Data Processing Agreement (DPA)

TuruMail Enterprise Compliance Document · Ref: TM-DPA

Executive Summary: This Data Processing Agreement ("DPA") supplements the Terms of Service between Adidigi Webhaat Resolutions LLP (operating as TuruMail) and the Customer. TuruMail acts strictly as a Data Processor on your behalf. We enforce AES-256 encryption at rest, TLS 1.3 in transit, automated 30-day post-termination data erasure, and transparent sub-processor management.

By using our service, you agree to this DPA. For our list of sub-processors, visit /subprocessors.

Section 1

Definitions & Scope

This Data Processing Agreement ("DPA") is entered into between Adidigi Webhaat Resolutions LLP (LLPIN: ACF-1486), a registered Limited Liability Partnership ("TuruMail", "Processor", "we", "us", or "our"), and the entity or individual subscribing to or using the TuruMail cold email and warmup platform ("Customer", "Controller", or "you").

This DPA applies to all processing of Personal Data performed by TuruMail on behalf of the Customer in the course of providing cold email delivery, email warmup, dedicated SMTP routing, deliverability analytics, and customer communication services under the principal agreement.

Unless otherwise defined herein, capitalized terms have the meanings set forth in Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR"), the UK GDPR, and the California Consumer Privacy Act ("CCPA/CPRA").

Section 2

Roles & Governance

The parties acknowledge and agree that:

Customer is the Data Controller: The Customer determines the purposes and essential means of the processing of Customer Personal Data (such as recipient email lists, campaign copy, contacts, and sending configurations).
TuruMail is the Data Processor: TuruMail processes Customer Personal Data exclusively on documented instructions from the Customer and solely to provide, maintain, and optimize the services.
GDPR Compliance Commitment: Adidigi Webhaat Resolutions LLP maintains comprehensive technical and operational safeguards to ensure full compliance with Article 28 of the GDPR and equivalent international requirements.

Compliance Assurance: TuruMail never sells, rents, monetizes, or uses Customer contact lists or email recipient data for any secondary purpose, advertising network, or third-party marketing.

Section 3

Customer Instructions & Obligations

TuruMail shall process Personal Data strictly in accordance with documented instructions from the Customer, including transfers of Personal Data to a third country or international organization, unless required to do so by applicable European Union, Member State, or international law to which TuruMail is subject.

Customer represents and warrants that:

It has collected all Personal Data, email addresses, and recipient contacts in full compliance with applicable data protection laws, including having a valid legal basis (such as legitimate interest or explicit consent) for outreach campaigns.
Its outreach practices comply with CAN-SPAM, CASL, GDPR, and PECR regulations, including the inclusion of clear opt-out / unsubscribe mechanisms and sender transparency.
It will not upload sensitive categories of personal data (e.g., health data, biometric identifiers, government-issued IDs, or payment card details) into campaign variables.

Section 4

Technical & Organizational Data Security

TuruMail has implemented enterprise-grade Technical and Organizational Measures (TOMs) designed to prevent unauthorized access, accidental loss, disclosure, or alteration of Personal Data:

Security Control	Implementation Specification
Encryption at Rest	AES-256: All production databases, encrypted storage volumes, mailbox credentials, OAuth refresh tokens, and server backups are encrypted at rest using industry-standard Advanced Encryption Standard (AES) with 256-bit keys.
Encryption in Transit	TLS 1.3: All communications between clients and TuruMail APIs, web consoles, and outbound SMTP transmission channels enforce Transport Layer Security (TLS 1.3 and modern cipher suites) to ensure end-to-end cryptographic confidentiality.
Access Governance	Strict Least Privilege (RBAC): Access to server infrastructure is restricted to authorized operations engineers via hardware-bound SSH keys, mandatory multi-factor authentication (MFA), and zero persistent root privileges.
Infrastructure Isolation	Containerized Isolation: Dedicated SMTP containers, tenant-level privacy modes (Private Isolated Pools vs. Shared Pools), private network bridging, and perimeter firewalls prevent inter-client cross-talk or leakage.
Vulnerability Management	Continuous vulnerability scanning, automated patch deployment, operating system hardening, and annual external penetration testing.

Section 5

Data Retention & Permanent Erasure

We respect the fundamental right to data minimization and the right to be forgotten:

Active Retention: While your account is in good standing, TuruMail retains contact lists, campaign performance metrics, and warmup activity logs solely to provide the services and deliver accurate deliverability reporting.
30-Day Permanent Erasure Guarantee: Upon termination of the customer agreement, account cancellation, or upon receipt of a written deletion request, all Customer Personal Data, subscriber lists, uploaded contacts, and email logs will be permanently erased from active databases within 30 days.
Backup Purge Cycles: Encrypted system disaster recovery backups cycle on an automated 30-day rolling rotation, after which historical records are irrevocably overwritten and purged.
Data Export: Prior to account closure, Customers can export full contact lists, campaign analytics, and deliverability reports via CSV or TuruMail REST APIs.

Section 6

Authorized Sub-processors

Customer provides a general written authorization for TuruMail to engage third-party sub-processors to assist in delivering platform infrastructure, dedicated servers, hosting, deliverability monitoring, and payment processing.

TuruMail maintains a strict sub-processor governance framework:

All sub-processors are bound by written agreements requiring at least the same level of data protection and security as set forth in this DPA.
TuruMail remains fully liable to the Customer for the performance of each sub-processor’s obligations.
TuruMail publishes and maintains an up-to-date registry of all authorized sub-processors, their corporate locations, and specific processing functions.

Review Authorized Sub-processors: You can view the complete, active directory of our cloud hosting, infrastructure, and technology partners at turumail.com/subprocessors. We provide at least 30 days' advance notice before onboarding any new sub-processor.

Section 7

Assistance with Data Subject Requests (DSARs)

Taking into account the nature of the processing, TuruMail shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, objection, and data portability).

If TuruMail receives a request directly from a Customer's recipient or data subject, TuruMail shall promptly advise the data subject to submit their request directly to the Customer, and shall not respond to that data subject directly without prior written authorization from the Customer.

Section 8

Personal Data Breach Notification

In the unlikely event of a confirmed Personal Data Breach impacting Customer data processed by TuruMail, TuruMail shall:

48-Hour Notification: Notify the Customer in writing without undue delay, and in any event within 48 hours of becoming aware of the breach.
Incident Details: Provide sufficient information describing the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the remediation measures undertaken or planned.
Mitigation: Take immediate reasonable steps to contain, mitigate, and resolve the security incident to protect Customer data from unauthorized access or disclosure.

Section 9

International Data Transfers

Where the processing of Personal Data involves transfers outside the European Economic Area (EEA), United Kingdom, or Switzerland to countries not recognized as providing an adequate level of data protection by the European Commission, the parties agree that such transfers shall be governed by the European Commission’s Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914, Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum, which are hereby incorporated by reference.

Section 10

Audits & Compliance Verification

TuruMail shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including security reviews conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable advance notice, standard confidentiality agreements, and non-interference with production operations.

Section 11

Operating Entity, Governing Law & Contact

This Data Processing Agreement is operated, maintained, and enforced by:

Operating Entity: Adidigi Webhaat Resolutions LLP
LLPIN: ACF-1486
Platform: TuruMail (turumail.com)
Data Protection Officer (DPO) / Privacy Inquiries: info@turumail.com
Abuse & Security Inquiries: abuse@turumail.com

This DPA shall be governed by and construed in accordance with the governing law specified in the principal Terms of Service, except to the extent that applicable data protection legislation (such as EU/UK GDPR) mandates the jurisdiction of European or British supervisory courts.