Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service available at https://mailintel.io/terms (the "Agreement") entered into between MailIntel, Inc., a Wyoming corporation ("Company"), and the Customer identified in the applicable Order. This DPA governs the Processing of Customer Personal Data by Company in connection with the provision of the Service.

By accepting the Agreement — whether by clicking to accept, completing the signup process, or executing an Order — Customer agrees to the terms of this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws, on behalf of its authorized affiliates. All capitalized terms not defined herein have the meaning given in the Agreement. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, this DPA shall control.

This DPA applies only to the extent required by applicable Data Protection Laws. Where Customer Personal Data is not subject to Data Protection Laws, the data processing provisions of the Agreement shall apply.

1. Definitions

As used in this DPA, the following terms have the meanings set forth below:

"California Personal Information" means Personal Data that is subject to the CCPA.

"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations, as amended from time to time.

"Controller" means an entity that determines the purposes and means of the Processing of Personal Data.

"Customer Personal Data" means Personal Data received by Company from or on behalf of Customer pursuant to or in connection with the Agreement that is subject to Data Protection Laws.

"Data Protection Laws" means all applicable data privacy and security laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, to the extent applicable, European Data Protection Laws, United States Data Protection Laws, and Brazilian Data Protection Laws, as each may be amended, superseded, or replaced from time to time.

"Data Subject" means the identified or identifiable natural person who is the subject of Personal Data.

"United States Data Protection Laws" means, to the extent applicable: (a) the CCPA; (b) the Virginia Consumer Data Protection Act; (c) the Colorado Privacy Act; (d) the Connecticut Data Privacy Act; and (e) any other applicable US federal or state law or regulation related to the protection of Customer Personal Data that is in force or will come into force during the term of this DPA.

"European Data Protection Laws" means: (a) the EU General Data Protection Regulation 2016/679 ("GDPR"); and (b) any other applicable law or regulation related to the protection of Customer Personal Data in the European Economic Area that is in force or will come into force during the term of this DPA.

"Brazilian Data Protection Laws" means: (a) the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018) ("LGPD"); and (b) any regulations, resolutions, or guidance issued by the Autoridade Nacional de Proteção de Dados (ANPD) related to the protection of Customer Personal Data in Brazil that are in force or will come into force during the term of this DPA.

"Personal Data" means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, including any information defined as "personally identifiable information," "personal information," or "personal data" under applicable Data Protection Laws.

"Process" or "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.

"Processor" means an entity that Processes Personal Data on behalf of a Controller.

"Security Incident" means a confirmed breach of Company's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Company's possession, custody, or control. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, or denial of service attacks.

"Standard Contractual Clauses" or "SCCs" means Module Two (Transfer controller to processor) or Module Three (Transfer processor to processor), as applicable, of the standard contractual clauses approved by the European Commission's implementing decision (C(2021)3972) of 4 June 2021, as may be amended or replaced by the European Commission from time to time.

"Subprocessor" means any Processor appointed by Company to Process Customer Personal Data in connection with the Agreement.

"Supervisory Authority" means an independent competent public authority established or recognized under applicable Data Protection Laws.

2. Effectiveness and Term

2.1 Scope

This DPA applies only to the extent that Company Processes Customer Personal Data that is subject to Data Protection Laws. Where no Data Protection Laws apply to the relevant Processing, the data-related provisions of the Agreement shall govern.

2.2 Term and Termination

This DPA commences on the date Customer accepts the Agreement and remains in effect for the duration of the Agreement. This DPA will terminate automatically upon the earliest of: (a) termination or expiration of the Agreement; or (b) written agreement of both parties to terminate this DPA.

Upon termination of the Agreement, Customer is responsible for stopping the transmission of any Customer Personal Data to Company, including by updating Customer's DNS records and terminating any forwarding of DMARC data to Company, in accordance with Section 13.5 of the Agreement.

3. Processing of Personal Data

3.1 Roles of the Parties

As between the parties, with regard to the Processing of Customer Personal Data under the Agreement: (a) Customer is the Controller and Company is the Processor; or (b) where Customer is itself acting as a Processor to a third-party Controller, Company is a sub-Processor. Each party shall comply with the obligations applicable to its role under Data Protection Laws.

3.2 Customer Instructions

Company shall Process Customer Personal Data only in accordance with Customer's documented lawful instructions, unless otherwise required by applicable law, in which case Company shall inform Customer of such legal requirement before Processing (unless prohibited by law). Customer hereby instructs Company to Process Customer Personal Data to: (a) provide and maintain the Service in accordance with the Agreement; (b) perform its obligations and exercise its rights under the Agreement and this DPA; and (c) prevent or address technical problems with the Service.

