In short: You (the customer) are the controller of the email we filter. We are your processor and act only on your instructions. Processing takes place in Türkiye under the EU Standard Contractual Clauses and the UK Addendum. This addendum applies automatically when you accept our Terms of Service. If you need a signed copy, email info@spambil.com.
1. Parties and scope
This Data Processing Addendum ("DPA") is part of the agreement between the customer that uses the Spambil service ("Customer") and JusBil Yazılım Teknoloji Otomotiv Ltd. Şti., Fevzi Çakmak Mah. Büklü Sk. No:16 İç Kapı No:2, Pendik / İstanbul, Türkiye, MERSİS 0484234383100001 ("JusBil", "Processor"). The agreement consists of the Terms of Service and any order or other written agreement for the Service (together, the "Agreement").
This DPA applies whenever JusBil processes personal data on the Customer's behalf in providing the Service ("Customer Personal Data") and that processing is subject to the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP") or other data protection laws that require such terms (together, "Data Protection Law"). Terms such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR. If this DPA conflicts with the Agreement, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
This DPA does not cover personal data that JusBil processes as a controller, such as account holder contact details, billing records and website analytics. That processing is described in our Privacy Policy.
2. Roles of the parties
The Customer is the controller, or where the Customer acts for its own clients, a processor, of Customer Personal Data. JusBil is the Customer's processor, or sub-processor where the Customer is itself a processor. The Customer is responsible for having a lawful basis for the processing, for giving any notices to its users and correspondents that Data Protection Law requires, and for making sure that its instructions comply with the law.
3. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Inbound email security filtering for the domains the Customer registers with the Service. |
| Nature and purpose | Receiving email addressed to the Customer's domains, scanning it automatically for spam, viruses and phishing, relaying clean messages to the Customer's mail server, holding suspicious messages in quarantine, showing quarantine and filtering records in the Customer's panel, sending quarantine summaries, and applying the Customer's allow and block lists. |
| Duration | The term of the Agreement plus the deletion period in section 12. |
| Categories of data subjects | The Customer's users (mailbox holders at the protected domains), and people who send email to them (the Customer's correspondents, including senders of unsolicited email). |
| Categories of personal data | Email metadata (sender and recipient addresses, names in headers, sending server IP addresses and hostnames, subject, date, message identifiers, spam score and filtering result); email content and attachments, where they contain personal data; allow and block list entries. |
| Special categories | JusBil does not intend to process special categories of data. Email content may contain them incidentally, depending on what senders choose to write. Such content is processed only by automated scanning and is protected by the measures in section 6. |
| Frequency | Continuous, for as long as the Customer's MX record points to the Service. |
| Location | Email reception, scanning and quarantine storage take place on servers in Istanbul, Türkiye. Sub-processors listed in section 8 process limited data as described there. |
| Retention | Clean messages are relayed and not kept as mailbox copies. Quarantined messages are kept for up to 2 years and then deleted automatically, unless the Customer releases or deletes them earlier. Filtering logs are kept for the same purpose and deleted as described in section 12. |
4. Processing on documented instructions
JusBil processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's configuration of the Service (for example its domains, mail server address, allow and block lists and quarantine actions) are the Customer's complete instructions. Any additional instructions must be agreed in writing. JusBil will not use Customer Personal Data for any other purpose. In particular, it will not use it for advertising, will not sell it, and will not use email content to build profiles of individuals. JusBil will tell the Customer if it believes an instruction infringes Data Protection Law, or if it is legally required to process data other than on the Customer's instructions (unless the law prohibits that notice).
5. Confidentiality
Scanning is automated. JusBil ensures that everyone it authorises to access Customer Personal Data is bound by confidentiality obligations, and that access is limited to what is necessary to operate, secure and support the Service, for example investigating a delivery problem at the Customer's request.
6. Security measures
JusBil implements appropriate technical and organisational measures to protect Customer Personal Data. They include:
- Encryption in transit: TLS for the website, panel and APIs; TLS for SMTP connections to and from the Service whenever the other mail server supports it.
- Access control: administrative access to filtering servers is restricted to authorised personnel and protected by authentication. Customer panel access uses passwordless sign-in with short-lived, single-use codes, and HttpOnly, Secure session cookies. Each customer can only see the quarantine of its own domains.
- Data minimisation and deletion: clean mail is relayed rather than stored. Quarantined messages are deleted automatically at the end of the 2-year retention period.
- Maintenance: operating system and filtering software are kept up to date, including virus signature updates.
- Network protection: the website and panel are served through Cloudflare's network with DDoS and abuse protection.
- Resilience: email protocols retry delivery automatically, so temporary unavailability normally delays mail rather than losing it.
JusBil may update these measures over time, provided the overall level of protection is not reduced.
7. Assistance to the Customer
Taking into account the nature of the processing, JusBil will reasonably assist the Customer in responding to requests from data subjects exercising their rights, in carrying out data protection impact assessments and prior consultations, and in meeting its security obligations. Much of this can be done directly in the panel, for example by releasing or deleting quarantined messages. If JusBil receives a request directly from a data subject about Customer Personal Data, it will pass the request to the Customer and will not respond itself unless the Customer authorises it.
