Data processing addendum
Effective October 16, 2026. Rasel Hakkani, trading as Swift Web Dev, Kodomtoli, New Bridge Rd, Gaibandha - 5700, Bangladesh.
This Data processing addendum ("DPA") forms part of the Terms of service between the customer ("Controller") and Rasel Hakkani, trading as Swift Web Dev ("Processor") and applies where the Processor processes personal data on the Controller's behalf.
1. Subject matter and details
| Subject matter | Providing the Swift Outbox service |
|---|---|
| Duration | The term of the agreement plus the deletion period in section 9 |
| Nature and purpose | Storing leads, researching their public websites, generating, sending and tracking emails, receiving and matching replies, handling unsubscribes |
| Data subjects | The Controller's leads and contacts; the Controller's users |
| Categories of data | Names, business email addresses, job titles, company details, website URLs, email content, replies, open/click events, unsubscribe status. No special category data should be uploaded. |
2. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are the agreement, this DPA and the Controller's use of the Service. The Processor will tell the Controller if an instruction appears to break data protection law.
3. Controller obligations
The Controller is responsible for having a lawful basis for processing lead data and for sending each email, for giving any required notices to data subjects, and for complying with the Acceptable use policy.
4. Confidentiality
Everyone authorised to process the personal data is bound by confidentiality.
5. Security
The Processor implements appropriate technical and organisational measures, including encryption in transit, encryption at rest of credentials with per-workspace keys, workspace isolation, access control, logging and backups.
6. Sub-processors
The Controller gives general authorisation to use sub-processors. The current list is in section 3 of the privacy policy. The Processor will give at least 30 days' notice of new sub-processors, during which the Controller may object on reasonable grounds. The Processor imposes equivalent data protection obligations on each sub-processor and remains liable for them.
7. Data subject requests
The Processor helps the Controller respond to requests from data subjects through features of the Service (export, deletion, suppression) and, where needed, reasonable additional assistance.
8. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its obligations.
9. Deletion and return
On termination the Controller may export its data. The Processor deletes Customer Data 30 days after cancellation, unless law requires it to keep some of it.
10. Audits
The Processor makes available the information needed to demonstrate compliance and allows for reasonable audits, on 30 days' notice, at most once a year unless required by a regulator.
11. International transfers
Transfers outside the UK or EEA are covered by the EU Standard Contractual Clauses (module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference.
12. Signing
This DPA is accepted when the Controller accepts the Terms. To receive a countersigned copy, email privacy@swiftoutbox.com.