1. Parties and scope
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (the “Controller”) and CODEPRENEUR DOOEL (the “Processor”). It applies whenever the Processor processes personal data on the Controller’s behalf to provide Yourdiai, and it takes precedence over the Terms of Service for that processing.
2. Details of the processing
| Subject matter and duration | Providing the email marketing Service for the term of the customer’s subscription, plus the deletion period below. |
| Nature and purpose | Storing contacts and lists, importing data, sending campaigns, processing unsubscribes and suppressions, and reporting on delivery and engagement. |
| Data subjects | The Controller’s contacts and email recipients, and the Controller’s team members. |
| Personal data | Email addresses, names and other contact fields the Controller adds; consent records (time, source, IP address); delivery and engagement events (deliveries, opens, clicks, bounces, complaints, unsubscribes), which can include IP address and device or browser information. |
| Special categories | Not intended. The Controller must not upload special categories of personal data. |
3. Processor obligations
- Process personal data only on the Controller’s documented instructions, which are the Terms of Service, this DPA and the Controller’s use of the Service, unless EU or member state law requires otherwise.
- Ensure that staff with access are bound by confidentiality.
- Implement the technical and organisational measures described below (GDPR Art. 32).
- Assist the Controller, taking into account the nature of the processing, in answering data subject requests and in meeting its obligations under GDPR Arts. 32–36.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with the information available to help it meet its own notification duties.
- Make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to reasonable audits, on reasonable notice and at the Controller’s cost.
4. Security measures
- Encryption in transit (HTTPS/TLS) and hashed passwords.
- Logical separation of each customer’s data by workspace, with role-based access for team members.
- Access to production data limited to authorised staff; important actions recorded in an audit log.
- Authenticated sending domains (DKIM, SPF via MAIL FROM, DMARC) and automatic suppression of bounces, complaints and unsubscribes.
- Backups and monitoring of the infrastructure.
5. Sub-processors
The Controller authorises the following sub-processors:
- Amazon Web Services EMEA SARL (Amazon SES, region eu-north-1): email sending and delivery events.
- Our hosting provider: hosting of the application and database.
We impose data protection obligations on each sub-processor that are equivalent to this DPA and remain responsible for them. We will inform the Controller of intended changes to sub-processors at least 30 days in advance; the Controller may object on reasonable data protection grounds and, if we cannot address the objection, terminate the affected Service.
6. International transfers
Where personal data is transferred outside the European Economic Area, the transfer is based on an adequacy decision or on the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary.
7. Return and deletion
During the subscription the Controller can export and delete its data in the Service. After termination we delete the Controller’s personal data within 90 days, unless EU or member state law requires us to store it.
8. Controller obligations
The Controller is responsible for having a lawful basis for the processing, including valid consent of recipients where required, for the accuracy of the data, and for the lawfulness of its instructions.
9. Contact
CODEPRENEUR DOOEL · KIRIL PEJCHINOVIKJ 50 · North Macedonia · Company registration number: 4029025532735 · VAT ID: 7865465 · Email: [email protected]