PostFend Data Processing Agreement

Version 1.0 | Effective 11 November 2026 | URL: https://postfend.com/dpa

This Data Processing Agreement ("DPA") forms part of the PostFend Terms of Service between 2758188 Alberta Ltd., operating as PostFend ("Processor"), and the Business Customer ("Customer"). It applies only when the Customer is a Business Customer acting as a controller of Customer Personal Data, and Processor processes that data as a service provider or processor. This DPA does not apply to Consumers. For Consumers, the Privacy Policy covers their account data and the email we filter for them.

1. Definitions

• "Customer Personal Data": personal information or personal data in email content, headers, metadata, connection data and related records that Processor processes for Customer through the Service.
• "Data Protection Law": PIPA, PIPEDA and, where applicable, the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, US state privacy laws, and Québec private-sector privacy law.
• "Subprocessor": any third party that Processor engages to process Customer Personal Data.
• "Security Incident": any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. This includes a "breach of security safeguards" under PIPEDA and a loss or unauthorized access or disclosure under PIPA.
• Terms such as "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR where it applies.

2. Roles and scope

2.1 Customer is the controller or responsible organization. Processor is processor or service provider. Annex I describes the processing.

2.2 Customer is responsible for having a lawful basis and the authority to route its email through the Service. It is also responsible for giving notice to its users, as required by Terms s.8.2 and Data Protection Law.

3. Processor obligations (GDPR Art. 28(3) and equivalents)

Processor shall do the following.

(a) Documented instructions. Process Customer Personal Data only on Customer's documented instructions, including for transfers to third countries, unless EU, Member State, UK or Canadian law requires otherwise. In that case Processor informs Customer first, unless the law prohibits it. The instructions are this DPA, the Terms, Customer's configuration of the Service, and written requests from Customer administrators. Processor will tell Customer right away if it believes an instruction breaches Data Protection Law.

(b) Confidentiality. Ensure that everyone authorized to process Customer Personal Data is bound by confidentiality. Human access to message content requires one of the following, and is logged:

• a Customer ticket;
• a security-incident record; or
• a legal requirement.

(c) Security (Art. 32). Implement the technical and organizational measures in Annex II.

(d) Subprocessors. Comply with s.5.

(e) Data subject requests. Assist Customer by appropriate technical and organizational measures in responding to requests to exercise data subject rights. Processor forwards any request it receives directly, without responding to it except to redirect the requester.

(f) Compliance assistance (Arts. 32–36). Assist Customer with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Processor.

(g) Deletion or return. At the end of the Service, at Customer's choice, delete or return Customer Personal Data (s.9), unless the law requires retention.

(h) Information and audits. Make available all information necessary to demonstrate compliance with Art. 28, and allow for and contribute to audits (s.10).

4. Processor's own limited uses

Processor will not sell Customer Personal Data or use it for advertising. Processor will not use email content to train models shared with other customers without Customer's written opt-in.

Processor may use non-content security signals (IP addresses, domains, URL and file hashes, non-reversible fuzzy hashes) and aggregated statistics that do not identify Customer or individuals. These are used only to detect and prevent spam, malware and abuse for all customers. Where the GDPR applies, Customer instructs this processing as part of the Service.

5. Subprocessors

5.1 Customer gives general authorization for the Subprocessors listed in Annex III and at https://postfend.com/subprocessors.

5.2 Processor gives at least 30 days' notice of any intended addition or replacement, by email to Customer's admin contact and on the list page. Customer may object on reasonable data-protection grounds within that period. If the objection cannot be resolved, Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.

5.3 Processor imposes on each Subprocessor, by written contract, data protection obligations no less protective than this DPA. Processor remains fully liable to Customer for each Subprocessor's performance.

6. International transfers

6.1 Primary storage location: Beauharnois, Québec, Canada (OVHcloud, mail-filter server mx1). Processor will give 30 days' notice before changing it.

6.2 PIPA/PIPEDA. Where Customer Personal Data is stored in or accessed from outside Canada, Processor lists the countries in Annex III. Processor provides the information Customer needs for its notices under PIPA s.13.1 and PIPEDA transparency obligations.

6.3 EU GDPR. Transfers from the EEA to Processor in Canada rely on the European Commission's adequacy decision for Canada, for organizations subject to PIPEDA (counsel should confirm that this covers Processor in a given case). To the extent a transfer is not covered by adequacy, including onward transfers to Subprocessors in non-adequate countries, the parties incorporate the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as follows:

• Module Two (controller to processor);
• Clause 7 (docking clause): applies;
• Clause 9(a): Option 2, general authorization, with 30 days' notice;
• Clause 11(a): optional redress clause does not apply;
• Clause 13: supervisory authority of the Member State of Customer's establishment;
• Clauses 17 and 18: governing law and courts of Ireland, as a conservative default if the Customer's establishment does not itself determine them.

Annexes I–III of this DPA serve as the SCC Annexes.

6.4 UK. UK transfers rely on the UK adequacy regulations for Canada or, if those do not apply, on the UK International Data Transfer Addendum to the SCCs (version B1.0), with Table 1–3 information taken from Annexes I–III and Table 4: neither party may end the Addendum.

6.5 Switzerland. The SCCs apply with the FADP adaptations. The competent authority is the FDPIC. This clause applies if Swiss personal data is transferred.

