Data processing agreement (DPA)

Parties and scope

The organisation determining communication purposes and recipients acts as controller. SUCHET & BUTTIER acts as processor for data entrusted to it through Mailie. The customer’s identity, authorised representative and agreement reference must be identifiable in the contractual relationship.

The account notice separately describes processing for the publisher’s own purposes. An account’s terms acceptance must not be represented by a tool as the signature of an unidentified organisation. This framework and its annexes apply according to the agreement actually concluded; TEST conditions do not become LIVE sales terms.

Processing and instructions

Covered functions are storing and organising contacts, content and sending information, preparing communications, handoff to authorised transports, processing operational feedback and preferences, and requested export, restriction and erasure. Workspace settings and approvals document instructions within the agreed service.

Typical information includes email address, useful names or attributes supplied by the customer, source and permission evidence, preferences, content and operational metadata. Data subjects are the customer’s contacts and recipients. Sensitive data and uses needing specific safeguards are not covered without an appropriate assessment and agreement.

Processing commitments

Mailie processes data for documented instructions and agreed purposes, without general reuse for another activity. An instruction considered contrary to applicable rules must be reported to the customer. A legal requirement to process or disclose data must be assessed and communicated where law permits.

• Limit access to authorised people bound by confidentiality.
• Apply measures appropriate to the information and risks, and document relevant changes.
• Assist the customer with rights requests, incidents, assessments and its obligations, using available information.
• Provide information needed to demonstrate compliance with the agreement and contribute to proportionate checks without exposing other customers’ data or security secrets.

Incidents and rights requests

A personal-data breach affecting entrusted processing must be reported to the customer without undue delay after awareness, with available information and relevant updates during assessment. The customer decides on notifications for which it is responsible; a statutory controller deadline must not be confused with a guaranteed incident-detection period.

Requests received directly from a recipient are directed to the relevant customer with necessary assistance. Existing objections and protections must not be reactivated by a new import or processing restart.

Subprocessors and transfers

Use of a subprocessor must be documented and authorised under the agreement, with appropriate protection obligations. Additions or replacements must be communicated under agreed arrangements so the customer can object. An incomplete list is not an implicit general authorisation.

An operation outside the European Economic Area requires its own transfer basis and safeguards. This framework alone is not an international transfer mechanism. Functions and providers not specified in the annexes still require assessment; no promise is made that processing stays exclusively in France or uses no cloud service.

Duration, return and erasure

Processing follows the agreed service term and necessary exit operations. At the end of service, data must be returned or erased according to the customer’s choice and instructions, subject to applicable retention obligations. Exceptions, purposes and end dates or reviews must be identified, without equating access closure with erasure of every copy.

Backups, file versions, objection evidence and operations with uncertain outcomes require their own controls. Restore must not silently reauthorise revoked access or replay uncertain sending. Detailed periods and arrangements must be included in the annexes for the selected configuration.

Annex A — established elements

The service separates organisations and their rights, uses scoped authorisations, MFA checks for privileged operations and checks before sensitive operations. Relevant private information is protected through encryption and backups follow a separate process. These measures are not a certification or guarantee that incidents cannot occur.

OVHcloud infrastructure is described in the legal notice. The observed mail path includes Exim, a local Imunify filter and reinjection before remote SMTP transport. Feedback is not individual reading tracking. External providers selected for a function are not authorised as a group by this description.

Cloud Linux Software, Inc. publishes a DPA covering Imunify Email. Its annex lists providers in Europe and the United States; this proves neither our applicable contract nor the regions actually used.

Annex B — details needed for a complete agreement

The following details still need to be specified and tied to the customer’s configuration and agreement. Their absence is identified rather than replaced with an unproved guarantee.

• Contracting entities for hosting, filtering, backups and each external function; entrusted operations, countries and associated safeguards.
• Applicable contract and actual destinations for Imunify filtering, including any statistical flows; enabled AI functions and corresponding transfer safeguards.
• Detailed periods for technical logs, support, backup copies and exceptions; arrangements for subprocessor-change notices and checking implementation.
• Identification of the customer organisation, its representative and relevant agreement evidence. Displaying this page creates no acceptance.

Coordination and contact

Contact: contact@suchetbuttier.com. Postal address: 102 avenue des Champs-Élysées, 75008 Paris, France.

Factual annexes must be completed without retroactively changing an accepted version. This adapted text is not presented as unmodified official standard clauses or legal advice from a lawyer.