Data processing agreement
Effective from: 13 October 2026
This is a translation of the agreement in Swedish, which is at sendora.se/dpa. If the two differ, the Swedish agreement governs.
This agreement applies when Sendora processes personal data on the Customer’s behalf in the service. The Customer and Sendora are the parties to the terms of service. The Customer is the controller and Sendora is the processor.
1. The processing
The subject matter and purpose of the processing is to deliver the Customer’s transactional email and broadcasts. Sendora also receives mail for the addresses and domains that the Customer has pointed at the service, and shows the Customer what has happened to the messages. On a test server, the messages go through everything except delivery.
The processing consists of Sendora receiving the messages, storing them encrypted and handing them to the recipients’ mail servers. Sendora receives delivery reports, bounces, complaints and unsubscribes, and passes them to the Customer as events. Received mail is parsed, checked and stored encrypted, and passed to the Customer through the API and webhooks.
The personal data is the addresses and names of recipients and senders, subject lines, headers, content and attachments, the Customer’s tags and metadata, technical details of the mail servers, and times. The content may contain any data that the Customer or a sender writes. The data subjects are the Customer’s recipients, those who write to the Customer through the service and those named in the messages.
Sendora processes special categories of personal data under Article 9 of the General Data Protection Regulation only when the Customer sends or receives them through the service. The Customer decides whether the service is suitable for such content.
The processing continues for as long as the agreement for the service is in force, and after that until the data has been erased under section 6.
2. Instructions
Sendora processes the personal data only on the Customer’s documented instructions. The instructions are this agreement, the service’s documentation on sendora.se and the choices that the Customer makes in the service. This agreement takes precedence over the documentation. A change to the documentation never changes what data is processed, how long it is kept or where it is processed.
A person who represents the Customer can connect an app, such as an AI assistant, to the service. The app reaches only what that person has chosen and may reach themselves. What the app requests is the Customer’s instruction to Sendora, in the same way as when the Customer uses an API key. This applies both to what the app reads, which Sendora then discloses to the app, and to what the app changes or sends.
The app and its provider are the Customer’s choice and not Sendora’s subprocessors. The account’s administrators can disconnect any connection and switch off connected apps for the whole account.
The Customer also instructs Sendora to enforce the acceptable use rules. Sendora therefore adds a recipient to the stream’s suppression list after a hard bounce, a complaint or an unsubscribe. Sendora counts bounces and complaints and pauses sending as the rules provide. Sendora also compares subject lines as keyed hashes, a value that cannot be turned back into the text, to find bulk mailings sent as transactional email.
If Union or Member State law requires Sendora to process the data in another way, Sendora informs the Customer before the processing, unless that law prohibits it. If Sendora considers that an instruction infringes the General Data Protection Regulation, Sendora informs the Customer immediately.
3. Confidentiality and security
Everyone who processes the personal data on Sendora’s behalf does so under a duty of confidentiality. Sendora takes these measures and keeps them up to date:
- Content and attachments are encrypted before they are stored, with one key per customer.
- The mail server’s queue is on an encrypted volume.
- TLS always protects the Customer’s traffic to the API and SMTP, and mail to and from other servers when they support it.
- Customers are kept apart by row-level security in the database, and tests try to read across the boundary between customers.
- Logs, error reports and metrics contain no addresses, subject lines or content.
- Backups are encrypted, and restoring them is rehearsed.
- Only those responsible for Sendora’s operations can reach production.
- An audit log that cannot be altered records administrative actions and actions that concern the Customer’s data.
4. Subprocessors
The Customer gives Sendora a general authorisation to engage the subprocessors listed at sendora.se/subprocessors. Sendora tells the Customer by email at least 30 days before a subprocessor is added or replaced. The Customer may object within that time. If the objection cannot be resolved, either party may terminate the agreement for the service with effect from the end of the period.
