Data Processing Addendum

Last updated 2026-09-29 · v1.2

This Data Processing Addendum forms part of the Terms of Service between you ("Controller") and True North Tech Group LLC, Wyoming, USA ("Processor", "Cosend"). It applies automatically to every customer and needs no signature to be in force. §14 covers the case where your procurement team needs a countersigned copy.

Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails.

1. Scope and roles

You are the controller of the personal data Cosend processes on your behalf. We are the processor. We process that data only to provide the service and only on your instructions.

For our own account and billing data we are the controller, and our Privacy Policy governs it. That data is outside this DPA.

2. Subject matter, duration, nature and purpose

3. Instructions

We process personal data only on your documented instructions, which are: these terms, your configuration of the service, and any further written instruction you give us. We tell you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law.

If we are required by EU or member-state law to process beyond your instructions, we inform you of that requirement before processing, unless the law forbids it.

4. Confidentiality

Everyone we authorise to process your personal data is bound by a duty of confidentiality, and access is limited to those who need it to operate or support the service.

5. Technical and organisational measures

We implement measures appropriate to the risk, under Art. 32. The full description is at /security and this DPA incorporates it by reference. One description of our security that can drift is better than two. In summary:

• Encryption at rest: AES-256-GCM envelope encryption for secrets and credentials, with a per-record key bound to the record it belongs to, so a copied ciphertext fails to decrypt rather than silently working.
• Tenant isolation at the database: row-level security on every table, with the application connecting through a role that cannot bypass it. Application code is not the mechanism.
• Encryption in transit: TLS on every connection, inbound and outbound.
• Signed webhooks, inbound and outbound, verified before the payload is parsed.
• Outbound request containment: one HTTP client with a destination allowlist and DNS re-resolution on every delivery, so a hostname that was public when it was registered cannot later be pointed at an internal address.
• No message content in error tracking: redaction is structural. Secrets and bodies are wrapped in a type whose serialisation returns a placeholder, rather than filtered by a pattern that can miss.
• Backups: point-in-time recovery plus our own nightly encrypted dump to storage we control, with restore drills.
• Audit logging of administrative and security-relevant events.

We may change these measures, provided the level of protection is not reduced.

6. Sub-processing

You give general authorisation for us to engage sub-processors. The current list is published at /subprocessors with each sub-processor's purpose, the categories of data it can access and where it processes them. That page is generated from the same source the service is configured from, and the same list is available as JSON at /subprocessors.json.

We give at least 30 days' notice before adding or replacing a sub-processor, by email to your account's administrative contact. If you reasonably object on data-protection grounds within that period, tell us; if we cannot offer an alternative, you may terminate the affected part of the service without penalty and receive a pro-rata refund of any prepaid fees.

We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. International transfers

Your database, API hosting and automation execution are in Germany. Sub-processors outside the EEA are marked as such at /subprocessors.

Where personal data is transferred out of the EEA or the UK, the European Commission's Standard Contractual Clauses (Decision 2021/914) apply and are incorporated into this DPA, with Module Two (controller to processor) for transfers from you to us and Module Three (processor to processor) for onward transfers to our sub-processors. For UK transfers, the UK International Data Transfer Addendum applies. The optional docking clause applies; the governing law and forum are those of the Republic of Ireland unless the exporter's member state requires otherwise; and the annexes to those clauses are populated by §2, §5 and §6 of this DPA.

For Annex I: you are the data exporter and we are the data importer; the categories of data subject, of personal data and of processing are those in §2; the transfer is continuous for the duration in §2; and the competent supervisory authority is the one for the EEA member state in which you or your Art. 27 representative are established, or the Irish Data Protection Commission where you are not established in the EEA. Annex II is §5 and the description at /security; Annex III is the list at /subprocessors.

Google Maps Platform receives its data as an independent controller, not as our processor. When a member of your workspace opens a conversation that contains a shared location, their browser requests a map image from Google's Maps Static API, and that image is the only thing the request is for. It carries the location's coordinates, usually your contact's own location, and the viewing member's IP address, user agent and referrer. The referrer is only the dashboard's origin, never the address of the conversation. The data subjects are the person whose location it is and the member who views it.

