs.
• Personalizing emails using contact data and data the Customer provides.
• Processing delivery, bounce, complaint, unsubscribe, open, and click events, and providing email engagement analytics.
• Managing unsubscribes, paused subscriptions, and the suppression list.
• Providing signup forms and subscription preference pages.
• Sending event data to webhooks and integrations the Customer configures.
• Operating the BYO SES integration where the Customer uses it.
• Providing support to the Customer and maintaining and securing the Services.

Nature of processing

Collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (sending emails and webhook events), alignment or combination, restriction, erasure, and destruction, carried out by automated means through the Services.

Categories of data subjects

Depending on how the Customer uses the Services:

• newsletter subscribers;
• marketing contacts;
• recipients of transactional emails;
• the Customer's employees;
• the Customer's users and customers; and
• other individuals whose personal data the Customer processes through the Services.

Categories of personal data

Depending on how the Customer uses the Services:

• email addresses;
• names;
• custom contact properties defined by the Customer;
• mailing list membership;
• subscription status and preferences;
• email content and personalization values;
• campaign and transactional email metadata;
• delivery, bounce, complaint, and unsubscribe events;
• email opens and clicks;
• IP addresses, timestamps, user agent data, and other technical identifiers associated with these events; and
• other personal data the Customer provides through supported functionality.

Special categories of personal data

The Services are not designed for special categories of personal data. See Section 6.4.

Annex II: Technical and Organizational Measures

Area	Measures
Authentication	Users sign in with email and password, or with Google. Passwords are stored hashed. Customers can enable multi-factor authentication for their accounts.
Authorization and least privilege	Each Customer's data is held in its own account and projects, and the Customer manages which users can access its account and with which role (Admin or User, and Editor or Viewer access for clients). Within BlueFox Email, access to Customer Personal Data is limited to members of the BlueFox Email team (see Section 8.1).
Administrative access	BlueFox Email administrators may access a Customer's account only as needed to resolve support requests or maintain the Services. Team members sign in to the internal administration dashboard with individual Google accounts, with 2-step verification enforced. Server access is over SSH with key-based authentication only, and is limited to two people (the founder and the CTO). Administrative dashboard and server logins are logged. Access is revoked immediately when a team member leaves.
Credential protection	AWS SES credentials provided for BYO SES are stored encrypted. Cloudflare Turnstile secret keys configured for signup forms are encrypted at rest and never returned through the API. BYO SES can use AWS STS role-based temporary credentials instead of long-lived access keys.
API and webhook security	Access to the APIs requires an API key. Webhook requests are authenticated with an API key the Customer selects, sent as a Bearer token.
Encryption in transit	The web application, the APIs, and webhooks are served over HTTPS only.
Encryption at rest	Database and server disks are encrypted at rest. Backups are encrypted. Devices used by team members have full-disk encryption.
Infrastructure security	Servers are hosted by netcup in Nuremberg, Germany (see Annex III). A firewall exposes only the ports the Services need. Server operating systems and software dependencies are updated regularly.
Separation of customer data	Customer data is logically separated by account and project in the application.
Logging and monitoring	Administrative dashboard and server logins are logged. Monitoring alerts the team to outages and errors.
Handling of data on team devices	Customer Personal Data is downloaded to team members' devices only when needed for a specific task, such as a support request, and is deleted afterwards. These devices have full-disk encryption.
Development and testing	Development and testing do not use copies of production Customer Personal Data.
Backups	Production data is backed up to a separate server in Nuremberg, Germany. Backups are encrypted, and access is limited to the founder and the CTO. Backups are kept for up to 48 hours (hourly), 7 days (daily), about 1 month (weekly), and 12 months (monthly), and are then deleted automatically (see Section 15.3).
Incident detection and response	Monitoring alerts the team to outages and errors. The founder is responsible for assessing security incidents and for notifying affected Customers of Personal Data Breaches under Section 13.
Business continuity and disaster recovery	Daily backups are kept on a separate server, and restoration from backup has been tested. No specific recovery time or recovery point objective is committed to.
Confidentiality of personnel	Team members and contractors with access to Customer Personal Data are bound by written confidentiality obligations.
Secure deletion	Customer data is deleted from active production systems when the Customer deletes its account, and from backups when those backups expire, no later than 13 months after deletion (see Section 15.3). Deleted data is not reinstated after a restoration (see Section 15.4).
Email-specific safeguards	The Services process bounces and complaints, maintain a suppression list, honor unsubscribes, and offer double opt-in and CAPTCHA protection for signup forms.

Annex III: Subprocessors

Subprocessor	Processing	Personal data	Location	Transfer safeguards
netcup (netcup.com): netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany	Server hosting for the application, databases, Customer data, and backups	All categories in Annex I	Nuremberg, Germany	Data processing agreement with netcup. Processing within the EU
Amazon Web Services (aws.amazon.com/ses), Managed SES only: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg	Email sending and transmission, and delivery, bounce, and complaint event processing	Email addresses, email content and personalization values, email metadata, delivery events	Germany (eu-central-1), or United States (us-east-1) where the Customer selects it	AWS GDPR Data Processing Addendum, and the standard contractual clauses (Implementing Decision (EU) 2021/914) included in the AWS Service Terms, for processing in us-east-1
Ahmed Qudaih, independent contractor	Development, support, and administration of the Services, including remote access to Customer Personal Data	All categories in Annex I, to the extent needed for the task	Egypt (remote access)	Standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3, processor to processor) and a transfer impact assessment
Parth Tiwari, independent contractor	Development, support, and administration of the Services, including remote access to Customer Personal Data	All categories in Annex I, to the extent needed for the task	India (remote access)	Standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3, processor to processor) and a transfer impact assessment

AWS acts as a Subprocessor of BlueFox Email for emails sent through Managed SES. For emails sent through BYO SES, see Section 10.6. The independent contractors access Customer Personal Data remotely.

Contact

If you have any questions about this DPA, please contact us at hello@bluefox.email.

See also: Terms of Use · Privacy Policy · Refund Policy