BigMailer.io Data Processing Agreement 

Posted Date: November 16, 2022

Effective Date: November 16, 2022

Last Updated Date: February 23, 2024

This Data Processing Agreement, it Annexes, and Appendixes (the “DPA”) is between BigMailer.io, owned or controlled by Founder Bits Inc., or its affiliated companies (“Founder Bits” or “BigMailer.io” or “Service Provider” or “Processing Party” or “we” or “our” or “us”) and the BigMailer.io customer or user (the “Customer” or “User” or “you” or “your”).   This Agreement is pursuant to the Terms of Use and Privacy Policy hereinafter referred to as the “Terms” which are updated from time to time by the Service Provider. This DPA supplements and forms part of the Terms of Use.

The Parties to this DPA hereby agree to be bound by the terms and conditions herein as applicable with effect from November 16, 2022  or the effective date of the Terms of Use (whichever is later) (the “Effective Date”). We may amend this DPA from time to time due to changes in Applicable Data Protection Laws or as otherwise determined by us in our commercially reasonable discretion. Any amendment will only become effective upon notification to you (by posting on our website) and, if you do not agree to any such amendment, you should stop using our Services and contact us to cancel your account.

Under the Terms, Service Provider shall provide the User with services which involve Email Services and therefore, the Service Provider will process the personal data collected by the User.  As a result of providing Email Service to the User, the Service Provider will store, and process certain personal information of Customer as described below:

1. Definitions
   For the purposes of this DPA, the following expressions bear the following meanings unless expressly stated otherwise:“Applicable Data Protection Laws” means the data protection laws of various jurisdictions that are applicable to the Service Provider, as determined by the Service Provider in its sole discretion, including without limitation, the General Data Protection Regulation 2016/679 (“GDPR”), the California Consumer Privacy Act (“CCPA”), the UK Data Protection Act 2018 and UK General Data Protection Regulation (“UK GDPR”)  and any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, or rule applicable to Customer’s use of the Services.“Customer Personal Data” means Personal Data (as the term is defined in the GDPR, CCPA or other applicable law) provided by Customer to Service Provider for Processing on behalf of Customer pursuant to the Terms of Use.
   “Data Controller” means any entity that alone or jointly with others determines the purposes and means of Processing.“Data Processor” means the entity which Processes Personal Data on behalf of the Data Controller.“Data Subject” means an identified or identifiable natural person whose rights are protected by the Applicable Data Protection Law.“Data Subject Rights” means those rights identified in the Applicable Data Protection Law granted to Data Subjects.

    

   “Personal Data” or “Data” means information that directly or indirectly identifies or relates to a Data Subject.

   “Supervisory Authority” means an independent public authority which is established pursuant to Applicable Data Protection Law,

   “Third Party” means a natural or legal person other than the Data Subject, Controller, Processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

2. The Customer Personal Data Processed by Service Provider will be subject to the following basic Processing activities: operations necessary for the provision of the Services under the Terms of Use by Service Provider, including the storage, retrieval, use, disclosure, erasure, destruction, and access of the Customer Personal Data.
3. This DPA shall apply to all Customer Personal Data provided to Service Provider for the purposes of the provision of the Services under the Terms of Use (the “Permitted Purpose”). Customer as a Data Controller or acting on behalf of a Data Controller appoints Service Provider as a Data Processor to Process the Customer Personal Data on Customer’s behalf. In some circumstances, Customer may be a Data Processor; in this case, Customer appoints Service Provider as a Subprocessor. In both cases, Service Provider remains a Data Processor with respect to Customer for the Processing activities under this DPA. If there are other Data Controllers, Customer will identify and inform Service Provider of any such other Data Controllers upon request from the Service Provider. If Customer is acting on behalf of other Data Controllers, then Customer shall act as Service Provider’s main point of contact for all other Data Controllers and notice to Customer shall constitute notice to the Data Controller.
4. The Customer Personal Data Processed by Service Provider includes and shall be limited to the following categories of data: (i) identification and contact information (such as name, email address, address, title, contact details, and any custom fields) of Customer’s customers and other contacts; and (ii) information gathered in connection with the provision of services to Customer relating to Customer’s contacts, including (a) analytics and information about marketing emails and other campaigns sent by Service Provider on behalf of Customer (including open rates and similar usage data) and (b) device, browser and information related to Customer’s contacts identified through use of the Services.
5. Service Provider shall process Customer Personal Data on Customer’s instructions and in compliance with Applicable Data Protection Laws.  The Service Provider undertakes to process the personal data entrusted solely for the purposes of the services provided and only insofar as is necessary to fulfill these purposes.
6. Conditions of Processing
   This DPA governs the terms under which Service Provider is required to Process Customer Personal Data on behalf of Customer. In the event of any conflict or discrepancy between the terms of the Terms of Use and this DPA, the terms of this DPA shall prevail, to the extent of the conflict. In the event of any conflict or discrepancy between this DPA and any applicable Model Clauses, the terms of the Model Clauses shall prevail to the extent of the conflict.
7. Service Provider’s Obligations
   Service Provider shall only Process Customer Personal Data on behalf of Customer and in accordance with, and for the purposes set out in, the documented instructions received from Customer from time to time. If Service Provider becomes aware that Customer’s instruction violates Applicable Data Protection Laws, Service Provider agrees to inform Customer of its inability to comply as soon as reasonably practicable at the email address provided by Customer to Service Provider.

