Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Scott John Mathews trading as Space Cake ("Processor", "Space Cake"), and applies where we process personal data on your behalf in providing the Service. Where there is a conflict on data protection, this DPA prevails.

1. Roles

For the customer emails and contacts processed through your connected inboxes, you are the Controller and we are the Processor. Each party will comply with UK GDPR and the Data Protection Act 2018 as applicable to it.

2. Scope and purpose

• Subject matter: processing of email content and contacts to classify messages and draft replies.
• Duration: for as long as you use the Service, plus deletion periods below.
• Data subjects: your customers and contacts who email you.
• Data types: names, email addresses, message content, and any personal data your contacts include in their messages.

3. Our obligations

• Process personal data only on your documented instructions, including as set out in the Service and these terms.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures, including encryption in transit and at rest and strict isolation between customers.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification, and impact-assessment obligations.
• Notify you without undue delay after becoming aware of a personal-data breach.

4. Sub-processors

You authorise us to engage sub-processors (for example hosting, email delivery, payment, and AI providers) to support the Service. We impose data-protection terms on each sub-processor no less protective than this DPA, and remain responsible for their performance. We will inform you of changes to sub-processors and give you a chance to object on reasonable grounds.

5. International transfers

Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or an adequacy decision.

6. Return and deletion

On termination, or on your request, we will delete or return personal data we process on your behalf within a reasonable period, except where retention is required by law. You can also delete your data through the Service.

7. Audits

On reasonable request and notice, we will make available information necessary to demonstrate compliance with this DPA, subject to confidentiality.

8. Contact

Data protection contact: contact@spacecake.one. Postal contact: 31 Holcroft Drive, Wigan, WN2 5YP, United Kingdom.