Data Processing Addendum

This is a summary of how PostVee processes personal data on your behalf. It sits alongside our Terms of Service and Privacy Policy. A full Data Processing Addendum, suitable for signature, is available on request.

1. Roles

For the data you load into a workspace — the domains you add, the DMARC aggregate report data you route to us, and the email-test messages you send — you are the controller and Ctrl Networks (PostVee) is your processor. You decide which domains to add and whose reports to route; we process that data only to provide the service and only on your documented instructions, which include these terms and your use of the product.

For your own account and contact details, and for running the service, Ctrl Networks is the controller — see the Privacy Policy.

2. What we process for you

• Subject matter: email-authentication analysis, monitoring, DMARC report analytics and email testing.
• Categories of data: domain configuration (public DNS), DMARC aggregate report data (third-party sending IP addresses, mail volumes and authentication metadata), and the content and headers of test messages you send in.
• Data subjects: primarily senders and recipients whose mail appears in the reports and test messages you route to us — determined by you.

3. Our obligations as processor

• process the data only on your instructions and for the purposes above;
• keep it confidential and require the same of our staff;
• apply appropriate technical and organisational security measures, including per-workspace isolation — your data is never pooled with or disclosed to other customers;
• engage sub-processors only as listed in the Privacy Policy, under equivalent obligations, and tell you before adding a new one;
• assist you with data-subject requests, security, breach notification and data-protection assessments, so far as the service allows;
• delete or return the data at the end of the service, subject to short backup-rotation windows.

4. International transfers

Processing takes place in the United Kingdom. We will not transfer your data outside the UK without an appropriate safeguard in place and will tell you if that changes.

5. The full DPA

If your organisation needs a signed Data Processing Addendum with the standard clauses in full, request one at phowden@ctrl-networks.com and we will provide it.