    

   1. Service Provider shall ensure that its personnel who are authorized to Process the Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
   2. Service Provider shall implement and hold in force for the term of this DPA specific technical and organizational security measures as required by the Applicable Data Protection Laws.
   3. Upon receipt by Service Provider of a request from an individual seeking to exercise any of their rights under Applicable Data Protection Laws related to Customer Personal Data, Customer authorizes Service Provider to direct such individual to Customer. Taking into account the nature of the processing, Service Provider shall, at Customer’s expense, assist Customer by appropriate technical and organizational measures, for the fulfillment of Customer’s obligation to respond to requests by Data Subjects to exercise their rights under Chapter III of the GDPR (including the data subject access right, the right to rectification and erasure, the right to the restriction of processing, the right to data portability and the right to object to processing) and any other Applicable Data Protection Laws. Service Provider shall carry out a request from Customer to amend or correct any of the Customer Personal Data to the extent necessary to allow Customer to comply with its responsibilities under Applicable Data Protection Laws. Further, Service Provider shall carry out a request from Customer to block, transfer or delete any of the Customer Personal Data to the extent necessary to allow Customer to comply with its responsibilities as a data controller under Applicable Data Protection Laws.
   4. Considering the nature of the Processing under the Terms of Use and the information available to Service Provider, Service Provider shall, insofar as possible and at Customer’s expense, assist Customer in carrying out its obligations under Applicable Data Protection Laws, with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators. Service Provider shall promptly notify Customer about any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, as required by Applicable Data Protection Laws.
   5. Upon termination of the Processing of Customer Personal Data by Service Provider and at the request of Customer, Service Provider shall either (i) delete all Customer Personal Data; or (ii) return all Customer Personal Data to the Customer and delete existing copies, in each case unless otherwise permitted or required by Applicable Data Protection Laws.
   6. Customer may collect voluntary disclosures from the Service Provider or request the Service Provider to provide a certification or summary of an audit report that demonstrates compliance with their obligations under this DPA or Applicable Data Protection Laws. If such information is not reasonably sufficient to prove Service Provider’s compliance with Applicable Data Protection Laws, Service Provider shall, subject to reasonable advance notice, permit the Customer or a third party authorized by the Customer, and which is not a competitor of Service Provider, to carry out the audits and inspections of the processing of Customer Personal Data by the Service Provider during normal business hours. Service Provider may require a third-party auditor to enter into a confidentiality agreement before permitting it to carry out an audit or inspection. The auditing party shall bear its own costs in relation to such audit. The obligations set forth in this Section 7.7 shall only apply to Service Provider to the extent required by Applicable Data Protection Laws.
   7. Customer acknowledges and agrees that Service Provider may or may appoint an affiliate or third-party subcontractor to, Process the Customer Personal Data in a Third Country, provided that it ensures that such Processing takes place in accordance with the requirements of Applicable Data Protection Laws. Customer hereby consents to Service Provider’s processing of Customer Personal Data in the United States to the extent necessary for Service Provider to provide the Services.
   8. Customer acknowledges and agrees that the Service Provider may process the Customer Personal Data in the United States.  Service Provider will take reasonable steps to comply with any necessary Applicable Data Protection Laws promulgated by the relevant Supervisory Authority. 
   9. Customer acknowledges and agrees that Service Provider relies solely on Customer for direction as to the extent to which Service Provider is entitled to Process Customer Personal Data. Consequently, Service Provider is not liable for any claim brought by Customer or a Data Subject arising from any action or omission by Service Provider to the extent that such action or omission resulted from Customer’s instructions.
