Data Processing Agreement

The Article 28 GDPR terms on which DUST 4 Business, s.r.o. processes personal data on a Customer's instructions through postfly — part of the Terms of Service.

Effective from: 15 September 2026

This Data Processing Agreement ("DPA") is entered into between the Customer ("controller") and DUST 4 Business, s.r.o., Bratislavská 31, 010 01 Žilina, Slovakia ("processor", "we"), and forms part of the Terms of Service. It governs the personal data the processor processes on the controller's instructions when the controller sends mail through postfly. Questions about it go to privacy@postfly.app.

1. Subject matter

The processing of personal data contained in the messages, attachments and recipient data the controller sends, or configures the Service to send or store, through postfly.

2. Duration

This DPA applies for as long as the controller has an active postfly account, and until all personal data processed under it has been deleted or returned under Section 10.

3. Nature and purpose of processing

Receiving, queueing, signing, sending and logging the controller's transactional email (via the /v1 API, SMTP relay or dashboard), recording delivery, bounce and complaint events, honoring suppression requests, and delivering the controller's own configured webhook notifications about that mail.

4. Categories of data and data subjects

Data subjects: the recipients the controller emails through the Service, and anyone named or referenced inside a message's content.

Categories of data: recipient and sender email addresses and display names, including a message's visible To/Cc recipients, stored with each message; message subject, body and headers; attachments and their content; delivery status and SMTP/bounce responses; message events; suppression-list entries. Ordinary categories only — postfly is not designed to carry special categories of data (GDPR Art. 9), and the controller is responsible for not sending them through the Service.

5. Processor obligations

• Process personal data only on the controller's documented instructions — given through the dashboard, the API, SMTP configuration or this DPA — unless EU or member-state law requires otherwise, in which case we inform the controller before processing, unless that law prohibits it.
• Ensure that anyone we authorize to process the data is bound to confidentiality.
• Take the technical and organizational security measures listed in Section 6, appropriate to the risk.
• Not engage another processor without the controller's prior general authorization — see Section 7 — and remain fully liable to the controller for a sub-processor's performance.
• Assist the controller in responding to data-subject requests and in meeting its obligations under GDPR Articles 32-36, as described in Sections 8-9.
• At the controller's choice, delete or return all personal data at the end of the provision of services, as described in Section 10.
• Make available the information necessary to demonstrate compliance with this Article, and allow for audits as described in Section 11.

6. Security measures

• TLS in transit for the dashboard, the API and SMTP submission.
• Off-site backups encrypted with GPG before they leave the application server.
• Optional two-factor authentication (TOTP) for Customer accounts.
• Access control: API keys are scoped to specific sender domains and permissions; sessions are bound to an Account.
• An audit log of sign-ins and account actions, capturing the actor, action, IP address and user agent.

7. Sub-processors

The controller gives general authorization to the following sub-processors, each engaged for the purpose stated:

We will inform Customers of any intended addition or replacement of a sub-processor with reasonable advance notice (by email or an in-app/dashboard notice), giving the controller an opportunity to object on reasonable data-protection grounds before the change takes effect.

8. Assistance with data-subject rights

We will reasonably assist the controller, by appropriate technical and organizational measures, in fulfilling its obligation to respond to requests from data subjects to exercise their rights under the GDPR, insofar as this is possible given the nature of the processing.

9. Personal data breach

We will notify the controller of a personal data breach affecting the controller's data without undue delay after becoming aware of it.

The notification describes, as far as reasonably possible: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences of the breach; and the measures we have taken or propose to take to address it and mitigate its possible adverse effects (Art. 33(3) GDPR).

10. Deletion or return of data

At the end of the provision of services, and at the controller's choice, we delete or return all personal data processed under this DPA, and delete existing copies unless EU or member-state law requires their storage. In the ordinary course, this happens through the retention schedule in the Privacy Policy, which the controller may accelerate by removing its data (messages, suppression entries, domains) or closing its account.

11. Audit rights

We make available to the controller the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the controller or an auditor it mandates, on reasonable prior notice and without disrupting the Service for other Customers.

12. Retention

Processing under this DPA follows the same retention periods stated in the Privacy Policy: message content 30 days after final delivery state, the message record and its events 90 days after, attachment content at the latest 7 days after sending, webhook delivery attempts 7 days, and suppression-list entries until the controller removes them.