Data Processing Agreement

The parties

This Data Processing Agreement ("DPA") is between you (the customer, the controller for the mail you send and receive through SendClipper) and Marseco SH.P.K., Lagja e Muhagjereve, Rr. Lordi Bajron, Blloku B II-I, 10000 Prishtinë, Kosovo, registration number 811367847 (the processor). It is incorporated by reference into the Terms of Service: accepting the Terms also enters you into this DPA, with no separate signature.

Subject matter, duration and categories

Subject matter and nature. SendClipper processes personal data on your behalf to send email from your verified domains, receive replies into your mailboxes, log what happened to each message, and hold the contacts you upload: exactly the service described in the Terms of Service.

Duration. For as long as your workspace exists and this DPA (with the Terms) remains in effect, and afterwards only as described in "What happens when this ends" below. Within that: the body of a message you send is kept for 30 days by default and then deleted, while the row, its status and its full event timeline stay; mail you receive, and drafts, are kept for as long as your workspace exists (we do not expire them on a timer, and moving one to Trash does not delete it). We delete them on your written request (see "Helping you answer a data-subject request").

Categories of personal data. Sender and recipient addresses and names; the message body and any attachments; delivery events (accepted, delivered, opened, clicked, bounced, complained) and the IP address and user agent recorded with an open or a click; whatever fields your uploaded contacts carry.

Categories of data subjects. The people you send mail to and receive mail from, and your own users (the people you invite into your workspace).

Processing on your instructions

We process personal data only on your documented instructions (which you give by using the product: the domains you verify, the mail you send, the contacts you upload, the mailboxes you create) and to comply with the law that applies to us. If we believe an instruction would break the law, we will tell you before carrying it out.

Confidentiality

Anyone who processes personal data on our side (our own staff and the sub-processors named below) is bound to keep it confidential, whether by contract or because they are already under a statutory duty of confidence.

Security measures

• The dashboard, the API and the mailbox app are served over HTTPS (TLS). Webhook deliveries are encrypted too, unless you register a plain http:// endpoint and confirm that you accept it is not.
• Passwords are hashed with Argon2id, never stored in a reversible form. Two-factor secrets, webhook signing secrets and sandbox SMTP passwords are encrypted with AES-256-GCM.
• Each workspace's rows are isolated in the database itself by row-level security: a query made on one workspace's behalf is limited by the database to that workspace's rows.
• An API key is stored only as a hash, so it can never be shown to you twice.
• Message bodies, attachments and archived raw mail are not encrypted at rest by the application today. Moving the archived mail and attachments to Amazon S3 (which always encrypts at rest) would close part of this gap; it is tracked separately.
• SendClipper does not scan attachments for malware. Inbound mail relies on Amazon SES's own virus verdict; nothing is scanned on the way out.

Sub-processors

You give general authorisation for the sub-processors below to process personal data on our behalf. A change to this list (adding or replacing a sub-processor) is announced on this page, with its date in the "Last changed" line below, at least 30 days before it takes effect, and by email to account Owners where we can deliver to them.

Last changed: 2026-10-01. AWS publishes its own list of sub-sub-processors at aws.amazon.com/compliance/sub-processors.

Helping you answer a data-subject request

You can stop mail to an address yourself: an address that uses the unsubscribe link is suppressed automatically, and you can add one to your suppression list through the API (POST /v1/suppressions). Deleting a contact, or the messages sent to or received from a person, is not something the product does yet. Write to support@sendclipper.com and we will do it for you, and assist with any other request you cannot satisfy through the product.

Personal data breach

We will notify you of a personal data breach affecting your data without undue delay after becoming aware of it, and in any case within 48 hours, with what we know at the time. Notify a breach you believe involves SendClipper to support@sendclipper.com.

International transfers

Receiving, and every send Azure does not carry, run through Amazon SES in the AWS region you choose for each sending domain: US East (N. Virginia), Europe (Ireland) or US West (Oregon); a new domain starts in US East (N. Virginia) unless another region is picked, so mail through a domain in a US region is processed in the United States. Mail from an address Microsoft Azure Communication Services can send for your domain (for now, donotreply@) may be sent through Azure, whose data location is Europe; everything else is sent through Amazon SES, and all mail is received through Amazon SES. The application, its database and the archived copies of messages live on one server in Germany, and administrative access to it is from Kosovo, which does not hold an EU adequacy decision.

This DPA incorporates the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: Controller to Processor) by reference for any such transfer.

What happens when this ends

There is no self-service workspace deletion today. Write to support@sendclipper.com and we will delete your workspace's personal data within 30 days of the request, except what we are required to keep by law.

Audits

We will give you the information reasonably necessary to demonstrate compliance with this DPA on request. We do not offer on-site audits.

Liability

This DPA does not create liability separate from the Terms of Service: whatever those terms say about liability applies here too, by reference, rather than being restated or widened. This DPA is governed by the same law, and disputes about it go to the same courts, as the Terms of Service: the law of the Republic of Kosovo and the competent courts of the Republic of Kosovo.