Data Processing Agreement

You are the controller. You decide which numbers are on your list, where they came from, what the message says and when it goes out. Nothing here changes that, and nothing here can: it is a matter of fact, not of drafting.

We are the processor. PJMoney Serviços em Tecnologia Ltda. (CNPJ 40.870.650/0001-02), Rua Marechal Rondon 700, sala 307, Jardim Chapadão, 13070-173 Campinas-SP, Brasil, referred to here as the processor, carries out your instructions and nothing else.

Your instruction, in this product, is literal: each campaign you confirm in the panel is an instruction to process the list attached to it. There is no standing arrangement under which we process anything you did not confirm.

For our OWN data about you, your email address, your account, your balance and your invoices, we are the controller, and this annex does not apply to it. The Privacy Policy covers that half.

The particulars required by article 28(3), stated once, plainly:

We process this data only on your documented instructions, which are the Terms of Service, this annex, and each campaign you confirm. That includes transfers to a third country: we will not move your data anywhere this annex does not already say it goes.

If we are required by European Union or member state law to process it otherwise, we will tell you before doing so, unless that same law forbids telling you.

⚠️ And we will say so if an instruction looks unlawful. Article 28(3) requires it, and the practical meaning is narrower than it sounds: we do not audit your list and cannot tell whether you had consent for a number on it. What we can see is an instruction that is unlawful on its face, and we will say so rather than carry it out quietly.

Everyone with access to this data is bound to confidentiality, by contract or by statute, and that obligation outlives their engagement with us.

⚠️ Our operations team does not open your lists or your messages. User impersonation for support purposes is disabled in the product, not merely discouraged: `support.impersonation` is set to `disabled`, which is a configuration the backend enforces rather than a policy someone remembers. Owning the system is not a lawful basis to read what is in it.

The measures required by article 32, as they actually stand today rather than as a wish list:

You give a general written authorisation for the sub-processors below, which is the option of clause 9(a) of the Standard Contractual Clauses. Each is bound by data protection terms no weaker than these, and we remain fully liable to you for what they do.

⚠️ Thirty days’ notice, in writing, before a new sub-processor touches your data. If you object on reasonable data protection grounds within those thirty days, we will either not make the change for your workspace or, if that is not possible, you may terminate and we will return the unspent credit under clause 4 of the Terms of Service.

Silence is not consent to something we never told you about: the clock only starts once the notice is sent.

When one of your contacts exercises a right against you, we help you answer, insofar as the answer is in our systems. In practice that means telling you whether a number is on your suppression list, when a message was sent and what the carrier said about it.

The one right a recipient exercises directly here is the right to stop receiving, through the link in every message. We honour it immediately and permanently, and it appears in your panel as a dropped recipient.

We also help you with articles 32 to 36: security of processing, breach notification, and a data protection impact assessment, to the extent the information is ours to give.

⚠️ Breach notification: without undue delay after we become aware, and in any event within 48 hours. The notice names what happened, which data and how many people, what we have done and what we advise you to do. You notify the supervisory authority, because you are the controller; we give you what you need to do it.

⚠️ THIS IS THE CLAUSE THAT MAKES A BRAZILIAN PROCESSOR LAWFUL FOR A EUROPEAN CONTROLLER. The data itself sits in the European Union: the database in Frankfurt, the servers in Paris. But the company operating bucketmsg is established in Brazil and reaches it from there, and the European Commission has adopted no adequacy decision for Brazil. That access is a transfer under Chapter V of the GDPR.

The Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor), are incorporated into this annex by reference and form part of it. By accepting the Terms of Service you enter into them with us, you as data exporter and us as data importer.

The options within those clauses are exercised as follows, and they are stated here because an unexercised option is a clause nobody can rely on:

If any authority, in Brazil or elsewhere, asks us for your data, we will notify you before responding, unless the law forbids the notification, in which case we will challenge that prohibition and tell you as soon as we lawfully can.

We will not hand over anything beyond what a valid, binding and specific order compels, and we will challenge an order that appears unlawful under European Union law. This is clause 15 of the Standard Contractual Clauses, said in our own words so it is read rather than incorporated and forgotten.

⚠️ We hold no encryption key that would let us read a message whose content you encrypted yourself, and we do not offer that. What we can be compelled to produce is what we hold, which is set out in clause 2.

At the end of the service you choose: we return your data in a machine-readable format, or we delete it. Absent a choice within 30 days, we delete it.

⚠️ Except the suppression list, and this is deliberate. It outlives your lists and your account, because it is the record of who asked not to be contacted, and deleting it would mean messaging those people again. It is kept minimal for exactly that purpose: a number and a date, nothing else. Article 17(3)(b) of the GDPR covers keeping it, since forgetting an objection would defeat the objection.

We also keep whatever European Union or member state law requires us to keep, for as long as it requires.

You may verify that we comply with this annex. On reasonable notice, once a year, or after a personal data breach affecting your data, we will answer a written questionnaire and provide the documentation we hold.

⚠️ An on-site audit of shared infrastructure is not ours to grant, and saying so is more useful than promising it: the servers belong to the providers in clause 6, and an audit right we cannot honour is a clause that fails on the day it is used. What we will do is obtain and pass on what those providers publish, and answer for our own systems.

The processor is established in Brazil, so the LGPD: *Lei Geral de Proteção de Dados* (Law 13.709/2018), applies to it as well. Under that law we are the operador and you are the controlador, which are the same two roles as processor and controller.

Where the two laws impose different standards on the same question, we apply the stricter one, so being covered by both never leaves you with less than either alone would give. Clause 10 of the Privacy Policy sets out the differences that actually reach a data subject.

Clause 11 of the Terms of Service limits our liability, and it applies here too, EXCEPT where the Standard Contractual Clauses say otherwise. Their clause 12 governs liability for a breach of those clauses, and nothing here limits what they give a data subject.

⚠️ A data subject can enforce clause 12 against us directly, whatever you and we agreed between ourselves. That is how third party beneficiary rights work in those clauses, and a contract cannot bargain them away.

Anything under this annex, including a notice under clause 7 or a request under clause 12: support@bucketmsg.com.