Data Processing Addendum

Electronic Acceptance

Customer accepts this DPA through an authorized representative's electronic confirmation in Simply Send. The representative confirms authority to bind Customer. An individual acknowledgement by a person without that authority applies to that person's use and does not itself bind the Customer organization. Simply Send records the accepted document versions, representative's account identity, workspace, acceptance capacity, confirmation statement, acknowledgements, and server-recorded acceptance timestamp, and makes an acceptance receipt available under Account → Documents.

No separate customer signature on the downloadable PDF is required when the electronic confirmation creates a binding agreement under applicable contract law. Downloading the document, signing in, or creating an account without the relevant electronic confirmation does not constitute acceptance of this version. A company signature date does not replace Customer's actual acceptance time.

The SCCs in Section 8.1 and Annexes 1 and 2 form part of this DPA. The Customer is identified through the Agreement and the company and contact details supplied for its root workspace or an applicable order. The company-signed download supplies Simply Invent Labs LLC's full postal address. The authenticated acceptance record identifies the representative and acceptance date. These incorporated records must contain the information required for the actual transfer; omitted information must be supplied before relying on the SCCs. A separate customer signature on the standard PDF is not required where this electronic execution is legally binding.

1. Scope and Roles

"Data Protection Laws" means the privacy and data protection laws applicable to a party's Processing under the Agreement, including, where applicable, Regulation (EU) 2016/679 as incorporated into EEA law ("EU GDPR" or "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and applicable US state privacy laws. "Personal Data," "Controller," "Processor," "Data Subject," "Processing," and "Personal Data Breach" have the meanings given by those laws. "Customer Data" means Personal Data submitted to or made available through the Service for Processing on Customer's behalf. "Subprocessor" means a Processor engaged by Simply Send to Process Customer Data on that behalf.

Customer is the Controller of Customer Data, or a Processor authorized by its Controller to appoint Simply Send as a further Processor. Simply Invent Labs LLC acts as Processor or Subprocessor, respectively. Customer retains control of its purposes and instructions; Simply Send does not acquire ownership of Customer Data. The activities, data categories, duration, and safeguards are described in Annexes 1 and 2 and any applicable written order or processing schedule.

Customer is responsible for a valid legal basis, accurate notices, required consents and permissions, lawful recipient lists, and compliance with the marketing, electronic communications, and recording laws applicable to its messages and configured features. An import, verified domain, or successful delivery does not establish recipient consent. If Customer is a Processor, it warrants that the Controller has authorized the instructions, Subprocessors, and international transfers described in Annex 1 and the applicable written instructions.

Customer must minimize the Personal Data it submits and protect its account credentials, API keys, access permissions, and integration settings. Customer must not submit special-category data under GDPR Article 9, criminal-offence data under Article 10, payment-card authentication data, or data requiring a business associate agreement or other specialized safeguards unless the parties have separately agreed in writing to the relevant service and safeguards. This DPA alone does not establish compliance with HIPAA or authorize a sensitive-data use case.

2. Customer Instructions

Customer's documented instructions are the Agreement, this DPA, the incorporated Customer details and applicable orders, the use of the Service's documented controls, and further lawful written instructions accepted by the parties. They authorize the collection, storage, organization, transmission, delivery, event recording, retrieval, support, and deletion needed to provide the selected Service, including proportionate security and abuse prevention for that Processing. An optional feature or new communications channel is included only where it is made available and specifically selected or agreed; naming a vendor does not enable that feature.

Simply Send will Process Customer Data only on those instructions unless applicable law requires otherwise. Where required by EU or Member State law, Simply Send will inform Customer of that requirement before Processing unless the law prohibits notice on important public-interest grounds. Other legally binding demands and international-access requests are handled under Section 8. Simply Send will promptly inform Customer if it believes an instruction infringes Data Protection Laws and may pause the affected Processing while the parties resolve the issue. It will explain the reason and seek a lawful alternative where permitted. No instruction requires Simply Send to breach law or weaken the Service's security.

