Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Gaggle Mail Terms of Service (the “Terms”) between the customer identified in the Gaggle Mail account (the “Customer”) and Seven Forty Six Ltd, a company registered in England and Wales under company number 11386383 with its registered office at Longfrey Cottage, Dorking Road, Chilworth, Guildford, Surrey, GU4 8RH, United Kingdom, trading as Gaggle Mail (“Gaggle Mail”).

This DPA applies automatically to every Customer and does not need to be signed. Customers who require a countersigned copy may download the signature version at https://gaggle.email/dpa and return it to help@gaggle.email.

If there is a conflict between this DPA and the Terms, this DPA prevails in relation to the processing of personal data.

1. Definitions

“Customer Data” means personal data that the Customer or its members submit to the Service, including member names, email addresses, message content, attachments and group membership records.

“Data Protection Laws” means all laws that apply to the processing of personal data under this DPA, including the UK GDPR, the Data Protection Act 2018, the EU GDPR, and applicable US state privacy laws including the California Consumer Privacy Act as amended (together, “US Privacy Laws”).

“Service” means the Gaggle Mail group email service at gaggle.email.

“Sub-processor” means a third party engaged by Gaggle Mail to process Customer Data.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” have the meanings given in the UK GDPR and EU GDPR. The equivalent terms in US Privacy Laws (“business”, “service provider”, “consumer”, “sale”, “share”) apply where those laws govern.

2. Roles

2.1 For Customer Data, the Customer is the Controller and Gaggle Mail is the Processor. Where the Customer is itself a Processor acting for a third-party Controller, Gaggle Mail is a Sub-processor and the Customer warrants that it has authority to bind that Controller to this DPA.

2.2 For the Customer’s own account and billing information (administrator name, email, payment details, usage records), Gaggle Mail is an independent Controller and processes that data under the privacy terms in the Gaggle Mail GDPR statement.

2.3 The Customer is responsible for obtaining any consents and providing any notices required to lawfully add members to a group and to send messages through the Service.

2.4 The Service is not designed for protected health information under HIPAA. Gaggle Mail is not a Business Associate and does not enter into Business Associate Agreements. The Customer must not use the Service to process protected health information.

3. Processing instructions

3.1 Gaggle Mail will process Customer Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s use of the Service settings constitute the complete set of instructions. Additional instructions require written agreement.

3.2 Gaggle Mail will inform the Customer if it believes an instruction infringes Data Protection Laws. Gaggle Mail is not obliged to carry out legal review of Customer instructions.

3.3 Gaggle Mail may process Customer Data where required by law, in which case it will inform the Customer before processing unless the law prohibits this.

3.4 Details of the processing are set out in Annex 1.

4. Confidentiality

Gaggle Mail ensures that all personnel and contractors with access to Customer Data are bound by written confidentiality obligations and receive access only to the extent needed to provide the Service and support.

5. Security

5.1 Gaggle Mail implements the technical and organisational measures set out in Annex 2. Gaggle Mail may update these measures provided the overall level of protection is not reduced.

5.2 Gaggle Mail holds a SOC 2 Type 1 report and will maintain an independent SOC 2 audit programme. Gaggle Mail will provide the current SOC 2 report to the Customer on request under a confidentiality obligation.

6. Sub-processors

6.1 The Customer authorises Gaggle Mail to engage the Sub-processors listed in Annex 3.

6.2 Gaggle Mail will give at least 30 days’ notice before adding or replacing a Sub-processor by updating Annex 3 of this DPA at https://gaggle.email/dpa and emailing the Customer’s account administrator.

6.3 If the Customer objects on reasonable data protection grounds within the 30-day notice period and Gaggle Mail cannot address the objection, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the remaining term. This is the Customer’s sole remedy for an objection.

6.4 Gaggle Mail imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA and remains liable for the acts and omissions of its Sub-processors.

7. International transfers

7.1 The Service is hosted in the United States. By using the Service the Customer instructs Gaggle Mail to transfer Customer Data to the locations listed in Annex 3.

7.2 Transfers from the EEA to Gaggle Mail in the United Kingdom rely on the European Commission adequacy decision for the United Kingdom.