Customer warrants that its instructions comply with Data Protection Laws and that it has obtained all necessary rights, consents, and authorizations to disclose Customer Personal Data to Company for Processing under this DPA. Customer shall notify Company promptly of any changes to or revocation of instructions that would affect Company's ability to comply with this DPA or Data Protection Laws.

Company shall promptly notify Customer if, in Company's reasonable opinion, an instruction from Customer infringes applicable Data Protection Laws.

3.3 Details of Processing

The subject matter, nature, purpose, duration, types of Customer Personal Data, and categories of Data Subjects are set forth in Appendix 1 to this DPA.

3.4 Processing Subject to the CCPA

As used in this Section 3.4, the terms "Sell," "Share," "Business Purpose," and "Commercial Purpose" have the meanings given in the CCPA, and "Personal Information" means any personal information (as defined in the CCPA) contained in Customer Personal Data. Company will not:

• Sell or Share any Personal Information;
• Retain, use, or disclose any Personal Information for any purpose other than the Business Purposes specified in the Agreement, or as otherwise permitted by the CCPA; or
• Combine Personal Information received from or on behalf of Customer with Personal Data received from or on behalf of any third party, or collected from Company's own interactions with Data Subjects, except as permitted by the CCPA.

Company certifies that it understands and will comply with the foregoing restrictions. Customer has the right to take reasonable steps to ensure Company uses Personal Information in a manner consistent with Customer's CCPA obligations, including by exercising audit rights under Section 9 of this DPA. If Company determines it can no longer meet its CCPA obligations, it will notify Customer promptly.

3.5 Processing Subject to the LGPD

To the extent that Customer Personal Data is subject to the LGPD, the following provisions apply in addition to the other terms of this DPA. Company will Process Customer Personal Data only on the basis of a legitimate legal hypothesis (hipótese legal) as set forth in Articles 7 or 11 of the LGPD, as applicable, including the performance of a contract, compliance with a legal obligation, or the legitimate interests of Company or Customer, as documented in Appendix 1. Company will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising their rights under the LGPD, including the rights of confirmation, access, correction, anonymization, portability, deletion, and information about third parties with whom data has been shared. Company will notify Customer of any Security Incident affecting Customer Personal Data subject to the LGPD in accordance with Section 6.3 of the Agreement and as required by applicable LGPD regulations and guidance issued by the Autoridade Nacional de Proteção de Dados (ANPD).

4. Company Personnel

Company shall: (a) restrict access to Customer Personal Data to personnel who require such access to perform their job duties in connection with the Service; (b) ensure that all personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations; and (c) provide relevant data protection training to personnel who regularly access or Process Customer Personal Data.

5. Data Subject Rights

Company shall, taking into account the nature of the Processing and the functionality of the Service, provide reasonable assistance to Customer by appropriate technical and organizational measures to enable Customer to fulfill its obligations under Data Protection Laws to respond to Data Subject requests to exercise their rights (including rights of access, rectification, erasure, restriction, portability, and objection).

If Company receives a request directly from a Data Subject in relation to Customer Personal Data, Company shall advise the Data Subject to submit the request to Customer. Customer shall be solely responsible for responding to any such request. Company reserves the right to charge Customer on a time-and-materials basis for assistance that is onerous, complex, or time-consuming.

6. Subprocessors

6.1 Authorization and List

Customer hereby provides general authorization for Company to engage Subprocessors to Process Customer Personal Data in connection with the Service. A current list of Company's Subprocessors, including their functions and locations, is set forth in Appendix 3 and may be updated by Company from time to time in accordance with this Section 6.

6.2 New Subprocessors

Company shall notify Customer of any addition or replacement of a Subprocessor at least thirty (30) days prior to engagement by updating Appendix 3 and providing notice via email or in-application notification. Customer may object to a new or replacement Subprocessor on reasonable grounds by notifying Company in writing within thirty (30) days of receiving notice, providing specific reasons for the objection.

Upon receiving a timely objection, Company shall: (a) work in good faith with Customer to identify a commercially reasonable alternative; and (b) if no alternative can be found within thirty (30) days, Customer may terminate the affected portion of the Service by written notice, which shall be Customer's sole and exclusive remedy for such objection.

6.3 Subprocessor Obligations

Company shall enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those in this DPA with respect to Customer Personal Data. Company remains liable to Customer for the acts and omissions of its Subprocessors to the same extent Company would be liable if performing the services directly.

7. Security

7.1 Security Measures

Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to the rights and freedoms of natural persons, Company shall implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, as further described in Appendix 2 (the "Security Measures").

