Data Processing Addendum
Last updated: April 11, 2026
In order that you as a service user and data controller (referred to as “Controller” or “you” or “Client”) may use or continue to use our services (the “Services”) offered by us, SendStreak (Baryonix Kft, Eger, Kokut utca 0835/16) and data processor (referred to as SendStreak or “Processor”), you have agreed that these data processing terms (“Terms”) shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) in order to address the compliance obligations imposed upon SendStreak and its Clients pursuant to applicable Data Protection Law and in particular, Regulation (EU) 2016/679 (“GDPR”) and the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Infotv.”).
These Terms shall constitute a separate agreement, or they may be incorporated by reference in the relevant Services agreement, as the case may be.
1. Definitions
1.1. In this Agreement, capitalised words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:
1.1.1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with, a party from time to time during the Term.
1.1.2. “Data Protection Law” means the data privacy laws applicable to the processing in connection with the Services, including, where applicable, the GDPR, the Infotv. or similar law, or the applicable data privacy laws of any other relevant jurisdiction.
1.1.3. “Client” means any client of SendStreak.
1.1.4. “Contractual Clauses” means the standard contractual clauses of the European Commission for the transfer of personal data across borders, as amended or replaced from time to time, or any equivalent set of contractual clauses approved for use under Data Protection Law; and
1.1.5. “Personal Data” means the personal data processed by Processor in connection with the Services on behalf of Client during the Term, as further described in Annex 1. The processing may include activities auxiliary to SendStreak services, such as administrative and other services.
1.1.6. The words “data subject”, “personal data”, “processing” and variations, “controller” and “processor” shall have the meaning attributed to them in Data Protection Law.
2. Appointment
2.1. SendStreak is designated by its Clients, Client Affiliates and Business Affiliates (collectively “Instructing Parties”) to provide and manage various services, including the Services on their behalf. Accordingly, Personal Data may contain personal data in relation to which Client and its Instructing Parties are controllers. SendStreak confirms that it is authorised to communicate to Client any instructions or other requirements on behalf of Client in respect of processing of Personal Data in connection with the Services.
2.2. Processor is appointed by Client to process Personal Data on behalf of Client and/or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.
3. Duration
The Terms shall commence on the Effective Date and shall continue in full force and effect until such time as all Services have ceased and all Personal Data in the Processor’s possession or within its reasonable control has been returned or destroyed (the “Term”).
4. Data Protection Compliance
4.1. In relation to its processing of Personal Data, save as otherwise required by law, SendStreak agrees to:
4.1.1. process Personal Data only as required in connection with the Services and in accordance with Client and its Instructing Parties documented lawful instructions from time to time;
4.1.2. inform Client and its Instructing Parties if, in SendStreak’s opinion, an instruction infringes Data Protection Law;
4.1.3. ensure that all personnel authorised by SendStreak to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Such confidentiality obligations shall survive the termination of the respective employment or engagement relationship;
4.1.4. implement appropriate technical and organisational measures to appropriately safeguard Personal Data having regard to the nature of the personal data which is to be protected and the risk of harm which might result from any Security Breach (as defined below), at a minimum the measures set out in our Technical and Organisational Measures;
4.1.5. promptly inform Client and its Instructing Parties of any data subject requests under Data Protection Law or regulatory or law enforcement requests relating to Personal Data. SendStreak shall not acknowledge or otherwise respond to the subject access request except with Client and its Instructing Parties prior written approval, which shall not be unreasonably withheld;
4.1.6. provide such assistance as Client and its Instructing Parties may reasonably require in order to ensure SendStreak’s compliance with Data Protection Law in relation to data security, data breach notifications, data protection impact assessments and prior consultations with a competent authority. In respect of data protection impact assessments, this includes providing descriptions of the processing activities carried out by SendStreak, relevant risk assessments, documentation of the technical and organisational measures in place, and cooperation with the competent supervisory authority where required;
4.1.7. at Client and its Instructing Parties choice, without delay delete or return all Personal Data to Client and its Instructing Parties, and delete existing copies of all Personal Data in the Processor’s possession or within its reasonable control (including those held by a Sub processor); and
4.1.8. make available to Client and its Instructing Parties information reasonably necessary to demonstrate SendStreak compliance with these Terms and allow for, and contribute to, audits and inspections carried out by Client and its Instructing Parties.
4.2. SendStreak maintains a record of processing activities carried out on behalf of its Clients in accordance with Art. 30(2) GDPR. This record is available to the competent supervisory authority on request.