Simply Send will not sell Customer Data, use it for targeted advertising, build unrelated personal profiles, or use Customer Content or Google Workspace data to train or improve generalized AI models. An AI feature processes data only for the disclosed Service function. Redaction and pseudonymization reduce exposure but do not automatically make content anonymous or remove this DPA's protection. Data treated as anonymous must no longer reasonably identify an individual; Simply Send will not attempt to re-identify it.

Instructions that materially change the agreed service, risk, or cost may require a separate written agreement. That process does not postpone or remove duties that Data Protection Laws or the applicable transfer clauses already require.

3. Confidentiality and Security

Simply Send will restrict access to personnel who need Customer Data for an authorized function and are bound by contractual or statutory confidentiality duties. It will implement appropriate technical and organizational measures under GDPR Article 32 and comparable applicable requirements, taking account of the state of the art, implementation costs, the nature and scope of Processing, and risks to individuals. Annex 2 describes the measures and their limits for the Service.

Simply Send may improve or replace measures as technology and risks change, provided the overall level of protection is not materially reduced. Customer remains responsible for its own systems, lawful content, endpoints, credentials, and selected security settings. These responsibilities do not exclude Simply Send's own obligations. Neither this DPA nor the use of a cloud provider represents a certification or an absolute guarantee of security.

4. Subprocessors

Customer gives general written authorization for the Subprocessors identified on the central list incorporated below, limited to the applicable Service, data, and locations disclosed for Customer. Additions and replacements are subject to the notice procedure below. Before access, Simply Send will assess the provider's appropriate safeguards and enter into a written agreement imposing the applicable data protection, confidentiality, security, assistance, deletion, and transfer obligations required by this DPA and law. Simply Send remains responsible to Customer for the performance of its Subprocessors' data protection obligations as required by GDPR Article 28(4) and the applicable transfer clauses.

Simply Send will email Customer's designated account or privacy contact at least 30 days before adding or replacing a Subprocessor, identifying its function and processing locations and allowing an objection on reasonable data protection grounds within that period. The parties will seek a practical solution, such as a different provider or disabling the affected feature. If no solution is available, Customer may terminate the affected Service before the change takes effect; accrued charges and any refund are governed by the Agreement, subject to mandatory law and SCC remedies. Enabling an optional service after receiving its provider disclosures is a documented instruction for that service; it does not waive notice of subsequent changes or statutory rights.

The Subprocessors and Service Providers page is incorporated into this Section for providers engaged by Simply Send, with their functions, processing locations, and service-specific limits. The applicable list must be retained with Customer's processing record. Page updates do not bypass the authorization, notice, objection, or transfer requirements of this DPA. Simply Send will maintain information identifying the applicable onward processing chain and require its Subprocessors to apply equivalent contractual safeguards to authorized further processors as required by law and the applicable transfer clauses. An external provider's list is informational and does not authorize every listed provider.

The central page separately describes customer-selected integrations, including Google Workspace, Supabase, WordPress, Zapier, Shopify, webhooks, and MCP clients, and login providers. Where Customer independently engages a provider, Customer is responsible for authorizing the connection, selecting appropriate permissions, and meeting its notice, legal-basis, contractual, and transfer duties for that relationship. Simply Send will execute only lawful documented instructions within the agreed Service and remains responsible for its own Processing and any provider it actually engages. These classifications do not remove obligations imposed by law or the SCCs.

MCP access permits the selected client to receive authorized tool results and request permitted actions. Client retention or model use is governed by Customer's arrangement with that client; this does not expand Simply Send's permitted AI use or override restrictions on Google Workspace data. Revoking a connection does not automatically delete copies already received by an independent service or revoke separate API/SMTP credentials. The Privacy Policy describes identity, integration, purchase-channel, and retention information.

Before a Telnyx AI feature Processes Customer Data, its feature, upstream model providers, data categories, retention, and processing countries must be identified in the agreed written instructions and authorized under this Section. The central page's optional AI disclosures apply. Simply Send must ensure the selected configuration complies with this DPA's purpose, transfer, and no-training restrictions.

