Skip to content
SendOps
Sign inStart free

Legal

Data Processing Addendum

Effective September 2, 2026

SendOps is a software product operated by AltaCoda LLC (“AltaCoda”), a Delaware limited liability company with its principal place of business at 1111 Broadway, Oakland, CA 94607. This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions (“Agreement”) between AltaCoda (“AltaCoda,” “we,” “us,” or “our”) and the entity agreeing to the Agreement (“Customer,” “you,” or “your”), collectively referred to as the “Parties.”

This DPA applies to the extent that we process Personal Data on behalf of you or a Client for whom you are authorized to act in connection with the SendOps platform (the “Service”), as described in the Agreement. It does not govern partner-application, referral, commission, billing, or relationship-management data for which AltaCoda acts as controller; that processing is described in the Privacy Policy.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given to them in the Agreement. In addition:

“Applicable Data Protection Law” means all applicable laws and regulations relating to the processing of Personal Data, including (a) the General Data Protection Regulation (EU) 2016/679 (“GDPR”); (b) the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”); (c) the Swiss Federal Act on Data Protection (“FADP”); (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”); and (e) any other applicable data protection or privacy legislation, in each case as amended, superseded, or replaced from time to time.

“Client” means a third party for whom the Customer is authorized to configure, administer, or use the Service as part of a managed service or consulting engagement.

“Controller” means the entity that determines the purposes and means of the processing of Personal Data, as defined under Applicable Data Protection Law. Depending on the workspace, the Controller is either the Customer or the Customer’s Client.

“Customer Processor” means the Customer when it processes Personal Data on behalf of a Client as that Client’s processor, service provider, or equivalent regulated role.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“EEA” means the European Economic Area.

“Personal Data” means any information relating to a Data Subject that is processed by AltaCoda on behalf of the Controller, directly or through a Customer Processor, in connection with the Service, as further described in Annex 1.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

“Processor” means AltaCoda LLC when it processes Personal Data directly on behalf of a Customer that is the Controller.

“Processing” (and “process,” “processed”) means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to processors established in third countries, as set out in Commission Implementing Decision (EU) 2021/914, or any successor clauses adopted by the European Commission.

“Sub-Processor” means AltaCoda when the Customer is a Customer Processor and appoints AltaCoda to process Personal Data on behalf of a Client. Where context requires, “Processor” in this DPA includes AltaCoda acting as a Sub-Processor.

“Further Sub-Processor” means a third party engaged by AltaCoda to process Personal Data on behalf of a Controller in connection with the Service.

“Supervisory Authority” means an independent public authority responsible for monitoring the application of Applicable Data Protection Law.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018, as may be revised from time to time.

2. Scope and Applicability

2.1 Scope

This DPA applies to AltaCoda’s Processing of Personal Data on behalf of the Controller, directly or through a Customer Processor, in connection with the Service.

2.2 Nature of the Service

The Parties acknowledge that the Service is an email operations and marketing platform that runs on an Amazon SES account owned by the Customer or a Client and administered under the account owner’s authority. Email transmission occurs through Amazon SES within that AWS account; AltaCoda does not relay or transmit email through sending infrastructure of its own.

The Service stores and processes contact and audience data that the Customer or Controller uploads, imports, synchronizes, or submits, together with Recipient-level event, engagement, and campaign data. Where the Customer or Controller authors broadcasts or workflow messages in the Service, the Service also processes the content of those messages and the resolved recipient set. Messages sent directly through Amazon SES by the AWS Account owner’s application do not pass through the Service, and their content is not processed under this DPA.

Recipient email addresses are stored in plaintext within the Service’s searchable event store, scoped to the applicable workspace, and in irreversible hashed form for analytics and aggregate reporting. The full inventory of categories processed is set out in Annex 1.

2.3 Roles

For an ordinary or Client-billed workspace, the Customer is the Controller and AltaCoda is the Processor. AltaCoda processes Personal Data solely on behalf of the Customer and in accordance with the Customer’s documented instructions in the Agreement, this DPA, and the Customer’s use and configuration of the Service.

For a partner-billed managed workspace, the Client is the Controller, the Customer is a Customer Processor, and AltaCoda is the Customer’s Sub-Processor. The Customer appoints AltaCoda on behalf of the Client and represents and warrants that: (a) the Client has authorized the Customer to appoint AltaCoda; (b) the Customer’s instructions to AltaCoda reflect the Client’s documented instructions; (c) the Customer has disclosed the identity and processing role of AltaCoda to the Client where required; and (d) the Customer will make this DPA and AltaCoda’s sub-processor information available to the Client as required by Applicable Data Protection Law.

