This Data Processing Agreement ("DPA") forms part of the Terms of Service between FluentCart Inc. ("Processor," "toSend," "we," or "us") and the entity identified on the toSend account ("Controller," "Customer," or "you").
By accepting the Terms of Service or by using the Service, you agree to this DPA on behalf of the Controller. No separate signature is required; this DPA is binding as of the date of account creation or continued use of the Service, whichever is earlier. A signed PDF version is available on request to support@tosend.com for customers whose procurement requires one.
Where this DPA conflicts with the Terms of Service in respect of Processing of Personal Data, this DPA prevails.
Capitalised terms not defined here have the meanings given to them under applicable Data Protection Laws.
The subject matter of the Processing is the provision of the Service to the Controller. The Processor Processes Customer Personal Data only on the documented instructions of the Controller, including as set out in the Terms of Service, this DPA, and any reasonable written instructions thereafter.
The Processor will inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Laws.
Storing, transmitting, and delivering email messages; providing dashboards, logs, and webhook events; billing, support, and abuse prevention.
For the duration of the Controller's account, plus the retention periods set out in the Privacy Policy for logs and metadata.
The Controller warrants that it has a lawful basis for the Processing, has provided all required notices to Data Subjects, and has obtained any necessary consents. The Controller is solely responsible for the content of messages sent through the Service and for the accuracy and lawfulness of recipient lists.
The Processor will:
The Controller grants the Processor general authorisation to engage Sub-processors subject to this Section.
A current list of Sub-processors is maintained at /legal/subprocessors/. The Processor will give the Controller at least 7 days' prior written notice (by email to the account's billing address or an in-product notice) before adding or replacing a Sub-processor.
The Controller may object in writing to the appointment of a new Sub-processor on reasonable, good-faith grounds relating to data protection within the notice period. If the Parties cannot agree on a resolution, the Controller may terminate the affected portion of the Service without penalty, with a pro-rata refund of any prepaid fees for the unused portion.
The Processor remains responsible for the acts and omissions of its Sub-processors to the same extent as its own acts and omissions under this DPA. Each Sub-processor is engaged under a written agreement containing data-protection obligations no less protective than those set out in this DPA.
The Processor will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as described in Annex A.
The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include the information required under Article 33(3) GDPR to the extent available at the time, and updates as further information becomes available.
The Processor will cooperate with the Controller and provide reasonable assistance in the Controller's investigation, notification, and remediation of the Breach.
Taking into account the nature of the Processing, the Processor will provide the Controller with reasonable assistance — by appropriate technical and organisational measures, insofar as possible — to help the Controller fulfil its obligations to respond to Data Subject requests under Chapter III of the GDPR.
If the Processor receives a request directly from a Data Subject that relates to Customer Personal Data, the Processor will (unless prohibited by law) redirect the Data Subject to the Controller and promptly notify the Controller.
The Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, including summaries of relevant third-party audit reports and certifications where available.
The Controller may, once per calendar year and on at least 30 days' prior written notice, conduct an audit of the Processor's compliance with this DPA. Audits must be carried out during business hours, without unreasonable disruption to the Processor's operations, and at the Controller's cost. The Controller may appoint an independent third-party auditor (other than a competitor of the Processor) who is bound by written confidentiality obligations.
A Supervisory Authority's audit authority is unaffected by this Section.
On termination or expiry of the Service, the Processor will, at the Controller's choice, return or delete Customer Personal Data in its custody, except where retention is required by applicable law. Deletion will occur within 30 days of termination, subject to the retention periods set out in the Privacy Policy and the Service's internal backup cycles (no longer than 90 days).
The Service is operated from the United States, and Customer Personal Data may be transferred to, stored in, and Processed in the United States or in any other country where the Processor or its Sub-processors maintain facilities.
Where the Controller transfers Personal Data to the Processor from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision:
Annex I (Parties, description of transfer, competent supervisory authority) and Annex II (technical and organisational measures) of the SCCs are completed by the information in this DPA and in Annex A below.
Each Party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits either Party's liability to Data Subjects under the third-party beneficiary rights in the SCCs.
This DPA takes effect on the Effective Date above and continues until the Terms of Service terminate. Sections that by their nature should survive termination (including Sections 5, 6, 9, 10, 11, and 13) will survive.
The Processor implements the following technical and organisational measures to protect Customer Personal Data (TOMs within the meaning of Article 32 GDPR):
The current list of authorised Sub-processors, including name, purpose, location, and link to each Sub-processor's data-processing agreement, is maintained at /legal/subprocessors/ and is incorporated into this DPA by reference.