Data processing agreement

Subject and duration

We process your contacts’ data (email address, name, language, the other fields you add, consent records, opens, clicks and purchases you connect) only to provide Spedito, for as long as your account is open.

Our commitments

• We process the data only on your documented instructions, which are given by how you use Spedito.
• Everyone at Spedito who can access the data is bound by confidentiality.
• We apply appropriate security measures: encryption in transit and at rest, access limited to who needs it, separation between accounts, backups and logging.
• We help you answer your contacts’ requests (access, deletion, export) through the tools in Spedito, and we help you with security incidents and impact assessments.
• We notify you without undue delay, and within 48 hours, of any personal data breach affecting your data.
• At the end of the contract we delete the data within 30 days, after letting you export it.

Sub-processors

• You authorise these sub-processors. We will tell you at least 30 days before adding or replacing one, and you can object by closing your account.
• Amazon Web Services EMEA SARL (Luxembourg): sending emails, servers in Ireland (EU).
• Supabase Inc.: database and sign-in, servers in Frankfurt (EU).
• Vercel Inc.: website and application hosting, EU region.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payments, as an independent controller.
• Anthropic PBC (USA): only the text you send to the AI writing and translation features, under the EU Standard Contractual Clauses; it is not used to train models.

Transfers outside the EU

Data is stored in the EU. Where a sub-processor may access it from outside the EU, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or on the Standard Contractual Clauses.

Audits

On request, we provide the information needed to show compliance with this agreement.