Data processing agreement

This agreement forms part of Secuenza’s terms of sale and licence and is accepted together with them. It governs the processing that Tude carries out, on the customer’s behalf, of the data of the recipients of their emails, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Parties

• Controller: the customer who uses Secuenza and decides whom they write to and why.
• Processor: TUDE CONSULTORES INFORMÁTICOS, S.L. (“Tude”), Tax ID B71466502, Avda. Zaragoza, 67 · 31500 Tudela (Navarre), Spain.

2. What Tude processes and why

The customer’s contacts and emails are on their PC: Tude does not receive them. So that the customer knows what happens to their emails, the program adds to each one an open pixel, links and an unsubscribe link pointing to Tude’s tracking service (secuenza.eu). On the customer’s behalf, Tude:

• records opens, clicks and unsubscribes, and delivers them to the customer’s program;
• serves the version of each email to “view it in the browser”;
• serves the unsubscribe page with the customer’s name, logo and colour;
• receives the sign-ups that arrive through the form on the customer’s website or from their system through the API, and keeps them until the customer’s program collects them;
• stores and serves the images the customer uploads for their emails;
• keeps a backup of the fingerprints of unsubscribed addresses, so that the customer does not lose their suppression list;
• if the customer sends them from Help, processes the program’s diagnostics to provide support.

Tude does not store recipients’ email addresses. Each event is linked to a random code that only the customer’s program can relate to a contact. The only exception is sign-ups: the details of people who sign up are kept only in transit, until the customer’s program collects them.

3. Data subjects and data

• Data subjects: the recipients of the customer’s emails, and the people who sign up to their campaigns through a form or the API.
• Data: the code of the send; the type of event and its date; whether the open was automatic (as some email providers do); the type of device (mobile or computer); the link clicked; the reason for unsubscribing, if the recipient gives one; the fingerprints (SHA-256) of unsubscribed addresses; and the content of the emails for “view in browser”, in their general version, without each recipient’s details. In diagnostics, the program’s log entries, with email addresses masked. For sign-ups, the details given by the person signing up or sent by the customer’s system (the email address, name and other contact details), the form’s page without its parameters, whether they agreed to receive the emails, and the date.
• The IP addresses and browsers of recipients and of people who sign up are not stored.
• No special categories of data are processed. The customer must not include them in their emails.

4. Duration

• Events: until the customer’s program collects them, and 90 days at most.
• Unsubscribes, for abuse control: the email’s code, the date and whether the reason was “I don’t remember signing up”, 90 days.
• Browser versions: for as long as the email is part of one of the customer’s campaigns.
• Unsubscribe fingerprints: for as long as the installation exists.
• Diagnostics: 30 days.
• Sign-ups: until the customer’s program collects them, and 30 days at most.
• Email images: until the customer deletes them or the relationship ends.

When the relationship ends, Tude deletes within 30 days whatever it keeps on the customer’s behalf, unless the law requires it to be kept. At the customer’s request, Tude will certify the deletion.

5. Tude’s obligations

Tude undertakes to:

• process the data only for what is described in this agreement and according to the customer’s instructions, which take the form of the use of the program; if an instruction seems to it to breach the GDPR, it will tell the customer;
• ensure that the persons authorised to process the data have committed themselves to confidentiality;
• apply the security measures in section 8;
• not engage other processors without the customer’s authorisation, as set out in section 7;
• help the customer respond to data subjects’ requests (section 10) and meet their obligations on security, breach notification and impact assessment;
• delete the data at the end, as set out in section 4;
• make available to the customer the information needed to demonstrate compliance, and allow audits with 30 days’ notice. The cost of the audit is borne by the customer, unless it reveals a serious breach by Tude.

6. The customer’s obligations

The customer undertakes to:

• have a legal basis to write to each recipient and to track their emails;
• inform their recipients of the processing, in accordance with Articles 13 and 14 GDPR;
• respect unsubscribes and not write again to anyone who has unsubscribed;
• not include special categories of data in their emails;
• comply with the acceptable use policy.

7. Other processors (sub-processors)

The customer authorises Tude to use the sub-processors listed in the annex. Tude will give 30 days’ notice of any change, and the customer may object within 15 days; if this is not resolved, they may cancel their subscription without penalty. Tude will impose on each sub-processor the same obligations as this agreement and will be liable for their compliance.

8. Security measures

• Encrypted connections (HTTPS) on all services.
• No recipient addresses on the server: random codes and cryptographic fingerprints. Sign-ups only until the customer’s program collects them.
• Signed tracking links, so that nobody can use them to redirect elsewhere.
• Program requests signed with a key unique to each installation.
• Restricted access to the database, and mandatory two-factor authentication for administration.
• Technical logs without personal data, deleted after 14 days.
• Suspension of installations that abuse the service, to protect all customers.

Tude will review these measures when the risks or the state of the art change.

9. Security breaches

Tude will notify the customer without undue delay, and within 48 hours at most of becoming aware of it, of any security breach affecting this data. It will tell them what happened, which data and data subjects are affected, the possible consequences and what has been done to remedy it, and will help them notify the supervisory authority where necessary.

10. Data subjects’ rights

The unsubscribe link in each email always works, even if the customer’s installation is suspended. If a recipient contacts Tude to exercise other rights, Tude will inform the customer within 48 hours at most and will not reply directly, unless the customer asks it to.

11. International transfers

The data is processed in the European Union. Tude will not transfer it outside the European Economic Area without the customer’s authorisation and without the safeguards required by the GDPR.

12. Term

This agreement remains in force for as long as the customer uses Secuenza and for as long as Tude keeps data on their behalf.

13. Contact

For any question about this agreement: info@secuenza.com.

Annex · Sub-processors

Sub-processor	What it does	Data	Where
MonsterASP.NET (Prague, Czech Republic)	Hosting of the tracking service, the program’s services and the database	All those described in section 3	European Union

Language

This text is a translation. In the event of any discrepancy, the Spanish version prevails.