Data Processing Addendum (DPA)

Placeholder. A counsel-reviewed DPA will land before the first sender goes live.

Parties and roles

Senders integrating Keepable act as Data Controllers for the personal data they cause to be delivered. Keepable acts as a Data Processor for that content and as an independent Controller for recipient identity data.

Sub-processors

Keepable maintains a current sub-processor list and notifies controllers ahead of material changes. Cross-border transfers run on Standard Contractual Clauses or NDPC-issued Adequacy Decisions where available.

Security measures

Keepable applies the technical and organisational measures detailed in our Security page, including encryption in transit and at rest, key management via AWS KMS, append-only audit trails, and 72-hour breach notification per the NDPA.

---

For DPA execution requests, contact legal@keepable.co.