The Customer shall identify the applicable Client and managed workspace in the partner schedule, order form, Service record, or other written notice reasonably requested by AltaCoda. AltaCoda may rely on the Customer as the authorized point of contact for Client instructions, requests, authorizations, objections, and notices unless the Parties agree otherwise in writing.

2.4 Precedence

In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

3. Customer and Controller Obligations

3.1 Compliance

The Customer shall comply with its obligations under Applicable Data Protection Law. Where the Customer is the Controller, it shall ensure that it has a lawful basis for the Processing and for instructing AltaCoda. Where the Customer is a Customer Processor, it shall process only on the Client’s documented instructions, ensure that the Client has a lawful basis, and maintain authority to instruct and appoint AltaCoda throughout the managed engagement.

3.2 Instructions

Instructions regarding the Processing of Personal Data are set forth in the Agreement, this DPA, and the Customer’s use and configuration of the Service. Where the Customer is a Customer Processor, those instructions must be consistent with the Client’s documented instructions. The Customer may issue additional written instructions consistent with the Agreement; instructions outside the Agreement require a separate written agreement between the Parties.

3.3 Data Subject Communications

The Controller is responsible for responding to requests from Data Subjects and Supervisory Authorities regarding the Processing of Personal Data. Where the Customer is a Customer Processor, the Customer shall promptly relay requests and AltaCoda’s assistance to the Client. AltaCoda is not required to communicate directly with a Client unless required by law or agreed in writing.

4. Processor Obligations

4.1 Processing Instructions

The Processor shall process Personal Data only in accordance with the Controller’s documented instructions, except where required to do so by applicable law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law from doing so.

4.2 Confidentiality

The Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

4.3 Security

The Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage, as further described in Annex 2. These measures shall take into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risks to Data Subjects.

4.4 Sub-Processing

The Processor shall not engage a Further Sub-Processor without the prior general written authorization of the Controller, which the Customer confirms has been granted subject to the conditions set out in Section 5 of this DPA.

4.5 Data Subject Rights

Taking into account the nature of the Processing, the Processor shall assist the Controller, by appropriate technical and organizational measures and insofar as possible, in fulfilling the Controller’s obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law. Such assistance may include providing access to, rectification of, or deletion of Personal Data, to the extent such data is within the Processor’s systems. The Service provides self-service tools for the common cases: contact search and export, contact deletion, attribute correction, and the hosted unsubscribe page.

Where a Recipient contacts the Processor directly to exercise a right in respect of Personal Data, the Processor shall not act on the request unilaterally. The Processor shall, where it can identify the relevant workspace, refer the Data Subject to the Customer and notify the Customer without undue delay so that the Customer or Client may respond.

4.6 Assistance with Compliance

The Processor shall assist the Controller in ensuring compliance with its obligations under Applicable Data Protection Law with respect to security, breach notification, data protection impact assessments, and prior consultation with Supervisory Authorities, taking into account the nature of the Processing and the information available to the Processor.

4.7 Deletion and Return

Upon termination of the Agreement or an affected managed engagement, the Processor shall, at the Controller’s election communicated through the Customer, delete or return all Personal Data and delete existing copies, unless applicable law requires retention. The Customer may request return or deletion by contacting the Processor at hello@altacoda.io. If the Customer does not make an election within thirty (30) days of termination, the Processor shall delete the Personal Data in accordance with its standard data deletion procedures.

4.8 Audit

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or a third-party auditor mandated by the Controller (provided such auditor is not a competitor of the Processor and is bound by appropriate confidentiality obligations).

Audits shall be subject to the following conditions:

  • The Controller shall provide at least thirty (30) days’ prior written notice of an audit request.
  • Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor’s operations.
  • The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by the Processor.
  • Audits shall be limited to once per twelve (12) month period, unless required by a Supervisory Authority or following a Personal Data Breach.
  • Where the Processor can demonstrate compliance through an independent third-party audit report or certification (such as SOC 2 or ISO 27001), the Processor may provide such report in lieu of an on-site audit, provided the Controller has no reasonable objection.

5. Further Sub-Processors

5.1 Authorized Further Sub-Processors

The Customer provides, and where acting as a Customer Processor confirms it has obtained from the Client, general written authorization for the Processor to engage Further Sub-Processors to assist in providing the Service. A current list is maintained at sendops.dev/subprocessors.

