Data Processing Agreement

1. Introduction and Parties

This Data Processing Agreement (the "DPA") sets out the terms on which DMARC Engine ("DMARC Engine", "we", "us", the "Processor") processes personal data on behalf of a customer (the "Customer", "you", the "Controller") in connection with the DMARC Engine hosted email-authentication platform (the "Service"). The Service helps organisations configure, monitor and enforce DMARC, SPF, DKIM, MTA-STS and BIMI, including done-for-you progression to a p=reject enforcement policy.

This DPA forms part of, and is incorporated by reference into, the agreement between you and DMARC Engine for use of the Service (the "Terms", available at /terms). By accepting the Terms and using the Service, you enter into this DPA on behalf of yourself and, to the extent required by applicable data protection law, in the name and on behalf of your authorised affiliates. Where the Customer acts as a processor on behalf of its own end-customers, this DPA applies on a back-to-back basis and the Customer warrants that it is authorised to instruct DMARC Engine as a sub-processor. It governs our processing of personal data and is intended to satisfy the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation ("EU GDPR"). This DPA should be read together with our Privacy Policy.

2. Definitions

Terms used in this DPA have the meanings given to them here, and otherwise the meanings given in the applicable data protection law:

• "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR and any other privacy or data protection laws that apply to the processing under this DPA.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given in Applicable Data Protection Law.
• "Customer Personal Data" means the personal data that DMARC Engine processes on behalf of the Customer in providing the Service, as described in Annex I.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Sub-processor" means any third party engaged by DMARC Engine to process Customer Personal Data in connection with the Service.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission, and "UK IDTA" means the International Data Transfer Agreement and/or the UK Addendum issued by the Information Commissioner's Office.

3. Roles and Scope of Processing

As between the parties, the Customer is the Controller (or, where the Customer is itself a processor, the processor) of the Customer Personal Data, and DMARC Engine is the Processor. DMARC Engine processes Customer Personal Data only to provide, secure, maintain and support the Service in accordance with the Terms, this DPA and the Customer's documented instructions. The subject matter, duration, nature, purpose, types of personal data and categories of data subjects are described in Annex I.

DMARC Engine separately acts as a Controller in its own right for certain limited data (for example account registration data, billing data, support correspondence and security logs) as described in our Privacy Policy. This DPA governs only the processing carried out by DMARC Engine as a Processor on the Customer's behalf.

4. Processor Obligations

DMARC Engine shall:

• Documented instructions: process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case we will inform the Customer of that legal requirement before processing, unless prohibited from doing so). The Terms, this DPA and the Customer's use and configuration of the Service constitute the Customer's complete and final documented instructions. We will inform the Customer if, in our opinion, an instruction infringes Applicable Data Protection Law.
• Confidentiality: ensure that all personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality and are made aware of the confidential nature of the data.
• Security (Article 32): implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as summarised in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to data subjects.
• Assistance: taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligations to respond to requests from data subjects (see section 8), and assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (security of processing, breach notification and communication, and data protection impact assessments and prior consultation), taking into account the information available to us.
• Records and demonstrable compliance: maintain records of its processing activities as required by Article 30 and make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, as further described in section 10.

5. Sub-processing

The Customer provides a general authorisation for DMARC Engine to engage Sub-processors to process Customer Personal Data, subject to this section. A current list of Sub-processors is published at /sub-processors. Our primary infrastructure Sub-processor is Cloudflare, whose Workers, D1 (database), R2 (object storage) and Workers KV (cache) products run the Service, alongside a transactional email provider and a third-party payment processor.

• Prior notice and right to object: we will give the Customer prior notice of any intended addition or replacement of a Sub-processor (for example via the /sub-processors page and/or by email where subscribed), giving the Customer a reasonable opportunity to object on reasonable, data-protection-related grounds. If the Customer objects and the parties cannot agree a resolution, the Customer may terminate the affected Service as its sole remedy.
• Flow-down: we will impose on each Sub-processor, by written contract, data protection obligations no less protective than those set out in this DPA, in particular obligations to provide sufficient guarantees to implement appropriate technical and organisational measures.
• Liability: where a Sub-processor fails to fulfil its data protection obligations, DMARC Engine remains fully liable to the Customer for the performance of that Sub-processor's obligations, to the extent provided by Applicable Data Protection Law and subject to section 11.

6. International Transfers

Because the Service runs on globally distributed infrastructure, Customer Personal Data may be transferred to or accessed from countries outside the United Kingdom or the European Economic Area. Where such a transfer takes place to a country that is not the subject of an applicable adequacy decision, DMARC Engine will ensure an appropriate transfer mechanism is in place, such as the UK IDTA, the UK Addendum, or the European Commission's SCCs, together with any supplementary measures required to ensure that the data continues to receive an essentially equivalent level of protection. To the extent the SCCs or UK IDTA apply to a transfer between the Customer and DMARC Engine, they are incorporated into this DPA by reference, the Customer is the data exporter and DMARC Engine is the data importer, and the relevant annexes are populated by Annexes I to III of this DPA.

7. Personal Data Breach Notification

DMARC Engine will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will, to the extent known and reasonably available to us, describe the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and a contact point for further information. We will take reasonable steps to mitigate the effects of, and to minimise any damage resulting from, the breach, and will cooperate with the Customer and provide reasonable assistance to enable the Customer to meet any obligation it has to notify a Supervisory Authority or affected data subjects. Our notification is not an acknowledgement of fault or liability.

