Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer ("you", the controller) and Eventuallycoding, the sole proprietorship operating Kula ("Kula", the processor; see the legal notice). It applies automatically when you accept the Terms, and needs no signature. If you need a signed copy for your records, write to support@kulamail.com.
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given by the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Scope and roles
This DPA covers the personal data that you, your team, your applications or your AI agents put into Kula, and the data Kula collects on your behalf when it sends your emails ("customer personal data"). The details are in Annex 1.
You are the controller of customer personal data and Kula is your processor. You are responsible for the lawfulness of the processing, in particular for having a legal basis for each email you send and for informing your contacts.
The data of your account and team (sign-in, billing, support) is processed by Kula as controller and is described in our Privacy Policy.
2. Instructions
Kula processes customer personal data only on your documented instructions, which are: these Terms and this DPA, and your use of the service through the dashboard, the API, the MCP server and the settings you choose. Kula does not process it for any other purpose, except where EU or member state law requires it, in which case Kula tells you first unless that law forbids it. Kula tells you if, in its opinion, an instruction breaks data protection law.
3. Confidentiality
Customer personal data is accessed only by the operator of Kula and by people working for Kula who need it to provide the service, and who are bound by confidentiality.
4. Security
Kula implements the technical and organisational measures listed in Annex 2, and keeps them at a level appropriate to the risk. Kula may update them, provided the overall level of protection does not decrease.
5. Subprocessors
You authorise Kula to use the subprocessors listed on the subprocessors page. Kula binds each of them by a written contract with data protection obligations at least as protective as this DPA, and remains responsible to you for their performance.
Kula announces any new subprocessor at least 30 days before it processes customer personal data, by updating that page and emailing the owners of paid accounts. You can object on reasonable data protection grounds by writing to support@kulamail.com within that period. If we cannot address your objection, you can terminate the affected service and receive a refund of any prepaid amount for the period after termination.
6. Transfers outside the European Economic Area
Kula stores customer personal data in the European Union. Customer personal data leaves the EEA only through a subprocessor established in a third country, as shown on the subprocessors page (today: the AI assistant, when you use it). Such transfers are covered by an adequacy decision of the European Commission or by the Standard Contractual Clauses (Commission Decision 2021/914) concluded between Kula and the subprocessor, together with any supplementary measures required.
7. Assistance to the controller
- Data subject requests. Kula gives you the means to answer the requests of your contacts: you can find, update, unsubscribe and delete a contact from the dashboard or the API. If a data subject contacts Kula directly about your processing, Kula forwards the request to you without answering it, unless you ask us to.
- Impact assessments and authorities. Kula provides the information you reasonably need for a data protection impact assessment or a prior consultation of a supervisory authority, regarding the processing done by Kula.
8. Personal data breaches
Kula notifies you of any personal data breach affecting customer personal data without undue delay, and no later than 72 hours after becoming aware of it, by email to the owners of the account. The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. Information that is not available at first is provided as it becomes available. Kula takes the measures needed to contain the breach and limit its effects.
9. Audits
Kula makes available the information needed to demonstrate compliance with this DPA, in the first place by answering your written questions. Once a year, or after a personal data breach or at the request of a supervisory authority, you can audit the processing, yourself or through an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours, without access to the data of other customers, and at your own cost.
10. Deletion and return
You can delete customer personal data at any time: a contact, a list, or a whole space. When a space or the account is deleted, Kula deletes the corresponding customer personal data from its active systems within 30 days, and it disappears from backups within the following 7 days. Before deletion, you can retrieve your data through the API, or ask us for an export of your contacts.
Kula keeps only what the law requires, and the shared list of hard-bounced addresses, which Kula maintains as controller to protect the deliverability of all senders (see the Privacy Policy).
11. Term and liability
This DPA applies as long as Kula processes customer personal data for you. The limitations of liability of the Terms of Service apply to this DPA, except where the GDPR does not allow it. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.
Annex 1: Details of the processing
| Subject and purpose | Providing the Kula service: storing contacts and lists, collecting subscriptions through signup forms, sending campaigns, automated flows and transactional emails, recording delivery and engagement events, producing reports, applying deliverability safeguards (suppression of bounced and complained addresses, unsubscribes), running the AI assistant on request |
| Duration | As long as the customer uses Kula, then until deletion as set out in section 10 |
| Data subjects | The customer's contacts and subscribers, recipients of the customer's emails, and people who fill in the customer's signup forms |
| Categories of data | Email address; name and any other attribute the customer chooses to store; list subscriptions and their confirmation date; events sent by the customer's application; content of the emails; delivery events (sent, delivered, delayed, bounced, complaint, rejected); engagement events (opens, clicks with the link clicked, unsubscribes) with the user agent of the device |
| Sensitive data | Not intended. The customer must not store special categories of data (article 9 GDPR) in Kula, except where the law allows it and the customer has assessed the risk |
| Frequency | Continuous |
Annex 2: Security measures
- Encryption. HTTPS and TLS for all traffic to the website, the dashboard, the API and the tracking links. Database backups encrypted before leaving the server, with a key kept apart from the backups. Secrets used by the service (for example provider credentials) encrypted at rest.
- Access control. Production access limited to the operator of Kula, through SSH keys only. The database is reachable only over TLS from approved addresses. Customer accounts sign in with one-time codes sent by email; API keys and MCP connections are scoped to an account or a space; roles (owner, admin, member) limit what each team member can do.
- Isolation. The data of each customer is separated by account and by space at every request, and checked on every access.
- Data minimisation. Logs contain no email addresses and no IP addresses of contacts. The raw content of transactional emails is deleted after 30 days. Opens and clicks do not record IP addresses.
- Availability. Continuous database archiving and daily backups, stored in another data centre than the server, kept 7 days. Health monitoring and zero-downtime deployments.
- Monitoring. Application errors are monitored. Bounce and complaint rates are watched per space, and sending is paused automatically when they rise.
- Development. Changes go through automated tests before reaching production. Dependencies are kept up to date.
- Subprocessors. Chosen for their security guarantees and bound by data processing agreements.
Annex 3: Subprocessors
The current list is on the subprocessors page.