Data Processing Agreement
In short: you decide what personal data goes into the emails you send; we process it only to deliver them, keep it in India, protect it, tell you quickly if something goes wrong, and delete it when you leave. This agreement applies automatically to every Vaartix account; there is nothing to sign.
1. Parties and scope
This Data Processing Agreement ("DPA") is between you, the Vaartix customer ("Customer", "you"), and NAP Designs, India, which operates Vaartix ("Vaartix", "we", "us"). It forms part of the Terms of Service and applies whenever Vaartix processes personal data in Customer Data on your behalf.
For that personal data you are the Data Fiduciary and we are your Data Processor, as those terms are used in India's Digital Personal Data Protection Act, 2023 and its rules (together, the "DPDP Act"). Data we hold about you as our customer, such as your account and billing details, is covered by our Privacy Policy instead.
If this DPA and the Terms of Service conflict on the processing of personal data, this DPA wins.
2. Definitions
- Customer Data: the email content, recipient addresses, attachments, headers, tags and other data you send to Vaartix, and the delivery events and logs we create from it.
- Personal data, Data Principal and processing have the meanings given in the DPDP Act.
- Sub-processor: a third party we engage that processes Customer Data.
- Personal data breach: a breach of security that leads to unauthorised processing, accidental disclosure, loss of access to, or destruction or alteration of, personal data in Customer Data.
3. Details of the processing
| Purpose | Sending your emails, recording what happened to them (sent, delivered, bounced, complained, opened, clicked), keeping suppression lists, sending webhooks to you, and showing you logs and metrics |
|---|---|
| Nature | Receiving, storing, transmitting, logging and deleting |
| Data Principals | The people you email, and people named in the emails you send |
| Personal data | Email addresses and display names; message subject, content and attachments; IP address and user agent of recipients when open or click tracking is on; anything else you choose to put in an email |
| Duration | While your account is open, then until deletion under section 11 |
| Location | India (AWS Mumbai region), as described in section 8 |
Vaartix is built for transactional email. Don't use it to send sensitive data such as passwords, full card or bank account numbers, health records or government ID numbers in plain text, unless the law requires it and you have the necessary safeguards.
4. Your instructions
We process Customer Data only on your documented instructions. Your instructions are the Terms of Service, this DPA, your API requests and the settings you choose in the dashboard. We may also process it where Indian law requires us to; if so, we will tell you first unless the law forbids it.
If we believe an instruction breaks the DPDP Act or another law, we will tell you and may decline to follow it.
5. Your responsibilities
As the Data Fiduciary you are responsible for:
- Having a lawful basis, such as consent or another ground the DPDP Act allows, to email each recipient and to include their personal data in your emails
- Giving recipients the notices the DPDP Act requires, and honouring their requests to access, correct or erase their data and to withdraw consent
- Getting verifiable parental consent where the law requires it before processing a child's data
- The accuracy of the data you send, and following our Acceptable Use Policy
6. Our people
Only people who need access to run, secure or support the service can access Customer Data, and only as much as they need. They are bound by confidentiality obligations. We look at email content only when you ask us to (for example, to investigate a delivery problem), to investigate abuse or a security incident, or where the law requires it.
7. Security
We maintain the technical and organisational measures in the Annex, which are reasonable security safeguards as the DPDP Act requires. We may improve these measures over time but will not reduce the overall level of protection.
8. Sub-processors and data location
You authorise us to use these sub-processors:
| Sub-processor | What it does | Where |
|---|---|---|
| Amazon Web Services India Private Limited / Amazon Web Services, Inc. | Servers, database, backups, email sending (Amazon SES) and delivery events | India (Mumbai region, ap-south-1) |
| Cloudflare, Inc. | Network security and encrypted transit for requests to the API and dashboard; DNS | Global network; does not store email content |
Customer Data is stored in India. Two things necessarily happen outside our storage: requests to the API pass encrypted through Cloudflare's network, the nearest point of which may be outside India, and emails are delivered to recipients' mail servers wherever those are.
