Data Processing Agreement

Version 1.0, last updated 14 October 2026.

This Data Processing Agreement ("DPA") forms part of the Mailfois Terms of Service between WealthR Ltd, a company registered in Scotland (company number SC900929), whose registered office is at 5 South Charlotte Street, Edinburgh, EH2 4AN, trading as Mailfois ("we", "us", the "Processor") and the customer that has agreed to those terms ("you", the "Controller"). It applies whenever we process personal data on your behalf in providing Mailfois. You don't need to sign anything: it applies automatically. If your organisation needs a signed copy, email [email protected] and we'll countersign one.

If this DPA and the Terms of Service conflict on how we handle personal data, this DPA wins.

In short: Mailfois is a planning and approval tool, not an email service provider. We don't store your subscriber or mailing lists and we don't send your campaigns. The personal data we process for you is mostly the names and email addresses of your users and the approvers you invite, plus anything personal that happens to be in the content you upload.

1. Definitions

• Data Protection Law means the laws that apply to the processing: the UK GDPR and the Data Protection Act 2018; where relevant, the EU GDPR; and, for customers or data subjects elsewhere, laws such as US state privacy laws (including the California Consumer Privacy Act), Canada's PIPEDA and Australia's Privacy Act 1988.
• Customer Personal Data means personal data you or your users put into Mailfois, or that we process on your behalf, as described in Annex 1.
• Sub-processor means a third party we use to process Customer Personal Data, as listed in Annex 3.
• "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR. For US state laws, "business" and "service provider" (or "contractor") correspond to controller and processor.

2. Roles

For Customer Personal Data, you're the controller and we're your processor. We process it only to provide Mailfois to you. For our own account, billing and website data, we're a controller, and our Privacy Policy applies instead.

3. Your instructions

We'll process Customer Personal Data only on your documented instructions. Your instructions are: the Terms of Service, this DPA, and how you and your users configure and use Mailfois. If we're required by law to process it in another way, we'll tell you first unless the law forbids it. If we think an instruction breaks Data Protection Law, we'll tell you.

You're responsible for having a lawful basis for the data you put into Mailfois, for giving data subjects any notices they need, and for your instructions complying with Data Protection Law. That includes the email addresses you enter for guest approvers: we send the review link to exactly the address you give us, so please check it before you send. If a link goes to the wrong person, you can switch it off at once from the review, or issue a new link (which stops the old one working).

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality. Access is limited to what's needed to run, support and secure the service.

5. Security

We'll keep appropriate technical and organisational measures in place to protect Customer Personal Data, taking into account the state of the art, the cost, and the nature and risks of the processing. Annex 2 describes them. We may update them, but not in a way that reduces the overall level of protection.

6. Sub-processors

You authorise us to use the sub-processors listed in Annex 3. We'll give each one data protection obligations that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for what they do.

We'll tell you at least 30 days before we add or replace a sub-processor, by email to your workspace owner and by updating Annex 3. If you have a reasonable data protection objection, tell us within that period. We'll work with you on it, and if we can't resolve it, you can end the affected service and we'll refund any unused prepaid fees.

7. Helping you with data subjects' requests

Mailfois lets you find, export, correct and delete data yourself (including workspace export in Settings). If we receive a request directly from one of your data subjects, we'll pass it to you without delay and won't respond ourselves except to point them to you. We'll help you, as far as is reasonable, to respond to requests you can't handle using the product.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we'll tell you without undue delay, and in any event within 48 hours. We'll give you the information you reasonably need to meet your own obligations, including, as it becomes available: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what we've done or will do about it. We'll take reasonable steps to contain and fix it.

9. Impact assessments and consultation

We'll give you reasonable help with data protection impact assessments and any consultation with a supervisory authority, as far as they relate to Mailfois and the information is available to us.

10. International transfers

We store Customer Personal Data in the United Kingdom (London). Some sub-processors in Annex 3 process data in, or can access it from, other countries, including the United States. Where Customer Personal Data is transferred outside the UK (or, for EU data, outside the EEA), we make sure an approved transfer mechanism is in place: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, the "UK-US Data Bridge", where the recipient is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable.

