Data Processing Agreement

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject", "sub-processor" and "personal data breach" have the meanings given in Data Protection Law. "Services" means the email migration, deliverability, security, sending, relay, monitoring and managed email services we provide to you.

2. Roles and scope

You are the controller (or a processor acting for your own customer), and Mailoza is your processor (or sub-processor) for personal data processed to deliver the Services. When we send, relay, route or monitor email on your behalf, we process personal data about your recipients — for example their email addresses, and the content and metadata of the messages you ask us to handle — strictly to deliver the Services you have instructed. Each party will comply with its obligations under Data Protection Law.

3. Our processing obligations

As your processor, Mailoza will:

• process personal data only on your documented instructions (including this DPA and the Services Agreement), unless required by law — in which case we will notify you where permitted;
• ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures (see section 7);
• respect the conditions for engaging sub-processors set out below;
• assist you, by appropriate measures, to respond to data-subject rights requests;
• assist you with security, breach notification, data-protection impact assessments and prior consultation, taking into account the information available to us;
• at your choice, delete or return personal data at the end of the Services and delete existing copies, unless retention is required by law;
• make available information reasonably necessary to demonstrate compliance, and allow for and contribute to audits as described below.

4. Your obligations

You warrant that you have a valid lawful basis and all necessary consents or opt-ins for the personal data you provide and for the messages we send on your behalf; that your recipients have agreed to receive your email where consent is required; that your instructions are lawful; and that you comply with our Acceptable Use Policy, including its anti-spam and consent-based sending rules, and with applicable law.

5. Sub-processors

You provide general authorisation for Mailoza to engage sub-processors to deliver the Services. We will impose data-protection terms on each sub-processor no less protective than this DPA and remain responsible for their performance. Current categories of sub-processor include:

• infrastructure and application hosting providers;
• outbound email delivery, relay and inbound filtering providers;
• DNS, authentication and deliverability-reporting providers;
• monitoring, logging and alerting providers;
• customer-relationship and support tooling used to administer your account.

A current, named list of our sub-processors and their processing locations is available to customers on request and is provided as part of onboarding. We will give you advance notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds.

6. International transfers

We aim to process personal data within the UK and EEA. Where processing involves transferring personal data outside those areas, the parties will put in place an approved transfer mechanism — such as the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses — or rely on an adequacy decision.

7. Security measures

Taking into account the state of the art and the risks of processing, we maintain appropriate technical and organisational measures, which may include: access controls and least-privilege permissions; encryption of data in transit, and at rest where supported; network and application security controls; email authentication (such as SPF, DKIM and DMARC) for the systems we operate; logging and monitoring; secure development and change management; vendor due diligence; and staff confidentiality and awareness. The specific measures for an engagement are set out in the signed DPA.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and provide the information reasonably available to us to help you meet your own notification obligations to regulators and data subjects.

9. Audits

We will make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior notice, subject to confidentiality and to not compromising other customers' security. Where available, we may satisfy audit requests by providing relevant third-party reports or documentation.

10. Processing details

• Subject matter and duration: provision of the Services for the term of the Services Agreement.
• Nature and purpose: migrating, configuring, securing, sending, relaying, routing and monitoring email on your behalf, and related support.
• Types of personal data: contact identifiers (such as names and email addresses), message content and metadata, delivery and engagement events, and other data you choose to process through the Services. Special-category data should not be processed through the Services unless expressly agreed.
• Categories of data subjects: your recipients, customers, prospects, end users and staff whose data is processed through the Services.

11. Liability, term and governing law

This DPA is effective for as long as we process personal data for you and is subject to the liability provisions of the Services Agreement. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, unless the Services Agreement states otherwise.

12. Contact

To request a signed DPA or ask about our processing, contact Mailoza:

• Email:
• Phone:

See also our Privacy Policy and Acceptable Use Policy.

Part of Ozavion Limited.
Ozavion Limited · Registered in England and Wales · Company No. 16814450 · Registered office: 86-90 Paul Street, London, EC2A 4NE, United Kingdom