Company may update the Security Measures from time to time upon reasonable notice to Customer to reflect process improvements or evolving security practices, provided that such updates shall not materially diminish the level of protection afforded to Customer Personal Data.

7.2 Security Incidents

Upon becoming aware of a confirmed Security Incident, Company shall: (a) notify Customer without undue delay and in accordance with the notification timeframe set forth in Section 6.3 of the Agreement; (b) provide Customer with available information about the nature of the Security Incident, including the categories and approximate volume of Customer Personal Data affected, to the extent known, and supplemented as further information becomes available; and (c) take reasonable steps to identify the cause, minimize harm, and prevent recurrence.

Company's notification of or response to a Security Incident shall not be construed as an acknowledgment of fault or liability by Company.

7.3 Customer Responsibilities

Customer is solely responsible for: (a) making appropriate use of the Service to ensure a level of security appropriate to the risk in respect of Customer Personal Data; and (b) securing all account credentials, systems, and devices used to access the Service. Customer is responsible for independently assessing whether the Security Measures meet Customer's requirements and legal obligations under Data Protection Laws.

8. Data Protection Impact Assessments

To the extent required by Data Protection Laws, Company shall provide reasonable assistance to Customer in conducting data protection impact assessments or prior consultations with Supervisory Authorities, taking into account the nature of Company's Processing and the information available to Company. Company reserves the right to charge Customer on a time-and-materials basis for assistance that is onerous, complex, or time-consuming.

9. Audit Rights

9.1 Compliance Information

Upon Customer's reasonable written request (no more than once per calendar year unless required by a Supervisory Authority), Company will provide Customer with information reasonably necessary to demonstrate Company's compliance with its obligations under this DPA. Such information constitutes Company Confidential Information under the Agreement.

9.2 Audit Procedure

Customer may conduct, or commission a third-party auditor to conduct, an audit of Company's Processing of Customer Personal Data, subject to the following conditions: (a) Customer provides at least thirty (30) days' prior written notice specifying the scope and purpose of the audit; (b) audits are conducted during normal business hours and in a manner that minimizes disruption to Company's operations; (c) the auditor executes a confidentiality agreement acceptable to Company before accessing any Company systems or information; and (d) Customer bears all costs associated with such audit unless the audit reveals a material breach of this DPA.

Notwithstanding the foregoing, audits required or requested by a Supervisory Authority shall not be subject to frequency limitations or the prior notice requirement where not practicable.

10. International Data Transfers

10.1 Processing Locations

Customer Personal Data is stored and processed within the Microsoft Azure region selected by Customer during the signup process. Available regions are:

• NA – United States (West US 2)
• LATAM – Brazil (Brazil South)
• EMEA – Ireland (North Europe)
• APAC – Australia (Australia East)

Company will use commercially reasonable efforts to maintain Customer Personal Data within the selected region for the duration of the Subscription Term. Customer Data does not leave the selected region except where Customer explicitly requests cross-region functionality or where required by applicable law. The only data transferred to the United States regardless of region selection is aggregated, non-identifiable Telemetry Data as defined in the Agreement, which does not constitute Customer Personal Data. Company may update available regions from time to time upon reasonable prior notice to Customer.

10.2 Transfers Subject to European Data Protection Laws

Where Customer transfers Customer Personal Data to Company that is subject to European Data Protection Laws, and such transfer is not otherwise subject to an adequate transfer mechanism or exemption under European Data Protection Laws, Customer (as data exporter) and Company (as data importer) agree that the Standard Contractual Clauses shall apply to and govern such transfer and are incorporated into this DPA by reference. In furtherance of the foregoing:

• Execution of this DPA constitutes execution of the applicable Standard Contractual Clauses as of the DPA Effective Date;
• Module Two (controller to processor) shall apply where Customer acts as a Controller; Module Three (processor to processor) shall apply where Customer acts as a Processor to a third-party Controller;
• The information required to complete the SCCs is set forth in Appendix 1 (Annex I.B), Appendix 2 (Annex II), and Appendix 3 (Annex III) of this DPA;
• The competent Supervisory Authority under Annex I.C shall be determined by Clause 13 of the GDPR; where such determination is unclear, the Irish Data Protection Commission shall serve as the competent authority; and
• The SCCs shall automatically terminate once the relevant transfer becomes lawful under European Data Protection Laws without reliance on the SCCs.

