Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between EmailPoint Group EOOD („ИМЕЙЛПОЙНТ ГРУП" ЕООД), UIC 207188514 ("Monfri", "we", the processor), and the customer that holds the Monfri account ("you", the controller). It applies from the date you accept the Terms and for as long as we process personal data on your behalf. Where it conflicts with the Terms on data protection, this DPA prevails.

1. Roles and subject matter

1.1 You are the controller and we are the processor for all personal data you or your end users submit to, or generate within, the Service ("Customer Personal Data"): CRM contacts and their communications, CDP visitor profiles and events, Push subscribers, Automation flow data, Pages content, Assistant conversations and the work of Agents. Annex 1 describes the processing.

1.2 For your account, billing and our own operations we are an independent controller; that processing is described in our Privacy Policy, not here.

1.3 Payments are outside this DPA. Stripe is the merchant of record and processes payment data as an independent controller.

2. Your instructions

2.1 We process Customer Personal Data only on your documented instructions, including to transfer it outside the EEA as described in §6. Your use of the Service — the settings you choose, the integrations you connect, the automations you build — constitutes your instructions.

2.2 We tell you if, in our opinion, an instruction infringes data-protection law, and we may refuse instructions that would require us to break the law.

2.3 We do not sell Customer Personal Data and do not use it to train AI models, ours or anyone else's.

3. Confidentiality

Only personnel who need access to operate or support the Service have it, and they are bound by confidentiality.

4. Security

We implement the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may change them as long as the level of protection does not fall.

5. Sub-processors

5.1 You give general authorisation for us to engage sub-processors. The current list is at monfri.net/subprocessors and forms part of this DPA. Integrations that you connect yourself are your own processors, not ours.

5.2 We give at least 30 days' notice by e-mail to the workspace owners and on that page before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot resolve the objection, you may terminate the affected service and we refund the prepaid fees for the rest of the term.

5.3 We impose data-protection obligations on each sub-processor equivalent to those in this DPA and remain liable to you for its performance.

6. Transfers outside the EEA

Customer Personal Data is stored in the EU (Bulgaria). Where a sub-processor processes it outside the EEA — our AI provider in the United States, and the global network of our CDN — the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.

7. Assisting you

7.1 Requests from data subjects. We help you answer requests under Chapter III GDPR. The Service gives you these tools:

• "Export everything" — all data of a workspace across the seven services, in one ZIP file;
• deleting a workspace — erased in all services 30 days after the request;
• for one person: exporting a profile in CDP, deleting a contact in CRM, deleting a subscriber in Push; a CDP profile is deleted by our team when you ask.

Anything the tools do not cover we do for you on request to privacy (at) monfri.net, within 30 days.

7.2 We help you with data protection impact assessments and prior consultations, and give you the information needed to demonstrate compliance with Article 28 GDPR.

7.3 Personal data breaches. We notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information available at that time, and keep you informed as we learn more.

8. Deletion and return

8.1 You can export Customer Personal Data at any time (§7.1). When a subscription ends, the workspace becomes read-only and the data is kept until you delete the workspace or ask us to delete it. When a workspace is deleted, its data is erased in all services after 30 days.

8.2 Backups are encrypted with a key held offline and expire on their regular rotation. Archived monthly copies of CDP event data are currently kept longer than that rotation; they are used only to restore a service.

8.3 We keep data beyond that only where the law requires it.

9. Audits

We make available the information needed to demonstrate compliance and answer reasonable questionnaires. Once a year, or after a breach, you may have an independent auditor bound by confidentiality inspect our compliance with this DPA, with 30 days' notice, during business hours, at your cost and without access to other customers' data.

10. Your responsibilities

You are responsible for the legal basis of the processing and for informing the people concerned. In particular:

• Tracking on your websites — the CDP script, the Assistant chat and Push web-push need the notices and, where the law requires it, the consent of your visitors. Choose the consent mode of the CDP script accordingly; a mode that stores identifiers before consent is your decision.
• E-mail — Push measures opens and clicks in the messages you send; where the law requires consent for that, you obtain it. Marketing messages need the recipients' agreement where the law requires it, your identity and postal address, and an unsubscribe.
• AI — the content you give an AI feature goes to our AI provider (Annex 3). Do not give it special categories of data unless the law allows it and the feature needs it.

11. US state privacy laws

Where the California Consumer Privacy Act or a comparable US state law applies, we act as your "service provider" or "processor". We will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you; will not combine it with personal data we receive from others except as those laws permit; will comply with those laws and provide the same level of protection; will notify you if we can no longer meet these obligations; and allow you to take reasonable steps to stop and remedy unauthorised use. We certify that we understand these restrictions.

12. General

Liability under this DPA is subject to the limits in the Terms, except where the law does not allow them. This DPA is governed by the law that governs the Terms. We may update it with 30 days' notice to the workspace owners; changes that the law requires take effect when it requires.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Servers on our own infrastructure in a data centre in Sofia, Bulgaria; services on a private, encrypted network; databases reachable only by application services.
• Encryption in transit (TLS 1.2 or higher) for all traffic from the internet.
• Encrypted off-site backups, with the private key held offline.
• Tenant isolation in every service; role-based access control in the platform and per service; single sign-on through the Hub.
• A content security policy on every service; secrets kept as encrypted runtime secrets, not in code.
• Automated infrastructure auditing every five minutes with alerting; centralised logs kept 10 days.
• Regular patching of operating systems and dependencies; malware scanning of every uploaded file.
• Access to production limited to the people who operate the Service.

Annex 3 — AI processing

Our AI provider is OpenAI (see sub-processors). It receives only what the feature you use works on, and does not use it to train its models.