5.2 Obligations

The Processor shall impose on each Further Sub-Processor, by way of a written contract, data protection obligations that are no less protective than those set out in this DPA. The Processor shall remain fully liable to the Controller for the acts and omissions of its Further Sub-Processors.

5.3 Changes to Further Sub-Processors

The Processor shall notify the Customer at least thirty (30) days in advance of any intended addition or replacement of a Further Sub-Processor, including its name, location, and purpose. Notification will be provided by email to the address associated with the Customer’s Account or through the Service. A Customer Processor is responsible for relaying that notice to the Client where required.

5.4 Objections

The Customer may object, on its own behalf or on behalf of a Client, to a new or replacement Further Sub-Processor by providing written notice to the Processor within fifteen (15) days of receiving notification. The objection must state reasonable grounds related to data protection. Upon receipt of an objection, the Processor shall use commercially reasonable efforts to:

  • Make available to the Customer or Controller a change in the Service or recommend a commercially reasonable change to avoid Processing by the objected-to Further Sub-Processor; or
  • Cease use of the objected-to Further Sub-Processor with respect to the Controller’s Personal Data within a reasonable period.

If the Processor is unable to accommodate the objection within thirty (30) days, either Party may terminate the Agreement (or the affected portion of the Service) by providing written notice. Upon such termination, the Processor shall refund any prepaid fees for the period following the effective date of termination.

6. International Data Transfers

6.1 Transfer Mechanisms

To the extent that the Processing of Personal Data involves a transfer of Personal Data from the EEA, UK, or Switzerland to a country that has not been recognized as providing an adequate level of data protection, the Parties shall ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs): The SCCs are incorporated by reference using Module Two (Controller to Processor) where the Customer is the Controller and Module Three (Processor to Processor) where the Customer is a Customer Processor. For transfers subject to the GDPR, the Parties agree to be bound by the applicable module as set out in Annex 3.
  • UK Addendum: For transfers subject to the UK GDPR, the UK Addendum to the SCCs is incorporated by reference into this DPA.
  • Swiss Transfers: For transfers subject to the FADP, the SCCs apply with the modifications necessary to comply with the FADP, including treating the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority.

6.2 Alternative Transfer Mechanisms

If a transfer mechanism described in Section 6.1 is invalidated, replaced, or superseded by Applicable Data Protection Law, the Parties shall cooperate in good faith to implement a replacement transfer mechanism that provides adequate safeguards in compliance with Applicable Data Protection Law.

6.3 Disclosure Requests

If the Processor receives a request from a public authority for disclosure of Personal Data transferred under this DPA, the Processor shall:

  • Promptly notify the Controller, unless prohibited by law.
  • Challenge the request if there are reasonable grounds to consider it unlawful.
  • Provide only the minimum amount of Personal Data necessary to comply with the request.

7. Personal Data Breach

7.1 Notification

The Processor shall notify the Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting the Controller’s Personal Data. Notification shall be provided by email to the address associated with the Controller’s Account.

7.2 Content of Notification

The notification shall, to the extent reasonably possible, include:

  • A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned.
  • The name and contact details of the Processor’s point of contact for further information.
  • A description of the likely consequences of the Personal Data Breach.
  • A description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its adverse effects.

7.3 Ongoing Cooperation

If it is not possible to provide all required information at the time of initial notification, the Processor shall provide the information in phases without further undue delay. The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach.

7.4 Notification Not an Acknowledgment

The Processor’s obligation to notify or respond to a Personal Data Breach under this Section shall not be construed as an acknowledgment of fault or liability.

8. CCPA/CPRA Provisions

To the extent that the CCPA/CPRA applies to the Processing of Personal Data under this DPA:

  • The Processor is a “service provider” as defined under the CCPA/CPRA. The Processor shall not sell or share (as those terms are defined under the CCPA/CPRA) any Personal Data received from the Controller.
  • The Processor shall not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, or as otherwise permitted by the CCPA/CPRA.
  • The Processor shall not combine Personal Data received from the Controller with Personal Data received from or on behalf of another person or collected from its own interactions with Data Subjects, except as permitted by the CCPA/CPRA.
  • The Processor certifies that it understands and will comply with the obligations set forth in this Section.
  • The Controller may take reasonable steps to ensure that the Processor uses Personal Data in a manner consistent with the Controller’s obligations under the CCPA/CPRA.
  • The Processor shall notify the Controller if it determines that it can no longer meet its obligations under the CCPA/CPRA.

