chore: Updated terms, privacy and dpa
This commit is contained in:
Dries Augustyns
@@ -128,6 +128,11 @@ export default function Footer() {
|
||||
Terms
|
||||
</Link>
|
||||
</li>
|
||||
<li>
|
||||
<Link href={'/dpa'} className="text-sm text-neutral-600 transition hover:text-neutral-900">
|
||||
DPA
|
||||
</Link>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -0,0 +1,695 @@
|
||||
import {NextSeo} from 'next-seo';
|
||||
import React from 'react';
|
||||
import {Navbar} from '../components';
|
||||
|
||||
export default function DataProcessingAgreement() {
|
||||
return (
|
||||
<>
|
||||
<NextSeo
|
||||
title="Plunk Data Processing Agreement (DPA) | GDPR Compliance"
|
||||
description="Data Processing Agreement for Plunk customers. GDPR-compliant DPA covering data processing activities, sub-processors, security measures, and data subject rights."
|
||||
openGraph={{
|
||||
title: 'Plunk Data Processing Agreement (DPA) | GDPR Compliance',
|
||||
description:
|
||||
'Data Processing Agreement for Plunk customers. GDPR-compliant DPA covering data processing activities, sub-processors, security measures, and data subject rights.',
|
||||
}}
|
||||
additionalMetaTags={[
|
||||
{
|
||||
property: 'title',
|
||||
content: 'Plunk Data Processing Agreement (DPA) | GDPR Compliance',
|
||||
},
|
||||
]}
|
||||
/>
|
||||
|
||||
<div className="min-h-screen bg-white">
|
||||
<div className="px-8 pb-32 sm:px-12 md:px-16 lg:px-20 xl:px-24 2xl:px-56">
|
||||
<Navbar />
|
||||
|
||||
<div className="mx-auto max-w-4xl py-16">
|
||||
{/* Hero */}
|
||||
<div className="mb-12">
|
||||
<h1 className="text-4xl font-bold text-neutral-900">Data Processing Agreement</h1>
|
||||
<p className="mt-2 text-sm text-neutral-600">Last Updated: February 18, 2026</p>
|
||||
<p className="mt-4 text-base leading-relaxed text-neutral-700">
|
||||
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Data
|
||||
Controller") and Plunk ("Processor", "we", "us") and governs the processing of Personal Data in
|
||||
accordance with GDPR requirements.
|
||||
</p>
|
||||
<div className="mt-6 rounded-lg border border-blue-200 bg-blue-50 p-4">
|
||||
<p className="text-sm leading-relaxed text-blue-900">
|
||||
<strong className="font-semibold">GDPR Requirement:</strong> This DPA is required under Article 28 of
|
||||
the GDPR. By using Plunk's hosted service, you accept and agree to the terms of this DPA.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Table of Contents */}
|
||||
<nav className="mb-12 rounded-lg border border-neutral-200 bg-neutral-50 p-6">
|
||||
<h2 className="mb-4 text-lg font-semibold text-neutral-900">Contents</h2>
|
||||
<ol className="space-y-2 text-sm text-neutral-700">
|
||||
<li>
|
||||
<a href="#definitions" className="text-blue-600 hover:underline">
|
||||
1. Definitions
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#scope" className="text-blue-600 hover:underline">
|
||||
2. Scope & Applicability
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#processing-details" className="text-blue-600 hover:underline">
|
||||
3. Processing Details
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#obligations" className="text-blue-600 hover:underline">
|
||||
4. Data Processor Obligations
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#security" className="text-blue-600 hover:underline">
|
||||
5. Security Measures
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#sub-processors" className="text-blue-600 hover:underline">
|
||||
6. Sub-Processors
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#data-subject-rights" className="text-blue-600 hover:underline">
|
||||
7. Data Subject Rights
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#data-breach" className="text-blue-600 hover:underline">
|
||||
8. Data Breach Notification
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#international-transfers" className="text-blue-600 hover:underline">
|
||||
9. International Data Transfers
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#audits" className="text-blue-600 hover:underline">
|
||||
10. Audits & Compliance
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#deletion" className="text-blue-600 hover:underline">
|
||||
11. Data Deletion & Return
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#liability" className="text-blue-600 hover:underline">
|
||||
12. Liability & Indemnification
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#term" className="text-blue-600 hover:underline">
|
||||
13. Term & Termination
|
||||
</a>
|
||||
</li>
|
||||
</ol>
|
||||
</nav>
|
||||
|
||||
{/* Content Sections */}
|
||||
<div className="space-y-12">
|
||||
{/* Section 1 */}
|
||||
<section id="definitions" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">1. Definitions</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Terms used in this DPA have the meanings set forth in the GDPR. Specifically:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"Personal Data"</strong> means any information
|
||||
relating to an identified or identifiable natural person processed via Plunk
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"Data Controller"</strong> means the Customer who
|
||||
determines the purposes and means of processing Personal Data
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"Data Processor"</strong> means Plunk, which
|
||||
processes Personal Data on behalf of the Data Controller
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"Sub-processor"</strong> means any third party
|
||||
engaged by Plunk to process Personal Data
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"Data Subject"</strong> means the individuals
|
||||
whose Personal Data is processed (your contacts/subscribers)
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">"GDPR"</strong> means Regulation (EU) 2016/679
|
||||
(General Data Protection Regulation)
|
||||
</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 2 */}
|
||||
<section id="scope" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">2. Scope & Applicability</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Hosted Service Only</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
This DPA applies ONLY to customers using Plunk's hosted service (useplunk.com). Self-hosted
|
||||
deployments are NOT covered by this DPA - you are solely responsible for GDPR compliance when
|
||||
self-hosting.
