← PlainMailOS

Data Processing Addendum

Last updated: 5 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Business Lead Intelligence, a sole proprietorship in Mumbai, India, operating PlainMailOS ("Processor", "we"), and the organization using the Service ("Customer"). It applies when we process personal data on the Customer's behalf, for example the mail of the Customer's staff. It applies automatically to every organization on a paid plan; to receive a countersigned copy, email grievance@plainmailos.com.

1. Roles

The Customer is the controller (or "data fiduciary" under India's DPDP Act) of personal data in the mailboxes and accounts it connects to the Service. We are its processor. We process that data only to provide the Service and only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use and configuration of the Service. If we believe an instruction breaks the law, we will tell the Customer.

2. What we process

  • Data subjects: the Customer's users, and the senders and recipients of mail in connected mailboxes.
  • Personal data: names, email addresses, message metadata and content, attachment metadata, account and sign-in data.
  • Purpose and nature: storing, indexing, classifying and displaying mail and related information to the Customer's authorized users.
  • Duration: for the term of the Customer's use of the Service, then as described in §9.

The Customer must not use the Service to process special categories of personal data unless it has a lawful basis to do so.

3. Confidentiality

Everyone we authorize to process Customer personal data is bound by confidentiality. Our staff do not read Customer mail except where the Customer asks us to (for example, for support), where necessary for security, or where required by law.

4. Security

We maintain appropriate technical and organizational measures, described on our security page, including encryption in transit and of credentials at rest, access control enforced on our servers, backups and monitoring. We may update these measures as long as the overall level of protection does not decrease.

5. Sub-processors

The Customer authorizes the sub-processors listed on our sub-processors page. We will give at least 14 days' notice before adding or replacing a sub-processor that processes Customer personal data (on that page, and by email to Customers who ask), during which the Customer may object on reasonable data-protection grounds; if we cannot address the objection, the Customer may terminate the affected Service. We impose data-protection obligations on each sub-processor at least as protective as this DPA and remain responsible for their performance.

6. Assistance

Taking into account the nature of the processing, we will help the Customer respond to requests from data subjects (access, correction, deletion, portability and objection), and with data-protection impact assessments and consultations with regulators, as far as these relate to our processing. If a data subject contacts us directly about Customer data, we will refer them to the Customer.

7. Personal data breaches

We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer personal data. We will describe what happened, the data affected, its likely consequences and the measures taken, and keep the Customer informed.

8. International transfers

Customer personal data is stored in the United States and may be processed by sub-processors in other countries. Where the law of the Customer's country requires safeguards for such transfers (including the EU GDPR and UK GDPR), the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where the Customer is itself a processor), together with the UK International Data Transfer Addendum where applicable, which are incorporated by reference with the details in §2 of this DPA.

9. Deletion and return

The Customer can export or delete data through the Service where available, or ask us to. When the Customer's use of the Service ends, we will, at its choice, return or delete Customer personal data within 30 days of a written request, and delete it in any case within 90 days of the end of the subscription, except where the law requires us to keep it. Backups are overwritten within 14 days.

10. Audits

We will make available the information reasonably necessary to show compliance with this DPA and respond to the Customer's reasonable written questions. Where that is not enough, the Customer may audit our compliance, at its own cost, once a year with 30 days' notice, under confidentiality, without access to other customers' data and without disrupting the Service.

11. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data; the Standard Contractual Clauses prevail over both where they apply.