Data processing agreement

Controller

The customer that holds the Elmetry account ("you")

Processor

ECTELECO CARRIER MOBILE LIMITED, trading as Elmetry ("we")

Company registration

Registered in England & Wales No. 17475876

Registered office

Tenace, 106-2 Regus Atterbury Lakes, Fairbourne Drive, Atterbury, Milton Keynes, Buckinghamshire MK10 9RG, United Kingdom

Data protection contact

[email protected]

This Data Processing Agreement ("DPA") forms part of our Terms of Service and applies whenever we process personal data on your behalf in providing the service ("Customer Personal Data"). It is made under Article 28 of the UK GDPR and the Data Protection Act 2018. Where the EU GDPR also applies to your processing, the same terms apply as if the references were to it. If this DPA conflicts with the Terms of Service on anything about personal data, this DPA prevails.

Personal data we hold about you as an account holder (your login, billing and support records) is not Customer Personal Data: we are the controller of it, as our privacy notice explains.

• Instructions: we process Customer Personal Data only on your documented instructions, including with regard to international transfers. The Terms of Service, this DPA, your API calls and your console settings are your instructions. If the law requires other processing, we will tell you first unless the law forbids it.
• We will tell you promptly if we believe an instruction infringes data protection law.
• Confidentiality: everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
• Security: we apply the measures in section 5.
• Sub-processors: we engage them only as section 6 allows.
• Data subject rights: we help you respond to requests as section 9 sets out.
• Assistance: taking into account the nature of the processing and the information available to us, we help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO (Articles 32 to 36).
• End of processing: we delete or return Customer Personal Data as section 11 sets out.
• Information and audit: we make available the information needed to show compliance with Article 28 and allow audits as section 10 sets out.

• You have a lawful basis for the processing and have given data subjects any information the law requires.
• Your instructions comply with data protection law.
• You submit only the personal data the service needs, and no special category or criminal offence data unless it is strictly necessary and lawful.
• You are responsible for the security of your account credentials and API keys, and for what you do with results and exports once they leave our service.

• Encryption in transit: the console and API are served over HTTPS (TLS).
• Credentials: passwords are stored only as bcrypt hashes; API keys are stored only as hashes and shown once, when they are created; either can be revoked at any time.
• Access control: each customer's data is isolated to its own project; project admins control who in the customer's team has access; our staff access production systems only where their role needs it.
• Rate and attempt limits on email verification codes, API key authentication and API calls, to resist guessing and abuse.
• Audit trail: security-relevant console actions (such as creating or revoking keys, changing passwords and team changes) are logged with who did them and when.
• Operations: our servers are hosted in the United Kingdom; we keep backups and review and update these measures as risks and technology change.

We impose data protection obligations on each sub-processor by written contract that are no less protective than this DPA, and remain liable to you for their performance. We will tell you by email or in the console at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may end the affected service and we will refund unused prepaid balance for it.

The current list, with each provider's name where we have one, what it does, where it processes data and the transfer safeguard, is published on our sub-processor list. You can also ask for it at [email protected].

Items sent to messaging platforms

A classification check works by asking a messaging platform's own spam system how it classifies the item. When you submit a Sender ID or URL for a check, you instruct us to disclose that item to the platform. The platform receives only that Sender ID or URL, not your account details or the rest of your submission. It is not our sub-processor: it handles the item under its own terms and privacy policy, not under a processing contract with us, and may do so outside the United Kingdom. The safeguards in section 7 do not apply to this disclosure.

Because of this, do not submit for a check any item that contains personal data you are not entitled to disclose to the platform, such as a URL with a customer's name, email address or access token in it.

Apart from the items you instruct us to send to messaging platforms (section 6), we will transfer Customer Personal Data outside the UK only where the destination is covered by UK adequacy regulations (including the UK–US Data Bridge for certified US organisations), or under the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment. Where you are established outside the UK and we transfer data back to you, the parties will put in place whichever of these mechanisms the law requires.

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any event within 48 hours, by email to your account's registered address. We will tell you, as far as we know them, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and will update you as more becomes known. We will take reasonable steps to contain the breach and help you meet your own notification duties to the ICO and data subjects. Notifying you is not an admission of fault.

If a data subject contacts us about Customer Personal Data, we will pass the request to you without undue delay and will not respond to it ourselves except to tell them we have done so. Taking into account the nature of the processing, we will help you by appropriate technical and organisational measures to answer requests to access, correct, erase, restrict, port or object to processing of their data, including by finding and deleting specific items you submitted.

We will answer your reasonable written questions about our compliance with this DPA. If that is not enough to show compliance, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance once in any 12 months, on at least 30 days' written notice, during business hours and without undue disruption to our operations or other customers' data. Each party bears its own costs of an audit.

While your account is active you can retrieve check results through the console and API, and ask us to delete specific items at any time. When the Terms of Service end, you can ask us within 30 days to return Customer Personal Data in a structured, machine-readable format. We will then delete it, including copies, within 90 days of the end of the Terms of Service, and confirm this in writing if you ask, unless the law requires us to keep it. Backups are overwritten in the normal backup cycle and are not restored except to recover the service.

Each party's liability under or in connection with this DPA is subject to the limits in the Terms of Service, except where the law does not allow it to be limited. This DPA lasts as long as we process Customer Personal Data, and the obligations in it survive the end of the Terms of Service until the data has been deleted or returned.

Version

2026-11

Effective date

1 November 2026

We may update this DPA to reflect changes in law or in how the service works; we will not reduce the protection it gives Customer Personal Data without your agreement, and we tell account holders of material changes as the Terms of Service describe. If you need a countersigned copy for your records, write to [email protected].

Terms of Service

2026-11

Acceptable Use Policy

2026-10

Privacy Notice

2026-11

Sub-processors

2026-10

Complaints Procedure

2026-10

Accessibility Statement

2026-10