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Agreement Hierarchy</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
This DPA supplements the Plunk Terms of Service and Privacy Policy. In case of conflict regarding data
|
||||
processing:
|
||||
</p>
|
||||
<ol className="mb-4 ml-6 list-decimal space-y-2 text-neutral-700">
|
||||
<li>This DPA takes precedence</li>
|
||||
<li>Then the Terms of Service</li>
|
||||
<li>Then the Privacy Policy</li>
|
||||
</ol>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Acceptance</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
By using Plunk's hosted service, you acknowledge that you have read, understood, and agree to be bound
|
||||
by this DPA. This constitutes a legally binding agreement between Customer and Plunk.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Section 3 */}
|
||||
<section id="processing-details" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">3. Processing Details</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
As required by GDPR Article 28(3), the following details describe the processing activities:
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Subject Matter</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Processing of Personal Data necessary to provide email automation, transactional email, marketing
|
||||
campaigns, and workflow automation services.
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Duration</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Processing occurs for the duration of your Plunk subscription/account, plus 30 days for API logs
|
||||
(which are automatically deleted), and until you request account deletion.
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Nature & Purpose</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Storing and managing contact databases</li>
|
||||
<li>Sending transactional, marketing, and workflow-triggered emails</li>
|
||||
<li>Tracking email delivery, opens, clicks, bounces, and complaints (per your settings)</li>
|
||||
<li>Managing email templates and automation workflows</li>
|
||||
<li>Processing email events and webhooks</li>
|
||||
<li>Providing analytics and reporting</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Type of Personal Data</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Email addresses (required)</li>
|
||||
<li>Names and custom contact fields (optional, Customer-defined)</li>
|
||||
<li>Email content (subject lines, message bodies, attachments)</li>
|
||||
<li>Subscription status and preferences</li>
|
||||
<li>Email activity data (opens, clicks, bounces, complaints)</li>
|
||||
<li>Timestamps and metadata</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Categories of Data Subjects</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Customer's email subscribers and contacts</li>
|
||||
<li>Recipients of transactional emails</li>
|
||||
<li>Marketing campaign recipients</li>
|
||||
<li>Workflow automation recipients</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 4 */}
|
||||
<section id="obligations" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">4. Data Processor Obligations</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Plunk commits to the following obligations as Data Processor:
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Processing Instructions</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
Process Personal Data only on documented instructions from Customer (via API, dashboard, etc.)
