Data Processing Addendum

This DPA covers the personal data that you, or anyone in your workspace, put into Norbelys or that Norbelys receives for you, such as the people you email, the emails you send and the replies you get (“Customer Personal Data”).

For Customer Personal Data, you are the controller and Xuxil is your processor. If you use Norbelys for your own clients, as an agency does, you are their processor and Xuxil is your sub-processor. Under US state privacy laws such as the CCPA, Xuxil is your service provider.

“Data Protection Laws” means every law that applies to Customer Personal Data, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws. Words defined in the GDPR, such as “personal data breach”, have the same meaning here.

We process Customer Personal Data only on your documented instructions. Those instructions are the Terms, this DPA and the way you configure and use Norbelys, including your campaigns, your settings and your API calls. We’ll tell you if we believe an instruction breaks Data Protection Laws.

We will not sell or share Customer Personal Data, use it for any purpose but providing Norbelys, keep it outside our direct business relationship with you, or combine it with data from other sources, except as Data Protection Laws allow a service provider to.

Everyone at Xuxil who can access Customer Personal Data is bound by confidentiality and gets access only when their work requires it. When our support team signs in to a workspace to help, each session lasts 10 minutes at most and is recorded in that workspace’s audit log.

We protect Customer Personal Data with the technical and organizational measures in Annex 2. We may improve them, but never in a way that lowers the overall protection.

You authorize us to use the sub-processors listed on our sub-processors page. Each is bound by a written contract with data protection obligations at least as protective as this DPA, and we remain responsible for them.

We will tell workspace owners by email, and update that page, at least 30 days before a new sub-processor starts processing Customer Personal Data. You may object on reasonable data protection grounds within those 30 days by writing to privacy@norbelys.com. We’ll look for a solution together; if there isn’t one, you may end the affected part of the service and get a refund of fees paid for the time after it ends.

Norbelys stores Customer Personal Data in the European Union, on servers in Germany and Finland and in Cloudflare R2 storage located in the EU.

Xuxil is a US company, and some sub-processors are in the United States. Where a transfer of Customer Personal Data to us or to them would otherwise be restricted by Data Protection Laws, the European Commission’s Standard Contractual Clauses of June 4, 2021 apply and are incorporated into this DPA: Module Two where you are a controller and Module Three where you are a processor. For those clauses, Clause 7 applies; under Clause 9 the option is general authorization, with the notice period in section 5; the optional wording in Clause 11 doesn’t apply; under Clause 17 the governing law is Irish law, and under Clause 18 the courts are those of Ireland. Annexes 1 and 2 of this DPA complete the clauses’ annexes.

For data from the United Kingdom, the UK Addendum to those clauses applies; for data from Switzerland, the clauses apply with the amendments Swiss law requires.

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We’ll tell you what happened, the data and people likely affected, the likely consequences and what we are doing about it, and we’ll keep you updated as we learn more.

We will take reasonable steps to contain the breach and limit its effects. Notifying you is not an admission of fault.

Norbelys lets you find, export, correct, suppress and delete the people in your workspace, so you can answer most requests from data subjects yourself. If a data subject writes to us about Customer Personal Data, we’ll pass the request to you without answering it ourselves, unless the law requires otherwise.

We’ll also help you, as far as is reasonable, with data protection impact assessments and with consulting a supervisory authority, using the information available to us.

You can export Customer Personal Data at any time while the agreement lasts, and for 30 days after it ends, as CSV or JSONL.

When an owner deletes a workspace, or 30 days after the agreement ends, we erase the Customer Personal Data in it. Erasure happens 30 days after deletion, and copies in our backups are overwritten within the 30 days after that. We keep only what the law requires us to keep, and protect it as this DPA describes for as long as we do.

We’ll give you the information you reasonably need to confirm that we meet this DPA, including written answers to security questionnaires.

You may audit our compliance once every 12 months, or after a personal data breach affecting you, with 30 days’ notice, during business hours, at your own cost and under a confidentiality agreement. An auditor you appoint must not be our competitor. A supervisory authority may audit us whenever the law allows.

This DPA is subject to the Terms, including their limitation of liability. If they conflict on how personal data is processed, this DPA wins; if this DPA conflicts with the Standard Contractual Clauses, the clauses win.

This DPA lasts as long as we process Customer Personal Data for you, including the deletion period in section 9.

• Encryption in transit. The dashboard, the API and webhooks are served only over HTTPS. Mail to and from mail servers requires STARTTLS and is never downgraded to plain text.
• Encryption at rest. Mailbox credentials, tokens and secrets are sealed with AES-256-GCM, with a separate key for each purpose and for each part of the service. Our providers encrypt disks and storage.
• Isolation. Every workspace table in the database enforces row-level security, which the application’s own database users cannot bypass.
• Access control. Four roles (owner, admin, member and viewer). Sign-in with passkeys that require user verification, or with one-time email codes that expire after 10 minutes and five attempts. Single sign-on with OIDC, with domain verification and enforcement. Sessions end after 30 days of inactivity and 90 days at most. API keys are stored as hashes and shown once.
• Logging. A 180-day audit log of important actions in each workspace. IP addresses are kept only as keyed hashes. AI prompts and outputs are never logged.
• Abuse prevention. Rate limits on the API and on sign-in, a captcha on sign-in and private network addresses refused as webhook targets.
• Staff access. Support sessions last 10 minutes at most and appear in the workspace’s audit log.
• Resilience. Encrypted backups, restore tests recorded and checked every month, and services that run with the fewest privileges they need, built from images that carry a software bill of materials.
• Email hygiene. One-click unsubscribe in every campaign email, suppression lists that never expire, and bounce and complaint processing.

The current list of sub-processors, with what each one does and where, is on our sub-processors page.