Data processing addendum

This data processing addendum ("DPA") applies when Rykon Technologies Inc. ("Processor") processes Personal Data in Customer Data on behalf of the Customer ("Controller") in providing Rykon Mail. Terms defined in the terms of service have the same meaning here.

For Account Data, we act as an independent Controller under our privacy policy, and this DPA does not apply to it.

Where the CCPA applies, we act as the Customer’s service provider: we do not sell or share Customer Data, retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the service, or combine it with personal information from other sources except as the CCPA permits.

We process Customer Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the service, unless the law requires otherwise, in which case we tell the Customer first unless the law prohibits it. We tell the Customer if we believe an instruction infringes data protection law.

We do not use Customer Data for advertising or to train artificial intelligence models.

We limit access to Customer Data to personnel who need it to run and support the service and who are bound by confidentiality. Staff access to the operator console requires an internal account, a confirmed email address and an allowlist.

We maintain technical and organisational measures appropriate to the risk, as described on our security page, including:

We may update these measures, provided we do not lower the overall level of protection.

The Customer gives general authorisation for the subprocessors listed on our subprocessors page. We impose on each, by written contract, data protection obligations no less protective than this DPA, and remain responsible for their performance.

We give at least 30 days’ notice of a new or replacement subprocessor on that page and by email. The Customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer may end the affected service and receive a refund of prepaid fees for the unused period.

Customer Data is stored in Germany. Outbound mail is sent through Amazon SES in the United States, and AI features, when used, are processed in the United States. Transfers of Personal Data from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision are made under the European Commission’s Standard Contractual Clauses (Module 3, processor to processor, with each subprocessor), with the UK International Data Transfer Addendum where UK data is concerned, or under the EU-US Data Privacy Framework where the recipient is certified.

Taking into account the nature of the processing, we help the Customer respond to Data Subject requests, chiefly through the console’s tools to export, correct and erase contacts and to export account data. If we receive a request directly, we pass it to the Customer without undue delay and do not answer it ourselves except to say we have done so.

We give reasonable help with data protection impact assessments, prior consultations and the Customer’s security obligations.

We notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed; we supplement it as we learn more. We take reasonable steps to contain and remedy the breach.

Before the account closes, the Customer can export its data and move mail out over IMAP. When the account closes, we delete Customer Data from the live service, and it leaves our encrypted backups as they expire on their rolling schedule, unless the law requires us to keep it.

We make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires. Where that is not sufficient, the Customer may audit our compliance once a year, on 30 days’ notice, during business hours, under confidentiality, and at its own cost, or by an independent auditor bound by confidentiality.

Data protection questions: privacy@rykonmail.com, subject "Privacy request".