Data Processing Addendum
Last updated: 28 October 2026
These terms are provided by Studio 404 d.o.o., Gradišče 15c, 1360 Vrhnika, Slovenia, EU, VAT ID SI42531357 ("SpacePost", "we", "us"), contact: legal@spacepost.dev.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Customer", controller) and Studio 404 d.o.o. ("SpacePost", processor) and applies to personal data in Customer Data that SpacePost processes when providing the Service. It is intended to meet Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Subject matter and details of processing
| Subject matter and purpose | Providing the email sending, delivery tracking, suppression, webhook and audience-management features of the Service. |
|---|---|
| Duration | The term of the agreement, plus the retention periods below. |
| Categories of data subjects | The Customer's recipients, contacts and users, and the Customer's own personnel. |
| Types of personal data | Email addresses, names and other data in message content, headers, attachments or contact properties; delivery and engagement events (delivery, bounce, complaint, open, click), IP and user-agent of recipients where tracking is enabled. |
| Special categories | Not intended. The Customer must not send special-category data unless it has a lawful basis and appropriate safeguards. |
2. Processor obligations
- Process personal data only on the Customer's documented instructions (the Terms, this DPA and the Customer's use of the Service), unless required by Union or Member State law, in which case we will inform the Customer unless prohibited.
- Ensure that persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures under Article 32, as described at /security, including encryption in transit and at rest, access control, hashed credentials, logging and abuse controls.
- Assist the Customer, taking into account the nature of processing, in responding to data-subject requests, and with security, breach notification, impact assessments and prior consultation (Articles 32 to 36).
- Notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Customer Data.
- Make available information necessary to demonstrate compliance and allow for audits, which will be conducted through written questionnaires and documentation; on-site audits only where legally required, with reasonable notice, at the Customer's cost and under confidentiality.
- Tell the Customer if, in our opinion, an instruction infringes data-protection law.
3. Sub-processors
The Customer gives general authorisation for the sub-processors listed on the sub-processors page. We impose data-protection obligations on each that are no less protective than this DPA, and remain responsible for them. We will give at least 30 days' notice of new or replacement sub-processors by updating that page and notifying account owners; the Customer may object on reasonable data-protection grounds within that period, and if the parties cannot agree, the Customer may terminate the affected Service.
4. International transfers
Email delivery runs in AWS eu-central-1 (Germany). The application and its database run in Railway's EU region (Amsterdam, Netherlands). If we or a sub-processor transfer personal data outside the EEA, the transfer relies on an adequacy decision or the Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module 3 where applicable), which are incorporated by reference, together with supplementary measures where needed.
5. Return and deletion
Email logs are deleted automatically after the retention period of the Customer's plan (30, 30 or 60 days). On termination, the Customer may export data for 30 days, after which we delete Customer Data, and backups within 35 days, unless law requires retention.
6. Customer obligations
The Customer is responsible for the lawfulness of its processing, including having a legal basis (and consent where required) for emailing its recipients, providing privacy information, and honouring opt-outs in accordance with the Acceptable Use Policy.
7. Liability and order of precedence
Liability under this DPA is subject to the limitations in the Terms of Service, except where law does not permit it. If this DPA conflicts with the Terms on data protection, this DPA prevails.
8. Contact
Data-protection requests: privacy@spacepost.dev. To obtain a countersigned copy of this DPA, write to legal@spacepost.dev.