983 Mail

Legal

Data Processing Addendum

For customers who need a DPA. This describes how we process personal data as your processor.

This document is a starting template. Have it reviewed by legal counsel and adapted to your jurisdiction (including GDPR/UK GDPR specifics) before you rely on it.

Effective date: January 1, 2026

1. Roles

For personal data contained in your mailboxes, you are the data controller and 983 Mail is the data processor. We process that data only on your documented instructions.

2. Scope of processing

We process the personal data necessary to deliver, store, secure, and support your email service, for the duration of your subscription.

3. Subprocessors

We use a limited set of vetted subprocessors for infrastructure, delivery, and payments. We maintain a current list and will give you notice before adding a new subprocessor so you can object.

4. Security measures

  • Encryption of data in transit (TLS) and at rest (AES-256)
  • Access controls, logging, and continuous monitoring
  • Regular backups and tested recovery procedures

5. Data subject requests

We will assist you in responding to requests from individuals to access, correct, or delete their personal data, to the extent you can't do so yourself through the service.

6. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.

7. Deletion

On termination, we delete or return personal data within 30 days, except where retention is legally required.

8. Contact

To request a signed DPA or ask questions, email [email protected].