Data processing agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Kawaa ("Processor") and the Customer ("Controller") for the provision of email verification services.

This DPA is incorporated into the Terms of Service by reference. It applies automatically whenever the Processor processes Personal Data on the Controller's behalf, and no signature is needed for it to apply. A copy countersigned by Kawaa is available on request by email to privacy@kawaa.com.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data.
"Data Subject" means the individual whose Personal Data is processed.
"Sub-processor" means any third party engaged by the Processor to process Personal Data.

3. Scope and purpose

The Processor processes email addresses submitted by the Controller solely for the purpose of providing email verification services. Processing includes validation checks, risk analysis, and result storage.

Validation checks include looking up the domain of each address in DNS and, where a mailbox check runs, an SMTP conversation with the mail server that receives mail for the address, in which that address is sent to that mail server. Risk analysis includes AI analysis of submitted addresses by Amazon Bedrock, part of Amazon Web Services. DNS lookups of each address's domain are sent through Google Public DNS.

4. Controller obligations

The Controller warrants that:

It has a lawful basis for processing the email addresses submitted
It has provided appropriate notice to Data Subjects
It will not submit sensitive personal data (health, religion, political opinions, etc.)
It will comply with all applicable data protection laws

5. Processor obligations

The Processor agrees to:

Process Personal Data only on documented instructions from the Controller
Ensure personnel are bound by confidentiality obligations
Implement appropriate technical and organizational security measures
Assist the Controller in responding to Data Subject requests
Delete or return Personal Data upon termination
Make available information necessary to demonstrate compliance

6. Security measures

The Processor implements the following security measures:

Encryption in transit with TLS 1.2 or later on every connection to the Processor's website, dashboard, API and status page
Encryption at rest (AES-256) of Personal Data in the Processor's databases, file storage, job queues and results cache
Access controls and authentication
Regular security assessments
Incident response procedures
Employee security training
Physical security of data centers (AWS)

The following traffic is not encrypted: the SMTP conversation with the mail server that receives mail for an address, which carries that address in plain text; and DNS lookups of an address's domain, which carry the domain only. Traffic between the Processor's verification servers and their results cache inside the Processor's private AWS network, which only those servers can reach, is encrypted in transit and needs a password.

7. Sub-processors

The Controller authorizes the following sub-processors:

Amazon Web Services (AWS) - Cloud infrastructure and email delivery (Amazon SES), including Amazon Bedrock for AI analysis of submitted addresses, support chat replies and the AI email composer (US)
Stripe - Payment processing (US)
Cloudflare - Bot protection (Turnstile) on sign-up, sign-in, password reset, free email checker, support chat, newsletter and status subscription forms, which receives the visitor's IP address (US)
Google - Email hosting (Google Workspace) for the Processor's @kawaa.com addresses, which receive support and privacy requests, and DNS resolution (Google Public DNS) of the domain of each submitted address (US)
Slack - The Processor's internal team messaging, which receives support chat messages with the account details described in the privacy policy (US)

The Processor will notify the Controller of any intended changes to sub-processors, allowing reasonable time for objections.

8. International transfers

Personal Data may be transferred to the United States. The Processor relies on Standard Contractual Clauses (SCCs) for such transfers and ensures sub-processors provide equivalent protections.

9. Data subject rights

The Processor will assist the Controller in responding to requests from Data Subjects exercising their rights under GDPR, including access, rectification, erasure, and portability.

10. Data breach notification

The Processor will notify the Controller without undue delay (within 72 hours where feasible) upon becoming aware of a Personal Data breach. Notification will include the nature of the breach, affected data, and remedial measures taken.

11. Audit rights

The Controller may request evidence of compliance with this DPA. The Processor will make available documentation demonstrating that compliance upon reasonable request.

12. Term and termination

This DPA remains in effect for the duration of the service agreement. Upon termination, the Processor will delete all Personal Data from its live systems unless retention is required by law, except audit log entries, which are kept until the end of the Controller's audit log retention period. Email tracking activity recorded by the Controller's tracking (individual opens and clicks, and totals per address and per domain) is deleted with the account. When the Controller asks for its account to be deleted, the Processor emails a link to confirm the request. Once it is confirmed, it can be cancelled for 30 days. After that, the Processor's deletion run, which runs once a day, removes the account's Personal Data from its live systems. For most accounts this takes two runs and is complete about 31 to 32 days after the confirmation. Each run deletes a bounded amount of data, so an account with a large amount of stored data or many white-label sub-accounts takes more runs (an account with 100 sub-accounts takes at least five, about 34 to 35 days after the confirmation), and the runs continue daily until everything other than the records excepted above is deleted.

The Processor's databases are backed up continuously and once a day. Copies of Personal Data in these backups are kept for up to 35 days after the data is deleted from the live systems, whether at termination or at the end of a retention period, and are then deleted automatically.

13. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service.

14. Contact

For DPA-related inquiries, including a request for a countersigned copy, contact us by email at: privacy@kawaa.com

The Processor's postal address is Kawaa, 548 Market St, PMB 214637, San Francisco, CA 94104, United States.