7.3 Transfers from the United Kingdom or the EEA to Sub-processors in countries without an adequacy decision (including the United States, Hong Kong and Ukraine) rely on (a) the Sub-processor’s certification under the EU-US Data Privacy Framework and UK Extension, where held, and otherwise (b) the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 3) together with the UK International Data Transfer Addendum, which are incorporated into Gaggle Mail’s agreements with those Sub-processors.

7.4 If a transfer mechanism in 7.2 or 7.3 is invalidated, Gaggle Mail will implement an alternative lawful mechanism and the Customer will cooperate reasonably with any additional steps required.

8. Assistance to the Customer

8.1 Data Subject requests. The Service provides self-serve tools for the Customer to access, correct, export and delete member data. Gaggle Mail will forward to the Customer any Data Subject request it receives that relates to Customer Data, without responding to it unless the Customer instructs otherwise or the law requires a response.

8.2 Impact assessments and consultations. Gaggle Mail will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Gaggle Mail.

8.3 Assistance beyond the self-serve tools and the SOC 2 report is provided by email. Gaggle Mail may charge a reasonable fee for assistance that is excessive or exceeds what is required by Data Protection Laws.

9. Personal Data Breach

9.1 Gaggle Mail will notify the Customer’s account administrator by email without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data.

9.2 The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Gaggle Mail may provide this information in phases as it becomes available.

9.3 Gaggle Mail’s notification is not an admission of fault or liability.

10. Deletion and return

10.1 The Customer may export or delete Customer Data at any time through the Service.

10.2 On termination of the Customer’s subscription or deletion of a group, Gaggle Mail will delete Customer Data within [90] days, except for copies retained in backups, which are deleted in the ordinary backup rotation within a further 30 days, and any data Gaggle Mail is legally required to retain.

10.3 Gaggle Mail will confirm deletion in writing on request.

11. Audit

11.1 Gaggle Mail will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer agrees that this obligation is satisfied by (a) the current SOC 2 report, (b) the security overview at https://help.gaggle.email/article/265-information-security-data-privacy, and (c) written responses to reasonable questions, provided by email.

11.2 If the Customer can demonstrate that the materials in 11.1 are insufficient to meet a legal or regulatory requirement, the Customer may request an audit no more than once in any 12-month period, on at least 30 days’ written notice, during normal business hours, conducted remotely unless a regulator requires otherwise, at the Customer’s cost, and subject to confidentiality. Audits must not access data of other customers and must not disrupt the Service.

12. US Privacy Laws

Where US Privacy Laws apply to Customer Data, Gaggle Mail acts as a service provider or processor and:

• will not sell or share Customer Data;
• will not retain, use or disclose Customer Data for any purpose other than providing the Service, or outside the direct business relationship with the Customer;
• will not combine Customer Data with personal data received from other sources, except as permitted for service providers;
• will notify the Customer if it determines it can no longer meet its obligations under US Privacy Laws;
• grants the Customer the right to take reasonable steps to stop and remediate unauthorised use of Customer Data;
• will comply with applicable US Privacy Laws and provide the same level of privacy protection they require.

13. Liability

Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA limits a party’s liability where such limitation is prohibited by Data Protection Laws.

14. Term and changes

14.1 This DPA applies for as long as Gaggle Mail processes Customer Data.

14.2 Gaggle Mail may update this DPA where required by law or to reflect changes to the Service. Material changes will be notified to the Customer’s account administrator at least 30 days before they take effect. The Customer may terminate its subscription before the effective date if it reasonably objects to a material change.

14.3 This DPA is governed by the laws of England and Wales and the courts of England and Wales have exclusive jurisdiction, except that mandatory provisions of the Data Protection Laws of the Customer’s jurisdiction apply to the extent they cannot be excluded.

Annex 1: Details of processing

Annex 2: Technical and organisational security measures

Annex 3: Sub-processors

Current as of 1 September 2026. Updates are published in this Annex at https://gaggle.email/dpa.

Signature version

For Customers who require a countersigned copy. Signing does not change the terms. Download the PDF.

Seven Forty Six Ltd (trading as Gaggle Mail)

Signed: ______________________________

Name: Simon Hutton

Title: Director

Date: 1 September 2026

Customer

Organisation: ______________________________

Signed: ______________________________

Name: ______________________________

Title: ______________________________

Date: ______________________________

Gaggle Mail account email: ______________________________