Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between CloudWish LLC, a Wyoming limited liability company with its address at 1509 Coffeen Ave STE 1200, Sheridan, WY 82801, United States ("CloudWish", "we", "us"), which provides the Mailbux (mailbux.com) and CloudWish (cloudwish.com) services, and the customer that has accepted the Terms ("Customer", "you").

This DPA applies automatically whenever we process Customer Personal Data that is subject to Data Protection Laws. No signature is needed: by accepting the Terms, or by continuing to use the Services after this DPA was published, you accept this DPA. You may download or print this page and keep it on file.

1. Definitions

• Data Protection Laws means all data protection laws that apply to our processing of Customer Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act ("CCPA"), in each case to the extent they apply.
• Customer Personal Data means personal data that Customer or its users store in, send through, or receive through the Services, and that we process on Customer's behalf.
• Services means the services we provide to Customer under the Terms: business email hosting (including webmail, mail apps, calendars, contacts, file storage, reseller and white-label email, and email migration) and cPanel web hosting, under the Mailbux and CloudWish brands.
• Subprocessor means a third party we engage that processes Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR.

2. Roles and scope

2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own customers (for example, a reseller). CloudWish is the processor, or a subprocessor where Customer is itself a processor.

2.2 Account data is not covered. We process the data we need to run your account (account holder names and contact details, billing and payment records, support communications, and service, security and usage logs) as an independent controller, as described in our Privacy Policy. That data is not Customer Personal Data.

2.3 Domain registration is not covered. Domain registrant data is processed under the rules of the relevant domain registry and registrar.

3. Processing on Customer's instructions

3.1 We process Customer Personal Data only on Customer's documented instructions, unless the law we are subject to requires otherwise. In that case we will inform Customer before processing, unless the law prohibits it. Customer's instructions are the Terms, this DPA, Customer's use and configuration of the Services, and any other written instructions we agree with Customer.

3.2 We will tell Customer if, in our opinion, an instruction infringes Data Protection Laws.

3.3 We process Customer Personal Data to provide, secure and maintain the Services. This includes:

• storing, transmitting, indexing (for search) and deleting data;
• automated filtering of incoming and outgoing email for spam, malware, phishing and abuse, including a statistical spam filter that learns from messages users mark as spam;
• investigating abuse reports and preventing misuse of the Services, as described in the Terms;
• complying with applicable law.

3.4 We do not sell Customer Personal Data. We do not use it for advertising, and we do not use it to train artificial intelligence models.

3.5 Customer is responsible for having a lawful basis for the processing, for giving any notices required by law, and for the lawfulness of its instructions.

4. Confidentiality

We ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and accesses it only as needed to provide the Services: for example, to give support that Customer asks for, to keep the Services secure, to handle abuse, or to comply with the law.

5. Security

5.1 We implement and maintain the technical and organisational measures described in Annex 2, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.

5.2 We may update these measures over time, provided the update does not materially reduce the overall level of protection.

5.3 Customer is responsible for the security choices within its control, including user passwords, app passwords, user access, and the DNS settings of its domains.

6. Subprocessors

6.1 Customer gives us general authorisation to engage Subprocessors. Our current Subprocessors are listed in Annex 3.

6.2 We impose data protection obligations on each Subprocessor, by written contract, that give in substance the same level of protection as this DPA. We remain liable to Customer for the performance of our Subprocessors' obligations.

6.3 We will update Annex 3 at least 30 days before a new Subprocessor starts processing Customer Personal Data. Customers who want to be notified by email can ask by writing to [email protected] or [email protected] with the subject "Subprocessor notifications".

6.4 Customer may object to a new Subprocessor on reasonable data protection grounds within 30 days of the update by writing to us. We will discuss the objection with Customer in good faith. If we cannot resolve it, Customer may cancel the affected Services under the Terms.

6.5 If we must replace a Subprocessor urgently for security or service continuity reasons, we will update Annex 3 as soon as possible, and the objection right in Section 6.4 applies from that update.

