GDPR & Data Processing

This page explains how Mega Mailer supports compliance with the EU General Data Protection Regulation (GDPR) and similar data-protection laws. It supplements our Privacy Policy. For contractual data-processing commitments, a Data Processing Agreement (DPA) is available on request.

1. Roles: controller and processor

For personal data about your own account, we act as the data controller. For personal data you upload and process through the Service (such as your contacts and recipients), you are the controller and we act as your processor, processing that data only on your documented instructions.

2. Data we process on your behalf

As your processor, we process the contact and campaign data you provide — such as recipient names, email addresses, and engagement events — solely to deliver the Service you configure.

3. Sub-processors

We use vetted sub-processors (for example, cloud hosting, email delivery, and payment providers) to operate the Service. They are bound by contractual obligations consistent with this page. A current list of sub-processors is available on request.

4. Data-subject rights

We support your ability to fulfill data-subject requests — access, rectification, erasure, restriction, portability, and objection. Tools in the Service let you edit, export, and delete data; for assistance, contact support@megamailer.xyz.

5. Security measures

We maintain appropriate technical and organizational measures, including encryption in transit, encryption of sensitive credentials at rest, access controls, and monitoring, designed to protect personal data against unauthorized access, loss, or disclosure.

6. International transfers

Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and equivalent mechanisms.

7. Data-breach notification

In the event of a personal-data breach affecting your data, we will notify you without undue delay and provide the information reasonably necessary for you to meet your own notification obligations.

8. Retention & deletion

We retain personal data only as long as necessary to provide the Service or as required by law. On termination, and on valid request, we will delete or return personal data processed on your behalf within a reasonable period, subject to legal retention requirements.

9. Data Processing Agreement

If your organization requires a signed DPA, contact us at support@megamailer.xyz and we will provide our current agreement.

10. Contact

For any data-protection question, email us at support@megamailer.xyz.