5. Data Subject Requests

Customer is responsible for responding to individuals and establishing the applicable legal basis for its Processing. Simply Send will provide reasonable technical and organizational assistance, taking account of the nature of Processing, so Customer can respond to requests for access, correction, deletion, restriction, portability, objection, or other applicable rights within legal time limits. It will pass on requests relating to Customer Data without undue delay and will not independently answer on Customer's behalf except on documented instructions or as law requires. It may request proportionate information to authenticate an instruction and avoid unauthorized disclosure. A request about data for which Simply Send is Controller is handled under the Privacy Policy.

6. Personal Data Breaches

Simply Send will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, using the designated account or privacy contact. The notice will describe, as information becomes available, the nature of the breach; the affected categories and approximate numbers of individuals and records; a contact for further information; likely consequences; and containment, mitigation, and corrective measures. Information may be supplied in phases without undue delay; an incomplete investigation will not by itself postpone the initial notice.

Simply Send will investigate, take appropriate containment and remediation steps, document the relevant facts and actions, and reasonably assist Customer with its assessment and any required notifications. Customer decides whether to notify authorities or individuals, unless law requires Simply Send to do so. Notification or cooperation is not an admission of liability. Unsuccessful attempts that do not result in a Personal Data Breach do not trigger this notification clause. Customer must keep its notification contacts current.

7. Assistance and Audits

Taking account of the nature of Processing and information available to it, Simply Send will assist Customer with applicable security duties, breach assessment, data protection impact assessments, and prior consultation with supervisory authorities. It will make available the information necessary to demonstrate compliance with the applicable Processor obligations and cooperate with competent supervisory authorities.

Customer should first use reasonably available documentation, questionnaires, and relevant independent assurance reports, if available. Where that information is insufficient, Simply Send will allow and contribute to a proportionate audit, including inspections, by Customer or an independent auditor acting on its instructions and bound by appropriate confidentiality. Ordinarily the parties will agree reasonable notice, business hours, scope, and no more than one audit per twelve months. Those arrangements do not restrict an audit required by law, a supervisory authority, an applicable SCC, a material breach, or reasonable evidence of noncompliance. A confidentiality requirement or scheduling process may not prevent the exercise of mandatory rights.

Audits must protect other customers' data, trade secrets, and the security and availability of systems. The parties will agree a secure way to disclose the necessary evidence rather than expose credentials or unrelated data. Each party ordinarily bears its own costs. Reasonable, documented fees for additional discretionary assistance may be agreed in advance, except where prohibited by law or the applicable SCCs or where required to remedy Simply Send's breach. Mandatory cooperation is not conditional on accepting an additional fee.

8. International Transfers

Customer Data may be Processed in the United States and the service-specific countries identified in the incorporated provider disclosures and any applicable order or written instructions, including authorized remote support access and onward Processing by Subprocessors. Where region-first signup is available, Customer selects an available Service region before creating its login. That region determines the regional identity and account services, workspace records, domain configuration, and core email processing and storage for that account. This regional scope does not include the separately disclosed US SMTP bridge, website delivery and associated metadata, external support or AI providers, or Customer-selected integrations. Available regions are those offered by the Service; a planned region is not available until released. Simply Send will not claim an EEA-only deployment or a particular transfer safeguard without verifying its applicability to the actual flow.

A "Restricted Transfer" is a transfer requiring additional safeguards under applicable Data Protection Laws because the destination or recipient is not covered by an applicable adequacy decision or regulation. Simply Send will ensure a lawful mechanism before making such a transfer, including onward transfers. It does not represent that Simply Invent Labs LLC is certified under the EU-US, UK-US, or Swiss-US Data Privacy Framework. A cloud provider's certification or DPA does not itself cover Simply Send's separate obligations to Customer.

