Data Processing Agreement

Effective date: 10 October 2026

The short version: we process the personal data in your email only to provide the Service and only on your instructions. Email is processed in the United States, transfers are covered by the Standard Contractual Clauses and the UK Addendum, we tell you about personal data breaches within 48 hours, give 30 days' notice of new subprocessors, and delete your data when the Service ends. This DPA applies automatically; you don't need to sign anything.

1. Parties, scope and how this DPA applies

1.1 This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between the customer ("Customer", "you") and BroadNet Technologies LLC, the operator of iBlockSpam ("iBlockSpam", "we", "us"). Our company details are in the Company details table in our Privacy Policy.

1.2 This DPA applies whenever we process Customer Personal Data in providing the Service. It takes effect when you accept the Terms, without the need for a signature. If you need a countersigned copy for your records, email privacy@iblockspam.com.

1.3 It is intended to meet the requirements of Article 28 of the EU General Data Protection Regulation ("GDPR"), Article 28 of the UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), and the service provider requirements of US state privacy laws such as the California Consumer Privacy Act ("CCPA") (together, "Data Protection Laws").

2. Definitions

Words with capitals that aren't defined here have the meanings given in the Terms. "Controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR. In addition:

• "Customer Personal Data" means personal data in Customer Data that we process on your behalf in providing the Service.
• "Subprocessor" means a third party we engage to process Customer Personal Data.
• "SCCs" means the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, as amended).

3. Roles

3.1 You are the controller of Customer Personal Data (or, where you act for your own clients, such as an MSP, a processor acting for them) and we are your processor (or subprocessor).

3.2 We act as an independent controller for the account, billing, website and support data described in our Privacy Policy. This DPA doesn't apply to that data.

4. Details of processing

5. Our obligations

5.1 Instructions. We process Customer Personal Data only on your documented instructions, which consist of the Terms, this DPA, your configuration of the Service, and any other written instructions you give us that are consistent with the Terms. If the law requires us to process it otherwise, we'll tell you before processing, unless the law prohibits that. We'll tell you promptly if we believe an instruction infringes Data Protection Laws.

5.2 Confidentiality. We ensure that everyone we authorize to process Customer Personal Data is bound by an appropriate duty of confidentiality and accesses it only as needed for the Service. No one at iBlockSpam reads message content as a matter of course; staff open a specific message only when you ask us to help with it, when needed to deal with a security incident or abuse, or when the law requires it.

5.3 Security. We implement and maintain the technical and organizational measures in Annex 2. We may update them, provided the overall level of protection doesn't decrease.

5.4 No other use. We won't sell Customer Personal Data, use it for advertising, use it to build profiles of individuals, or combine it with other data except as needed to provide and secure the Service.

6. Subprocessors

6.1 General authorization. You authorize us to engage the subprocessors listed on our Subprocessors page (Annex 3), including a US-based filtering subprocessor that operates our filtering infrastructure. Where Data Protection Laws entitle you to it, we'll provide that subprocessor's identity on request, as described on the Subprocessors page.

6.2 Our commitments. For each subprocessor, we will carry out appropriate due diligence, and impose by written contract data protection obligations no less protective than this DPA. We remain fully responsible to you for each subprocessor's performance of its obligations.

6.3 Notice of changes. We'll give at least 30 days' notice before a new or replacement subprocessor processes Customer Personal Data, by email to account owners and by updating the Subprocessors page.

6.4 Right to object. You may object on reasonable data protection grounds within the notice period, by emailing privacy@iblockspam.com. We'll work with you in good faith to address the objection, for example by offering a reasonable alternative. If we can't resolve it within 30 days, you may terminate the affected Subscriptions by notice, and we'll refund the Fees you prepaid for the remaining full months of the Subscription Period.

6.5 Emergency replacement. If we must replace a subprocessor urgently, for example because of its sudden failure, we may do so with shorter notice and will tell you as soon as we can. Your right to object under section 6.4 still applies.

7. Assistance

7.1 Data subject requests. Taking into account the nature of the processing, we'll help you, by appropriate technical and organizational measures, to respond to requests from data subjects to exercise their rights. If we receive a request directly that relates to Customer Personal Data, we'll pass it to you without undue delay and won't respond ourselves except to confirm that we've passed it on, unless you instruct us otherwise.

7.2 Other assistance. Taking into account the nature of the processing and the information available to us, we'll provide reasonable help with your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.

8. Personal data breaches

8.1 We'll notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 Our notice will describe, as far as the information is available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and limit its effects; and a contact point for more information. Where we can't provide all the information at once, we'll provide it in phases without further undue delay.

8.3 We'll take reasonable steps to contain and investigate the breach and reduce its effects. Our notification isn't an admission of fault.

9. Government and third-party requests

If a public authority or other third party asks us for Customer Personal Data, we'll refer it to you where possible. If we're legally compelled to disclose it, we'll notify you first, unless the law prohibits that, and disclose only what's required. Where appropriate, we'll challenge a request we consider unlawful. Section 15 of the SCCs applies to transfers under them.