|
||||
</li>
|
||||
<li>Not process Personal Data for any other purpose without Customer's prior written consent</li>
|
||||
<li>Immediately inform Customer if instructions violate GDPR or other EU data protection laws</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Confidentiality</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Ensure persons authorized to process Personal Data are bound by confidentiality obligations</li>
|
||||
<li>Maintain confidentiality of all Personal Data processed via Plunk</li>
|
||||
<li>
|
||||
Not disclose Personal Data to third parties except as required by law or with Customer consent
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Cooperation</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Assist Customer in responding to Data Subject rights requests (see Section 7)</li>
|
||||
<li>
|
||||
Assist Customer in ensuring compliance with GDPR security, breach notification, and impact
|
||||
assessment obligations
|
||||
</li>
|
||||
<li>Provide information necessary to demonstrate compliance with Article 28</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 5 */}
|
||||
<section id="security" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">5. Security Measures</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
As required by GDPR Article 32, Plunk implements appropriate technical and organizational measures to
|
||||
ensure a level of security appropriate to the risk:
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Technical Safeguards</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Industry-standard password hashing (never stored in plaintext)</li>
|
||||
<li>HTTPS-only API access (TLS 1.2+)</li>
|
||||
<li>Database connections encrypted via TLS/SSL</li>
|
||||
<li>HttpOnly, secure cookies with appropriate SameSite settings</li>
|
||||
<li>Authentication tokens with limited expiration periods</li>
|
||||
<li>Rate limiting to prevent brute force attacks</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Organizational Safeguards</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Access controls limiting personnel access to Personal Data</li>
|
||||
<li>Automated bounce and complaint rate monitoring</li>
|
||||
<li>Regular security updates and patching</li>
|
||||
<li>Data segregation by project (multi-tenancy with isolation)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Data Residency</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Primary data storage: EU/EEA (Hetzner infrastructure)</li>
|
||||
<li>Database and file storage remain within EU/EEA</li>
|
||||
<li>Email delivery may transit non-EU regions (see Section 9)</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 6 */}
|
||||
<section id="sub-processors" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">6. Sub-Processors</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Customer authorizes Plunk to engage the following sub-processors to process Personal Data:
|
||||
</p>
|
||||
|
||||
<div className="mb-6 overflow-x-auto">
|
||||
<table className="min-w-full border border-neutral-300">
|
||||
<thead className="bg-neutral-50">
|
||||
<tr>
|
||||
<th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
|
||||
Sub-Processor
|
||||
</th>
|
||||
<th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
|
||||
Service
|
||||
</th>
|
||||
<th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
|
||||
Location
|
||||
</th>
|
||||
<th className="border border-neutral-300 px-4 py-2 text-left text-sm font-semibold text-neutral-900">
|
||||
Purpose
|
||||
</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="bg-white">
|
||||
<tr>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Amazon Web Services (AWS SES)
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">Email Delivery</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Global (data in transit only)
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Sending emails to recipients
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">Stripe, Inc.</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Payment Processing
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
USA (PCI-DSS compliant)
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Billing for paid accounts
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Hetzner Online GmbH
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Infrastructure Hosting
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
EU/EEA (Germany)
|
||||
</td>
|
||||
<td className="border border-neutral-300 px-4 py-2 text-sm text-neutral-700">
|
||||
Database and application hosting
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Sub-Processor Obligations</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>All sub-processors are bound by data protection obligations equivalent to this DPA</li>
|
||||
<li>Plunk remains fully liable to Customer for sub-processor performance</li>
|
||||
<li>Sub-processors have executed Data Processing Agreements with Plunk</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Changes to Sub-Processors</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Plunk will provide 30 days advance notice of new or replacement sub-processors via email</li>
|
||||
<li>Notice will be sent to the email address associated with your account</li>
|
||||
<li>
|
||||
If you object on reasonable grounds related to data protection, you may terminate your account
|
||||
within 30 days
|
||||
</li>
|
||||
<li>Updated sub-processor list will be maintained on this page (check "Last Updated" date)</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 7 */}
|
||||
<section id="data-subject-rights" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">7. Data Subject Rights</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Plunk will assist Customer in fulfilling Data Subject rights requests under GDPR Articles 15-22:
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Self-Service via API</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Customer can fulfill most Data Subject requests independently via API:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">Access (Art. 15):</strong> Retrieve contact data
|
||||
via GET /contacts/:id
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">Rectification (Art. 16):</strong> Update contact
|
||||
data via PATCH /contacts/:id
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">Erasure (Art. 17):</strong> Delete contact via
|
||||
DELETE /contacts/:id
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">Restriction (Art. 18):</strong> Update
|
||||
subscription status to "unsubscribed"
|
||||
</li>
|
||||
<li>
|
||||
<strong className="font-semibold text-neutral-900">Portability (Art. 20):</strong> Use API to access
|
||||
data in JSON format
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Assistance from Plunk</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
If Customer cannot fulfill a request via API, contact legal@useplunk.com:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Provide Data Subject's email address and nature of request</li>
|
||||
<li>Plunk will respond within 10 business days with requested information or assistance</li>
|
||||
<li>
|
||||
Customer remains responsible for verifying Data Subject identity before disclosing information
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Email Activity Data</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Email opens, clicks, bounces, and complaints are linked to contact records</li>
|
||||
<li>Deleting a contact will cascade delete associated email activity</li>
|
||||
<li>API logs (non-Personal Data) are automatically deleted after 30 days</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 8 */}
|
||||