8.1 EU and EEA transfers

For eligible Restricted Transfers governed by the EU GDPR, the parties incorporate the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"), unchanged except for the permitted selections and Appendix completion below. Module Two applies where Customer is Controller and Simply Send is Processor; Module Three applies where Customer is Processor and Simply Send is a further Processor. The clauses apply only within the scope for which the approved instrument may lawfully be used. If that instrument is unsuitable for a particular transfer, including because the relevant importer's Processing is already directly subject to the EU GDPR, the parties must establish another lawful safeguard before making a Restricted Transfer on that basis.

• Clause 7: the optional docking clause is not selected; adding a party requires an appropriate written accession.
• Clause 9(a): Option 2, general written authorization, applies with 30 days' prior written notice under Section 4.
• Clause 11: the optional independent dispute-resolution language is not selected.
• Clause 17: Option 1 applies; Irish law governs the EU SCCs and must permit third-party beneficiary rights.
• Clause 18(b): the courts of Ireland are selected, without limiting a Data Subject's right under the EU SCCs to bring proceedings in the country of habitual residence.
• Annex I.A: the parties, roles, addresses, contacts, relevant activities, and acceptance date are completed under Annex 1.A below.
• Annex I.B: the transfers, purposes, data, retention criteria, and subprocessing details are described in Annex 1.B and the applicable Service settings and written instructions.
• Annex I.C: the competent supervisory authority is identified according to Clause 13 and Annex 1.C; it is not automatically the Irish authority merely because Irish law is selected.
• Annex II: Annex 2 and any agreed service-specific security schedule apply. The Section 4 provider list and applicable Service configuration identify authorized Subprocessors; Annex III is required by the EU SCCs if the parties instead expressly select specific authorization.

By an authorized electronic acceptance of this DPA, the parties also agree to be bound by the applicable EU SCCs, including the Annex information incorporated below. The same acceptance supplies the Customer signature and date for Annex I.A where valid under applicable contract law. The standard company-signed PDF is available through Account → Documents and is used together with the Agreement and recorded Customer details. No separate negotiated SCC schedule is required for the standard Service when those records supply the required details. Any missing party, authority, or transfer information must be completed before the parties rely on the SCCs.

8.2 Transfer assessments and public-authority requests

The parties will document the assessments required for the transfer, including the circumstances, destination-country laws and practices, onward transfers, access risks, and any necessary supplementary measures. Simply Send will provide reasonably available information and notify Customer if it can no longer comply with the applicable safeguard. Where protection cannot be ensured, the parties will suspend the affected transfer and follow the applicable suspension, termination, return, or deletion requirements, including Clause 16 of the EU SCCs. A commercial limitation in the Agreement cannot prevent those measures.

For a legally binding request for Customer Data by a public authority, Simply Send will review the request's legality, disclose only what is legally required, and notify Customer and, where required, the affected Data Subject unless prohibited by law. Where a prohibition applies, it will use reasonable efforts to obtain permission to notify and document those efforts. It will challenge a request and seek appropriate interim relief where there are reasonable grounds to consider it unlawful, as required by the applicable transfer clauses. It will maintain legally permitted records and provide information required by those clauses to Customer or the competent authority.

Transfer information: For the selected Service, the assessment identifies the data categories and individuals in Annex 1.B; the receiving parties, functions, and countries in Annex 1.A and the central Subprocessor disclosures; transfer frequency and retention; and the technical and organizational measures in Annex 2. It also evaluates relevant destination-country laws and practices, public-authority access, onward transfers, and whether additional safeguards are needed. Simply Send will supply reasonably available service-specific information to Customer on request through the privacy contact. These disclosures describe the processing; they do not represent that a transfer assessment has been completed or that encryption prevents all access to data processed in readable form.

8.3 UK and Swiss transfers

EU SCCs alone do not authorize Restricted Transfers under the UK GDPR. Before relying on that route for UK data, the parties must complete and enter into the ICO's approved International Data Transfer Addendum (or another valid UK safeguard), including the required Part 1 tables and the unchanged Part 2 Mandatory Clauses, and perform the required transfer assessment. The parties and Appendix information come from the Agreement and Annex 1; the selected EU modules and options are those in Section 8.1. The UK Addendum must expressly record the parties permitted to terminate upon an approved change. This paragraph does not substitute for an incomplete or unexecuted UK Addendum.

