Data Processing Agreement

Part B: Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Agreement between you (the Customer) and us (the Provider) and applies whenever we process personal data on your behalf. It is intended to meet Article 28 of the UK GDPR. Version 1.0, effective 15 October 2026.

1. Definitions and roles

1.1 Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced from time to time. Controller, processor, personal data, personal data breach, data subject and processing have the meanings given in the UK GDPR.

1.2 Customer Personal Data means personal data within Customer Data that we process on the Customer's behalf. Annex 1 describes it.

1.3 For Customer Personal Data the Customer is the controller and we are its processor. If the Customer is itself a processor acting for its own clients, we act as the Customer's sub-processor and the Customer confirms it has authority to appoint us on these terms.

1.4 Connected Services (such as the Customer's PSA, RMM, distributor and accounting providers) are the Customer's own suppliers. They are not our sub-processors.

2. Our obligations as processor

2.1 Instructions. We will process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, the Customer's use and configuration of the Service, and any further written instructions we accept. We will tell the Customer if we think an instruction breaches Data Protection Law, unless the law prevents us. We may process Customer Personal Data where the law requires it, telling the Customer first where lawful.

2.2 Confidentiality. We will ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

2.3 Security. We will implement appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex 2, taking account of Article 32 of the UK GDPR. We may update those measures if the overall level of protection is not reduced.

2.4 Sub-processors. The Customer gives general authorisation for the sub-processors listed in Annex 3. We will give at least 14 days' notice (by email or on our sub-processor page) before adding or replacing one. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the unused period. We will bind each sub-processor to data protection terms no less protective than this DPA and remain responsible for their performance.

2.5 International transfers. We will not transfer Customer Personal Data outside the UK unless the destination is covered by UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework), or an appropriate safeguard applies, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Annex 3 states the safeguard used for each sub-processor.

2.6 Data subject requests. We will promptly pass to the Customer any request we receive from a data subject about Customer Personal Data, and will not respond except to say it has been passed on. Taking account of the nature of processing, we will give the Customer reasonable help, through the Service's tools where possible, to respond to such requests.

2.7 Personal data breaches. We will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and where possible within 48 hours. Our notice will say what happened, the likely consequences, the data and data subjects concerned so far as known, and what we are doing about it. We will keep the Customer updated and give reasonable help so it can meet its own notification duties.

2.8 Further assistance. We will give reasonable help with data protection impact assessments and consultations with the Information Commissioner where they relate to our processing. We may charge reasonable costs for help that goes beyond what the Service and this DPA normally involve.

2.9 Deletion and return. When the Agreement ends we will delete Customer Personal Data, and the Customer may export it first, on the timings in clause 19 of the Terms (and Schedule 1 for free trials), unless the law requires us to keep it.

2.10 Audit and information. We will give the Customer the information needed to show we comply with Article 28, for example by answering security questionnaires and sharing any independent certifications we hold. If that is not enough, the Customer may audit us once in any 12 months (or after a personal data breach) on 30 days' notice, during business hours, subject to confidentiality and at the Customer's cost, in a way that does not disrupt our business or other customers' data.

3. The Customer's obligations

3.1 The Customer is responsible for having a lawful basis to process Customer Personal Data and to share it with us, for giving its own clients and staff any required privacy notices, and for making sure its instructions are lawful.

3.2 The Customer will connect only systems and data it is authorised to connect, and will not give us special category data or criminal offence data.

4. Liability and precedence

4.1 Each party's liability under this DPA is subject to the limits in clause 15 of the Terms, to the extent the law allows.

4.2 If this DPA conflicts with the rest of the Agreement on the processing of personal data, this DPA prevails.

4.3 This DPA lasts for as long as we process Customer Personal Data. Clause 22.2 of the Terms (assignment and novation) applies to it.

DPA Annex 1: Details of processing

DPA Annex 2: Security measures

• Access control. Multi-factor authentication is compulsory for all users. Free-trial users have a 7-day grace period to set it up, after which access is blocked until they do.
• Tenant separation. Each customer's data is separated logically by organisation, and requests are authorised against the signed-in user's organisation.
• Encryption in transit. Connections to the Service use HTTPS (TLS).
• Encryption at rest. API keys, OAuth access and refresh tokens and similar credentials for Connected Services are encrypted at the application layer, with keys held outside the database.
• Application hardening. Rate limiting, security response headers, request-forgery protection and restricted cross-origin access are in place.
• Logging and monitoring. Security-relevant actions, such as connecting or changing a connector and pushing invoices, are written to an audit log with the user and IP address.
• Hosting assurance. Railway holds SOC 2 Type II and SOC 3 certification.

DPA Annex 3: Sub-processors

We will keep this list at mspbilling.cloud/sub-processors (Part D). Resend handles only account contact details, for which we are the controller, and is listed for transparency.