Data processing agreement
Last changed: 2026-10-13. Words in [square brackets] are still to be filled in.
This agreement ("DPA") forms part of the terms of service between you ("Customer") and [Plainsend's legal entity and ABN] ("Plainsend"). It applies when Plainsend processes personal information about the Customer's contacts ("Customer Personal Data").
1. Roles
The Customer is the controller (or, under Australian law, the entity that collected the information). Plainsend is the processor: it processes Customer Personal Data only to provide the service and only on the Customer's documented instructions. The terms, the Customer's configuration (sources, journeys, sends) and its API calls are those instructions.
2. What is processed
| Who | The Customer's contacts, leads and customers, and its staff who use Plainsend |
| What | Contact details (email, phone, name), properties the Customer chooses to send, events, consent records, message and engagement history (deliveries, opens, clicks, bounces, complaints) |
| Why | Storing contacts and consent, rendering and sending messages, running journeys, reports |
| How long | For the term of the agreement, then as in section 8 |
| Sensitive information | Not intended. The Customer should not send health, financial account or other sensitive information unless agreed in writing |
3. Plainsend's obligations
Plainsend will:
- process Customer Personal Data only on the Customer's instructions, and say if it believes an instruction breaks the law;
- make sure its staff and contractors are bound to confidentiality;
- keep appropriate technical and organisational security measures (section 5);
- help the Customer answer requests from individuals (access, correction, erasure) through the API and console, which include contact export and erasure;
- help the Customer with security assessments and notifiable data breach obligations, as reasonably needed;
- tell the Customer without undue delay, and within [48 hours], after becoming aware of a breach affecting Customer Personal Data.
4. Sub-processors
The Customer authorises the sub-processors listed on the security page. Plainsend will give at least [30] days' notice before adding or replacing one, and the Customer may object on reasonable grounds; if we can't resolve the objection, the Customer may end the affected service and get a refund of prepaid fees for it. Plainsend stays responsible for its sub-processors.
5. Security measures
- Data at rest in Sydney (AWS ap-southeast-2); TLS in transit.
- Credentials for the Customer's data sources encrypted before storage.
- Access by scoped API keys and signed-in users with roles; agent keys cannot send or activate without an owner's approval.
- An activity log of changes and sends.
- Each workspace's data kept separate in the database, and a separate Amazon SES tenant per workspace.
6. Where data goes
Customer Personal Data is stored in Australia. Some sub-processors may access it from other countries (see the list). Where the GDPR or UK GDPR applies, transfers are covered by [the EU Standard Contractual Clauses / UK addendum, to be attached].
7. Audits
Plainsend will give the Customer the information reasonably needed to show it meets this DPA. Plainsend does not yet have a SOC 2 report or independent penetration test; when it does, it will share them on request under confidentiality. [On-site audit rights to be agreed for enterprise contracts.]
8. End of the agreement
When the agreement ends, the Customer can export its data for [30] days. Plainsend then deletes Customer Personal Data, except suppression records the Customer asks it to keep and anything the law requires it to retain.
9. Order of precedence
If this DPA and the terms conflict about personal information, this DPA wins.