Data Processing Addendum
Last updated 10 August 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Louis & Schwartz Group, LLC, a Delaware limited liability company operating the Faivelo service (“Faivelo”, “we”, “us”) and you, the customer (“Customer”). It applies automatically, without signature, wherever Faivelo processes personal data on your behalf and the GDPR, UK GDPR, or Swiss FADP applies to that processing. If you need a countersigned copy for your records, email support@faivelo.com and we will provide one.
For clarity: this DPA covers the data you are the controller of and we process for you — above all campaign/newsletter recipient data and the contents of mailboxes we host on your behalf. For the account data Faivelo collects as a controller (your login, billing, and usage data), the Privacy Policy applies instead.
1. Subject matter, duration, nature and purpose
Faivelo processes personal data on the Customer’s behalf as necessary to provide the email hosting, webmail, migration, campaign, and related services described in the Terms (the “Service”), for the duration of the Customer’s use of the Service plus the deletion windows in Section 9 of the Privacy Policy. The nature of the processing is the hosting, storage, transmission, receipt, filtering, and display of email and files, and the sending and delivery-tracking of campaigns the Customer initiates.
2. Categories of data subjects and personal data
Data subjects: the Customer’s mailbox users, email correspondents, campaign and newsletter recipients, contacts, and meeting or file-share participants. Categories of data: names and email addresses; the content and metadata of email messages, attachments, contacts, calendars, and files the Customer stores or transmits; campaign delivery and engagement events (sends, bounces, opens, clicks, unsubscribes); and credentials for external mailboxes the Customer submits for migration. The Service is not intended for special categories of data (Art. 9 GDPR), though email content is under the Customer’s control and may incidentally contain any category.
3. Documented instructions
Faivelo processes this data only on the Customer’s documented instructions — namely this DPA, the Terms, and the Customer’s use and configuration of the Service’s features — unless processing is required by law, in which case we will inform the Customer before processing (unless the law prohibits it). We will tell you if, in our view, an instruction infringes data-protection law.
4. Confidentiality and security
Persons authorised to process the data are bound by confidentiality obligations. Faivelo implements the technical and organisational measures described in Section 8 of the Privacy Policy — including TLS in transit, AES-256 encryption at rest, encrypted credential storage, least-privilege access, and audit logging — as required by Art. 32 GDPR, taking into account the state of the art and the risks of the processing.
5. Subprocessors
The Customer generally authorises the subprocessors listed in Section 6 of the Privacy Policy (currently Amazon Web Services, Stripe, Vercel, Neon, and Upstash, plus any DNS registrar the Customer connects). Faivelo remains fully liable for its subprocessors and imposes data-protection obligations on them equivalent to this DPA. We will give notice as described in the Privacy Policy before adding or replacing a subprocessor that processes customer content; if the Customer reasonably objects, the Customer may terminate the affected Service and export their data.
6. Assistance, breach notification, and audits
Taking into account the nature of the processing, Faivelo will assist the Customer with data-subject requests (the Service’s self-service export, deletion, and suppression-list features are the primary mechanism) and with the Customer’s obligations under Arts. 32–36 GDPR. Faivelo will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s data, with the information reasonably needed for the Customer’s own notification duties. Faivelo will make available the information reasonably necessary to demonstrate compliance with this DPA and, no more than once per year and under confidentiality, allow audits by the Customer or their mandated auditor; we may first satisfy an audit request with current third-party attestations and documentation of our subprocessors’ certifications.
7. Deletion and return
On termination, or when the Customer deletes a mailbox, domain, recipient list, or their account, Faivelo deletes the associated personal data as described in Section 9 of the Privacy Policy, unless law requires longer storage. Before deletion the Customer can retrieve their data via the Service’s export features and standard protocols (IMAP/JMAP).
8. International transfers
Where the processing involves a transfer of EEA, UK, or Swiss personal data to Faivelo in the United States, the parties conclude the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference with: the Customer as data exporter and Faivelo as data importer; option 2 of Clause 9(a) with the notice period in Section 5; the option in Clause 11(a) not exercised; Clause 17 option 1 with Irish law governing; Clause 18(b) designating the courts of Ireland; and Annexes I–III populated by Sections 1–2 and 4–5 of this DPA. For UK transfers, the ICO’s International Data Transfer Addendum applies with the tables completed by the same details; for Swiss transfers, the Clauses apply adapted as required by the FDPIC. Where a subprocessor is certified under the EU–US Data Privacy Framework, we may rely on that certification instead for the onward transfer.
9. Liability and precedence
Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where data-protection law does not permit such limitation. If this DPA conflicts with the Terms, this DPA prevails for the processing it covers; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.
10. Contact
Questions about this DPA, subprocessor notices, and audit or countersignature requests: support@faivelo.com, or by post to Louis & Schwartz Group, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.