8. Sub-processors
The Customer gives general authorisation for JusBil to use sub-processors. The current sub-processors are:
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of the website, customer panel and APIs; account database | Quarantine metadata and message previews shown in the panel (in transit); allow and block list entries; account data | Global network, including the USA and EU |
| SMTP2GO | Sending service emails, including daily quarantine summaries to the Customer's users | Recipient addresses; sender addresses and subjects of quarantined messages listed in summaries | SMTP2GO data centres (see SMTP2GO's documentation) |
Email reception, scanning and quarantine storage are carried out on servers in Istanbul, Türkiye, that are operated by JusBil. As part of scanning, the Service may query public DNS-based reputation and blocklist services with sending IP addresses or domain names. It does not send message content to them.
JusBil imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for their performance. JusBil will announce any intended addition or replacement of a sub-processor by updating this page and emailing the Customer's account address at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service. Where the Customer has prepaid, it will receive a refund of the unused portion.
Paddle.com Market Limited (our reseller for international orders) and PayTR (payments in Türkiye) process billing data as independent controllers or as providers to JusBil. They do not receive Customer Personal Data covered by this DPA.
9. International transfers
Customer Personal Data is processed in Türkiye, which is not covered by an adequacy decision under the GDPR or UK GDPR. To the extent the Agreement involves a transfer of personal data from the EEA, the UK or Switzerland to JusBil, the parties agree that the following are incorporated into this DPA by reference and apply as follows:
- EEA: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module Two (controller to processor), or Module Three (processor to processor) where the Customer is itself a processor. The Customer is the data exporter and JusBil is the data importer. The optional docking clause (Clause 7) applies. Under Clause 9(a), Option 2 (general written authorisation) applies with the notice period in section 8 above. The optional language in Clause 11(a) does not apply. Under Clause 13, the competent supervisory authority is the one determined by the Customer's establishment or, where the Customer is not established in the EU, by the location of its EU representative or of the data subjects concerned. Under Clause 17 (Option 1), the SCCs are governed by the law of Ireland. Under Clause 18, disputes are resolved by the courts of Ireland. Annex I is completed by section 1 and section 3, Annex II by section 6, and Annex III by section 8.
- UK: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, as amended) ("UK Addendum"). Table 1 is completed with the parties' details in section 1. Table 2 refers to the SCCs as configured above. Table 3 is completed by sections 3, 6 and 8. For Table 4, either party may end the UK Addendum as set out in its Section 19.
- Switzerland: the SCCs as configured above, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority for transfers governed by the FADP, and "Member State" read to include Switzerland so that Swiss data subjects can enforce their rights in Switzerland.
JusBil has assessed the laws of Türkiye that apply to this processing and, in addition to the measures in section 6, will: review any request for access by a public authority for legality; challenge requests that it considers unlawful where appropriate; disclose only the minimum data required; and, where legally permitted, notify the Customer promptly of any such request. The Customer can request a copy of the SCCs with the completed annexes by emailing info@spambil.com.
10. Personal data breaches
JusBil will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will be sent to the Customer's account email address. As far as the information is available, it will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. JusBil will take reasonable steps to contain the breach and reduce its effects, and will provide further information as it becomes available. Notification is not an admission of fault.
11. Information and audits
On request, JusBil will make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, including written answers to reasonable security questionnaires. If this information is not sufficient, the Customer, or an independent auditor bound by confidentiality, may carry out an audit no more than once a year, unless a supervisory authority requires otherwise or following a personal data breach. The Customer must give at least 30 days' written notice, agree the scope and timing with JusBil in advance, and avoid disrupting JusBil's operations or compromising the security or confidentiality of other customers' data. Each party bears its own audit costs.
12. Deletion or return at the end of the Service
Before its subscription ends, the Customer can release any quarantined messages it wishes to keep to its own mail server from the panel. When the subscription ends, filtering for the Customer's domains stops. Any remaining quarantined messages and filtering records are deleted within 90 days, unless the law requires JusBil to keep them. Any data kept under a legal requirement remains protected by this DPA and is deleted when the requirement ends.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Law or the SCCs do not allow such limitation, in particular as regards data subjects' rights under the SCCs.
14. How this DPA takes effect
This DPA applies automatically and forms part of the Agreement when the Customer accepts the Terms of Service, for example by creating an account. No signature is required. If the Customer needs a countersigned copy for its records, it can email info@spambil.com with its legal name, address and contact person, and we will send one for signature. JusBil may update this DPA to reflect changes in law or in the Service. Updates will not reduce the protection of Customer Personal Data, and material changes will be announced by email in advance.
15. Contact
Data protection questions: info@spambil.com, +90 850 242 16 23, JusBil Yazılım Teknoloji Otomotiv Ltd. Şti., Fevzi Çakmak Mah. Büklü Sk. No:16 İç Kapı No:2, Pendik / İstanbul, Türkiye. You can also use our contact page.