Data Processing Addendum
How Vaakio processes personal data on behalf of customers. It forms part of our Terms of Service.
Last updated 21 September 2026
1. Scope and roles
This Addendum applies where Vaakio processes personal data contained in Customer Content (for example subscriber and contact records) on behalf of the customer in providing the Service. The customer is the controller (or a processor acting for its own controller); Vaakio is the processor (or sub-processor). Capitalised terms not defined here have the meaning in the Terms of Service. "Data Protection Law" means the EU GDPR, UK GDPR, and other privacy laws that apply to the processing.
2. Details of processing
| Subject matter | Provision of email marketing, forms, automation, and analytics services. |
|---|---|
| Duration | The term of the customer's account, plus the retention period in the Privacy Policy. |
| Nature and purpose | Storing, sending email to, segmenting, and measuring engagement of the customer's contacts. |
| Data subjects | The customer's subscribers, contacts, leads, customers, and their users. |
| Personal data | Email address, name, custom fields the customer adds, subscription status, IP address, device data, and open, click, bounce, and complaint events. |
| Special categories | Not intended. The customer must not upload special-category data without our written agreement. |
3. Vaakio's obligations
- Process the data only on the customer's documented instructions, including these terms and use of the Service, unless the law requires otherwise (in which case we tell the customer unless prohibited).
- Ensure that people authorised to process it are bound by confidentiality.
- Implement appropriate technical and organisational measures (see Security).
- Assist the customer, taking account of the nature of processing, in responding to data-subject requests, and with security, breach notification, impact assessments, and prior consultation.
- Notify the customer without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting customer data.
- At the customer's choice, delete or return the data on termination and delete existing copies within the period in the Privacy Policy, unless the law requires storage.
- Make available information reasonably necessary to show compliance, and allow and contribute to audits by the customer or its auditor no more than once a year on reasonable notice, subject to confidentiality and at the customer's cost.
- Tell the customer if we believe an instruction breaches Data Protection Law.
4. Customer's obligations
The customer confirms it has a lawful basis and has provided all required notices and obtained all required consents for the processing, that its instructions comply with Data Protection Law, and that it will honour its recipients' rights and unsubscribe requests. See our Anti-Spam Policy.
5. Sub-processors
The customer gives general authorisation for Vaakio to engage sub-processors, including those listed in the Privacy Policy. We bind each sub-processor to data protection terms no less protective than these, remain liable for their performance, and give notice of new or replacement sub-processors. The customer may object on reasonable data-protection grounds within 30 days; if we cannot resolve the objection, the customer may terminate the affected service.
6. International transfers
Where processing involves a transfer of personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (Module Two, controller to processor, and Module Three where applicable) and the UK International Data Transfer Addendum are incorporated into this Addendum, with Vaakio as importer, and are completed as set out in this Addendum. Governing law and forum are those of an EU Member State the parties agree on, or Ireland if none.
7. Liability and order of precedence
Each party's liability under this Addendum is subject to the limits in the Terms of Service. If this Addendum conflicts with the Terms on data protection, this Addendum prevails.
8. Signed copy and contact
This Addendum applies automatically to all customers. If you need a countersigned copy, email privacy@vaakio.com.