For Restricted Transfers governed by the Swiss FADP, the EU SCCs apply with the adjustments necessary under Swiss law: references to the GDPR include the FADP for Swiss-protected data; the FDPIC is the competent Swiss authority; Swiss-protected individuals retain enforceable third-party rights; and references to an EU Member State do not exclude those rights in Switzerland. For transfers governed only by Swiss law, Swiss law governs the clauses and the courts of Switzerland have jurisdiction. Where the EU GDPR also applies, its governing-law, authority, and court requirements remain in force for that Processing. The parties record the applicable Swiss and EU authorities and adaptations in the Agreement and any required country-specific addendum.

9. Return and Deletion

During the Service, Customer may retrieve or delete data using available controls or request assistance. At the end of the relevant Service, Simply Send will, at Customer's choice, return Customer Data in a reasonably available structured format or delete it, and delete remaining copies, unless Union or Member State law requires retention for EU-GDPR Processing or another law lawfully requires retention for the relevant Processing. Simply Send will explain any legally permitted retention basis and restrict the retained data to that purpose. The parties will coordinate return and deletion without undue delay; Customer should request an export before its access ends. Simply Send will provide confirmation of completion on reasonable request, subject to mandatory transfer-clause requirements.

A standard account-deletion request has a seven-day cancellation period before the deletion process starts. That recovery period does not override a separately agreed deletion instruction or a mandatory legal or SCC deadline. Automated expiry and storage lifecycle processes are asynchronous; an expiry setting is not a promise of erasure at an exact timestamp. Data is retained only for the relevant purpose and is not kept merely because technical storage remains available.

• Contacts, subscriptions, campaigns, templates, and workspace configuration: While needed for the active Service, subject to Customer's deletion instructions and post-termination deletion.
• Mailboxes and received message content: The workspace's applicable retention setting; available retention tiers range from 7 to 730 days. The selected setting must be recorded for Customer's workload.
• Sending, delivery, and engagement records: The record-type and feature retention settings disclosed for the selected Service and retained with the applicable written instructions. Message content, temporary attachments, queued work, exports, and reporting records have different lifecycles; a single email-event period is not a limit for all these categories.
• Analytics, audit, and security records: Purpose-limited retention; some reporting and audit records have an expiry of up to one year. Customer-identifiable records remain Personal Data even where summarized. Longer legally required business records are handled under Section 10.
• Support and AI data: Only as needed for the selected feature or support purpose and the retention terms verified for its provider and configuration. Customer's sending-region or mailbox setting does not automatically control those providers' storage.
• Backups: Residual copies remain protected, are unavailable for ordinary active use, and expire through the applicable documented backup cycle. If a backup is restored, applicable deletion instructions must be reapplied. The backup cycle and any exception must be disclosed in the processing record; this DPA does not promise a backup period that has not been verified.

10. Processing as a Controller

Simply Send acts as an independent Controller only to the extent it determines its own lawful purposes and means for account relationships, procurement and billing, legal compliance, fraud prevention, or security and administration of its business. That Processing and the relevant rights and legal bases are described in the Privacy Policy. The role follows the actual activity and law, rather than a label applied to a vendor or dataset. This Section does not convert recipient lists, message content, support copies of that content, or other Customer Data into independent-controller data simply because they are needed to provide or secure the Service.

Stripe may process billing and transaction data; Google Analytics and Microsoft Clarity process usage and interaction data subject to applicable consent and privacy settings; Slack may support internal business communications or independent sign-in. If any such activity instead Processes Customer Data on Customer's behalf, this DPA's Processor safeguards apply. No controller-purpose exception permits selling Customer Data, unrelated advertising, or generalized AI training contrary to Section 2.

