Data Processing Addendum

This Data Processing Addendum forms part of the Terms of Service between you (the "Controller") and SimpleFlare (the "Processor") for SimpleFlare, and applies where we process personal data on your behalf.

1. Roles and scope

You are the controller of the personal data contained in the email you send and receive (recipient addresses, message content, delivery events, attachments). We process it only to provide the service and on your documented instructions.

2. Our commitments

• Process personal data only for the service and per your instructions.
• Ensure staff with access are bound by confidentiality.
• Apply appropriate technical and organizational security measures.
• Assist you with data-subject requests and breach notification within the timelines the law requires.
• Delete or return personal data at the end of the service (30-day export window, then deletion).

3. Subprocessors

You authorize us to use subprocessors to run the service, including Cloudflare (email delivery and infrastructure), our hosting provider, and our payment provider, each under equivalent data-protection terms. We will inform you of material changes to our subprocessors.

4. International transfers

Data is hosted in the EU. Where transfers outside the EEA occur through a subprocessor, they rely on an approved transfer mechanism (such as Standard Contractual Clauses).

5. Contact

Data-protection contact: [email protected].