We use the Maps APIs under the Google Maps Platform Terms of Service, which we accept with Google LLC and which incorporate Google's Controller-Controller Data Protection Terms. Google uses this data under its own Privacy Policy, not on your instructions or ours. So the obligations §6 says we impose on a sub-processor, our liability for its performance, the service-provider terms in §12 and Module Three above do not apply to it. The notice of changes in §6 does. For personal data from the EEA, Google's controller is Google Ireland Limited, in the EEA, and for personal data from the UK it is Google LLC. Where that data goes to Google LLC in the USA, Google's terms apply the EU-U.S. Data Privacy Framework and its UK Extension, under which Google LLC is certified.

8. Assistance and data subject requests

Taking into account the nature of the processing, we assist you with:

• Data subject requests. The dashboard lets you search, export, correct and delete the records we hold for you, which answers most requests without our involvement. Where it does not, email privacy@cosend.app and we will help. If a data subject contacts us directly about data we process for you, we do not respond on your behalf. We forward the request to you.
• Art. 32 to 36 obligations (security of processing, breach notification, data protection impact assessments and prior consultation), with the information available to us.

9. Breach notification

We notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting data we process for you. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we provide it in phases as it becomes available.

10. Audit

We make available the information necessary to demonstrate compliance with this DPA, and we allow and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice: for most requests, /security and this DPA are the answer. Where they are not, we will complete a reasonable security questionnaire. An on-site or remote inspection may be requested once in any 12-month period, on 30 days' notice, at your cost, subject to confidentiality, and scheduled so as not to disrupt the service, and immediately, without those limits, after a breach affecting your data.

11. Deletion and return

You can export your data at any time while your account is active. After termination we retain your data for 30 days so that you can export it, and then delete it. Deletion is hard deletion of the database row and the stored object, not a flag, and it propagates to backups as they age out under their own retention.

We retain what applicable law requires us to retain (billing and tax records in particular) and nothing else. Those records are listed in the retention table in our Privacy Policy.

12. California and other US state privacy laws

Where you are a business subject to the California Consumer Privacy Act, or to the comparable law of Colorado, Connecticut, Texas, Virginia or another US state, this section applies to the personal information we process for you, and the defined terms carry the meaning those laws give them.

• We are a service provider and a processor, not a third party. We process personal information only to perform the service for you, and for no other business or commercial purpose of our own.
• We do not sell it and we do not share it: not for money, not for other valuable consideration, and not for cross-context behavioural advertising.
• We will not retain, use or disclose it outside the direct business relationship between us, and we will not combine it with personal information received from anyone else, except where those laws expressly permit a service provider to do so.
• We tell you if we determine that we can no longer meet these obligations, and you may then take reasonable steps to stop and remediate any unauthorised use.
• You may take the steps in §10 to confirm that we use personal information consistently with your own obligations under those laws.
• We impose the same restrictions on every sub-processor, each of which acts as a service provider or contractor.

We certify that we understand these restrictions and will comply with them.

13. Liability, precedence and term

Liability under this DPA is subject to the limits and exclusions in §9 of the Terms of Service, except where the law does not allow it: a data subject's rights under Art. 82 GDPR and under the Standard Contractual Clauses are unaffected by any cap agreed between us.

Where they conflict, the Standard Contractual Clauses prevail over this DPA, this DPA prevails over the Terms of Service on the processing of personal data, and the Terms of Service govern everything else. This DPA takes effect when you accept the Terms of Service and runs for as long as we process personal data for you.

14. Signature

This DPA is in force without a signature. Accepting the Terms of Service accepts it.

To keep a copy, print this page or save it as a PDF. It is laid out for it, and the version and date at the top identify exactly which text you accepted. You do not need to ask us for a file and you do not need to wait for one.

If your procurement process requires a countersigned copy, or a copy on your own paper, email privacy@cosend.app and we will sign and return it. That is a convenience, not a precondition. Do not wait on it to start using Cosend.