If Sendora must replace a subprocessor sooner for the service to continue, for example when the subprocessor stops supplying it, Sendora tells the Customer before the replacement, as soon as it can. The Customer may then object within 30 days of the notice, with the same right to terminate the agreement.
Sendora imposes on each subprocessor in substance the same obligations as this agreement, and is liable to the Customer for the subprocessor’s processing.
5. Assistance to the Customer
Sendora helps the Customer to fulfil the data subjects’ rights. The Customer erases the data about a person through the service’s API. Within 24 hours, Sendora then erases the content of all messages to and from that person, sent and received. In the message log, the person’s address is replaced by a pseudonym, a value that cannot be turned back into the address.
A message that is already in the mail server’s queue stays there until it has been delivered, for at most three days. A backup that contains the data remains until it is overwritten, for at most six weeks.
A recipient who unsubscribes from a broadcast is added to the stream’s suppression list within seconds.
Sendora notifies the Customer of a personal data breach that concerns the Customer’s data without undue delay, and no later than 48 hours after Sendora becomes aware of it. The notice states, as far as is known, what has happened, which kinds of data and roughly how many data subjects are affected, and the likely consequences. It also states what Sendora has done and whom the Customer can contact, and is supplemented as more becomes known.
Sendora also assists the Customer in a data protection impact assessment or a prior consultation, with the information available to Sendora.
6. Retention periods, erasure and return
Sendora keeps the Customer’s data for as long as the table states, and then erases it.
| Data | How long |
|---|---|
| A message’s content: text, HTML and custom headers | 30 days after the message was sent, 7 days on a test server |
| A broadcast’s content | 30 days after the broadcast was sent, 7 days on a test server |
| The content of attachments | Until the message has been passed on or has failed, and for a broadcast until it is finished |
| Other data about messages and broadcasts: sender, subject line, tags, metadata, recipients, events, webhook deliveries and the names, types and sizes of attachments | 13 months after the message or the broadcast was sent, 30 days on a test server |
| The content, headers, attachments and sender of received mail | What the Customer has chosen for the stream, 1 to 30 days after receipt, 30 if nothing has been chosen |
| Whom received mail was to, when it arrived, its size, the results of the checks and the addresses in it as keyed hashes | 13 months after receipt |
| The suppression list, with unsubscribes and the events about them to the Customer’s webhook | For as long as the agreement for the service is in force |
| An erasure request, with the address encrypted until the erasure is done | 30 days after the erasure was done |
| Messages in the mail server’s queue | Until they have been delivered, at most three days |
| Logs and error reports, which hold only the service’s own ids | 30 days |
| Backups of the database | At most six weeks |
When the agreement for the service ends, Sendora erases the Customer’s data within 30 days and confirms the erasure by email. If the Customer wants the data returned, the Customer fetches it through the API before the agreement ends: the events, the suppression list, and received mail for as long as its content is kept. The Customer already has the content of sent messages in its own systems. What the law requires Sendora to keep, such as the records behind the invoicing, Sendora processes as a controller under the privacy policy.
7. Audits
Sendora gives the Customer the information needed to show that this agreement is complied with. The Customer may also audit Sendora’s processing, itself or through an auditor bound by confidentiality whom the Customer appoints. An audit may be carried out once a year on 30 days’ notice, and also, on reasonable notice, after a personal data breach that concerns the Customer’s data.
The audit is carried out primarily through documentation and written answers. If that is not enough, it is carried out on site, at an address in Sweden that Sendora designates. The premises of subprocessors are audited through the certificates and reports that the subprocessors give Sendora. The Customer bears its own costs, and the audit never covers other customers’ data.
8. Transfers outside the EU/EEA
Sendora processes the Customer’s personal data in Sweden. No subprocessor is outside the EU/EEA. Sendora does not transfer data to a country outside the EU/EEA without the Customer’s documented instruction.
9. Changes
A change to this agreement takes effect only when the Customer has accepted it. If the parties have signed a data processing agreement of their own, that agreement applies instead of this one.