9. Term

This DPA shall remain in effect for the duration of the Agreement. Sections 4.7, 4.8, 7, and any provisions that by their nature should survive termination shall survive the termination or expiration of this DPA.

10. Limitation of Liability

Each Party’s total aggregate liability arising out of or related to this DPA shall be subject to the limitations of liability set forth in the Agreement. Nothing in this DPA shall be construed to limit either Party’s liability with respect to the rights of Data Subjects under Applicable Data Protection Law.

11. General

11.1 Governing Law

This DPA shall be governed by and construed in accordance with the laws of the State of California, United States, without regard to conflict-of-law principles, except to the extent that Applicable Data Protection Law requires the application of the law of another jurisdiction.

11.2 Severability

If any provision of this DPA is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.

11.3 Modifications

This DPA may be modified by the Processor to reflect changes in Applicable Data Protection Law by providing at least thirty (30) days’ prior notice to the Controller.

11.4 Entire Agreement

This DPA, together with the Agreement, Annexes, and any SCCs incorporated by reference, constitutes the entire agreement between the Parties with respect to the Processing of Personal Data in connection with the Service.

Annex 1: Details of Processing

This Annex describes the Processing of Personal Data carried out in connection with the Service.

Categories of Data Subjects

  • Employees, contractors, and agents of the Customer or Client who are Authorized Users of the Service.
  • Recipients — the applicable Controller’s contacts, subscribers, customers, and other individuals whose email addresses and related data the Customer or Controller uploads to, synchronizes with, or submits to the Service, or whose data reaches the Service through Amazon SES events and campaign activity.

Categories of Personal Data

Relating to Authorized Users (Processor acts as controller for most of these; listed for completeness):

  • Account data: Name, email address, password (hashed), organization name and settings.
  • Authentication data: Session identifiers, IP addresses, login timestamps, MFA enrollment state, API keys and OAuth client and token records (stored hashed or as signed tokens).
  • Usage data: Pages viewed, features used, actions taken, session duration, device and browser information.
  • Audit data: Records of actions taken within the Controller’s workspace, attributed to an Authorized User.
  • Billing data: Limited payment card information (card brand, last four digits, expiration date) and billing address, as received from Stripe.
  • Support data: Email addresses, message content, and attachments submitted in the course of support communications.

Relating to Recipients (AltaCoda acts as Processor or Sub-Processor, as applicable):

  • Recipient email addresses: Stored in plaintext within the searchable event store and the contact roster; stored in irreversible hashed form for analytics and aggregate reporting.
  • Customer- or Controller-supplied contact identifiers (external_id) used to join relevant systems to the Service.
  • Custom contact attributes defined and populated by the Customer or Controller. These may include names, locale, plan or lifecycle status, dates, and numeric or enumerated values. The attribute schema and its contents are determined by the Customer or Controller, not AltaCoda.
  • List and segment membership, and the segment definitions that derive it.
  • Consent and subscription records: workspace-level unsubscribe state, per-topic subscription status, and changes made by Recipients through the hosted unsubscribe page.
  • Suppression status: the Service-derived undeliverable list, the applicable workspace’s classification rules, and suppression state mirrored to and from the connected SES contact list.
  • Email event data: sends, deliveries, rejects, delivery delays, bounces (including type and sub-type), complaints, opens, and clicks (including the clicked link), with sending identity, configuration set, message identifiers, and timestamps.
  • Recipient-level message history and per-campaign outcomes, including, for each recipient of a broadcast, whether the message was sent, failed, or was filtered before sending and the reason for filtering.
  • Contact activity events submitted by the Customer or Controller through the activity ingest API, including an event name, timestamp, and any properties supplied with the event.
  • Message content and campaign configuration for broadcasts and workflow messages authored in the Service: templates, subject lines, preview text, inline HTML and plain-text content, merge data, sending identity, schedule, workflow definitions, and uploaded assets. Content may contain personal data by virtue of personalization.
  • AWS and SES configuration data: IAM role ARN and external ID (stored encrypted), region, verified domains and identities, DKIM records, configuration sets, tracking domains, sandbox status and quotas, and CloudFormation stack state for the AWS Account owned by the Customer or Client. These are principally technical identifiers rather than personal data, and are included for completeness.

