Data Processing Agreement

This Data Processing Agreement (DPA) sits alongside your OnePush subscription. It covers personal data you put into OnePush that we process on your behalf — for example contact emails, form answers, and delivery events.

It applies when GDPR (or a similar law) applies to you and you use OnePush as your messaging platform.

Personal data — information that identifies a person (or could identify them), processed in OnePush for you.

Processing — anything we do with that data: store it, send it, log it, delete it.

Sub-processor — a third party we use to help (hosting, payments, and so on).

You are the controller. OnePush is the processor.

Subject matter

Running transactional email, campaigns, forms, social publishing, and related logs/analytics for your project.

How long

For as long as your account is active, then until data is deleted or returned under your instructions and our retention rules.

Purpose

• Send messages you ask us to send
• Store logs, form submissions, and delivery events
• Show analytics and fire webhooks you configure

Who the people are

• Your end users and customers
• Form respondents and list contacts
• Social audiences only where you connect accounts and publish

Typical data types

• Email addresses and names
• IP / device data in delivery logs
• Message bodies and form fields you collect
• Social identifiers for connected profiles

We will:

• Process personal data only on your documented instructions (including these Terms and product settings)
• Keep staff who can see the data under confidentiality duties
• Use sensible technical and organisational security measures
• Help with data subject requests where we reasonably can
• Tell you about personal data breaches without undue delay
• Delete or return data when the service ends, subject to legal retention
• Give you information you need to show compliance, within reason

You authorise us to use sub-processors for hosting, payments, and support. We keep a list and will tell you about material changes.

Today that includes EU-based cloud infrastructure and Stripe for payments. Social networks you connect act under your relationship with them when you publish.

Primary hosting is in the EU / EEA. If a transfer outside the EEA is needed, we use Standard Contractual Clauses or another approved mechanism — not unchecked exports.