Data Processing Agreement

Last updated: 22 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions (the "Terms") between byte2bit B.V., Korte Lijnbaanssteeg 1 - 4387, 1012 SL Amsterdam, the Netherlands, Chamber of Commerce number 94626251, VAT number NL866841179B01 ("byte2bit", the "Processor"), and the customer that has accepted the Terms (the "Customer", the "Controller").

It applies automatically when the Customer accepts the Terms; no separate signature is needed. If the Customer needs a signed copy, email info@byte2bit.com.

Terms that are not defined here have the meaning given in the Terms or in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Scope and roles

• This DPA applies to personal data that byte2bit processes on behalf of the Customer when providing the Service ("Customer Personal Data"), as described in Annex 1.
• The Customer is the controller and byte2bit is the processor of Customer Personal Data.
• This DPA does not apply to personal data for which byte2bit is itself the controller, such as account, billing and website data about the Customer and its Users. That processing is described in our Privacy Policy.

2. Instructions

• byte2bit processes Customer Personal Data only on the Customer's documented instructions, unless EU or Member State law requires otherwise. In that case byte2bit will inform the Customer of that legal requirement before processing, unless the law prohibits this.
• The Terms, this DPA, and the Customer's configuration and use of the Service (for example which timers, links, subscriber identifiers and integrations it sets up) are the Customer's complete instructions. Further instructions must be agreed in writing.
• byte2bit will tell the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

3. The Customer's obligations

The Customer is responsible for:

• having a valid legal basis for the processing, including any consent that is required for sending emails to Recipients and for measuring how they interact with those emails;
• informing Recipients about the processing, as Articles 13 and 14 GDPR require;
• deciding whether to add subscriber identifiers to timer links, and which ones. The Customer should use a pseudonymous identifier where its email platform allows, rather than an email address. Identifiers in timer links are also seen by the Recipient's email program or image proxy and by the Customer's email platform, which may log them under their own terms; and
• the lawfulness of the Customer Personal Data and of its instructions.

4. Confidentiality

byte2bit ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and processes it only as needed to provide the Service.

5. Security

byte2bit implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as required by Article 32 GDPR. These measures are described in Annex 2. byte2bit may update them, provided the overall level of security is not reduced.

6. Sub-processors

• The Customer gives byte2bit general authorisation to engage sub-processors. The current sub-processors are listed in Annex 3.
• byte2bit will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If byte2bit cannot reasonably address the objection, the Customer may terminate the affected part of the Service before the change takes effect and receive a pro-rata refund of fees paid in advance for the period after termination.
• byte2bit imposes on each sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, and remains liable to the Customer for its sub-processors' performance of those obligations.

7. International transfers

byte2bit transfers Customer Personal Data outside the European Economic Area only if it is protected as Chapter V of the GDPR requires, for example by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified recipients) or by the Standard Contractual Clauses adopted by the European Commission, together with additional measures where needed.

8. Assistance

• Data subject requests. Taking into account the nature of the processing, byte2bit assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. If byte2bit receives such a request directly, it forwards it to the Customer without undue delay and does not respond itself, except to confirm that the request has been forwarded.
• Other assistance. byte2bit assists the Customer, taking into account the information available to it, with its obligations on security, personal data breach notification, data protection impact assessments and prior consultation of supervisory authorities (Articles 32 to 36 GDPR).

9. Personal data breaches

• byte2bit notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
• The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where not all information is available at once, it is provided in stages without undue delay.
• byte2bit takes reasonable steps to contain the breach and limit its consequences. Notifying the supervisory authority and data subjects is the Customer's responsibility as controller, with byte2bit's assistance.

10. Deletion and return

• Customer Personal Data in timer view statistics is deleted automatically after about 3 months.
• Per-Recipient countdown start times are deleted one year after the Recipient's countdown ends, or when the Customer deletes the timer, if sooner. They are kept that long so that a Recipient who opens an old email again sees the offer as ended, rather than a new countdown.
• Per-Recipient A/B test assignments are deleted 90 days after the Recipient is first assigned a variant, or when the Customer deletes the test, if sooner.
• When the Customer deletes its account (which deletes the organization it owns), or the Terms end, byte2bit deletes Customer Personal Data from its live systems, and it is removed from backups within 30 days, unless EU or Member State law requires byte2bit to keep it. Per-Recipient countdown start times and A/B test assignments are deleted with the other Customer Personal Data, in batches: promptly, though for an organization whose timers were opened by a very large number of Recipients their deletion finishes somewhat later. The same applies when the Customer deletes a single timer or A/B test. Before deletion, the Customer can retrieve its view statistics through the Service.

11. Audits and information

• byte2bit makes available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR, and answers reasonable written questions about its processing.
• If that information is not sufficient, the Customer may, at its own cost and no more than once a year (or after a personal data breach, or when a supervisory authority requires it), have an audit performed by an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours, and without disrupting byte2bit's operations or compromising the security or confidentiality of data of other customers.

12. Liability and term

• The limitations of liability in the Terms apply to this DPA, to the extent permitted by law.
• This DPA applies for as long as byte2bit processes Customer Personal Data on behalf of the Customer.
• If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.
• This DPA is governed by Dutch law. The court specified in the Terms has jurisdiction.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

• Encryption: all traffic to the Service uses HTTPS (TLS). Data is encrypted at rest by our hosting provider. Integration credentials are additionally encrypted with AES-GCM under a separate key.
• Minimisation and pseudonymisation: byte2bit stores IP addresses and subscriber identifiers only as one-way hashes. byte2bit's logs and traces of requests for timers and tracked links are set to leave out the query string, the part of a timer link that carries subscriber identifiers and dates, and are kept for up to 7 days. View statistics are kept for about 3 months.
• Access control: access to production systems is limited to the personnel who need it, through individual accounts protected by multi-factor authentication. Customer access within the Service is controlled by roles (owner, admin, member) and is recorded in an audit log.
• Isolation: each request is processed in an isolated environment, and every query for customer data is scoped to the customer's organization.
• Integrity: incoming webhooks are verified by signature, and API access requires revocable tokens.
• Availability and resilience: the Service runs on a globally distributed network with automatic failover. The database has point-in-time recovery for 30 days.
• Abuse prevention: rate limiting, bot filtering and monitoring for abnormal traffic.
• Development: code changes are reviewed and tested before release, and dependencies are kept up to date.
• Incident response: errors and incidents are monitored, and personal data breaches are handled as described in section 9.

Annex 3: Sub-processors