Aggregate, pseudonymized, cross-account data:

  • Aggregate deliverability counts keyed by an HMAC-SHA256 hash of the recipient address and of the sending identity, with recipient and sender domain and day. This dataset carries no Controller identifier, no plaintext addresses, and no message content, is not attributable to any Controller, and cannot be used to enumerate or reconstruct a Controller’s contacts. It is described in Section 3.9 of the Privacy Policy.

Sensitive Data

No special categories of Personal Data (as defined in Article 9 GDPR) are processed under this DPA. The Service is not designed for special-category data, and the Customer shall not upload or permit such data to be uploaded as contact attributes or campaign content.

Processing Activities

  • Providing and operating the Service, including user authentication, session management, role-based access control, and audit logging.
  • Provisioning, monitoring, and reconciling Amazon SES resources within the AWS Account owned by the Customer or Client.
  • Storing and maintaining the applicable Controller’s contact roster, contact attributes, lists, and segments, including imports by CSV file and by API, synchronization with the connected SES contact list, and definitions read from a repository the Customer or Client connects.
  • Evaluating segment definitions against contact attributes and activity to derive segment membership.
  • Recording, enforcing, and mirroring consent, subscription, and suppression state, including operating the hosted unsubscribe page and pushing stricter consent state back to Amazon SES.
  • Composing, rendering, scheduling, and dispatching broadcasts and workflow messages through Amazon SES in the connected AWS Account, including applying consent filtering before dispatch and recording per-recipient outcomes.
  • Executing automated and drip workflows, including enrollment, step evaluation, and send de-duplication.
  • Receiving and storing email event data from Amazon SES via EventBridge in the connected AWS Account.
  • Ingesting contact activity events submitted by the Customer or Controller.
  • Syncing and managing email templates, segment and workflow definitions, and assets from connected repositories, and writing back where the Customer or Controller enables it.
  • Generating analytics, reports, dashboards, recipient search, and per-message history from contact and event data.
  • Maintaining aggregate, pseudonymized cross-account deliverability statistics as described above.
  • Investigating suspected abuse, complaints, and security or deliverability incidents, including inspection of sending metadata as permitted by the Agreement.
  • Processing payments and managing subscriptions through Stripe.
  • Delivering notifications (in-app, email, Slack, webhook) as configured for the workspace.
  • Product analytics and usage tracking through Mixpanel and Google Analytics 4; error reporting and operational telemetry through Sentry and Axiom.

Retention

Personal Data is retained in accordance with the retention schedule set out in Section 4 of the Privacy Policy. In summary:

  • Contact roster, attributes, list and segment membership, consent, suppression, campaign content, templates, and workflow definitions: retained until the Customer or Controller deletes them or the applicable workspace is closed.
  • Email event data and recipient-level message history: deleted 24 months after ingest, with data moved to cold storage after 90 days. Daily and hourly aggregates derived from it are retained longer.
  • Contact activity events: the raw event log is deleted 12 months after ingest; per-event-name daily counts derived from it are retained until the Account is closed.
  • Send-deduplication records: approximately 400 days.
  • Account, workspace, and audit data: duration of the Account, plus any legally required retention period.
  • Billing records: up to 7 years, as required by tax and accounting obligations.
  • Usage data: up to 90 days at record level; aggregated or de-identified thereafter.
  • Server logs, traces, and error reports: deleted or anonymized within 90 days.
  • Aggregate, pseudonymized cross-account deliverability data: retained on a long-term basis. It carries no Controller identifier and is therefore not deleted by Account closure.

Plan retention windows are a visibility control, not a deletion schedule. The applicable Subscription Plan determines how far back the Service displays email event data and analytics (7 days on Free, 90 days on Team, 1 year on Business). Physical deletion follows the schedule above. Where the Controller requires shorter retention than the schedule provides, the Customer may request deletion under Section 4.7.

Location of Processing

Personal Data is processed in Germany and the United States. Infrastructure hosting is provided by Hetzner Online GmbH (Germany) and Amazon Web Services (United States). A full list of Further Sub-Processors and their locations is available at sendops.dev/subprocessors.

Annex 2: Technical and Organizational Security Measures

The Processor implements and maintains the following technical and organizational measures to protect Personal Data:

Access Control

  • Role-based access controls for all internal systems.
  • Multi-factor authentication for administrative access to production systems.
  • Principle of least privilege applied to all system and database access.
  • Unique user accounts for all personnel; no shared credentials.

