- You are the controller. Delivrie is your processor and follows only your instructions.
- We tell you about new subprocessors 30 days in advance so you can object.
- We notify you of a personal data breach without undue delay, and within 48 hours.
This summary is for convenience. The full text below is what applies.
01Scope and roles
This DPA covers personal data in Customer Data that Delivrie processes to provide the service. You are the controller (or a processor acting for your own controller) and Delivrie is the processor (or subprocessor).
02Details of processing
| Item | Description |
|---|---|
| Subject matter | Sending, receiving and tracking email |
| Duration | For the term of the agreement |
| Data subjects | Your recipients, contacts and end users |
| Data types | Email addresses, names, message content, attachments, engagement events, IP addresses |
| Special categories | None intended. Do not send health or similar data unless agreed in writing |
03Our obligations
- Process personal data only on your documented instructions, including those given through the API and dashboard.
- Make sure anyone with access is bound by confidentiality.
- Apply the technical and organisational measures described on our Security page.
- Help you respond to data subject requests and carry out impact assessments.
- Delete or return personal data when the agreement ends.
04Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We will give 30 days notice of any new subprocessor by email and on that page. If you object on reasonable data-protection grounds and we cannot address it, you may terminate the affected service with a pro-rata refund.
05International transfers
Transfers out of Nigeria, the EEA, the UK or Switzerland are covered by the Standard Contractual Clauses (Module 2 and 3), the UK Addendum and the transfer requirements of the Nigeria Data Protection Act, which are incorporated by reference.
06Personal data breaches
We will notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting your personal data, with the information you need to meet your own reporting duties.
07Audits
We will answer reasonable security questionnaires and share our security documentation on request. You may audit us once a year with 30 days notice, at your cost, if that documentation does not answer your reasonable questions.