Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the WaveDrop Terms of Service between you ("Customer", controller) and WaveDrop ("Processor"). It applies to personal data of your contacts that WaveDrop processes for you, under Art. 9 Swiss FADP and, where applicable, Art. 28 GDPR.
1. Subject and duration
WaveDrop processes personal data on your behalf to provide the service described in the Terms: storing your contacts, sending emails from your Gmail account, logging sends, tracking clicks on pack links and handling unsubscribes. The DPA lasts as long as WaveDrop processes such data for you.
2. Data and data subjects
No special categories of personal data are intended to be processed. You must not upload such data.
3. Your instructions
WaveDrop processes the data only on your documented instructions, which are given by these Terms and by your settings and actions in the app, unless the law requires otherwise. WaveDrop will tell you if it believes an instruction breaks data protection law.
4. Confidentiality and access
Only persons who need access to run the service may access the data, and they are bound to confidentiality. Admin access is limited to a small number of named team members of WaveDrop and used only for support, error analysis, security and abuse prevention. Recipient addresses are masked in the admin view; showing a full address is logged.
5. Security
WaveDrop takes appropriate technical and organizational measures, including: encryption in transit (HTTPS), encrypted storage of Google tokens, hosting in an ISO 27001 certified data center in Germany, role-based access, short-lived login tokens, rate limiting, regular dependency security scans and nightly backups.
6. Sub-processors
You authorize the following sub-processors:
WaveDrop will inform you at least 30 days before adding or replacing a sub-processor. You may object for good reason; if we cannot resolve it, you may terminate the affected service. WaveDrop imposes data protection obligations on each sub-processor that are no less protective than this DPA.
7. Transfers abroad
Transfers to countries without adequate protection take place only on the basis of recognized safeguards, such as the Data Privacy Framework or standard contractual clauses.
8. Assistance
WaveDrop helps you, as far as reasonable, to answer requests from data subjects (for example access or deletion), to meet your security obligations and, where required, with data protection impact assessments. Requests that reach WaveDrop directly are forwarded to you without delay.
9. Data breaches
WaveDrop notifies you without undue delay, and where possible within 72 hours, after becoming aware of a breach affecting your data, with the information you need to meet your own notification duties.
10. Deletion and return
You can delete your data in the app at any time and request an export from us. When you delete your account, WaveDrop deletes the data at once, and backups are overwritten within 30 days, unless the law requires longer storage. The unsubscribe list is deleted together with your account.
11. Audits
WaveDrop provides the information you reasonably need to verify compliance with this DPA. On-site audits require reasonable notice, may take place at most once a year and are at your cost.
12. Your responsibilities
You are responsible for the lawfulness of the processing, in particular for having a legal basis or consent to email your contacts and for informing them about your processing.
13. Precedence
If this DPA conflicts with the Terms, this DPA prevails for matters of data protection.