Data Processing Agreement

You are the data controller of the contact data you upload. NUFUCONVERSION LTD acts as data processor and processes that data only on your documented instructions to provide the service.

Processing covers the storage, segmentation and transmission of email contact records for the duration of your subscription, plus a 30-day retention window after termination.

TLS 1.3 in transit, AES-256 at rest, role-based access control, least-privilege staff access with audit logging, annual penetration testing, and documented incident response with breach notification within 72 hours.

We use vetted sub-processors for cloud hosting, transactional email infrastructure, billing (aMember) and payment processing (PayPal). Each is bound by equivalent data protection obligations. We give notice before adding a new sub-processor.

Where data leaves the UK or EEA, transfers rely on Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary technical measures.

We assist you in responding to access, correction, erasure and portability requests. On written request we delete or return all personal data within 30 days, except where retention is legally required.

Need a countersigned DPA for your records? Email support@nufumail.com and we will return an executed copy within 2 business days.