Data Processing Addendum

1. Definitions

1.1. “Customer Data” means any Personal Data that Sender.net Processes on behalf of the Customer as a Data Processor in the course of providing its Services.

1.2. “Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.

1.3. “Data Processor” means an entity that processes Personal Data on behalf of a Data Controller.

1.4. “Data Protection Laws” means all data protection and privacy laws and regulations of the EU, EEA and their member states, Switzerland and the United Kingdom, applicable to the Processing of Personal Data.

1.5. “Data Subject” means the identified or identifiable person to whom Personal Data relates.

1.6. “EEA” means the European Economic Area, the United Kingdom, and Switzerland.

1.7. “EU” means European Union.

1.8. “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

1.9. “Personal Data” means any information relating to an identified or identifiable natural person as defined in GDPR.

1.10. “EU-U.S. Data Privacy Framework” means the self-certification program operated by the U.S. Department of Commerce, facilitating the transfer of Personal Data from the European Union to the United States in accordance with EU data protection requirements. This framework was approved by the European Commission on July 10, 2023, and replaced the previous Privacy Shield Framework, which had been invalidated in 2020. The framework ensures that U.S. organizations adhere to privacy principles that align with the GDPR, maintaining high standards for the protection of Personal Data.

1.11. “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. “Process”, “Processes” and “Processed” shall be interpreted accordingly.

1.12. “Processor” means a natural or legal person, public authority, agency, or any other body which processes Personal Data on behalf of the Data Controller.

1.13. “Services” means any product or service provided by Sender.net pursuant to Sender.net’s Terms of Service (“TOS”).

1.14. “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

1.15. “Sub-Processor” means any third-party Processor engaged by Sender.net.

1.16. “UK Addendum” means the International Data Transfer Addendum to the European Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, version B1.0, in force from 21 March 2022, as amended or replaced from time to time.

2. Applicability of this Agreement

2.1. This Agreement applies to the extent that Sender.net processes Customer Data that originates from EU/EEA and/or that is otherwise subject to GDPR.

2.2. In the course of providing the Services to Customer, Sender.net may Process Personal Data on behalf of Customer. Sender.net agrees to comply with the following provisions with respect to any Personal Data Processed for Customer in connection with the provision of the Services.

3. Role of Parties

The Parties agree that with regard to the Processing of Personal Data, Customer is the Data Controller and Sender.net is a Data Processor, acting on behalf of Customer, except for situations listed in clause 6.7.

4. Customer’s Processing of Personal Data

4.1. Customer is responsible for the control of Personal Data complying with its obligations as a Data Controller under Data Protection Laws, in particular for justification of any transfer of Customer Data to Sender.net and for its decisions and actions regarding the Processing and use of Personal Data.

4.2. Customer agrees that it has provided notice and received all consents and rights or relies on other lawful grounds necessary under Data Protection Laws for Sender.net to Process Customer Data and provide the Services.

5. Sender.net’s Processing of Customer Data

5.1. In connection with Sender.net’s delivery of the Services to the Customer, Sender.net shall Process certain categories and types of the Customer Data, as described in clause 6 below, only for the purposes described in this Agreement and only in accordance with Customer’s documented lawful instructions, including with regard to transfers of Customer Data to a third country or an international organisation, unless required to do so by EU or Member State of the EU law to which Sender.net is subject. In such a case, Sender.net shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

5.2. The Parties agree that this Agreement sets out the Customer’s complete and final instructions to Sender.net in relation to the Processing of Customer Data. The Processing outside the scope of these instructions shall require prior written agreement between Customer and Sender.net.

6. Details of Data Processing

6.1. Subject matter: The subject matter of the data Processing under this Agreement is the Customer Data.

6.2. Duration of Processing: Sender.net will Process Customer Data for the duration of the Services, as described in the TOS.

6.3. Nature of the Processing: Sender.net provides email marketing and automation software as a service and other related services, as described in the TOS.

6.4. Purpose of the Processing: The purpose of the data Processing under this Agreement is the provision of the Services.

6.5. Categories of Data Subjects:

• “Users” – any individual accessing and/or using the Services through the Customer’s account;
• “Subscribers” – any individual whose email address is included in the Customer’s distribution list / whose information is stored on or collected via the Services / to whom Users send emails or otherwise engage or communicate with via the Services.

6.6. Types of Customer Data:

• Users: identification and contact data (name, contact details, including email address, username); billing information (masked credit card details, account details, payment information); organization information (name, address, geographic location, VAT code); IT information (IP address, usage data, cookies data, online navigation data, location data, browser data, access device information);
• Subscribers: identification and contact data (name, contact details, including email address, and any other optional data fields submitted by Users); personal interests or preferences (including purchase history, marketing preferences); IT information (IP address, usage data, cookies data, online navigation data, location data, browser data, access device information).

6.7. Customer acknowledges that Sender.net shall have a right to use and disclose data relating to the operation, support and/or use of the Services for its legitimate business purposes, such as billing, account management, technical support, product development, sales, and marketing. To the extent any such data is considered Personal Data under Data Protection Laws, Sender.net is the Data Controller of such data and accordingly shall process such data in accordance with the Sender.net Privacy Policy and Data Protection Laws.

