Data processing agreement

Scope and parties#

This Data Processing Agreement ("DPA") forms part of the Terms of service between the customer that holds a Runearc workspace ("Customer", the controller, or a processor acting for its own customer) and Arin Prajapati, trading as Runearc (sole proprietor), Mumbai, Maharashtra, India ("Runearc", the processor). It applies whenever Runearc processes personal data on the Customer's behalf, and it takes effect when the Customer accepts the Terms. No signature is needed; a signed copy is available on request from privacy@runearc.com.

Account and billing data about the Customer's own users is processed by Runearc as controller under the Privacy policy, not under this DPA.

Definitions#

"GDPR" means Regulation (EU) 2016/679, and where applicable the UK GDPR and the Swiss FADP. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings in the GDPR. "Customer Data" means personal data in the mail, attachments and related metadata that the Customer's inboxes receive or send through Runearc. "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

Processing on instructions#

1. Runearc processes Customer Data only on the Customer's documented instructions, including for transfers, unless the law Runearc is subject to requires otherwise; in that case Runearc tells the Customer first unless that law forbids it. The Terms, this DPA, and the Customer's configuration of the service (inboxes, domains, forwarding, webhooks, retention settings, API calls) are the Customer's complete instructions.
2. Runearc tells the Customer if it believes an instruction infringes data protection law.
3. Runearc does not sell Customer Data, does not use it for advertising or profiling, and does not use it to train machine learning models.
4. The Customer is responsible for having a lawful basis for the mail it sends and receives, and for the instructions it gives.

Confidentiality#

Runearc ensures that everyone authorised to process Customer Data is bound by confidentiality. Today that is the founder alone: no staff or contractors have access. Anyone added later will be bound in writing before getting access.

Security#

Runearc implements the technical and organisational measures in Annex II (GDPR Article 32), and may change them only in a way that does not lower the overall level of protection.

Subprocessors#

1. The Customer gives Runearc general authorisation to engage the subprocessors in Annex III, also published on the subprocessors page.
2. Runearc announces any intended addition or replacement at least 30 days in advance, by email to workspace owners and on the subprocessors page. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro rata refund of prepaid fees.
3. Runearc imposes data protection obligations on each subprocessor that are no less protective than this DPA, and stays liable to the Customer for its subprocessors.

Assistance and data subject rights#

Taking into account the nature of the processing, Runearc helps the Customer respond to data subject requests, mostly through the product itself: messages and inboxes can be read, exported and deleted through the API and dashboard, and the workspace owner can export the whole workspace (GET /v1/workspace/export) and delete it (DELETE /v1/workspace). Runearc forwards to the Customer any request it receives directly about Customer Data, without answering it itself. Runearc also gives reasonable help with data protection impact assessments and consultations with supervisory authorities (GDPR Articles 32 to 36).

Personal data breaches#

Runearc notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. Runearc updates it as it learns more.

Deletion and return#

During the term the Customer can export Customer Data at any time and set automatic deletion of mail after 30, 90, 180, 365 or 730 days. When the Customer deletes its workspace, Runearc deletes all Customer Data in the workspace from the live system at once: messages, raw files and attachments, threads, inboxes, domains and DKIM keys, API keys, app passwords, webhooks and their logs, forwarding rules, invitations and the audit log. After the Terms end Runearc deletes any remaining Customer Data within 30 days. Copies in backups are deleted when the backups expire, after 14 days (up to 21 days for the database's point in time archive, which is built on weekly full backups), and are not used in the meantime except to recover from a failure. Runearc keeps data longer only where the law requires it.

Information and audits#

Runearc makes available the information needed to demonstrate compliance with GDPR Article 28, including this DPA, Annex II and answers to reasonable security questionnaires. Where that is not enough, the Customer (or an independent auditor bound by confidentiality) may audit Runearc once a year, on 30 days' notice, at the Customer's cost, in a way that does not expose other customers' data. Audits required by a supervisory authority are not limited in this way.