11. Term, Liability, and Precedence

This DPA continues while Simply Send or an authorized Subprocessor retains Customer Data on Customer's behalf. The Agreement governs commercial terms, warranties, indemnities, liability allocation, and dispute resolution except where this DPA, applicable transfer clauses, or mandatory law provides otherwise. To the extent legally permitted, inter-party claims under this DPA are subject to the Agreement's aggregate liability framework and do not create an additional separate liability cap. Customer's responsibility for unlawful content or instructions does not excuse Simply Send's own breach or make Customer indemnify Simply Send for liability that law requires Simply Send to bear.

Nothing in the Agreement or this DPA excludes or reduces liability that cannot lawfully be excluded, the enforceable rights of Data Subjects, the powers of supervisory authorities, or liability and contribution rights under GDPR Article 82 and Clause 12 of the applicable EU SCCs. The Agreement's arbitration, forum, third-party service, and security disclaimers do not limit those rights or the mandatory SCC forum and remedy provisions. Simply Send cannot disclaim its required responsibility for Subprocessors by referring to a third party's terms.

For conflicts on Personal Data Processing, mandatory law and applicable transfer clauses take priority, followed by this DPA and its agreed processing schedules, then the remainder of the Agreement. A schedule may add details or stronger safeguards but may not reduce mandatory protections. Contract changes cannot alter the approved SCC text beyond permitted selections or authorize new purposes without a lawful documented instruction. Required notices and Subprocessor-change procedures continue to apply.

Questions and privacy requests may be sent to [email protected]. Simply Invent Labs LLC's full company postal address appears in the company-signed DPA available to authorized workspace owners under Account → Documents. The public reference page omits that address. Company contact details and a completed copy will also be supplied to individuals and authorities where legally required, subject only to permitted redactions.

12. Additional Privacy Terms

Where Customer Data is subject to the California Consumer Privacy Act as amended ("CCPA") and Simply Send acts as Customer's service provider or contractor, the limited business purposes are the selected communication, storage, contact management, reporting, support, and security functions in Annex 1. Simply Send will not sell or share that data as those terms are defined in the CCPA; use, retain, or disclose it outside those specified purposes or the direct business relationship; or combine it with information from other customers or its own consumer interactions except as the CCPA permits. Simply Send certifies that it understands and will comply with those restrictions and will provide the level of privacy protection required by the CCPA.

Customer may take reasonable and appropriate steps under Section 7 to verify the permitted use and stop or remediate unauthorized use. Simply Send will inform Customer if it determines it can no longer meet these obligations, cooperate with lawful consumer requests, and impose the required written restrictions on any further service provider. For other applicable US state privacy laws, the parties' Controller and Processor obligations, assistance, confidentiality, audits, deletion, and subcontracting arrangements under this DPA apply to the extent those laws require. These terms do not represent that a law applies to a party where its statutory scope or thresholds are not met.

Annex 1: Parties and Processing Details

A. Parties and electronic execution

Data importer — Simply Send: Simply Invent Labs LLC, doing business as Simply Send, United States. Privacy contact: Privacy and Data Protection, [email protected]. The company postal address is supplied in the authenticated company-signed copy. Its role is Processor for Module Two and Subprocessor for Module Three. Its relevant activities are operating the email communication Service, including instructed delivery, storage, reporting, security, and support as described in Annex 1.B. The company representative is Janeev Joy, Founder & CEO; the company-signed copy records the company signature and date.

Data exporter — Customer: The company or individual entering into the Agreement for the root workspace. Its legal name, postal address, and contact details are those supplied in the Agreement, the root workspace's Company profile, or an applicable order, which are incorporated into this Annex for the covered Service. The authorized accepting representative is the Customer contact unless Customer designates another privacy contact in writing. Customer acts as Controller under Module Two when it determines the purposes and means of Processing, or as Processor under Module Three when acting on its Controller's documented instructions. Its relevant activity is using Simply Send for the communication and related functions described in Annex 1.B.