6.8. Customer acknowledges that in connection with the performance of the Services, Sender.net employs the use of cookies, unique identifiers, web beacons and similar tracking technologies. Customer shall maintain appropriate notice, consent, opt-in and opt-out mechanisms as are required by Data Protection Laws to enable Sender.net to deploy previously mentioned tracking technologies lawfully on and collect data from the devices of Subscribers.

7. Confidentiality of Processing

Sender.net ensures that persons authorised by Sender.net to Process the Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8. Security of Processing

8.1. Sender.net shall implement appropriate technical and organizational security measures to ensure a level of security appropriate to the risk and protect Customer Data from any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data and to preserve the security and confidentiality of the Customer Data, in accordance with Sender.net’s Privacy Policy.

8.2. The Parties shall take steps to ensure that any natural person acting under the authority of the Customer or Sender.net who has access to Personal Data does not Process them except on instructions from the Customer unless he or she is required to do so by EU or EU Member State law.

8.3. Customer is responsible for reviewing the information made available by Sender.net relating to its data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Laws. Customer acknowledges that Sender.net may update or modify Sender.net’s security standards from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Customer.

8.4. Customer agrees it is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Customer Data when in transit to and from the Services and taking any appropriate steps to securely encrypt or backup any Customer Data uploaded to the Services.

9. Sub-Processing

9.1. Customer agrees that Sender.net may engage Sub-Processors to Process Customer Data on Customer’s behalf. The Sub-Processors currently engaged by Sender.net and authorized by Customer are listed in the Annex.

9.2. Sender.net shall ensure that Sub-Processor will protect the Customer Data to the standard required by Data Protection Laws and remain responsible for its compliance with the obligations of this Agreement and for any acts or omissions of the Sub-Processor that cause Sender.net to breach any of its obligations under this Agreement.

10. Changes to Sub-Processors

10.1. Sender.net provides a list of the Sub-Processors in the Annex. The list is updated prior to any changes in the Sub-Processors.

10.2. Customer may object in writing to Sender.net’s addition of a Sub-Processor, provided that such objection is based on reasonable grounds relating to Data Protection Laws. In such an event, Sender.net and Customer shall discuss such concerns in a good faith effort to achieve resolution. If the resolution is not possible, Customer may suspend or terminate the Agreement by providing written notice to Sender.net.

11. Cooperation

11.1. Sender.net’s Services provide Customer with controls that Customer may use to retrieve, correct, delete or restrict Customer Data, which Customer may use to assist it in connection with its obligations under Data Protection Laws, including responding to requests from Data Subjects or applicable data protection authorities. Requests from Data Subjects may include the Data Subject’s right of access, right to rectification, restriction from Processing, erasure (“right to be forgotten”), data portability, and object to the Processing.

11.2. To the extent that Customer is unable to independently access the relevant Customer Data within the Services, Sender.net will, at Customer’s expense, provide reasonable cooperation to help Customer respond to any requests from Data Subjects or applicable data protection authorities relating to the Processing of Personal Data under the Agreement. In the event any such request is made directly to Sender.net, Sender.net shall not respond to such communication directly without Customer’s prior authorization unless legally compelled to do so. If Sender.net is required to respond to a request, Sender.net shall promptly notify Customer and provide it with a copy of the request unless legally prohibited from doing so.

11.3. To the extent Sender.net is required under Data Protection Laws, Sender.net shall, at Customer’s expense, provide reasonably requested information regarding the Services to enable Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required by Data Protection Laws.

11.4. If a law enforcement agency sends Sender.net a demand for Customer Data (for example, through a subpoena or court order), Sender.net shall attempt to redirect the law enforcement agency to request that data directly from Customer. As part of this effort, Sender.net may provide Customer’s basic contact information to the law enforcement agency. If compelled to disclose Customer Data to a law enforcement agency, Sender.net shall give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedies unless Sender.net is legally prohibited from doing so.

12. Security Reports and Audits

12.1. Upon request, Sender.net shall supply, on a confidential basis, a copy of its audit reports to Customer in no longer than 30 business days, so that Customer can verify Sender.net’s compliance with the audit standards and this Agreement.

12.2. Sender.net shall also provide written responses, on a confidential basis, to all Customer’s reasonable requests for information to confirm Sender.net’s compliance with this Agreement in no longer than 30 business days.

12.3. Upon becoming aware of any unauthorized or unlawful breach of security, Sender.net shall notify Customer without undue delay and shall provide timely information as it becomes known or as is reasonably requested by Customer.

13. Return or Deletion of Customer Data

13.1. Upon termination or expiration of the TOS and/or Agreement, Sender.net shall, at Customer’s request, delete or return to Customer all Customer Data in its possession or control. This requirement shall not apply to the extent Sender.net is required by applicable law to retain some or all of the Customer Data, or to Customer Data it has archived on backup systems, which Customer Data Sender.net shall securely isolate and protect from any further processing, except to the extent required by applicable law.