10.3 Transfer Subject to the LGPD

Where Customer transfers Customer Personal Data to Company that is subject to the LGPD, and such transfer involves the transfer of personal data outside Brazil, the parties agree that such transfer shall be conducted: (a) pursuant to standard contractual clauses or global corporate rules as may be approved by the ANPD; or (b) on the basis of specific consent of the Data Subject; or (c) on such other lawful basis as may be recognized under the LGPD or by the ANPD from time to time. The parties agree to cooperate in good faith and execute any additional documentation required by the ANPD to legitimize such transfers. Until the ANPD formally approves standard contractual clauses for international transfers, the parties agree to rely on the mechanisms in clauses (b) or (c) above, or such interim guidance as the ANPD may issue.

10.4 Other Jurisdictions

If Customer transfers Customer Personal Data subject to Data Protection Laws of jurisdictions not covered by Section 10.2, and such transfer requires a specific transfer mechanism, the parties agree to cooperate in good faith to implement the applicable mechanism required by the relevant Supervisory Authority.

11. Return and Deletion of Customer Personal Data

Following termination or expiration of the Agreement, Company shall, at Customer's written request made within the Retention Period defined in Section 5.9 of the Agreement, either delete or return Customer Personal Data to Customer. If Customer does not request return or deletion within the Retention Period, Company shall delete Customer Personal Data in accordance with Section 5.9 of the Agreement.

Where Company is required by applicable law to retain Customer Personal Data beyond the Retention Period, Company shall: (a) notify Customer of such retention and the legal basis therefor; and (b) continue to protect such Customer Personal Data in accordance with this DPA until deletion is permissible.

Upon Customer's written request, Company shall provide written confirmation of deletion of Customer Personal Data.

12. Limitation of Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the Limitation of Liability provisions of the Agreement. Company's total aggregate liability for all claims from Customer or any third party (other than individual Data Subjects exercising rights under applicable Data Protection Laws) arising out of or related to both the Agreement and this DPA shall be subject to the aggregate cap set forth in Section 11.1 of the Agreement.

13. Governing Law and Jurisdiction

Except as otherwise required by the Standard Contractual Clauses or applicable Data Protection Laws, this DPA is governed by and construed in accordance with the laws of the State of Wyoming, United States of America, consistent with Section 14.1 of the Agreement. Any disputes arising under this DPA shall be subject to the jurisdiction and dispute resolution provisions of the Agreement.

14. General Provisions

14.1 Order of Precedence

In the event of any conflict between this DPA and the Agreement with respect to the Processing of Customer Personal Data, this DPA shall control. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall control.

14.2 Amendments

Company may update this DPA from time to time to reflect changes in Data Protection Laws or Company's practices, subject to providing reasonable prior notice to Customer. Material changes shall be subject to the modification provisions of Section 14.5 of the Agreement.

14.3 Severability

If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

14.4 Entire Agreement on Subject Matter

This DPA, together with the Agreement and its appendices, constitutes the entire agreement between the parties with respect to the Processing of Customer Personal Data and supersedes all prior agreements, representations, and understandings relating to such subject matter.

14.5 Execution

This DPA is incorporated into and forms part of the Agreement. Customer accepts this DPA by accepting the Agreement, whether by clicking to accept, completing the online signup process, or executing an Order. No separate signature is required. Company maintains a record of Customer's acceptance, including the date, time, IP address, email address, and document version accepted, in accordance with Section 14.12 of the Agreement.

Appendix 1: Details of Processing of Customer Personal Data

1. Parties

Customer (Controller / Data Exporter): As identified in the applicable Order and Agreement.

Company (Processor / Data Importer): MailIntel, Inc., a Wyoming corporation. Privacy Contact: privacy@mailintel.io.

2. Subject Matter and Duration

Company provides a cloud-based SaaS platform for the collection, parsing, aggregation, analysis, and visualization of DMARC (Domain-based Message Authentication, Reporting & Conformance) reports and related email authentication data, to help organizations improve their email security posture and protect their domains from phishing and spoofing attacks. Company will Process Customer Personal Data on an ongoing basis for the duration of the Agreement.

3. Nature and Purpose of Processing

Company Processes Customer Personal Data to: (a) ingest and parse DMARC aggregate and forensic XML reports delivered by email service providers; (b) visualize and present DMARC data in a user-friendly format to aid customers in implementing and monitoring the DMARC protocol; (c) provide analytics, alerts, and recommendations related to email authentication; (d) perform technical support services; and (e) comply with applicable legal obligations.

4. Categories of Data Subjects

Customer's employees, IT administrators, and other authorized personnel who access the Service. DMARC forensic reports may incidentally contain email header data relating to third-party senders or recipients whose emails triggered DMARC policy failures.

