Data Processing Addendum (DPA)

This DPA forms part of the agreement between the customer ("Controller") and Peicloud Digital, S.L.("Processor") and governs the processing of personal data on the Controller's behalf when using the Service.

1. Roles

The Controller determines the purposes and means of processing their contact data and campaign content. Delark processes that data solely to provide the Service and per the Controller's documented instructions.

2. Subject matter & duration

Processing covers the delivery of email and related analytics for the duration of the agreement and any legally required retention period thereafter.

3. Data subjects & categories

• Data subjects: the Controller's contacts and recipients.
• Categories: identifiers (name, email), engagement metadata, and any custom fields the Controller uploads.

4. Sub-processors

Delark uses vetted sub-processors (hosting, sending infrastructure, payment, analytics) under written contracts with equivalent data-protection obligations. A current list is available on request; we notify Controllers of material changes.

5. Security measures

Encryption in transit, access controls, least-privilege, logging/monitoring, and regular review. Details available under NDA.

6. International transfers

Where applicable, transfers rely on Standard Contractual Clauses or equivalent safeguards.

7. Data subject requests & breach

Delark assists the Controller in responding to data-subject requests and will notify the Controller without undue delay upon becoming aware of a personal data breach affecting their data.

8. Deletion

On termination, Delark deletes or returns personal data per the Controller's instruction, subject to legal retention requirements.

9. Contact

To execute a signed DPA or request our sub-processor list: privacy@delark.io.