The binding electronic acceptance of the Agreement and this DPA supplies the Customer signature and effective date for the incorporated SCCs. Simply Send retains the accepting representative's account identity, root workspace identity, confirmation, acceptance time, and the company details supplied at acceptance, and provides an acceptance receipt through Account → Documents. Later profile edits do not alter that saved record. Customer must keep its legal and contact information accurate and supply any missing address, privacy contact, representative, or transfer details needed for the applicable SCCs. The Agreement, this DPA and its annexes, the company-signed copy, and those incorporated Customer records together describe the arrangement; a separate customer-specific PDF or handwritten countersignature is not required solely to restate information already supplied. Required missing information is not deemed supplied by a click, download, or generic workspace name.

B. Processing and transfer description

• Subject and duration: The agreed email communication Service and related functions during the Agreement and until required return or deletion is complete. Any other channel requires a feature-specific agreement or disclosure.
• Individuals: Customer's message senders and recipients, contacts and subscribers, authorized workspace users where processed on Customer's behalf, and other people whose data Customer lawfully includes in the selected Service.
• Data: Names, email addresses, contact attributes and consent or subscription status, message subjects and bodies, headers and attachments, sender domains, routing and delivery identifiers, delivery or engagement events where enabled, mailbox content, and necessary IP addresses, timestamps, and technical metadata. Phone numbers, audio, transcripts, and AI inputs or outputs apply only to separately agreed features that actually use those categories.
• Intake and storage: Customer submits data through the API, SMTP, web portal, or an enabled integration. Selected contacts, lists, campaigns, templates, messages, and attachments may be stored in application databases or object storage, with queues used for processing and retries.
• Transmission and delivery: The Service routes messages and necessary attachments and addressing data through the configured delivery provider, currently including AWS SES or OCI for the applicable email route. Recipient email providers and Customer-selected endpoints receive the instructed messages or events under their applicable relationship with Customer or the recipient. Simply Send does not control data once independently held by a recipient.
• Regional infrastructure and SMTP transit: The region selected before signup identifies the regional account and email infrastructure, including US East or Frankfurt for supported AWS and OCI workloads where offered. Login and account services, workspace records, domain configuration, and core email processing and storage use that selected region. A regional delivery selection is not a commitment that all Customer Data remains in that region. The currently US-hosted Simply Send SMTP bridge processes submissions in the United States before forwarding them to the configured delivery workflow, including for Frankfurt-selected delivery. This transit includes addressing, message content, headers, and attachments. The bridge is not a long-term message archive, but transient memory and temporary attachment files may be used during processing. Operational and security logs can include IP addresses, account, session and message identifiers, sending domains, timestamps, and error information; such metadata may be Personal Data and remains subject to applicable retention and safeguards. Downstream storage, queues, logs, and provider processing remain governed by their respective settings. Future regional SMTP availability does not change these current disclosures until implemented and disclosed.
• Customer-selected connections: Authorized integrations can import selected contact data, configure a Supabase project's SMTP settings and credentials, submit WordPress email requests, or exchange selected event payloads. An authorized MCP client can submit tool inputs and receive permitted results, including personal data in contact records or email previews, within the selected workspace and permissions. The central provider page describes these flows and their role limits. Identity-provider sign-in alone does not authorize message-content access.
• Events and reporting: Delivery outcomes and, where enabled, opens and clicks are recorded for reporting, suppression and subscription controls, troubleshooting, and the agreed workflow. Customer is responsible for required tracking notices, consents, and feature choices.
• AI and support: User-requested template generation sends selected prompt and template context to OpenAI's API. Email-content review can send locally redacted subject and content to Google Gemini for safety screening; residual Personal Data remains protected. Authorized personnel and support providers may access data necessary to investigate a request or abuse issue. Optional Telnyx AI requires the separate disclosures and authorization in Section 4.
• Frequency: Transfers occur as users submit, receive, send, retrieve, or manage data and may be continuous for active workloads.
• Retention: The category-specific criteria in Section 9 and the workload's recorded settings apply. Data needed for a resolved temporary task is not retained as if it were permanent account content.
• Subprocessing: Section 4 identifies each authorized provider's function and the limits of its Processing. The incorporated provider disclosures and applicable Service settings identify the entities, processing countries, functions, and retention criteria for the services actually used. Additional or materially different Processing requires documented instructions and any necessary additional safeguards before it begins.
• Sensitive data: Restricted under Section 1. A separately approved sensitive-data use requires a documented risk assessment, lawful basis and authorization, restricted access, minimization, appropriate encryption or pseudonymization, and any additional retention, recording, or contractual safeguards required for that use.