8. Data-Subject Rights Assistance

Taking into account the nature of the processing, DMARC Engine will provide reasonable assistance, including by appropriate technical and organisational measures and through self-service functionality in the Service where available, to enable the Customer to respond to requests from data subjects exercising their rights of access, rectification, erasure, restriction, portability and objection under Applicable Data Protection Law. If we receive a request directly from a data subject relating to Customer Personal Data, we will, unless legally required to respond, promptly inform the data subject to contact the Customer and notify the Customer of the request rather than responding ourselves, except to the extent necessary.

9. Deletion or Return on Termination

Upon termination or expiry of the Service, and at the Customer's choice, DMARC Engine will delete or return all Customer Personal Data and delete existing copies, unless storage is required by law. Following a short grace period after termination to allow account recovery and data export, Customer Personal Data is deleted or irreversibly anonymised in the ordinary course of operation. Residual copies held in routine backups are deleted or overwritten in line with our backup-rotation cycle, and remain protected by this DPA until then. Retention periods for specific categories of data are described in our Privacy Policy.

10. Audits and Information Rights

DMARC Engine will make available to the Customer information reasonably necessary to demonstrate compliance with its obligations under Article 28 and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. To minimise disruption and to protect the confidentiality and security of other customers' data, the Customer agrees that such requests will, in the first instance, be satisfied by DMARC Engine providing relevant documentation, security summaries and, where available, the certifications and audit reports of our infrastructure providers. The Service runs on Cloudflare infrastructure, which maintains SOC 2 Type II and ISO 27001 certifications. DMARC Engine's own first-party certification status is not independently certified; our controls are designed to align with ISO 27001 and SOC 2 principles. An on-site audit may be conducted no more than once per year, on reasonable prior written notice, during business hours, subject to confidentiality undertakings, and limited to systems and facilities relevant to the processing of the Customer's Personal Data.

11. Liability and Order of Precedence

Each party's liability arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Terms, and any reference in the Terms to the liability of a party means the aggregate liability of that party under the Terms and this DPA together. In the event of any conflict or inconsistency between this DPA and the Terms in relation to the processing of personal data, this DPA prevails. In the event of any conflict between this DPA and the SCCs or UK IDTA, those transfer clauses prevail to the extent of the conflict in respect of the transfers they govern.

12. Governing Law

This DPA is governed by and construed in accordance with the laws of England and Wales, without prejudice to any mandatory provisions of Applicable Data Protection Law. Where the SCCs or UK IDTA apply, the governing law and forum specified in those clauses apply to the matters they govern.

13. Annex I: Details of Processing

This Annex describes the processing carried out by DMARC Engine as Processor on behalf of the Customer.

14. Annex II: Technical and Organisational Measures

DMARC Engine implements and maintains technical and organisational measures appropriate to the risk, designed to align with ISO 27001 and SOC 2 principles. These include:

• Infrastructure: the Service runs entirely on Cloudflare's global edge platform (Workers for compute, D1 for the database, R2 for raw report storage, Workers KV for rate-limiting and caching, and the Cloudflare CDN, WAF and DDoS protection). There are no self-managed servers. Cloudflare maintains SOC 2 Type II and ISO 27001 certifications for that infrastructure, with global anycast routing and automatic failover.
• Encryption in transit: all connections use TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) preload and a strict Content-Security-Policy.
• Encryption at rest: sensitive stored secrets, including two-factor authentication secrets, single sign-on client secrets and notification-channel credentials, are encrypted at the application layer using AES-GCM, in addition to the storage-layer protections of the underlying platform.
• Authentication and access control: passwords are stored only as salted hashes; optional TOTP two-factor authentication with backup codes; role-based access control; IP allow-listing; enterprise single sign-on and social login; and least-privilege, scoped API tokens.
• Application security: CSRF tokens on state-changing requests; per-IP and per-account rate limiting; Cloudflare Turnstile and honeypots on public forms; and HMAC-signed, expiring report-download links.
• Logging and monitoring: an append-only audit log of significant account and security events, queryable Workers Logs, and abuse-prevention controls.
• Organisational measures: confidentiality obligations on personnel, least-privilege internal access, and a coordinated vulnerability disclosure process published at https://dmarcengine.com/.well-known/security.txt with reports accepted via our contact page and at security@dmarcengine.com.

For a fuller description of these controls, see our Security page. We may update specific measures from time to time provided the overall level of protection is not materially reduced.

15. Annex III: Sub-processors

The Customer authorises DMARC Engine to engage the Sub-processors listed, with their roles and processing locations, on our dedicated page at /sub-processors. That page is maintained as the current, authoritative list and is incorporated into this DPA by reference. Changes to the list are governed by section 5 (Sub-processing).

16. Closing Note and Contact

This DPA is provided in good faith and in the interests of transparency, and may be updated from time to time to reflect changes in our practices, sub-processors or legal requirements; the "Last updated" date above will reflect any revision. A countersigned copy of this DPA is available on request via legal@dmarcengine.com, and customers should have their own legal counsel review this DPA before relying on it. For any questions about this DPA or our data processing, contact legal@dmarcengine.com, or our privacy team at privacy@dmarcengine.com.