Data Processing Addendum

Draft of 25 October 2026

This Addendum forms part of the Postilon Terms of Service between Kulina Pte. Ltd. (UEN 201530273G), which operates Postilon ("Postilon") and the Customer, and governs how Postilon processes personal data in Customer Data on the Customer's behalf. It is published at postilon.com/legal/dpa and applies without signature; a countersigned copy is available on request.

1. Scope and roles

1. Roles. For personal data in Customer Data (the emails the Customer sends through Postilon, its recipients' addresses and the events recorded for them), the Customer is the controller (pengendali data pribadi) and Postilon is the processor (prosesor data pribadi). Where the Customer is itself a processor for its own client, Postilon is its subprocessor and this Addendum applies the same way.
2. Laws. This Addendum is written to meet Article 28 of the GDPR and UK GDPR, Articles 51 and 52 of Indonesia's UU No. 27 of 2022 (UU PDP), and Singapore's PDPA 2012, as they apply to the processing.
3. Customer's responsibilities. The Customer is responsible for having a lawful basis, including consent where required, for every recipient, and for the instructions it gives through the API, the dashboard and its settings.
4. Duration. This Addendum lasts as long as Postilon processes Customer Data for the Customer.

2. Postilon's commitments

Postilon will:

1. Process Customer Data only on the Customer's documented instructions, which are these Terms, this Addendum and the Customer's use of the API, the SMTP relay and the dashboard, unless the law requires otherwise; in that case Postilon tells the Customer first, unless the law forbids it.
2. Tell the Customer if it believes an instruction breaks data protection law.
3. Make sure everyone authorised to process Customer Data is bound by confidentiality.
4. Apply the security measures in Annex II, and keep them at least as protective while this Addendum lasts.
5. Help the Customer answer requests from data subjects (access, correction, deletion and the other rights under the laws above), mainly through the dashboard and API: emails can be looked up, recipients added to the suppression list, and data deleted by deleting the workspace. Postilon forwards any request it receives directly to the Customer.
6. Help the Customer, as far as reasonable and with the information Postilon holds, with data protection impact assessments and consultations with authorities.

3. Subprocessors and international transfers

1. Authorisation. The Customer authorises the subprocessors in Annex III. Postilon binds each by written terms that protect Customer Data at least as well as this Addendum, and stays responsible for them.
2. Changes. Postilon gives at least 30 days' notice, by email to account owners and on postilon.com/legal/subprocessors, before a new subprocessor processes Customer Data. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Customer may end the agreement and receive a refund of unused paid credits.
3. Transfers. Customer Data is stored in the United States (Google Cloud, us-east4) and may be accessed from Indonesia and Singapore. For transfers of EU personal data, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, or Module 3 where the Customer is a processor), with the UK Addendum for UK personal data; they are incorporated by reference, with Annexes I to III of this Addendum as their annexes and the law and courts of [Ireland] for the Clauses, which must be those of an EU member state (Clauses 17 and 18). For Indonesian personal data, Postilon transfers only where UU PDP Article 56 allows it, relying on these contractual safeguards. For Singapore personal data, Postilon meets the PDPA's Transfer Limitation Obligation through this Addendum.

4. Breaches, deletion, audits and precedence

1. Breaches. Postilon notifies the Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with what it knows of the nature, the data and people affected, the likely consequences and the measures taken. It sends updates as it learns more. This lets the Customer meet its own deadlines, including 3 x 24 hours under UU PDP.
2. Retention and deletion. While the agreement lasts, Customer Data is kept only as long as the Privacy Policy states (email bodies 30 days, emails and events 90 days, logs 30 days). When the agreement ends, Postilon deletes the remaining Customer Data within 30 days, and backup copies expire within 7 days after that, unless the law requires keeping them. The Customer can export what it needs through the API before deleting its workspace.
3. Audits. Postilon answers the Customer's reasonable security questionnaires and makes available the information needed to show compliance with this Addendum. If that is not enough, or an authority requires it, the Customer may audit once a year with 30 days' notice, during business hours, through an auditor bound by confidentiality, at its own cost.
4. Liability. Each party's liability under this Addendum is subject to the limits in the Terms, except where the law does not allow them.
5. Precedence. If this Addendum conflicts with the Terms, this Addendum prevails for the processing of personal data; the Standard Contractual Clauses prevail over both where they apply.

Annex I: Details of the processing

Annex II: Security measures

Annex III: Subprocessors

The current list is kept at postilon.com/legal/subprocessors.