Data Processing Addendum
Last updated 2 October 2026Effective 26 September 2026
1. Who this applies to
Draft for legal review. This part describes Business Viremail and does not apply until it has been approved and published.
This Data Processing Addendum ("DPA") applies when an organisation (the "customer") uses Viremail Business, or otherwise provides Viremail accounts to its staff or members. It forms part of our Business terms and Terms of Service. If they conflict on the protection of personal data, this DPA wins.
For personal data in the customer’s business accounts, the customer is the controller and Svayam Incarnation Limited ("we") is its processor. For our own account, billing, security and fraud records, we are a controller, as our Privacy Policy explains.
"Data protection law" means the UK GDPR and the Data Protection Act 2018, the EU GDPR, and any other law that applies to the processing, such as the California Consumer Privacy Act and the Australian Privacy Act 1988.
2. What we process
| Item | Description |
|---|---|
| Subject matter | Providing email on the customer’s domains, and the other Viremail apps: chat and calling, calendars and booking pages, contacts and the business people book, leads, notes, tasks, a password vault, file storage, the office apps, Pintas and Launch, the staff rota and timesheets, the business page, and, once they open, Billing and review requests |
| Duration | For as long as the customer’s business account exists, plus the deletion periods in section 9 |
| Nature and purpose | Hosting, storing, transmitting, filtering, indexing and displaying data to provide the service; protecting it; and, where the customer turns them on, counting activity for business analytics and recording presence and location |
| Data subjects | The customer’s staff and other users it gives a mailbox, its admins, the customer’s own customers and leads, people who visit or report its business page, and the people they correspond with or keep records about |
| Personal data | Account details; message content and metadata; contacts, calendars, notes, tasks, leads, chats, call metadata and files; Vault items (end to end encrypted, unreadable to us); audit logs; and, only where the customer turns them on, activity counts, presence and location. Annex 3 lists the data of each Business feature |
| Special category data | Not intended. It may be present in content at the customer’s choice |
| Frequency | Continuous, while the service is used |
3. The customer’s instructions and duties
We process personal data only on the customer’s documented instructions. The customer’s instructions are this DPA, the Business terms, and the choices its admins make in the service, such as the monitoring categories, retention periods and the location policy. We will tell the customer if we believe an instruction breaks data protection law.
The customer is responsible for:
- having a lawful basis for the processing, and for giving its staff and other people the information the law requires;
- before turning on business analytics, presence or location: completing the monitoring setup, carrying out any legitimate interests assessment and data protection impact assessment the law requires, consulting works councils or staff representatives where the law requires it, and giving the employee notice (see our Workplace Monitoring Policy);
- the accuracy of the data it gives us, and for keeping its admins’ sign-in details safe.
4. What we commit to
- Make sure everyone who can access the personal data is bound by confidentiality.
- Keep the security measures in Annex 1 in place, and keep improving them.
- Help the customer answer requests from people exercising their rights, mostly through the tools in the service, such as export and deletion.
- Help the customer with impact assessments, consultations with a regulator, and its security obligations, taking into account what we know.
- Never sell the personal data, or use it for advertising or to build profiles for anyone else.
- Keep records of our processing as the law requires.
5. Personal data breaches
If we become aware of a personal data breach affecting the customer’s data, we will tell the customer’s owner without undue delay and in any case within 48 hours, with what we know at that point: what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it. We will follow up as we learn more. Telling the customer is not an admission of fault.
6. Sub-processors
The customer generally authorises us to use sub-processors. They are listed, with what each does and where, on our sub-processors page. We bind each one to data protection terms at least as protective as this DPA, and we stay responsible for them.
We will give the owner of each business at least 30 days’ notice by email before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the customer may cancel the affected service, and we will refund any amount paid in advance for the time after it ends.
7. Where data is kept, and transfers
The app and its database are hosted in France (EU), and mail in the United Kingdom. Data moves between the UK and the EU under their adequacy decisions for each other. Customers outside the UK and the EU should know that their data is held there; there is no choice of region yet.
Where a sub-processor processes personal data outside the UK or the EEA in a country without an adequacy decision, we rely on the EU Standard Contractual Clauses with the UK Addendum, or another safeguard the law allows.
