Data processing agreement

1. Roles

The customer is the controller of the personal data of its contacts and members that it puts in the service. Lekalao is its processor. Each party complies with the obligations the data protection law places on it.

The customer is responsible for having a lawful basis for the data it puts in the service and the e-mails it sends, in particular the consent of the people it writes to where the law requires it.

2. The processing

3. Instructions

Lekalao processes the data only on the customer’s documented instructions: these terms, the settings and actions of the customer’s members in the service, and the customer’s calls to the API. Lekalao informs the customer if, in its opinion, an instruction infringes the data protection law, and does not process the data for any purpose of its own.

If a law obliges Lekalao to process the data otherwise, Lekalao tells the customer before doing so, unless that law forbids it.

4. Confidentiality

The people Lekalao authorises to process the data are bound by confidentiality and have access only to what their task requires.

5. Security

Lekalao takes the technical and organisational measures appropriate to the risk, as article 32 of the GDPR requires. They are described on the security page, which forms part of this agreement, and include in particular: encryption of connections; encryption at rest of the sending providers’ credentials, signing secrets and DKIM keys; passwords stored only as hashes; two-factor authentication and passkeys; roles that separate writing, sending and exporting; an activity log; nightly backups kept away from the production server, and a monthly rehearsal of their restoration.

Lekalao may improve these measures; it does not lower their overall level during the service.

6. Subprocessors

The customer authorises Lekalao to use the subprocessors listed on the subprocessors page. Lekalao imposes on each, by contract, data protection obligations equivalent to those of this agreement, and remains responsible to the customer for them.

Lekalao announces a new subprocessor, or the replacement of one, by e-mail to the owners of each team and on that page at least 30 days before it is used. The customer may object on reasonable grounds within that time; if no solution is found, the customer may end the service, and Lekalao refunds the part not used of any period already paid.

The sending provider the customer chooses is not a subprocessor of Lekalao: the customer contracts with it, and Lekalao hands it the e-mails on the customer’s instructions. The same holds for the webhook addresses and connectors the customer sets up.

7. Requests from data subjects

The service gives the customer the means to answer the people whose data it holds: the file of everything held about a person, its correction, its erasure, the blocking of an address, the register of consents, and a page where each subscriber manages their subscriptions.

If Lekalao receives a request meant for the customer, it passes it on without delay and does not answer it itself, unless the customer asks it to. Lekalao also assists the customer, as far as it reasonably can, with its impact assessments and its consultations of an authority.

8. Personal data breaches

Lekalao notifies the customer without undue delay after becoming aware of a breach affecting the customer’s personal data, by e-mail to the owners of the team. The notice says what is known: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed. It is completed as more is known.

Lekalao keeps a record of breaches, and helps the customer notify the authority and the people concerned when the customer must.

9. Where the data is, and transfers

Lekalao transfers personal data to a country that does not offer an adequate level of protection only with the safeguards the data protection law requires: for data under the GDPR, the standard contractual clauses adopted by the European Commission (decision 2021/914); for data under Cameroonian law, the conditions it sets for transfers.

10. Return and deletion

The customer can export its contacts and its blocklist at any time. When the service ends, the data remains available for export for 30 days, then is deleted within the following 30 days, unless a law obliges Lekalao to keep some of it. Copies in backups disappear as those backups are replaced, and are not restored except to recover the service.

11. Information and audits

Lekalao makes available to the customer the information needed to show that it meets its obligations: this agreement, the security page, and its answers to the customer’s written questions.

If that is not enough, the customer may have an audit carried out, by itself or by an auditor bound by confidentiality, once a year, with 30 days’ notice, at its own cost, during working hours, and without access to the data of other customers or to information whose disclosure would weaken the service’s security.

12. General

This agreement lasts as long as Lekalao processes personal data for the customer. On data protection, it prevails over the terms of service; where standard contractual clauses apply, they prevail over it. Liability under this agreement is governed by the terms of service, within what the data protection law allows.

Questions about this agreement: hello@lekalao.com.