Data Processing Agreement
This agreement is made on 1 December 2026 between:
- Brightwater Analytics Ltd, of 20 Harbour Street, Dublin D02 AB12, Ireland, contact privacy@brightwater.example ("the Customer"); and
- CloudMail Services GmbH, of Hauptstrasse 14, 10115 Berlin, Germany, contact dpo@cloudmail.example ("the Provider").
It forms part of the Email Platform Services Agreement dated 3 March 2026 ("the Main Agreement"). If this agreement and the Main Agreement conflict on the handling of personal data, this agreement applies.
1. Definitions
In this agreement "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning they have in the data protection laws that apply, or, where those laws use other words for the same ideas, the nearest meaning. "Data Protection Laws" means all laws on data protection and privacy that apply to the processing of Customer Personal Data under this agreement, including any that apply to a party because of where the data subjects are. "Customer Personal Data" means the personal data that the Provider processes for the Customer under the Main Agreement. "Sub-processor" means a third party that the Provider uses to process Customer Personal Data.
2. Roles and scope
2.1 For Customer Personal Data the Customer is the controller and the Provider is the processor. If the Customer is itself a processor for another controller, it promises that it has that controller's authority to give the instructions in this agreement, and the Provider acts as a sub-processor.
2.2 Each party will follow the Data Protection Laws that apply to it.
2.3 The Customer is responsible for having a lawful basis for the processing, for giving the notices that the Data Protection Laws require to data subjects, and for the accuracy and lawfulness of the personal data it gives the Provider.
3. Details of the processing
3.1 Subject matter and purpose. The Provider processes Customer Personal Data only to provide the services under the Main Agreement, in this way:
Sends and stores the customer's marketing and service emails, and records opens and clicks, to provide the email platform.
3.2 Duration. The processing lasts for as long as the main agreement runs, plus the time needed to return or delete the data.
3.3 Types of personal data:
Names, email addresses, company names, and records of emails sent, opened and clicked.
3.4 Categories of data subjects: the customer's clients, prospects and newsletter subscribers.
3.5 Sensitive personal data that is handled: health information that patients write in appointment messages.
3.6 Place of processing. The Provider will process and store Customer Personal Data in data centres in Frankfurt, Germany.
3.7 The Customer will not give the Provider other types of personal data, or sensitive personal data not listed above, without the Provider's written agreement.
4. The Customer's instructions
4.1 The Provider will process Customer Personal Data only on the Customer's documented instructions, which are this agreement, the Main Agreement, and the Customer's use and settings of the services, unless a law that applies to the Provider requires otherwise. In that case the Provider will tell the Customer before the processing, unless that law forbids it.
4.2 The Provider will tell the Customer at once if it believes that an instruction breaks the Data Protection Laws. It may pause the instruction until the Customer confirms or changes it.
4.3 The Provider will not use Customer Personal Data for its own purposes, sell it, or combine it with data from other sources, except as the Data Protection Laws allow for its own legal duties.