10. Audits and information

10.1 Documentation first. We'll make available the information reasonably needed to demonstrate compliance with this DPA. This includes this DPA and its annexes, our Security page, and written answers to a reasonable security or privacy questionnaire, not more than once in any 12 months unless a personal data breach or supervisory authority makes it necessary.

10.2 On-site audits. Where documentation isn't sufficient to demonstrate compliance and an audit is required by Data Protection Laws or a supervisory authority, you (or an independent auditor bound by confidentiality, who isn't our competitor) may audit our compliance with this DPA. You'll give at least 30 days' written notice, agree the scope with us in advance, conduct it during business hours without unreasonably disrupting our operations or other customers' data, and bear its costs.

10.3 Subprocessors. Audits of a subprocessor's facilities are carried out by relying on the subprocessor's own audit reports, certifications or documentation, which we'll share where its terms allow.

11. Deletion and return at the end of the Service

11.1 The Service delivers email to your own mail server, so you already hold the email it processes. Quarantine and message history are temporary by design.

11.2 When a Subscription ends, we stop processing Customer Personal Data for that domain. Message history and quarantined messages are deleted as they reach the end of the 30-day history period, and spooled mail within 5 days. Other Customer Personal Data in your account is deleted within 90 days after your account is closed, and removed from our rolling backups within a further 14 days.

11.3 If you want a copy of your account settings or domain configuration, ask us before the Service ends and we'll provide it in a common format.

11.4 We may keep Customer Personal Data longer only where the law requires us to, and then keep it confidential and process it only for that purpose.

12. International transfers

12.1 Where data goes. Customer email is processed in the United States. We are established in the United Arab Emirates, and our personnel may access Customer Personal Data remotely from there to run and support the Service. You authorize us and our subprocessors to transfer Customer Personal Data to the countries listed on the Subprocessors page, provided the transfer complies with Data Protection Laws.

12.2 EU SCCs. For transfers of Customer Personal Data from the European Economic Area to a country without an adequacy decision (including to us in the United Arab Emirates and to our subprocessors in the United States), the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
• Clause 7 (docking clause) applies;
• Clause 9: Option 2 (general written authorization) applies, with the notice period in section 6.3;
• Clause 11: the optional language doesn't apply;
• Clause 13: the competent supervisory authority is the one identified in Annex 1;
• Clause 17: the SCCs are governed by the law of Ireland;
• Clause 18: disputes are resolved by the courts of Ireland; and
• Annexes I to III of the SCCs are completed with the information in Annexes 1 to 3 of this DPA.

12.3 UK transfers. For transfers from the United Kingdom, the UK Addendum applies, incorporated by reference. Tables 1 to 3 are completed with the information in this DPA and its annexes, and for Table 4 either party may end the UK Addendum as its Section 19 allows.

12.4 Swiss transfers. For transfers from Switzerland, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; and data subjects in Switzerland may enforce their rights in their place of habitual residence.

12.5 Alternative mechanisms. If a transfer mechanism is invalidated or replaced, we'll work with you to adopt a valid alternative.

13. US state privacy laws

Where the CCPA or a similar US state law applies, we act as your service provider or processor. We won't: sell or share Customer Personal Data (as those terms are defined in the CCPA); retain, use or disclose it for any purpose other than the business purposes set out in the Terms, or outside our direct business relationship with you; or combine it with personal data we receive from others, except as those laws permit. We'll notify you if we can no longer meet these obligations. We certify that we understand and will comply with these restrictions.

14. Your obligations

You confirm that you have a lawful basis for the processing you instruct, have given your Users and other data subjects any notices the law requires, and, where you act as a processor for your own clients, that your instructions are authorized by them. You're responsible for configuring the Service, including who may see quarantines and message history, in a way that meets your obligations.

15. Liability, precedence and term

15.1 Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs don't allow it.

15.2 If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

15.3 This DPA stays in force for as long as we process Customer Personal Data. We may update it as described in the Terms, but won't reduce the overall level of protection without your agreement unless the law requires it.

Annex 1: Parties and description of the transfer

Data exporter: the Customer, as identified in its account. Contact: the account owner's email address. Role: controller (Module Two) or processor (Module Three). Activities: use of the Service.

Data importer: BroadNet Technologies LLC, operator of iBlockSpam; address and registration details in the Company details table in our Privacy Policy. Contact: privacy@iblockspam.com. Role: processor. Activities: providing the Service.

Description of the transfer: the categories of data subjects and personal data, special categories, frequency, nature and purpose of processing, and retention periods are set out in section 4. Transfers to subprocessors are for the purposes and duration described on the Subprocessors page.

Competent supervisory authority: where the data exporter is established in the EEA, the supervisory authority of the Member State where it is established. Where the data exporter isn't established in the EEA but has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State where that representative is established. Otherwise, the supervisory authority of the Member State where the data subjects whose personal data is transferred are located. For UK transfers, the UK Information Commissioner; for Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Annex 2: Technical and organizational measures

We describe only the measures we actually apply. We don't hold SOC 2 or ISO 27001 certification.

Annex 3: Subprocessors

The current list of subprocessors, with their purpose, location and the personal data involved, is on our Subprocessors page, which forms part of this Annex.