Data Processing Agreement

1 · Parties and roles

This Data Processing Agreement (“DPA”) forms part of the agreement between the Customer (“Controller”) and Barrzen (“Processor”) for the Barrzen Email service. The Customer determines the purposes and means of processing. Barrzen processes personal data only on documented instructions from the Customer, unless required by Union or Member State law.

• Processor legal name: an individual trading as Barrzen IT Solutions (trading name; not a registered limited company)
• Processor registered address: Dhaka, Bangladesh
• Processor privacy / DPO contact: support@barrzen.com
• Controller legal name: [TO BE COMPLETED]
• Controller address / contact: [TO BE COMPLETED]

2 · Subject matter and duration

Barrzen provides managed email services including business mailboxes, transactional sending (SMTP/API), marketing campaigns, delivery logs, and related support. Processing continues for the term of the service agreement and any retention period required by law or documented in Annex II.

Governing law / venue: Bangladesh; courts of Dhaka

3 · Nature and purpose of processing

Processing includes storage, transmission, authentication, logging, spam/abuse filtering, backup, support access, and deletion/return of personal data as needed to deliver Barrzen Email on the Customer’s instructions and to maintain the security and integrity of the service.

4 · Categories of data subjects and personal data

Typical categories (to be confirmed in Annex II for each Customer):

• Customer personnel and mailbox users
• End users / customers of the Controller who receive transactional or marketing email
• Contacts stored for campaign and automation purposes

Typical personal data: names, email addresses, message content and attachments, IP addresses, device/client metadata, delivery/engagement events, authentication records, and support communications.

5 · Documented instructions and purpose limitation

The Processor shall process personal data only for the specific purposes set out in this DPA and Annex II, and only on documented instructions from the Controller. If the Processor believes an instruction infringes the GDPR or other Union/Member State data-protection law, it shall inform the Controller without undue delay.

6 · Confidentiality

The Processor shall ensure that persons authorised to process personal data are bound by confidentiality (contractual or statutory) and grant access only to personnel who need it to perform the contract.

7 · Security of processing

Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, as well as risks to data subjects, the Processor shall implement appropriate technical and organisational measures as summarised in Annex III, including measures to protect against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

Confirmed EU hosting regions / data centres: EU region (OVHcloud); object storage and outbound relay may process data in the EU or US.

8 · Sub-processors

The Processor shall not engage a sub-processor without the Controller’s prior general or specific written authorisation as selected below. Where a sub-processor is engaged, the Processor shall impose equivalent data-protection obligations and remain liable to the Controller for the sub-processor’s performance.

Authorisation model: general written authorisation
Advance notice period for changes: 30 days

Authorised sub-processors are listed in Annex IV.

9 · International transfers

Barrzen provides EU-region compute for customer mail data; object storage, outbound relay, and billing may process data in the EU or US. Any transfer of personal data to a third country shall occur only on documented instructions from the Controller or where required by Union/Member State law, and only with an appropriate Chapter V transfer mechanism (for example Standard Contractual Clauses).

Transfer mechanism / notes: Standard Contractual Clauses where a sub-processor processes outside the EU; no other transfers outside the EEA.

10 · Assistance with data-subject rights

Taking into account the nature of processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data-subject rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection, and related rights).

11 · Personal data breach assistance

In the event of a personal data breach concerning data processed by the Processor, the Processor shall notify the Controller without undue delay after becoming aware of the breach, and cooperate so the Controller can meet Articles 33 and 34 GDPR where applicable.

Breach notification target / contact: support@barrzen.com
Target timeframe: without undue delay and, where feasible, within 72 hours

12 · Audits and compliance information

The Processor shall make available information necessary to demonstrate compliance with this DPA and contribute to audits or inspections by the Controller or an auditor mandated by the Controller, at reasonable intervals and with reasonable notice, subject to confidentiality and security requirements.

13 · Deletion or return of data

At the end of the provision of services, the Processor shall, at the choice of the Controller, delete or return all personal data processed on behalf of the Controller, and delete existing copies unless Union or Member State law requires storage. Retention defaults are documented in Annex II.

Default retention schedule: mailbox content plan term + 30 days after termination; traffic and authentication logs 12 months.

14 · Termination

Without prejudice to any provision of the GDPR, if the Processor is in breach of its obligations under this DPA, the Controller may instruct the Processor to suspend processing until compliance is restored, or terminate the processing aspects of the service agreement in line with the Commission controller–processor clauses.

Annex I · List of parties

Controller

• Name: [TO BE COMPLETED]
• Address: [TO BE COMPLETED]
• Contact person / DPO: [TO BE COMPLETED]
• Signature / accession date: [TO BE COMPLETED]

Processor (Barrzen)

• Name: an individual trading as Barrzen IT Solutions
• Address: Dhaka, Bangladesh
• Contact person / DPO: support@barrzen.com
• Signature / accession date: MD Nazrul Islam Khan, 30 Sep 2026

Annex II · Description of the processing

• Categories of data subjects: Customer personnel and mailbox users; end users / customers of the Controller; campaign contacts
• Categories of personal data: names, email addresses, message content and attachments, IP addresses, device/client metadata, delivery/engagement events, authentication records, support communications
• Sensitive data (if any) and safeguards: none solicited; mailbox content may contain special-category data if sent. The Controller is responsible for the lawful basis; the Processor processes on documented instructions.
• Nature of processing: hosting, transmission, logging, support, deletion/return
• Purpose(s): provision of Barrzen Email on Controller instructions
• Duration: service term + 30 days (export window before deletion)

Annex III · Technical and organisational measures

Concrete measures to be confirmed for the production environment (examples of categories required under Decision (EU) 2021/915 Annex III):

• Encryption of personal data in transit and at rest: TLS in transit; stored mailbox content encrypted at rest with EU-managed keys and staff-locked access (audited break-glass). This is encryption at rest, not end-to-end encryption.
• Access control, authentication, and authorisation: role-based access; personnel bound by confidentiality; audited break-glass for stored mail.
• Logging, monitoring, and incident response: node metrics, TLS expiry, SMTP queue depth, backup success, DKIM/DMARC and deliverability signals; runbooks; breach notified without undue delay and within 72 hours where feasible.
• Backup, restore, and resilience: message blobs in object storage; continuous PostgreSQL backup plus nightly logical dump; weekly restore test. Target RPO ≤ 24 h, RTO ≤ 4 h.
• Physical security of processing locations: EU-region provider data centres (OVHcloud); provider physical controls.
• Data minimisation, retention, and erasure: mailbox content retained for plan term + 30 days, logs 12 months; no silent deletion of mail.
• Regular testing/assessment of security measures: weekly restore drill; SPF/DKIM/DMARC and deliverability tests across major providers.

Annex IV · List of sub-processors

The Controller authorises the following sub-processors (update before signature; notify Controllers of changes per Section 8):

• OVHcloud, EU region — Kubernetes compute (k3s), VPS nodes, local NVMe, optional block storage
• Backblaze, EU/US (configurable) — B2 object storage for mail blobs and metadata archives
• SMTP2GO, EU/US (configurable) — outbound relay for transactional and promotional mail
• Polar, EU/US — Merchant of Record billing, subscriptions, tax handling
• Google LLC, US/EU — Google Analytics 4 (website analytics only after opt-in)
• Cloudflare, global edge — Load Balancing (optional HA ingress only; not enabled at launch)

15 · Related documents

See also our Privacy Policy and the Barrzen Email service page. To request a completed and signed DPA, contact us at support@barrzen.com or contact sales.