We bind each sub-processor by contract to protect Customer Data at least as well as this DPA does, and we are responsible for their work. We will announce a new sub-processor on this page and by email at least 30 days before it starts processing Customer Data. If you object on reasonable data protection grounds, tell us within that time; if we can't address your objection, you may close your account and we will refund any fees prepaid for the period after the change.
9. Helping you meet your obligations
- Data Principal requests: if a recipient contacts us about data in Customer Data, we will send them to you and not answer for you unless you ask us to. We will help you find, correct or delete their data when you can't do it yourself through the dashboard or API.
- Suppression and unsubscribes: addresses that hard bounce or complain are added to your suppression list automatically. We will add or remove addresses on your request.
- Regulators: we will reasonably help you with questions from the Data Protection Board of India about our processing.
10. Personal data breaches
If we become aware of a personal data breach affecting Customer Data, we will tell you without undue delay, and within 24 hours of confirming it, so you can meet your own duty to inform the Data Protection Board of India and affected Data Principals. We will tell you what happened, what data and how many Data Principals are likely affected, what we are doing about it and who you can contact, and keep you updated as we learn more. We will take reasonable steps to contain the breach and stop it from happening again.
11. Deletion
- While your account is open, email contents and logs are deleted automatically at the end of your plan's retention period, and attachments are deleted as soon as the email is sent.
- When your account closes, we delete Customer Data within 30 days. Copies in backups are overwritten within a further 7 days.
- We may keep suppression entries for as long as they are needed to stop unwanted email to those addresses, and data the law requires us to keep.
The DPDP Act also requires a Data Fiduciary to erase personal data once its purpose is served. Tell us if you need Customer Data deleted sooner and we will do so.
12. Information and audits
On written request, no more than once a year (or more often if a regulator requires it or after a personal data breach), we will answer a reasonable security questionnaire and give you the information you need to check that we meet this DPA. Requests to inspect our premises or systems are limited to what the law or a regulator requires, and need reasonable notice and confidentiality terms. Our sub-processors' own audit reports, such as those of AWS and Cloudflare, are available from them.
13. Requests from authorities
If a court or government authority asks us for Customer Data, we will check that the request is valid, disclose only what is legally required, and tell you about it unless the law forbids us to.
14. Liability and changes
Each party's liability under this DPA is subject to the limits in the Terms of Service. We may update this DPA to reflect changes in the law or our service; we will post the new version here and, for material changes, tell you by email at least 30 days before they take effect. Changes will not reduce the protection Customer Data has under this DPA unless the law requires it.
If your use of Vaartix is also subject to data protection laws outside India, such as the EU GDPR, write to [email protected] before sending us that data.
Annex: security measures
- Location: Customer Data is stored in AWS's Mumbai region, India.
- Encryption: TLS for all connections to the API, the dashboard and between our systems; encryption at rest for the database, backups and server disks. Webhook signing secrets are encrypted in the database.
- Network: the application server accepts no inbound connections from the internet; traffic reaches it only through an authenticated Cloudflare Tunnel. The database is in a private network reachable only by the application server.
- Access control: production access requires multi-factor authentication, uses short-lived credentials through AWS Systems Manager, and is limited to the people who need it. Servers use IAM roles with only the permissions they need; no long-lived cloud keys are stored on servers or in code.
- Customer credentials: API keys are shown once and stored only as hashes; keys can be limited to sending and to one domain, and revoked at any time. Dashboard login uses one-time codes; sessions expire after 30 days.
- Data minimisation: attachments are deleted as soon as the email is sent; email contents and logs are deleted at the end of the retention period. Error monitoring, where used, is configured to exclude email addresses and content.
- Resilience: daily automated database backups kept for 7 days with point-in-time restore; a durable queue for delivery events; documented recovery procedures.
- Monitoring: alerts for errors, stuck email, unusual sending volumes and bounce or complaint rates; an audit log of account changes.
- Abuse prevention: sending limits for new accounts, automatic suppression of bouncing and complaining addresses, and automatic pausing of accounts with high bounce or complaint rates.
- Development: code changes are reviewed and tested automatically before deployment; secret scanning is enabled on our code repository.
Contact
Questions about this DPA: [email protected].