Draft. This document is a pre-launch draft based on market-standard terms for email deliverability services and is being reviewed by legal counsel. Questions: welcome@roxinbox.io.
Summary. This DPA applies automatically to every customer under the RoxInbox Terms of Service; you do not need to sign anything. Customer data is hosted in the EU, breaches are notified within 48 hours, subprocessor changes are announced 30 days ahead, and data is deleted within 30 days of termination.
Need a countersigned copy for your records? Email welcome@roxinbox.io.
1. Scope and precedence
This Data Processing Agreement (“DPA”) forms part of the agreement between Havik Group, Utrecht, Netherlands, KvK 98526472 (“Processor”) and the customer (“Controller”) for the RoxInbox service (the “Agreement”). It applies when the Processor processes Customer Personal Data on the Controller's behalf. If this DPA conflicts with the Agreement, this DPA prevails for the processing of personal data.
2. Definitions
“Data Protection Law” means Regulation (EU) 2016/679 (the GDPR) and the laws implementing or supplementing it, including the Dutch GDPR Implementation Act (UAVG), and, where applicable, the UK GDPR and the Swiss FADP. “Customer Personal Data” means personal data processed by the Processor on the Controller's behalf under the Agreement. “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR.
3. Roles
The Controller determines the purposes and means of processing Customer Personal Data, and the Processor processes it on the Controller's behalf. The Controller is responsible for having a lawful basis for the processing, including for connecting mailboxes it controls and for the email it sends from them. For account, billing and verification data, the Processor acts as an independent controller under its Privacy Policy.
4. Instructions
The Processor processes Customer Personal Data only on the Controller's documented instructions, which are the Agreement, this DPA and the Controller's configuration of the Service, unless EU or member-state law requires otherwise; in that case the Processor will inform the Controller first unless the law prohibits it. The Processor will tell the Controller promptly if it believes an instruction infringes Data Protection Law.
5. Confidentiality
The Processor ensures that everyone authorised to process Customer Personal Data is bound by confidentiality and has access only as far as needed to provide the Service.
6. Security
The Processor implements the technical and organisational measures in Annex II, appropriate to the risk under GDPR article 32. The Processor may update these measures as long as the overall level of protection does not decrease.
7. Personal data breaches
The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor will provide further information as it becomes available and will take reasonable steps to contain and remedy the breach.
8. Subprocessors
The Controller gives general authorisation for the Processor to engage subprocessors. The current list is in Annex III. The Processor will:
- impose data-protection obligations on each subprocessor that are no less protective than this DPA;
- announce any new or replacement subprocessor at least 30 days in advance on the subprocessor page and to customers who subscribe to updates;
- remain responsible to the Controller for its subprocessors' performance.
The Controller may object on reasonable data-protection grounds within the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Controller may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
9. Assistance
Taking into account the nature of the processing, the Processor will assist the Controller by appropriate measures to respond to data subject requests, and with data protection impact assessments, prior consultations and security obligations under GDPR articles 32 to 36. If a data subject contacts the Processor directly, the Processor will redirect the request to the Controller without responding to it, unless the law requires otherwise.
10. Audits
On request, the Processor will provide the information reasonably necessary to demonstrate compliance with this DPA, including summaries of security policies and any third-party audit reports it holds. If that information is not sufficient, the Controller may, no more than once a year and with at least 30 days' notice, carry out an audit itself or through an independent auditor bound by confidentiality, during business hours and without disrupting the Service. Each party bears its own costs, unless the audit reveals a material breach by the Processor.
11. International transfers
The Processor hosts Customer Personal Data in the European Union. The Processor will not transfer Customer Personal Data outside the European Economic Area unless the transfer is covered by an adequacy decision or by the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (module two or three, as applicable), with supplementary measures where required. For transfers from the UK or Switzerland, the corresponding UK addendum or Swiss amendments apply.
12. Deletion and return
Mailbox credentials are deleted when a mailbox is disconnected. On termination of the Agreement, the Processor will delete Customer Personal Data within 30 days, unless the Controller asks within that period for an export of the data available in the Service, or EU or member-state law requires the data to be kept. Backups are overwritten in their normal cycle, within a further 60 days.
13. Liability and term
Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law does not allow it. This DPA lasts as long as the Processor processes Customer Personal Data under the Agreement. It is governed by the same law and jurisdiction as the Agreement.
Annex I: Processing details
| Controller | The customer identified in the account or order form |
|---|---|
| Processor | Havik Group, Utrecht, Netherlands, KvK 98526472. Contact: welcome@roxinbox.io |
| Subject matter | Building, measuring and monitoring the sender reputation of mailboxes connected by the Controller |
| Nature of processing | Storing mailbox credentials; sending, receiving and acting on warm-up messages; sending placement-test messages to seed mailboxes; reading message headers and folder placement; DNS and blocklist checks; generating reports and alerts |
| Duration | The term of the Agreement plus the deletion period in section 12 |
| Data subjects | The Controller's users; people whose mailboxes the Controller connects; correspondents whose data appears in the metadata of warm-up and test messages |
| Categories of personal data | Names and email addresses; mailbox credentials and OAuth tokens; message metadata such as headers, timestamps and folder placement; content of placement-test messages chosen by the Controller; IP addresses and technical logs |
| Special categories | None intended. The Controller should not use test messages to send special-category data. |
| Frequency | Continuous, for as long as mailboxes are connected |
Annex II: Security measures
- Encryption: TLS for data in transit; encryption at rest for databases and backups; mailbox credentials and tokens in a dedicated encrypted vault with key rotation.
- Access control: least-privilege, role-based access for staff; multi-factor authentication; access reviews; immediate revocation on departure.
- Tenant separation: customer data logically separated by account; warm-up network segments isolated from each other.
- Data minimisation: the Service identifies and acts on warm-up messages and does not process the content of other messages in a connected mailbox beyond what is needed to identify them.
- Hosting: EU data centres operated by providers with recognised security certifications.
- Logging and monitoring: security-relevant events logged and monitored; alerts on anomalous access.
- Resilience: regular encrypted backups; tested restore procedures.
- Vulnerability management: dependency and infrastructure patching; external security testing.
- Incident response: documented process for detecting, containing and notifying personal data breaches.
- People: confidentiality undertakings and security training for everyone with access.
Annex III: Subprocessors
See the current subprocessor list.