   10. The Service Provider is accordingly obliged to notify without undo delay the Customer of any suspected infringement or actual infringement of the protection of the personal data – no later than within (72) hours of the suspected violation or breach of the protection of personal data. In the notice, the Service Provider is obliged to indicate the incident circumstances, probable causes and measures which have been taken following the incident in order to minimize its adverse impact – along with the necessary documentation. The Service Provider is required to provide the Customer with the opportunity to participate in clarifying the incident circumstances. The Service Provider is obliged to provide all information and explanations as well as take any actions which will allow the Customer to satisfy the reporting obligation to the appropriate Supervisory Authority.
8. Customer’s Obligations
   1. Customer warrants that it has complied and continues to comply with the Applicable Data Protection Laws, that it has obtained any necessary consents or given any necessary notices, and otherwise has a legitimate ground to disclose the Customer Personal Data to Service Provider and enable the Processing of the Customer Personal Data by the Service Provider as set out in this DPA and as envisaged by the Terms of Use.
   2. Customer agrees that it will indemnify and hold harmless Service Provider on demand from and against all claims, liabilities, costs, expenses, loss, or damage (including consequential losses, loss of profit and loss of reputation and all interest, penalties and legal and other professional costs and expenses) incurred by Service Provider arising directly or indirectly from a breach of this Section 8 or any Applicable Data Protection Laws.
9. Liability The Customer shall bear the responsibility for compliance with the provisions of law with respect to the processing and protection of personal data according to the Applicable Data Protection Laws.  This does not exclude the liability of the Service Provider for the processing of the data in breach of this Agreement.The Service Provider bears liability for the damage caused by processing, if they have not fulfilled the obligations imposed by this Agreement or when they have worked outside the lawful instructions of the Customer or contrary to these instructions.
10. Sub-Contracting
    Customer consents to Service Provider engaging third party subprocessors to process the Customer Personal Data for the Permitted Purpose. Service Provider shall maintain a current list of its subprocessors in Appendix 1 of this DPA, which will be updated from time to time to reflect any change in subprocessors. Service Provider ensures that it has a written agreement in place with all subprocessors which contains obligations on the subprocessor which are no less onerous on the relevant subprocessor than the obligations on Service Provider under this DPA. Customer
11. Termination
    Upon termination of the provision of the personal data protection-related services, the Service Provider, in accordance with the decision of the Customer shall remove or return any personal data as well as remove all their existing backups, unless specific legal provisions oblige them to continue to store the personal data in question.
12. Law and Jurisdiction
    This DPA and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed in all respects by the laws of the United States of America and by the laws of the State of New York. The Courts of Westchester County, New York shall be the exclusive forum for any mediation, arbitration, litigation, or dispute resolution.

Appendix 1

Current List of Sub-Processors

Purpose

Cloud hosting provider potentially used for delivering the Client email communications.

Cloud email infrastructure and delivery provider potentially used for delivering the Client email communications.

Cloud hosting provider for Elasticsearch.

Drag-n-drop email template editing.

Payment gateway to collect fees from Client

Payment, Revenue, and Subscription Services Analytics

Affiliate referral tracking.

Centralized log management, monitoring, and alerting.

Cloud support desk software used for tracking our Client questions and issues. Service Provider account creation and subsequent sign-in share Service Provider account information with Intercom to provide customer care.

Email verification provider

A platform to manage co-promotion of newsletters via Upscribe or magic links.