Data Processing Agreement

1. Scope

This Data Processing Agreement applies when Ludoitte Oy processes personal data on behalf of a business customer using Evermail. It supplements the Terms of Service and Privacy Policy.

2. Processing Instructions

Evermail processes email archive data only to provide the Service, including upload, storage, indexing, search, export, deletion, security monitoring, and support.

3. Sub-Processors

Evermail uses Microsoft Azure for hosting, storage, database, monitoring, and secrets management. Stripe processes billing data. Optional Azure OpenAI features are used only when enabled by the customer.

4. Data Return And Deletion

During an active subscription, cancellation grace period, or service wind-down window, tenant administrators may request an Exit Package containing available tenant archive data. Zero-Access archives are returned as ciphertext and metadata; Evermail cannot decrypt them without customer-held key material.

After the applicable export window ends, Evermail deletes or anonymizes customer data according to the Terms, Privacy Policy, and configured retention rules.

5. Security Measures

Evermail uses tenant isolation, encryption in transit, encryption at rest, role-based access control, audit logging, least-privilege operations, and guarded export/deletion flows.

6. Breach Notification

If Evermail becomes aware of a personal data breach affecting customer data, we will notify affected customers without undue delay and provide information reasonably needed for GDPR compliance.

7. Contact

For DPA questions, contact privacy@evermail.ai.