This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement" or "ToS") between:
NamiLink Kft, registered at 2856 Szákszend, Móra Ferenc utca 8/c, Hungary, company registration number 11-09-030788 ("Processor" or "CrewMailer"),
and
The Customer agreeing to the CrewMailer Terms of Service ("Controller" or "Customer").
This DPA is effective from the date the Customer agrees to the CrewMailer Terms of Service.
WHEREAS
IT IS AGREED AS FOLLOWS
The Controller is the Data Controller (or a Processor for another Controller) and the Processor (CrewMailer) is the Data Processor of the Controller Personal Data.
The Processor shall Process Controller Personal Data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. The Controller's instructions for the Processing of Controller Personal Data shall comply with Data Protection Laws. The Controller's use of the Services configuration options and functionalities constitutes documented instructions.
The subject matter, duration, nature, and purpose of the Processing, as well as the types of Personal Data and categories of Data Subjects involved, are set out in Annex 1 (Details of Processing).
The Controller warrants that it has all necessary rights, consents, and lawful bases (pursuant to Articles 6 and 9 of GDPR) to permit the Processor to Process the Controller Personal Data through the Services according to this DPA and the Agreement. The Controller is responsible for the accuracy, quality, and legality of the Controller Personal Data and the means by which it acquired the Personal Data.
The Processor shall ensure that its personnel authorized to Process the Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
These measures shall include, as appropriate, the measures referred to in Article 32(1) of the GDPR. A description of the Processor's current security measures is set out in Annex 2 (Security Measures). Processor may update these measures from time to time, provided the updates do not materially decrease the overall security of the Services.
The Controller grants the Processor general written authorization to engage Subprocessors to Process Controller Personal Data on the Controller's behalf.
The Processor shall maintain a list of its current Subprocessors, including their locations and the services they provide, as set out in Annex 3 (Subprocessors). The Processor shall make this list available to the Controller (e.g., via its website or this DPA).
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other Subprocessors, thereby giving the Controller the opportunity to object to such changes. Such notification shall be provided with reasonable advance notice (e.g., via email or platform notification). If the Controller reasonably objects to a new Subprocessor, the Parties shall discuss the objection in good faith. If the objection cannot be resolved, the Controller may terminate the Agreement in accordance with its terms.
The Processor shall ensure that it enters into a written agreement with each Subprocessor containing data protection obligations equivalent to those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the GDPR.
The Processor shall remain fully liable to the Controller for the performance of that Subprocessor's obligations.
Taking into account the nature of the Processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the GDPR (e.g., access, rectification, erasure, restriction, portability, objection). If a Data Subject contacts the Processor directly, the Processor shall promptly notify the Controller, unless otherwise prohibited by law.
Taking into account the nature of Processing and the information available to the Processor, the Processor shall provide reasonable assistance to the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of Processing, Personal Data Breach notification, Data Protection Impact Assessments).
The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data. The Processor shall provide the Controller with sufficient information (as reasonably available) to allow the Controller to meet its obligations under Article 33 and 34 of the GDPR.
Upon termination of the Agreement or upon the Controller's written request, the Processor shall, at the choice of the Controller, delete or return all Controller Personal Data to the Controller, and delete existing copies unless Union or Member State law requires storage of the Personal Data.
The Processor shall adhere to the data retention and deletion timelines specified in its Privacy Policy (e.g., deletion of original files and recipient data 90 days after project archiving, immediate deletion of watermarked files post-transmission), unless otherwise agreed or legally required.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and Article 28 of the GDPR.
The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (who is not a competitor of the Processor). Such audits shall be subject to:
- a) Reasonable prior written notice (at least 30 days unless legally required otherwise or following a confirmed security incident);
- b) A written non-disclosure agreement between the Controller (or its auditor) and the Processor;
- c) Conducted during Processor's normal business hours and in a manner that does not unreasonably interfere with Processor's business operations;
- d) Limited to once per year unless mandated by a Supervisory Authority or following a confirmed security incident affecting Controller Personal Data;
- e) The Controller bearing all costs associated with the audit.
As an alternative to an on-site audit, the Processor may provide current third-party audit reports (e.g., ISO 27001, SOC 2 if available for the specific services) to demonstrate compliance, where applicable.
The Processor shall Process Controller Personal Data primarily within the European Economic Area (EEA).
The Processor shall not transfer Controller Personal Data outside the EEA unless it ensures compliance with the provisions of Chapter V of the GDPR (e.g., by implementing Standard Contractual Clauses approved by the European Commission, or relying on an adequacy decision, or other appropriate safeguards).
The Controller acknowledges that certain Subprocessors (as listed in Annex 3) may be headquartered outside the EEA (e.g., USA), but Processing of Controller Personal Data by these Subprocessors is conducted within the EEA as specified in Annex 3. Any required access from outside the EEA by such Subprocessors (e.g., for support) shall be subject to appropriate safeguards compliant with GDPR.
Liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA shall limit either party's liability towards Data Subjects under GDPR.
This DPA shall remain in effect for as long as the Processor Processes Controller Personal Data under the Agreement. Termination of the Agreement shall automatically terminate this DPA. Provisions which by their nature should survive termination (e.g., confidentiality, data deletion) shall survive.
This DPA shall be governed by the laws of Hungary. Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the competent courts specified in the Agreement ([Komárom-Esztergom County, Hungary OR Budapest, Hungary] - Ensure this matches ToS).
This DPA is incorporated into and forms an integral part of the Agreement. In case of conflict between this DPA and the Agreement, the terms of this DPA shall prevail concerning the subject matter of data protection.
Annex 1: Details of Processing
Annex 2: Security Measures
The Processor implements and maintains the following technical and organizational security measures:
Annex 3: Subprocessors
The following Subprocessors are engaged by CrewMailer to provide the Services as of the DPA Effective Date:
| Subprocessor Entity Name | Service Provided | Location of Processing (Country/Region) |
|---|---|---|
| Neon Inc. (via AWS) | Managed PostgreSQL Database Hosting | Germany (AWS EU Frankfurt Region) |
| Hetzner Online GmbH | Application Backend & Frontend Server Hosting | Germany (Falkenstein) |
| Zoho Corporation B.V. | Transactional Email Gateway (ZeptoMail) | Netherlands (EU) |
| Auth0 by Okta | Authentication Services | Global (with EU-US Privacy Shield) |