Data processing agreement

Version: [VERSION], [DATE]

This agreement applies when you use eoinbox to process personal data for which you are the controller, for example as a sole trader using eoinbox for business mail, and it forms part of the Terms of service.

1. Parties

• Controller: the eoinbox customer ("you").
• Processor: [COMPANY NAME], [REGISTERED ADDRESS], company number [REGISTRATION NUMBER] ("we").

2. Subject matter and duration

We process personal data to provide the eoinbox service for as long as your account exists, and afterwards only as long as needed to delete it under section 9.

3. Nature and purpose

Receiving, storing, filtering, indexing, forwarding and sending email; managing domains and addresses; providing API, JMAP and MCP access you set up.

4. Types of data and data subjects

• Data: names, email addresses, message content and attachments, metadata such as IP addresses and timestamps, and any personal data contained in messages.
• Data subjects: you, the people you correspond with, and people mentioned in messages.

5. Our obligations

We will:

• process personal data only on your documented instructions, which are given by your use and configuration of the service;
• ensure people with access are bound by confidentiality;
• apply the technical and organisational measures in Annex 1;
• assist you with data subject requests and with your obligations under Articles 32 to 36 GDPR, as far as reasonably possible;
• notify you without undue delay, and within [HOURS] hours, after becoming aware of a personal data breach affecting your data;
• make available the information needed to demonstrate compliance, and allow audits under [AUDIT TERMS].

6. Sub-processors

You authorise the sub-processors listed in Annex 2. We will inform you of intended changes at least [NOTICE PERIOD] in advance, and you may object.

7. Location of processing

Personal data is stored and processed in the European Union. [DESCRIBE any transfer outside the EU and the safeguard used, if applicable.]

8. Your obligations

You are responsible for having a legal basis for the personal data you process with eoinbox, and for the instructions you give, including connecting third-party tools such as AI assistants.

9. Deletion

When your account is deleted, we delete personal data within [DELETION PERIOD], including from backups within [BACKUP RETENTION], unless the law requires us to keep it. You can export your data before deletion.

Annex 1: Technical and organisational measures

[TO BE COMPLETED: encryption in transit (TLS) and at rest, access control and logging, two-factor authentication for staff, network separation, backups and restore testing, incident response, vulnerability management.]

Annex 2: Sub-processors

Signature

[TO DECIDE: accepted electronically in account settings, or signed copy on request via legal@eoinbox.com.]