C. Competent supervisory authority

For EU SCCs, the authority is determined under Clause 13 and incorporated into this Annex by the applicable rule: ordinarily the authority responsible for the EEA-established exporter; where the exporter is outside the EEA, the authority determined by the exporter's required representative or, where applicable, the location of the affected individuals under that Clause. For a Norwegian exporter, the Norwegian Data Protection Authority (Datatilsynet) applies where it is the competent authority under Clause 13. UK and Swiss authority details are included where those laws apply; any authority not determinable from these rules must be identified before relying on the SCCs. The governing law selected for the SCCs does not itself select the supervisory authority.

Annex 2: Technical and Organizational Security Measures

These measures describe the Service's safeguards by function. Any additional measures required for Customer's actual workload and transfer must be documented and agreed before the affected Processing. A provider's certification is not represented as Simply Invent Labs LLC's own certification.

• Service access and identity: Authenticated accounts and API credentials, role and workspace authorization, and permission checks restrict access to the relevant account and function. Customers manage authorized users and must secure their credentials; personnel access is limited by role and need.
• Transport: HTTPS/TLS protects supported web and API connections; supported SMTP submissions use the documented secure connection settings. Delivery onward to an external recipient depends on the provider policy and recipient server's TLS support. Opportunistic TLS does not guarantee encryption on every recipient delivery leg, and the Service is not end-to-end message encryption.
• Stored data: AWS application database and object storage services use encryption at rest and cloud access controls. Private storage policies and scoped access protect stored message files and attachments. The applicable Service settings and written security information identify provider-specific encryption and key arrangements for other services rather than assuming all providers use AWS keys.
• Tenant and service isolation: Workspace authorization, scoped database access, cloud IAM roles, and separate service permissions limit cross-account access. Confidential configuration and API secrets are handled through restricted service configuration and secret-management facilities.
• Minimization and AI controls: Only feature-relevant data is transmitted. Gemini review locally redacts identifying content and known Google-imported contact values and is withheld when sanitization fails. No generalized AI training is authorized. Optional AI providers require the verified purpose, retention, and onward-transfer restrictions in Section 4.
• Monitoring and traceability: Activity, access, error, and delivery records support troubleshooting and abuse detection. Their access and retention are limited to the applicable purpose. Logging must not be treated as permission to collect unnecessary message content or credentials.
• Availability and recovery: Managed cloud infrastructure, processing queues, retries, failed-work handling, and applicable database recovery settings support resilience. Recovery controls and backup scope depend on the selected workload; a customer-specific recovery-time or recovery-point guarantee requires a separate written commitment.
• Lifecycle and erasure: Record expiry, object-storage lifecycle rules, workspace mailbox settings, and account-deletion processors implement category-specific retention. Deletion instructions also apply to restored backups and provider-held copies as required by Section 9.
• Organizational controls: Confidentiality restrictions, need-based personnel access, incident escalation and cooperation under Section 6, and Subprocessor due diligence and written restrictions under Section 4 apply to Customer Data. Simply Send will regularly assess the effectiveness of the safeguards and address identified risks as required by Article 32.
• Assurance and review: Available architecture and security evidence and relevant provider assurance information are supplied through the Section 7 process. Assessments and audits must reflect measures actually operating for the workload, including support, AI, secondary delivery, and backup paths.