International transfers and SCCs#

Runearc's primary Customer Data storage is in Canada, which benefits from an EU adequacy decision for commercial organisations subject to PIPEDA (reaffirmed in the Commission's January 2024 review). Outbound Customer Data is also processed by Amazon Web Services in Northern Virginia, United States (us-east-1) for SES delivery and delivery events, under the SCCs in the AWS data processing addendum. Runearc is established in India and administers the Canadian service remotely from there; India has no adequacy decision. To the extent Customer Data subject to the GDPR is transferred to Runearc in India, the SCCs are incorporated into this DPA by reference and apply as follows:

Modules

Module 2 (controller to processor) where the Customer is a controller; Module 3 (processor to processor) where the Customer is itself a processor for its own customer.

Data exporter

The Customer, with the details in Annex I.

Data importer

Runearc (Arin Prajapati, trading as Runearc (sole proprietor)), with the details in Annex I.

Clause 7 (docking)

Included.

Clause 9(a) (subprocessors)

Option 2, general written authorisation. Runearc informs the Customer of intended changes at least 30 days in advance, as in the Subprocessors section above.

Clause 11(a) (redress)

The optional language is not used.

Clause 13 (supervision)

Where the Customer is established in an EU Member State, the supervisory authority of that Member State. Otherwise, Ireland's Data Protection Commission. Runearc has not appointed a representative in the EU under GDPR Article 27.

Clause 17 (governing law)

Option 1: the law of Ireland.

Clause 18 (forum)

The courts of Ireland.

Annexes

Annex I.A and I.B: Annex I below. Annex I.C: Clause 13 above. Annex II and III: below.

UK and Switzerland. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Table 1 to 3 filled in from this DPA and Table 4 allowing either party to end it. For transfers subject to the Swiss FADP, the SCCs apply with the FDPIC as supervisory authority and references to the GDPR read as references to the FADP.

If the SCCs conflict with this DPA, the SCCs prevail. Runearc has carried out a transfer impact assessment for the transfer to India and will share a summary on request.

Liability, term and precedence#

Each party's liability under this DPA is subject to the limits in the Terms, except where the SCCs or the law do not allow a limit. This DPA lasts as long as Runearc processes Customer Data. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

Annex I: parties and processing#

A. List of parties

Data exporter

The Customer, identified by its workspace and the account email of its owner. Contact: the workspace owner. Activities: use of Runearc email infrastructure. Role: controller (Module 2) or processor (Module 3). Signature and date: by accepting the Terms.

Data importer

Arin Prajapati, trading as Runearc (sole proprietor), Mumbai, Maharashtra, India. Contact: privacy@runearc.com. EU representative: none appointed yet. Activities: providing Runearc. Role: processor. Signature and date: by making the Terms available.

B. Description of the processing

Data subjects

People who send email to or receive email from the Customer's inboxes and domains; the Customer's end users and contacts; the Customer's team members whose actions appear in the audit log.

Categories of data

Email content (subject, body, headers) and attachments; email addresses and display names; message metadata (Message-ID, timestamps, size, delivery and bounce status); authentication results (SPF, DKIM, DMARC, spam score) and IP addresses of connecting mail servers; IP addresses of API and dashboard requests in the audit log; webhook payloads and forwarding addresses.

Sensitive data

Runearc does not ask for special category data, but email content is whatever the senders write and may contain it. The measures in Annex II apply to all mail alike.

Frequency

Continuous, for as long as the Customer uses the service.

Nature and purpose

Receiving mail for the Customer's inboxes, storing it, making it available over the API, MCP, IMAP and the dashboard, sending and forwarding mail on the Customer's instructions, delivering webhooks, spam and authentication checks, backups, support and abuse handling.

Retention

Until the Customer deletes the data, the automatic deletion period the Customer sets (30, 90, 180, 365 or 730 days), or the workspace is deleted; audit log entries 400 days by default (90, 180, 400 or 730 days); backups as in the Deletion section.

Transfers to subprocessors

As in Annex III: primary storage and the Runearc control plane in Canada; outbound message delivery and delivery-event processing by Amazon Web Services in us-east-1; the dashboard front end on Vercel, through which dashboard pages pass in transit; remote administration from India by the importer.

C. Competent supervisory authority

As set out for Clause 13 above.

Annex II: security measures#

Technical and organisational measures, including those to ensure the security of the data. Each one describes how Runearc works today.

Annex III: subprocessors#

The Customer authorises the following. Changes are announced as described in the Subprocessors section; the current list is always on the subprocessors page.