Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Melly Labs ("Processor", "we", "us") and the customer ("Controller", "you") for the use of MellySend services. This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Definitions

• Personal Data means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• Processing means any operation performed on Personal Data, as defined in Article 4(2) GDPR.
• Data Subject means the identified or identifiable natural person to whom the Personal Data relates.
• Sub-processor means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and purpose of processing

The Processor processes Personal Data on behalf of the Controller solely for the purpose of providing the MellySend file transfer and collaboration services. The categories of data processed include:

• Email addresses (for account authentication and transfer notifications)
• IP addresses (for rate limiting and security, not stored long-term)
• File metadata (filenames, sizes, timestamps)
• File content (encrypted at rest, transferred via TLS)
• Billing information (processed by Mollie, not stored by MellySend)

3. Duration

This DPA remains in effect for the duration of the Controller's use of MellySend services. Upon termination, the Processor will delete all Personal Data within 30 days, unless retention is required by law.

4. Obligations of the Processor

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, including transfers to third countries (Article 28(3)(a))
• Ensure that persons authorized to process Personal Data have committed themselves to confidentiality (Article 28(3)(b))
• Implement appropriate technical and organizational measures to ensure security of processing (Article 28(3)(c), Article 32)
• Not engage another processor without prior written authorization of the Controller (Article 28(2))
• Assist the Controller in responding to data subject requests (Article 28(3)(e))
• Assist the Controller in ensuring compliance with Articles 32-36 (security, breach notification, impact assessments)
• Delete or return all Personal Data after the end of services (Article 28(3)(g))
• Make available all information necessary to demonstrate compliance and allow for audits (Article 28(3)(h))

5. Technical and organizational measures

The Processor implements the following security measures:

6. Sub-processors

The Controller authorizes the use of the following sub-processors. The Processor will notify the Controller before adding or replacing sub-processors, giving the Controller the opportunity to object.

All sub-processors are EU-based companies. No Personal Data is transferred outside the European Economic Area.

7. Data breach notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach (Article 33). The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

8. Data subject rights

The Processor shall assist the Controller in fulfilling its obligation to respond to data subject requests under Articles 15-22 GDPR, including the right of access, rectification, erasure, restriction, portability, and the right to object. Users can export their data via the vault download feature and delete their account through the settings page.

9. International transfers

The Processor does not transfer Personal Data outside the European Economic Area. All infrastructure, sub-processors, and data storage are located within the EU (Germany, France, Netherlands). This eliminates the need for Standard Contractual Clauses or other transfer mechanisms under Chapter V GDPR.

10. Audit rights

The Controller has the right to audit the Processor's compliance with this DPA. Audits shall be conducted with reasonable notice and during normal business hours. The Processor shall cooperate with the audit and provide access to relevant documentation, systems, and personnel.

11. Governing law

This DPA shall be governed by and construed in accordance with the laws of the Netherlands. Any disputes arising from this DPA shall be submitted to the competent court in Rotterdam, the Netherlands.

12. Contact

For questions about this DPA or to exercise your rights, contact us at:

• Melly Labs
• Hillevliet 90, 3074KD Rotterdam
• The Netherlands
• Email: privacy@mellysend.com