1. Roles
You are the Data Controller of the personal data you upload to MariMail. MariMail is the Data Processor, acting on your documented instructions as expressed through your use of the product.
2. Scope of processing
- Subject matter: operating the MariMail platform on your behalf.
- Duration: for the lifetime of your subscription, plus 30 days for restore.
- Nature and purpose: storing, matching, enriching, and sending outreach to your business contacts.
- Data categories: business contact details (name, work email, company, role), vessel operational data, campaign and email engagement events.
- Data subjects: your prospects, customers, and the crew/managers listed against vessels you track.
3. Security
MariMail implements the technical and organisational measures described on our Security page. These form Annex II of this DPA.
4. Subprocessors
You authorise MariMail to engage subprocessors to deliver the service — including Vercel (hosting), Neon (database), Upstash (queues), Stripe (billing), Resend/Postmark/SendGrid/SES (email delivery, when connected), and third-party contact enrichment providers (when enabled). A current list of named subprocessors is available on request at [email protected]. We give 30 days’ notice before adding new subprocessors.
5. International transfers
Where MariMail transfers personal data outside the EEA/UK, we rely on the EU Standard Contractual Clauses (2021 module 2 + UK Addendum) as incorporated by reference here.
6. Assistance
We assist you in responding to data subject requests, DPIAs, and regulator inquiries, taking into account the nature of the processing and the information available to us.
7. Breach notification
We notify you without undue delay — and in any event within 72 hours — of any personal data breach that affects your data.
8. Deletion and return
On termination of your subscription, we delete your personal data within 30 days unless retention is required by law. Export via our API or admin panel is available before deletion.
9. Audits
Once per year, on 30 days’ notice, you may request our latest SOC 2 report and subprocessor list. On-site audits are available under NDA for enterprise plans.
10. Signature
Acceptance of the MariMail Terms of Service constitutes acceptance of this DPA. For a countersigned copy, email [email protected].