Data Processing Addendum

Last updated June 2026

Draft template. This text is a starting point and must be reviewed and finalized by legal counsel, and this notice removed, before it is relied on.

This Data Processing Addendum ("DPA") forms part of the agreement between MessagePipe, Inc. ("Processor") and the customer ("Controller") for the MessagePipe Service. It governs the processing of personal data that the Controller submits through the Service.

Roles and scope

The Controller determines the purposes and means of processing the personal data it submits. MessagePipe processes that data only on the Controller's documented instructions, to provide and support the Service, and as permitted by law.

Subject matter and duration

Processing covers the recipients, message content, and metadata the Controller sends, for the duration of the agreement and any retention period agreed in writing.

Sub-processors

The Controller authorizes MessagePipe to engage sub-processors (such as hosting, payment, and the message providers the Controller selects) to deliver the Service. We impose data protection terms on sub-processors consistent with this DPA and remain responsible for their performance.

Security

MessagePipe maintains technical and organizational measures appropriate to the risk, including encryption of credentials, access controls, and tenant isolation. See our Security overview.

Data subject requests

MessagePipe will assist the Controller, taking into account the nature of processing, in responding to requests from data subjects to exercise their rights, to the extent the Controller cannot do so through the Service.

Breach notification

MessagePipe will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provide information reasonably available to support the Controller's obligations.

International transfers

Where personal data is transferred across borders, the parties will rely on a lawful transfer mechanism, such as standard contractual clauses, as applicable.

Deletion

On termination, MessagePipe will delete or return the Controller's personal data as agreed, except where retention is required by law.