Data Processing Addendum

1. Details of the Processing

• Subject matter and purpose: providing the services the customer orders: Business Email, Cloud Hosting, SEO audits, ahref.is short links, and related support.
• Nature: storing, hosting, transmitting, crawling, redirecting, backing up and deleting data, and accessing it when needed for support or security.
• Duration: while the service runs, until the data is deleted as described in section 9.
• Types of personal data: whatever the customer chooses to store, such as email messages, addresses and headers; contacts and calendars; files and databases of hosted websites; personal data on crawled web pages; link destinations and notes; and report recipients. Special categories of data only if the customer chooses to store them.
• Data subjects: the customer's staff, users, customers, correspondents and website visitors, and other people whose data the customer stores.

2. Customer Instructions

Maxspell processes customer personal data only on the customer's documented instructions. The Terms, the customer's settings and use of the services, and written requests from team owners or admins are those instructions. Maxspell may also process data when EU or Finnish law requires it, and then tells the customer first unless the law forbids it. Maxspell tells the customer if it believes an instruction breaks data protection law.

The customer is responsible for having a lawful basis for the personal data it stores and for its instructions.

3. Confidentiality

Only people who need access to provide the services can access customer personal data, and they are bound by confidentiality. Maxspell does not read mailbox or website contents except when the customer asks, to handle a security incident or abuse report, or when the law requires it.

4. Security Measures

Maxspell protects customer personal data with measures suited to the risk, including:

• encryption of all connections with TLS;
• access checks on every request so that each team sees only its own data;
• passwordless sign-in for customers and strong keys for administrative access, limited to the people who run Maxspell;
• encryption at rest of credentials and other secrets;
• servers in the European Union from infrastructure providers with recognized security certifications;
• regular backups, monitoring, logging and security updates.

Maxspell may update these measures as long as the overall level of protection does not decrease.

5. Sub-processors

The customer gives general authorization for the sub-processors on our Sub-processors page. Maxspell gives each sub-processor data protection obligations at least as protective as this DPA and remains responsible for them.

Maxspell announces a new or replaced sub-processor on that page and by email to team owners at least 30 days before it starts processing customer personal data. The customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the customer may end the affected service and receive a refund of the unused part of prepaid fees.

6. Transfers Outside the EU

Maxspell transfers customer personal data outside the EU/EEA only as listed on the Sub-processors page, and only with a valid safeguard under Chapter V of the GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.

7. Assistance

Taking into account the nature of the processing, Maxspell helps the customer to answer data subject requests, mainly through the features of the services, and to meet its duties on security, breach notification, data protection impact assessments and prior consultation. If a data subject contacts Maxspell directly about customer personal data, Maxspell refers them to the customer.

8. Personal Data Breaches

Maxspell notifies the customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice describes the breach, the likely consequences, the measures taken, and a contact person, as far as that information is available, and is updated as more becomes known.

9. Return and Deletion

The customer can export its data with the services while they are active. When a service ends, as described in the Terms of Service, Maxspell deletes the customer personal data in it, and the data leaves backups within 30 days, unless the law requires Maxspell to keep it.

10. Information and Audits

Maxspell makes available the information needed to show compliance with this DPA, first through written answers and documentation. If that is not enough, the customer or an independent auditor bound by confidentiality may carry out an audit, with at least 30 days' notice, during business hours, at most once a year (unless a breach or a supervisory authority requires more), and at the customer's cost.

11. Liability and Precedence

The limitation of liability in the Terms applies to this DPA, to the extent the GDPR allows. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

12. Contact

Data protection questions and notices: [email protected]. Maxspell, Adjutantinkatu 1 A 5, 02650 Espoo, Finland.