<section id="data-breach" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">8. Data Breach Notification</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Notification Obligation</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
In the event of a Personal Data breach affecting Customer data, Plunk will:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
Notify Customer without undue delay and within 72 hours of becoming aware of the breach (per GDPR
|
||||
Art. 33)
|
||||
</li>
|
||||
<li>Send notification to the primary email address associated with Customer's account</li>
|
||||
<li>Provide information to enable Customer to meet any GDPR breach reporting obligations</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Breach Information</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Notifications will include (to the extent known):
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Nature of the breach (what happened)</li>
|
||||
<li>Categories and approximate number of Data Subjects affected</li>
|
||||
<li>Categories and approximate number of Personal Data records affected</li>
|
||||
<li>Likely consequences of the breach</li>
|
||||
<li>Measures taken or proposed to address the breach and mitigate harm</li>
|
||||
<li>Contact point for more information (legal@useplunk.com)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Customer Responsibility</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Customer is responsible for notifying their supervisory authority if required by GDPR Art. 33</li>
|
||||
<li>Customer is responsible for notifying affected Data Subjects if required by GDPR Art. 34</li>
|
||||
<li>Plunk's breach notification to Customer does NOT constitute legal or compliance advice</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Section 9 */}
|
||||
<section id="international-transfers" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">9. International Data Transfers</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Primary Storage (EU/EEA)</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>All contact data, templates, workflows, and account data stored in EU/EEA (Hetzner, Germany)</li>
|
||||
<li>No routine transfers of stored Personal Data outside EU/EEA</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Data in Transit (Email Delivery)</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
When emails are sent to recipients, Personal Data may transit through non-EU regions:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>AWS SES processes emails globally for delivery purposes</li>
|
||||
<li>Data is in transit only (not stored long-term outside EU/EEA)</li>
|
||||
<li>Protected by AWS Data Processing Agreement and Standard Contractual Clauses (SCCs)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Payment Data (Stripe)</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Payment information (credit cards) processed by Stripe (USA-based)</li>
|
||||
<li>Stripe is PCI-DSS Level 1 certified</li>
|
||||
<li>Protected by Stripe's Data Processing Agreement and Standard Contractual Clauses</li>
|
||||
<li>Plunk does NOT store credit card numbers (tokenized by Stripe)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Standard Contractual Clauses</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
All sub-processors that process Personal Data outside EU/EEA have executed Standard Contractual
|
||||
Clauses (SCCs) approved by the European Commission, providing appropriate safeguards for international
|
||||
transfers per GDPR Article 46.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Section 10 */}
|
||||
<section id="audits" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">10. Audits & Compliance</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Information Provision</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Plunk will make available to Customer information necessary to demonstrate compliance with GDPR
|
||||
Article 28 obligations, including:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>This DPA (publicly available)</li>
|
||||
<li>Privacy Policy describing processing activities</li>
|
||||
<li>Sub-processor list (Section 6 above)</li>
|
||||
<li>Security measures documentation (available upon reasonable request)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Audit Rights</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Customer may audit Plunk's compliance with this DPA, subject to the following:
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Audits limited to once per year unless required by supervisory authority</li>
|
||||
<li>Request must be submitted in writing to legal@useplunk.com with 30 days notice</li>
|
||||
<li>Audits must be conducted by independent third-party auditors bound by confidentiality</li>
|
||||
<li>Audits conducted during business hours with minimal disruption to operations</li>
|
||||
<li>Customer bears all costs of audit</li>
|
||||
<li>Audit scope limited to GDPR compliance (not general security assessments)</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Alternative to Audits</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
In lieu of conducting a full audit, Customer may request and review sub-processor certifications and
|
||||
compliance documentation (SOC 2, ISO 27001, etc.) where available.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Section 11 */}
|
||||
<section id="deletion" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">11. Data Deletion & Return</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Account Deletion</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
When Customer deletes their Plunk account (via dashboard or by request):
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>All Personal Data is immediately deleted from production systems</li>
|
||||
<li>No grace period or recovery window (deletion is permanent)</li>
|
||||
<li>
|
||||
Customer should access or backup data via API before deletion (Plunk does NOT provide data export)
|
||||
</li>
|
||||
<li>Deletion includes: contacts, emails, templates, workflows, campaigns, and email activity</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Backup Retention</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Deleted data may remain in encrypted backups for up to 30 days for disaster recovery purposes</li>
|
||||
<li>Backup data is not accessible or restorable after account deletion</li>
|
||||
<li>Backups are automatically overwritten after retention period</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Legal Retention</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Plunk may retain certain data if required by law (e.g., accounting records, fraud prevention):
|
||||
</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Billing records: Retained per tax/accounting laws (typically 7 years)</li>
|
||||
<li>Fraud/abuse records: Retained for security purposes (email addresses of suspended accounts)</li>
|
||||
<li>Legal requests: Data subject to legal holds retained as required by law</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">No Data Return</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Plunk does NOT provide data export or return upon termination. Customer must retrieve data via API
|
||||
before deleting account. Once deleted, data cannot be recovered.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Section 12 */}
|
||||
<section id="liability" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">12. Liability & Indemnification</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Customer Responsibilities</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">Customer (Data Controller) is responsible for:</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
Ensuring lawful basis for processing under GDPR (consent, contract, legitimate interest, etc.)