Encryption

  • Encryption of data in transit using TLS 1.2 or higher for all external communications.
  • Encryption of data at rest for databases, backups, and stored credentials.
  • AWS credentials stored using application-level encryption with keys managed through a dedicated key management process.

Data Minimization and Pseudonymization

  • Recipient email addresses are hashed using a one-way cryptographic hash function for analytics and aggregate reporting. Plaintext addresses are retained only within the search index, scoped per account, to support per-message lookup.
  • Personal Data collection is limited to what is necessary for the provision of the Service.

Infrastructure Security

  • Production infrastructure hosted in professionally managed data centers with physical access controls.
  • Network-level firewalls and security group rules restricting access to production systems.
  • Regular patching and updates to operating systems and application dependencies.

Monitoring and Logging

  • Centralized logging of access to production systems and databases.
  • Monitoring for anomalous activity, unauthorized access attempts, and system errors.
  • Log retention consistent with the retention periods described in Annex 1.

Incident Response

  • Documented incident response procedures for identifying, containing, and remediating security incidents.
  • Defined escalation paths and notification procedures for Personal Data Breaches, as described in Section 7 of this DPA.

Business Continuity

  • Regular backups of databases and critical systems.
  • Backup integrity verification and restoration testing.
  • Disaster recovery procedures documented and periodically reviewed.

Personnel

  • Confidentiality obligations for all personnel with access to Personal Data.
  • Security awareness training for personnel involved in the Processing of Personal Data.

Vendor Management

  • Due diligence assessments conducted on Further Sub-Processors prior to engagement.
  • Written agreements with Further Sub-Processors imposing data protection obligations no less protective than those in this DPA.

Annex 3: Standard Contractual Clauses

To the extent that the Processing of Personal Data involves a transfer of Personal Data from the EEA to the United States or another country without an adequacy decision, the Parties agree to be bound by the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914. Module Two (Controller to Processor) applies where the Customer is the Controller. Module Three (Processor to Processor) applies where the Customer is a Customer Processor and AltaCoda acts as its Sub-Processor.

The SCCs are completed as follows:

Clause 7 — Docking Clause

The optional docking clause is included, permitting additional parties to accede to the SCCs.

Clause 9 — Use of Sub-Processors

Option 2 (General written authorization) is selected under the applicable module. AltaCoda shall inform the Customer of intended changes to the list of Further Sub-Processors, giving the Customer an opportunity to object in accordance with Section 5. A Customer Processor is responsible for relaying notices and objections to and from the Client where required.

Clause 11 — Redress

The optional clause on independent dispute resolution is not included.

Clause 13 — Supervision

Where the data exporter is established in an EU Member State, the Supervisory Authority of that Member State shall act as the competent Supervisory Authority. Where the data exporter is not established in an EU Member State but falls within the territorial scope of the GDPR, the Supervisory Authority of the Member State where the data exporter’s EU representative is established shall act as the competent Supervisory Authority. Where the data exporter is not established in the EU and has not appointed an EU representative, the Irish Data Protection Commission shall act as the competent Supervisory Authority.

Clause 17 — Governing Law

Option 1 is selected. The SCCs shall be governed by the law of Ireland.

Clause 18 — Choice of Forum and Jurisdiction

Disputes arising from the SCCs shall be resolved by the courts of Ireland.

Annex I to the SCCs

Annex I.A (List of Parties):

  • Under Module Two, data exporter: the Customer, in its role as Controller and as identified in the Agreement.
  • Under Module Three, data exporter: the Customer, in its role as Customer Processor and as identified in the Agreement. The Client is the Controller identified in the applicable order, partner schedule, Service record, or other written notice.
  • Data importer: AltaCoda LLC, 1111 Broadway, Oakland, CA 94607. Contact: hello@altacoda.io. Role: Processor under Module Two or Sub-Processor under Module Three.

Annex I.B (Description of Transfer): As set forth in Annex 1 of this DPA.

Annex I.C (Competent Supervisory Authority): As determined in accordance with Clause 13 above.

Annex II to the SCCs

The technical and organizational measures implemented by the data importer are as set forth in Annex 2 of this DPA.

Annex III to the SCCs

The current list of Further Sub-Processors is maintained at sendops.dev/subprocessors.

Contact: AltaCoda LLC 1111 Broadway Oakland, CA 94607 Email: hello@altacoda.io

Last updated: September 2, 2026