6.6 Processor will help Customer with transfer impact assessments and will implement the supplementary measures in Annex II.

7. Government access requests

Processor will do the following when a public authority asks for Customer Personal Data:

• require valid and binding legal process;
• challenge requests it considers unlawful or overbroad;
• disclose the minimum necessary;
• notify Customer unless legally prohibited; and
• document each request.

Processor has not built backdoors into the Service and will not do so voluntarily.

8. Security Incidents

8.1 Processor notifies Customer without undue delay and in any event within 72 hours after becoming aware of a Security Incident affecting Customer Personal Data.

8.2 The notice includes, as far as known at the time (more can follow in phases):

• the nature of the incident;
• the categories and approximate numbers of data subjects and records;
• the likely consequences;
• the measures taken or proposed; and
• a contact point.

8.3 Processor cooperates so that Customer can meet its own obligations to notify the Alberta OIPC, the OPC, supervisory authorities and individuals. Processor keeps a record of the incident for at least 24 months. Processor does not notify Customer's data subjects or regulators about Customer Personal Data without Customer's agreement, except where Processor is itself legally required to.

8.4 Notifying a Security Incident is not an admission of fault.

9. Deletion and return

On termination, Customer may export Customer Personal Data for 30 days (Terms s.18). Processor then deletes it within 30 days, and backups are overwritten within 35 days, except copies the law requires Processor to keep, which stay protected and used only for that purpose. On request, Processor certifies deletion in writing.

10. Audits

10.1 Once a year, on request, Processor provides:

• its current security documentation;
• answers to a reasonable security questionnaire; and
• its most recent independent audit report (for example SOC 2 Type II or ISO 27001), when such a report has been obtained. Until then, Processor provides its current security documentation and questionnaire answers.

10.2 If that is not enough to show compliance, or a supervisory authority requires it, Customer or an independent auditor bound by confidentiality may audit on 30 days' notice. Audits take place during business hours, at most once in 12 months (more often after a Security Incident), at Customer's cost, and without access to other customers' data.

11. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, as far as Data Protection Law allows. If this DPA conflicts with the Terms, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

12. Term

This DPA lasts as long as Processor processes Customer Personal Data.

Annex I — Description of processing

• Parties. Data exporter (controller): Customer, as identified on the account. Data importer (processor): 2758188 Alberta Ltd., operating as PostFend. Contact: [email protected].
• Data subjects. Customer's users (employees, contractors), and senders and recipients of email to or from Protected Mailboxes.
• Data categories. Email addresses, display names, message content and attachments, headers, IP addresses, connection metadata, verdicts and logs, and the account data of Customer administrators.
• Special categories. Not targeted. Email may incidentally contain any category, such as health or financial data. Annex II safeguards apply to all content.
• Frequency. Continuous.
• Nature and purpose. Receipt, scanning, classification, quarantine, release, delivery, logging, reporting and support, to provide email security filtering.
• Duration and retention. The Term plus the export period. Retention is as configured by the Customer, within these limits: quarantine 30 days on every Plan (or a shorter period the Customer chooses), logs 90 days, backups 35 days.
• Subprocessor transfers. As in Annex III.

Annex II — Technical and organizational measures

1. Encryption. TLS 1.2+ for web and API traffic. STARTTLS for SMTP, with MTA-STS support and an optional enforced-TLS policy. AES-256 (or equivalent) encryption at rest, including backups. Keys are managed in a KMS and rotated at least annually.
2. Access control. Role-based access with least privilege. MFA for all staff and all Customer admin accounts. Content can be accessed only through a ticketed emergency ("break-glass") procedure, which expires automatically. All access is logged and the logs are reviewed.
3. Isolation. Customer ID is enforced server-side on every query and storage object. Automated tests check isolation between customers.
4. Data minimization. Clean mail is not persisted after delivery. Logs contain metadata only. Cross-customer intelligence uses non-content signals only.
5. Retention. Configurable, with automatic deletion and deletion logs.
6. Resilience. Redundant infrastructure, encrypted backups, restores tested quarterly, and a documented continuity plan.
7. Vulnerability management. Dependency and container scanning, critical patches within 7 days, and annual penetration testing when commercially available.
8. Secure development. Code review, separation of environments, and secrets kept in a vault.
9. Incident response. A documented runbook, tested at least annually, and an append-only breach register kept for at least 24 months.
10. People. Confidentiality agreements, annual privacy and security training, and background checks where the law allows.
11. Vendors. Due diligence before onboarding any Subprocessor, written DPAs, and an annual review.
12. Supplementary transfer measures. Encryption with keys held by Processor, minimization, a government-access policy (s.7), and a transparency report at least annually (or a statement that there were no government-access requests in the period).

Annex III — Subprocessors

Processor does not use a separate transactional-email vendor or support-desk vendor to process Customer Personal Data. Digests, invoices and support replies are sent from Processor's own systems. Website hosting (ChemiCloud) and the public website chat (a separate OVH VPS in Canada) are listed at https://postfend.com/subprocessors; they do not process Protected Mailbox content under this DPA. If Processor later uses a third-party language service (planned: AWS Bedrock in a Canadian region) for the website chat, it will add that provider to the public list, give the notice required by s.5.2 if Customer Personal Data would be involved, and will not use it before that update and notice.