|
||||
</li>
|
||||
<li>Obtaining necessary consents from Data Subjects before adding them to Plunk</li>
|
||||
<li>Providing privacy notices to Data Subjects per GDPR Article 13/14</li>
|
||||
<li>Complying with anti-spam laws (CAN-SPAM, CASL, GDPR, etc.)</li>
|
||||
<li>Verifying Data Subject identity before fulfilling rights requests</li>
|
||||
<li>Notifying supervisory authorities and Data Subjects of breaches where required</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Plunk's Liability</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Plunk is liable to Customer for compliance with this DPA and GDPR Article 28 obligations</li>
|
||||
<li>Plunk is liable for sub-processor acts/omissions to the same extent as its own acts</li>
|
||||
<li>
|
||||
Liability limitations in Terms of Service apply, except where prohibited by GDPR (particularly Art.
|
||||
82)
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Indemnification</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>
|
||||
Customer indemnifies Plunk for claims arising from Customer's violation of GDPR or data protection
|
||||
laws
|
||||
</li>
|
||||
<li>
|
||||
Plunk indemnifies Customer for claims arising solely from Plunk's breach of this DPA or GDPR Article
|
||||
28
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">GDPR Fines</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Under GDPR Article 82(3), liability for damages is allocated between Controller and Processor based on
|
||||
fault. Each party is liable only for the damage caused by its own GDPR violation.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Section 13 */}
|
||||
<section id="term" className="mb-12">
|
||||
<h2 className="mb-4 text-2xl font-bold text-neutral-900">13. Term & Termination</h2>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Effective Date</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
This DPA is effective as of the date you first use Plunk's hosted service and remains in effect for
|
||||
the duration of the Terms of Service.
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Termination</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">This DPA terminates automatically when:</p>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Customer deletes their Plunk account</li>
|
||||
<li>Terms of Service are terminated</li>
|
||||
<li>All Personal Data has been deleted per Section 11</li>
|
||||
</ul>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">Survival</h3>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
Obligations regarding confidentiality, data deletion, and liability survive termination to the extent
|
||||
necessary to fulfill their purpose.
|
||||
</p>
|
||||
|
||||
<h3 className="mb-3 mt-6 text-xl font-semibold text-neutral-900">DPA Updates</h3>
|
||||
<ul className="mb-4 ml-6 list-disc space-y-2 text-neutral-700">
|
||||
<li>Plunk may update this DPA to reflect changes in law, sub-processors, or processing activities</li>
|
||||
<li>Material changes will be notified via email 30 days in advance</li>
|
||||
<li>Continued use of Plunk after changes constitutes acceptance</li>
|
||||
<li>Check "Last Updated" date at top of page for version tracking</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
{/* Contact Section */}
|
||||
<section className="mb-12 rounded-lg border border-neutral-200 bg-neutral-50 p-6">
|
||||
<h2 className="mb-4 text-xl font-semibold text-neutral-900">Questions or Requests?</h2>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
For questions about this DPA, data processing activities, or to exercise audit rights:
|
||||
</p>
|
||||
<p className="mb-2 leading-relaxed text-neutral-700">
|
||||
<strong className="font-semibold text-neutral-900">Email:</strong> legal@useplunk.com
|
||||
</p>
|
||||
<p className="mb-4 leading-relaxed text-neutral-700">
|
||||
<strong className="font-semibold text-neutral-900">Response Time:</strong> Within 10 business days
|
||||
</p>
|
||||
<p className="text-sm text-neutral-600">
|
||||
For Data Subject rights requests, Customers should use the API (see Section 7) or contact
|
||||
legal@useplunk.com with Data Subject's email address and nature of request.
|
||||
</p>
|
||||
</section>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</>
|
||||
);
|
||||
}
|
||||
+1148
-8766
File diff suppressed because it is too large
Load Diff
+680
-4090
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user