5. Categories of Customer Personal Data

The following categories of Personal Data may be Processed:

• Account and contact information: names, email addresses, job titles of Customer's authorized Users
• Email authentication metadata: IP addresses, email header information (From, Return-Path, DKIM signatures), sending domain information, and DMARC policy results contained in DMARC aggregate and forensic reports
• Usage and access data: login timestamps, IP addresses used to access the Service, and activity logs

6. Sensitive Personal Data

No sensitive or special category Personal Data (as defined under GDPR Article 9) is expected to be Processed under this DPA. Customer shall not submit sensitive Personal Data to the Service without prior written agreement from Company.

7. Frequency of Transfer

Customer Personal Data is transferred on an ongoing and continuous basis for the duration of the Agreement, as DMARC reports are generated and forwarded to the Service.

8. Retention Period

Customer Personal Data will be retained in accordance with the Active Retention Period applicable to Customer's subscription tier, as set forth in the Plan Features Schedule, and the post-termination Retention Period set forth in Section 5.9 of the Agreement.

9. Subprocessor Transfers

For transfers to Subprocessors, see Appendix 3.

Appendix 2: Security Measures

Company has implemented and will maintain a comprehensive written Information Security Program that includes appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of Customer Personal Data. The Information Security Program includes the following measures, where appropriate:

1. Access Controls: Policies, procedures, and technical controls to: (a) limit physical and logical access to information systems and facilities to authorized personnel only; (b) authenticate and permit access only to authorized individuals; (c) prevent unauthorized access to Customer Personal Data; and (d) encrypt Customer Personal Data at rest and in transit using industry-standard encryption protocols, leveraging Microsoft Azure's built-in encryption capabilities.
2. Security Awareness and Training: A security awareness and training program for all relevant Company personnel, including training on how to implement and comply with the Information Security Program and applicable Data Protection Laws.
3. Security Incident Procedures: Documented policies and procedures to detect, respond to, and address Security Incidents, including: monitoring systems for attempted attacks or intrusions; identifying and responding to suspected or known Security Incidents; mitigating harmful effects; and documenting Security Incidents and their outcomes.
4. Contingency Planning: Policies and procedures for responding to emergencies or events that may damage Customer Personal Data or related systems, including a data backup plan and a disaster recovery plan. Company leverages Microsoft Azure's redundancy and disaster recovery capabilities.
5. Device and Media Controls: Policies and procedures governing hardware and electronic media containing Customer Personal Data, including procedures for secure disposal and destruction of Customer Personal Data and the media on which it is stored.
6. Audit Controls: Hardware, software, and procedural mechanisms that record and examine activity in information systems containing Customer Personal Data, including appropriate logs and reports to support compliance monitoring.
7. Data Integrity: Policies and procedures to ensure the accuracy, confidentiality, integrity, and availability of Customer Personal Data and to protect it against improper alteration, disclosure, or destruction.
8. Transmission Security: Technical security measures to protect Customer Personal Data transmitted over electronic communications networks, including encryption of data in transit (TLS 1.2 or higher) and at rest, leveraging Microsoft Azure security controls.
9. Assigned Security Responsibility: Company designates a security responsible person for the development, implementation, and maintenance of the Information Security Program. The identity of this person is available upon written request. Privacy Contact: privacy@mailintel.io.
10. Testing and Review: Company will regularly test key controls, systems, and procedures of the Information Security Program to ensure they are effective. Company will regularly review and update the Information Security Program to reflect evolving threats, industry standards, and best practices, and will pursue formal security certifications as the business matures.
11. Program Adjustment: Company will monitor, evaluate, and adjust the Information Security Program in light of changes in technology, security standards, the sensitivity of Customer Personal Data, internal or external threats, and Company's evolving business arrangements. Any such updates will not materially diminish the protections applicable to Customer Personal Data.
12. Cloud Infrastructure: Company's primary cloud infrastructure is Microsoft Azure. Company leverages Azure's compliance certifications, data center security, network security, and encryption services as a foundational layer of its security program. Details of Azure's security and compliance posture are available at https://azure.microsoft.com/en-us/explore/trusted-cloud/compliance.

Appendix 3: Subprocessors

The following Subprocessors are authorized by Customer to Process Customer Personal Data in connection with the Service. Company will update this list and notify Customer in accordance with Section 6.2 of this DPA prior to engaging any new or replacement Subprocessor.

Note: Company will maintain an up-to-date version of this Appendix 3 at https://mailintel.io/subprocessors and will notify Customer of any changes in accordance with Section 6.2 of this DPA.

Contact Information

For questions regarding this Data Processing Addendum, please contact:

© 2026 MailIntel, Inc. All rights reserved.