13.2. Customer is responsible for any costs arising from the deletion of Customer Data after the termination or expiration of the TOS.

14. International Transfers

14.1. Sender.net may transfer and process Customer Data anywhere in the world where Sender.net or its Sub-Processors maintain data Processing operations. Sender.net shall at all times provide an adequate level of protection (within the meaning of Data Protection Laws) for the Customer Data Processed, in accordance with the requirements of Data Protection Laws.

14.2. Sender.net stores and Processes Customers’ Subscriber Data that originates from the EEA in data centers, located exclusively within the EEA.

14.3. Sub-Processors used by Sender.net to Process any Customer Data protected by Data Protection Laws and / or that originates from the EEA, in a country that has not been designated by the European Commission or Swiss Federal Data Protection Authority (as applicable) will provide an adequate level of protection for Personal Data. Sub-Processors based in the US will be certified with the EU-U.S. Data Privacy Framework to ensure compliance.

14.4. Where a Sub-Processor referred to in clause 14.3 is not certified under the EU-U.S. Data Privacy Framework, and the transfer is not otherwise covered by an adequacy decision, Sender.net shall enter into the Standard Contractual Clauses (Module Three: processor to processor) with that Sub-Processor before any Customer Data is transferred to it.

14.5. If the EU-U.S. Data Privacy Framework, or any adequacy decision on which a transfer relies, is suspended, invalidated or otherwise ceases to provide a lawful basis for that transfer, Sender.net shall without undue delay put the Standard Contractual Clauses (Module Three: processor to processor) in place with the affected Sub-Processor, or stop the transfer, and shall notify Customer of the measures taken.

14.6. Where Customer is established in a country that is not recognised under Data Protection Laws as providing an adequate level of protection, any transfer of Customer Data from Sender.net to Customer (for example, through exports, reports or API access) is governed by the Standard Contractual Clauses (Module Four: processor to controller), which are incorporated into this Agreement by reference. For that purpose: (a) Sender.net is the data exporter and Customer is the data importer; (b) each Party is deemed to have signed the SCCs, including their Annexes, on the date Customer accepts the TOS; (c) the optional clauses 7 and 11(a) do not apply; (d) the SCCs are governed by the laws of the Republic of Lithuania, and disputes are resolved by the courts of Lithuania; and (e) the information required by Annex I of the SCCs is set out in the introduction to and clause 6 of this Agreement.

14.7. For transfers of Personal Data subject to the UK GDPR, the Standard Contractual Clauses referred to in this clause 14 apply as amended by the UK Addendum, which is incorporated by reference. The information required by Tables 1 to 3 of the UK Addendum is set out in this Agreement and the Annex, and neither Party may end the UK Addendum under its Section 19.

14.8. For transfers of Personal Data subject to the Swiss Federal Act on Data Protection (“FADP”), the Standard Contractual Clauses referred to in this clause 14 apply with the following changes: references to the GDPR are to be read as references to the FADP to the extent the transfer is subject to it; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; and the term “Member State” shall not be interpreted to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.

14.9. Before relying on the Standard Contractual Clauses for a transfer, Sender.net shall assess whether the laws and practices of the destination country could prevent the recipient from complying with them, document that assessment, and adopt supplementary measures where needed (such as encryption of Customer Data in transit and at rest). Sender.net shall provide Customer with a summary of the assessment on request.

14.10. In the event of any conflict between this Agreement or the TOS and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

15. Miscellaneous Provisions

15.1. Parties agree that this Agreement replaces any existing agreements the Parties may have previously entered into in connection with the Services. If there is any conflict between this Agreement and the TOS, the relevant terms of this Agreement take precedence.

15.2. Any claims brought under or in connection with this Agreement are subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the TOS.

15.3. Except for the rights of Data Subjects as third-party beneficiaries under the Standard Contractual Clauses, no one other than a Party to this Agreement, its successors and permitted assignees shall have any right to enforce any of its terms.

15.4. In no event shall any Party limit its liability with respect to any individual’s data protection rights under this Agreement or otherwise. Customer further agrees that any regulatory penalties incurred by Sender.net in relation to the Customer Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this Agreement or any applicable Data Protection Laws shall count toward and reduce Sender.net’s liability under the Agreement.

15.5. This Agreement shall be governed by and construed in accordance with governing law and jurisdiction provisions in the TOS unless required otherwise by applicable Data Protection Laws.

Execution

This Agreement has been executed on behalf of Sender.net by its authorized representative as set out below. The Customer accepts this Agreement electronically by accepting the TOS.

Sender.net
By: UAB “Sender.lt”, doing business as Sender.net
Name: Edgaras Vaitkevičius
Title: Director and owner
Date: November 6, 2026

Annex – List of Sender.net Sub-Processors

Sender.net uses a range of third-party Sub-Processors to assist it in providing the Services (as described in the Agreement). These Sub-Processors set out below provide cloud hosting and storage services; content delivery and review services; payment processing; marketing; analytics; data analysis; assist in providing customer support; incident tracking, response, diagnosis and resolution services; etc.