7. Data subject requests

7.1 The Services let Customer access, correct, export and delete Customer Personal Data, through webmail, standard mail protocols and the account dashboard.

7.2 If we receive a request from a data subject about Customer Personal Data, we will direct the data subject to Customer and will not respond ourselves, unless the law requires otherwise.

7.3 Taking into account the nature of the processing, we will give Customer reasonable assistance in responding to data subject requests that Customer cannot handle with the Services' own tools.

8. Security Incidents

8.1 We will notify Customer of a Security Incident without undue delay, and where feasible no later than 48 hours after becoming aware of it. We will send the notice to the email address on Customer's account.

8.2 The notice will describe, as far as the information is available: the nature of the Security Incident; the categories and approximate number of data subjects and records concerned; its likely consequences; and the measures taken or proposed to address it. Where we cannot provide everything at once, we will provide it in phases.

8.3 We will take reasonable steps to contain the Security Incident and reduce its effects.

8.4 Our notification of, or response to, a Security Incident is not an acknowledgement of fault or liability.

9. Assistance

Taking into account the nature of the processing and the information available to us, we will give Customer reasonable assistance with its obligations under Articles 32 to 36 GDPR: security, data protection impact assessments and prior consultations with supervisory authorities.

10. Return and deletion

10.1 Customer can export Customer Personal Data at any time during the term, using webmail, standard mail protocols (such as IMAP) and, for web hosting, the hosting control panel. Customer should export any data it wants to keep before its Services end.

10.2 After the Services end, we delete Customer Personal Data as described in the Terms, and in any event within 30 days, unless the law requires us to keep it. Once deleted, it cannot be recovered.

10.3 Copies held in secured, access-restricted systems that we keep temporarily after a platform migration, for recovery purposes, are deleted once no longer needed. Until then, this DPA continues to protect them.

11. Information and audits

11.1 We will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, including this DPA and its annexes, and answers to a reasonable security questionnaire once every 12 months.

11.2 If that information is not enough, or a supervisory authority requires it, Customer (or an independent auditor bound by confidentiality and not a competitor of ours) may audit our compliance with this DPA, on the following conditions:

• at least 30 days' written notice;
• during normal business hours;
• no more than once every 12 months, unless a Security Incident or a supervisory authority requires it;
• at Customer's cost.

11.3 Audits will not give access to other customers' data or to systems unrelated to the Services. For data centres operated by our Subprocessors, we may rely on those Subprocessors' own audit reports and certifications.

12. International transfers

12.1 CloudWish is established in the United States. Customer Personal Data in the Services is stored in the European Union and Canada, as listed in Annex 3. Canada benefits from a European Commission adequacy decision.

12.2 EU. To the extent Customer Personal Data subject to the GDPR is transferred to CloudWish, or to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor;
• Customer is the data exporter and CloudWish is the data importer;
• Clause 7 (docking clause) applies;
• in Clause 9(a), Option 2 (general written authorisation) applies, with the notice period set out in Section 6.3;
• the optional wording in Clause 11(a) does not apply;
• in Clause 13, the competent supervisory authority is the one determined under Clause 13(a);
• in Clause 17, Option 1 applies and the governing law is the law of Ireland;
• in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.

12.3 United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018) is incorporated. Its Tables 1 to 3 are completed by Section 12.2 and the annexes of this DPA. For Table 4, either party may end the Addendum as set out in its Section 19.

12.4 Switzerland. For transfers subject to the FADP, the SCCs apply as set out in Section 12.2, with these changes:

• the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority;
• references to the GDPR are read as references to the FADP;
• "Member State" does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

12.5 If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

13. US state privacy laws

Where the CCPA or a similar US state law applies, we act as Customer's "service provider" or "processor". We will not sell or share Customer Personal Data. We will not retain, use or disclose it for any purpose other than providing the Services as described in this DPA, or outside our direct business relationship with Customer. We will not combine it with personal data we receive from other sources, except as those laws permit.

14. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent permitted by Data Protection Laws. Nothing in this DPA limits the rights of data subjects under the SCCs.