If you're in the EEA and transfer Customer Personal Data to us in the UK, the transfer is covered by the European Commission's adequacy decision for the UK. If that decision stops applying, the EU Standard Contractual Clauses (controller-to-processor module) are incorporated into this DPA by reference.

11. Deleting or returning data

You can export your data at any time. When your account or a workspace is closed, we'll delete the Customer Personal Data it held within 30 days, unless the law requires us to keep it. Copies in backups are overwritten on their normal cycle and stay protected by this DPA until they are.

12. Audits and information

We'll make available the information you reasonably need to show that we comply with this DPA, including answering security questionnaires. If that isn't enough, or a supervisory authority requires it, you may audit our compliance once a year, on at least 30 days' written notice, during business hours, at your own cost, and under a confidentiality agreement. Audits of sub-processors are covered by the reports and certifications they publish.

13. Customers outside the UK

• United States: for the purposes of the California Consumer Privacy Act and similar state laws, we act as your service provider (or contractor). We won't sell or share Customer Personal Data, keep, use or disclose it for any purpose other than providing Mailfois to you, combine it with personal data from other sources except as the law allows, or process it outside our direct business relationship with you. We'll tell you if we can no longer meet these obligations.
• Canada: we'll protect Customer Personal Data with safeguards appropriate to its sensitivity, use it only to provide Mailfois, and help you meet your obligations under PIPEDA and provincial privacy laws.
• Australia: we'll handle Customer Personal Data in a way that helps you comply with the Australian Privacy Principles, including on security, use and cross-border disclosure, and tell you about any breach as set out in section 8 so you can assess it under the Notifiable Data Breaches scheme.

14. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law doesn't allow it to be limited. This DPA lasts for as long as we process Customer Personal Data for you, and the obligations in sections 4, 5 and 11 continue until it has been deleted. It's governed by the same law as the Terms of Service, except where Data Protection Law or a transfer mechanism requires otherwise.

Annex 1: Details of the processing

• Subject matter and duration: providing Mailfois to you, for as long as you use it, plus the deletion period in section 11.
• Nature and purpose: hosting, storing, organising, displaying and sharing data within your workspaces so you can plan, build, check, translate, approve and archive email campaigns; sending sign-in, invitation, notification and approval emails; and, if a user requests it, generating alt text for an image.
• Categories of data subjects: your users (staff, contractors, agency staff) and the guest approvers you invite. Occasionally, other people named in content you upload, such as a test address left in an email's HTML or a name in a document.
• Categories of personal data: users' and guest approvers' names, email addresses, job titles and roles; comments, approvals and activity history; and any personal data that happens to be in emails, copy, documents or images you upload.
• Not processed: subscriber, customer or mailing lists. Mailfois doesn't import or store them, and you shouldn't upload them.
• Special category data: none is intended. Please don't upload special category data, such as health information, unless you've told us and we've agreed on suitable safeguards.
• Frequency: continuous, while you use Mailfois.

Annex 2: Security measures

• Encryption: data is encrypted in transit (TLS) and at rest by our hosting and database providers.
• Access control in the database: every table uses row-level security, so users can only read and change data in workspaces they belong to. Workspace owners and admins control membership, roles and which areas each member can see.
• Separation between workspaces: each client or team workspace is kept separate. Guest approvers can only see the review they were invited to.
• Credentials and links: passwords are stored hashed by our authentication provider. Guest review links contain a random token with 256 bits of randomness. We store only its SHA-256 hash, so the links can't be recovered from our database. Each one can be switched off or replaced at any time, expires 30 days after the approval date, and has a "This isn't me" button that switches it off and alerts your team if it reaches the wrong person. Before a link is sent, the address is confirmed and checked against the domains your other approvers use.
• Least privilege: server-side keys are kept as encrypted secrets in our hosting provider, never in source code or the browser. Access to production systems is limited to the people who run Mailfois and protected with multi-factor authentication.
• Browser-only tools: the free pre-send tools and the image tool process content in the user's browser. It isn't uploaded unless the user chooses an upload-based feature, such as AI alt text.
• Resilience: our database provider takes regular backups, and we can restore from them.
• Monitoring and response: we review security advisories from our providers, keep dependencies up to date, and follow the breach process in section 8.

Annex 3: Sub-processors

To be told about changes to this list, make sure your workspace owner's email address is up to date. Questions about this DPA: [email protected].