Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mintagency OÜ (registry code 16972018, Tallinn, Estonia) ("Processor", "we") and the customer ("Controller", "you") and applies whenever we process personal data on your behalf under Article 28 of the EU General Data Protection Regulation (GDPR). By using the Service to run outreach campaigns you accept this DPA.

1. Roles

For the personal data contained in your lead lists, campaigns, and outreach communications, you are the Controller and Mintagency OÜ is the Processor. For your own account and usage data, Mintagency OÜ is the Controller (see the Privacy Policy).

2. Subject Matter & Duration

We process personal data only to provide the Service (lead discovery, campaign management, AI email drafting, sending and reply/bounce detection) for the duration of your subscription and until deletion under Section 8.

3. Nature & Purpose of Processing

• Storing and organising business-contact lead lists you create or import
• Generating draft email content using AI from the data you supply
• Sending emails through your connected mailbox at your instruction
• Recording delivery, open, reply, bounce and unsubscribe events

4. Categories of Data & Data Subjects

Data subjects: business contacts and representatives of the companies you target. Categories: names, business email addresses, phone numbers, job roles, company names, and publicly available firmographic information. You must not upload special categories of personal data (Article 9 GDPR).

5. Controller Instructions

We process personal data only on your documented instructions (including via your use of the Service), unless required otherwise by EU or Estonian law. If we believe an instruction infringes the GDPR, we will inform you.

6. Confidentiality

Personnel authorised to process personal data are bound by confidentiality.

7. Security (Article 32)

We maintain appropriate technical and organisational measures, including encryption in transit (TLS), encryption of stored mailbox credentials (AES-256-GCM), access controls, row-level data isolation between customers, and a global suppression list for opt-outs and bounces.

8. Sub-processors

You authorise the following sub-processors. We will give notice of intended changes and you may object on reasonable data-protection grounds.

• Vercel Inc. — application hosting
• Supabase — database and storage (EU region)
• Anthropic / Google — AI email drafting (content is processed transiently, not used for model training)
• Your connected email/IMAP provider — sending and reply detection through your own mailbox

9. Data Subject Rights & Assistance

We will assist you, taking into account the nature of processing, in responding to data-subject requests (access, rectification, erasure, restriction, objection, portability) and in meeting your obligations under Articles 32–36. A recipient may also contact us directly at hello@mintagency.eu to be erased and added to the global suppression list.

10. Personal Data Breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your Article 33/34 obligations.

11. Deletion & Return

On termination, we delete or return your personal data within 30 days, except where retention is required by law.

12. Audits

We make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to reasonable audits, including on-request documentation.

13. International Transfers

Where a sub-processor processes data outside the EEA, we rely on European Commission Standard Contractual Clauses or an equivalent adequacy mechanism.

14. Contact

Mintagency OÜ
Registry code: 16972018, Tallinn, Estonia
Email: hello@mintagency.eu

This DPA is a standard template provided for convenience. For high-value or regulated customers, both parties may wish to have it reviewed by their own legal counsel.

Mintreach is a product of Mintagency OÜ