15. Term, precedence and changes

15.1 This DPA applies for as long as we process Customer Personal Data.

15.2 If this DPA conflicts with the Terms on data protection matters, this DPA prevails. The SCCs prevail over both.

15.3 We may update this DPA to reflect changes in law or in the Services. Updates will not reduce the overall level of protection for Customer Personal Data. The current version is always published at mailbux.com/dpa and cloudwish.com/dpa.

15.4 Apart from the SCCs, this DPA is governed by the law that governs the Terms.

---

Annex 1: Description of the processing

A. Parties

Data exporter: Customer, as identified in its account. Contact details: those on Customer's account. Activities: use of the Services. Role: controller, or processor on behalf of its own customers. Signature and date: by accepting the Terms.

Data importer: CloudWish LLC, 1509 Coffeen Ave STE 1200, Sheridan, WY 82801, United States. Data protection contact: [email protected] or [email protected] (subject "Data protection"). Activities: providing the Services. Role: processor, or subprocessor. Signature and date: by publication of this DPA.

B. Description of the transfer and processing

Data subjects:

• Customer's users, such as employees and contractors who use mailboxes;
• people who send email to, or receive email from, Customer's users;
• people whose details appear in Customer's contacts, calendars and files;
• visitors to and users of websites that Customer hosts with us.

Personal data:

• names and email addresses;
• email messages and attachments, including headers and metadata (senders, recipients, dates and the IP addresses recorded in message headers);
• contacts, calendar entries and stored files;
• mailbox login credentials (passwords are stored hashed);
• access and service logs, such as IP addresses, login times and device or app information;
• website files, databases and content that Customer hosts with us.

Sensitive data: Customer decides what data it stores in or sends through the Services. The Services are not designed specifically for special categories of personal data. Any such data is protected by the measures in Annex 2.

Frequency of the transfer: Continuous, for as long as Customer uses the Services.

Nature of the processing: Hosting, storage, transmission, filtering, indexing, retrieval and deletion.

Purpose: Providing, securing and maintaining the Services, as described in Section 3.

Retention: For the duration of the Services, followed by deletion under Section 10. Service logs are kept only as long as needed for security, abuse prevention and troubleshooting.

Transfers to Subprocessors: As listed in Annex 3, for the same purposes and duration.

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs.

Annex 2: Technical and organisational security measures

• Encryption in transit: HTTPS (TLS) for webmail, the account dashboard and our websites; TLS for IMAP, POP3 and SMTP client connections; TLS for server-to-server email whenever the other server supports it.
• Access control: Access to production systems is limited to authorised personnel who need it, on a least-privilege basis, and administrative access takes place only over encrypted connections.
• Account protection: User passwords are stored hashed. App passwords are available for mail clients. Repeated failed mail logins are blocked automatically.
• Network security: Network access rules and automatic blocking of abusive connections. Internal services, such as databases and search indexes, either are not reachable from the internet or require authentication over encrypted connections.
• Separation: Each customer's data is kept logically separate. Web hosting accounts are isolated from one another.
• Email security: Incoming and outgoing email is filtered for spam, malware and phishing. Outgoing email is monitored for abuse.
• Vulnerability management: Security updates are applied to operating systems and software promptly, with priority for critical vulnerabilities.
• Monitoring: System health, security events and availability are monitored and logged.
• Physical security: Servers are hosted in professionally operated data centres with controlled access, 24/7 security and environmental protections.
• Personnel: Everyone with access to Customer Personal Data is bound by confidentiality.
• Incident response: A process to detect, contain, investigate and report Security Incidents (see Section 8).
• Data minimisation and deletion: Data is processed only as needed for the Services and deleted as described in Section 10.

Annex 3: Subprocessors

Payment processors (for information). These companies process payment data when you pay us. They act as independent controllers, not as Subprocessors of Customer Personal Data:

• Stripe, Inc. (United States): card payments;
• Paddle.com Market Limited (United Kingdom): PayPal payments.