8. Information and audits
We will make available the information reasonably needed to show we meet this DPA. Once a year, or after a breach, the customer may audit our compliance itself or through an independent auditor bound by confidentiality, with 30 days’ notice, during working hours and at its own cost. Where we hold a recent independent report that covers the question, we may provide that instead.
9. Return and deletion
The customer can export its data at any time while the business is open, including while it is suspended. When a business is closed, as set out in the Business terms, we delete its mailboxes, files and other data, and the copies in our backups are overwritten on the normal backup cycle. We keep invoices and the business’s audit log for 7 years where tax or other law requires it, and only for that purpose. Working time records from Rota, and invoices the customer issues in Billing, are kept for the periods in Annex 3, which the law where the customer works sets, and are deleted when those periods end.
10. United States
Where the California Consumer Privacy Act applies, we act as the customer’s service provider. We will not sell or share the personal data, retain, use or disclose it for any purpose other than providing the service, or combine it with personal data we receive from anyone else, except as that law allows. We will tell the customer if we can no longer meet these obligations.
Annex 1: Security measures
- Each business is kept apart: every business request is checked against the business first, and every database query for it is limited to that business.
- Before any change to a mailbox, we check its address is on a verified domain of the same business.
- Connections are encrypted with TLS. Files in Drive and Pinglar are encrypted at rest with a key for each file. Vault items are end to end encrypted.
- Sign-in with passkeys and two-step verification, sign-in alerts, and checks of new passwords against known breaches.
- One-time links for sharing new passwords, kept only as a hash and valid once, for 72 hours at most.
- An audit log of business admin actions, each entry chained to the one before with a keyed hash.
- Staff access to production systems limited to those who need it, with their own accounts.
- Backups, monitoring for faults and abuse, and a published process for reporting security issues.
11. Services the customer connects
Some features work with an account the customer holds with another company and connects itself: a Stripe or Razorpay account for taking payments on its own invoices in Billing, and a Facebook Page for lead ads. These companies are not our sub-processors. The customer chooses them, has its own agreement with them, and they are its own processors or independent controllers. We send them only what the feature needs, and the customer can disconnect them at any time.
| Service | What for | What we send or receive |
|---|---|---|
| Stripe | Card and other payments for a business’s own invoices, through the business’s own Stripe account | The invoice number, amount and currency, and the customer’s email address |
| Razorpay | Payments for a business’s own invoices in India, through the business’s own Razorpay account | The invoice number, amount and currency, and the customer’s email address |
| Meta (Facebook and Instagram) | Lead ads: leads a business’s own Facebook Page sends to Leads, once it connects that Page | Leads arrive from Meta; we send Meta nothing about your customers |
Annex 2: Sub-processors
The current list is on our sub-processors page, which forms part of this DPA.
Annex 3: Data in each Business feature
| Feature | Personal data | How long |
|---|---|---|
| People (the business people book) | Names, email addresses, phone numbers, addresses, company, notes and anything else the business saves about a person | Until the business deletes the person or closes |
| Leads | The person, stage, source (booking, form, import or lead ad), notes, reminders and history | As the business chooses: 12 or 24 months without activity, or until deleted |
| Rota and timesheets | Staff names, shifts, availability, time off, clock events with how they were made, optional clock-in location points and network matches, timesheets, and pay rates where entered | Working time records: UK 6 years, US 3 years, Australia 7 years, EU 5 years by default, never less than the law there; location points 90 days |
| Business page | What the business publishes: its name, links, services, hours, contact details and pictures; counts of clicks; reports from visitors | While the page exists |
| Billing (coming soon) | Orders, invoices with a copy of the customer’s details as they were when issued, payments and credit notes | The tax law period: UK 6 years, Australia 5, the US 7 as a guide, India 8, the EU varies; 8 by default |
| Review requests (coming soon) | The request, its channel, a keyed hash of the recipient’s address, and counts of clicks and, only if turned on, opens | Counts 13 months; unsubscribes kept so they are honoured |
Where the law sets a minimum period for a record, such as tax records or working time records, the customer cannot choose a shorter one in the service. When a person asks for their data to be deleted, records the law requires the customer to keep are kept until that period ends, and only for that purpose.