5. Sub Processors
5.1. Processor will sub-contract, outsource, assign, novate or otherwise transfer obligations under these Terms or engage any subcontractors involved in the processing of Personal Data (each a “Sub processor”) only with Client’s prior written consent and subject to subclause 5.2.
5.2. When engaging a Sub processor, Processor will:
5.2.1. carry out reasonable due diligence;
5.2.2. enter into a contract on terms, as far as practicable, same as those in these Terms, and which may include Contractual Clauses to provide adequate safeguards with respect to the processing of Personal Data; and
5.2.3. inform Client of any intended changes concerning the addition or replacement of a Sub processor at least 30 days before such change takes effect. Client may object to such change in writing within 14 days of being notified. If Client raises a reasonable objection and the parties are unable to resolve it within 14 days, Client may terminate the affected Services without penalty.
5.3. Our currently engaged Sub processors are listed on our Sub-processor List page, which is kept up to date.
6. Security Incidents
6.1. “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
6.2. Processor will investigate any Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. Processor will take such further action as Client may reasonably request in order to comply with Data Protection Law.
6.3. Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach (“Notices”) without Client’s prior written approval; such approval shall not be unreasonably withheld.
6.4. SendStreak will notify Client without undue delay if SendStreak becomes aware of any Security Breach, and in any event within 24 hours of discovering such Breach. Notification shall be sent to the email address designated by Client in Client’s account settings (or, if no such address has been designated, to the primary account email). SendStreak will provide Client with:
6.4.1. a detailed description of the Security Incident;
6.4.2. the type of data that was the subject of the Security Incident;
6.4.3. the identity of each affected person, and
6.4.4. the steps SendStreak takes in order to mitigate and remediate such Security Incident, in each case as soon as such information can be collected or otherwise becomes available.
6.5. SendStreak shall use its best efforts to immediately mitigate and remedy any Security Incident and prevent any further Security Incident(s) at its sole expense.
6.6. SendStreak agrees that Client shall have the sole right to determine (i) whether notice of the Security Incident is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in Client’s discretion, (ii) the contents of such notice, and (iii) whether any type of remediation may be offered to affected persons, as well as the nature and extent of any such remediation.
6.7. In the event of a Security Incident involving Personal Data in SendStreak’s possession or otherwise caused by or related to SendStreak’s acts or omissions, and without limiting Client’s other rights and remedies, SendStreak will pay all costs and expenses of (i) any disclosures and notification required by applicable law or as otherwise determined as appropriate in Client’s reasonable discretion, (ii) monitoring and reporting on the impacted individuals’ or entities’ credit records if determined in Client’s reasonable discretion as reasonable to protect such individuals, and (iii) all other costs incurred by Client in responding to, remediating and mitigating damages caused by such Security Incident.
6.8. Following any Security Breach, SendStreak will conduct a root cause analysis and provide the results to Client within 30 days of the Breach, together with a description of the measures taken to prevent recurrence.
7. Audit
7.1. Client (or its designated representatives) may, on an annual basis or more frequently as reasonably requested by Client, at Client’s expense, conduct an audit to verify that SendStreak is operating in accordance with this DPA. Such audit(s) may include a review of all aspects of SendStreak’s performance, including, but not limited to, SendStreak’s general controls and security practices and procedures. SendStreak will cooperate with Client in conducting any such audit, and will allow Client reasonable access, during normal business hours and upon reasonable notice, to all pertinent records, documentation, computer systems, data, personnel and areas used to Process the Client Data areas as Client reasonably requests to complete such audit. Client will take reasonable steps to prevent the audit from materially impacting SendStreak’s operations.
7.2. SendStreak shall correct any deviations from Security Best Practices that are identified in any security audit as soon as practicable, but in no event more than five days after receiving notice from Client outlining any deviations (provided, however, that if five days is not a practicable cure period, then SendStreak may instead present a remediation plan to Client within such five day period that sets forth an achievable and reasonable timeframe, and SendStreak must thereafter diligently proceed to correct any deviations in accordance with such plan).
8. International Data Transfers
8.1. SendStreak will ensure that no Personal Data are transferred out of either:
8.1.1. the by the Client approved data environment; or
8.1.2. any territory in which restrictions are imposed on the transfer of Personal Data across borders under Data Protection Laws,
8.1.3. without the prior written consent of Client.
8.1.4. SendStreak will ensure that Contractual Clauses or other applicable transfer mechanism are in place to ensure an adequate level of data protection.
9. Cross Border Data Transfer Mechanisms
9.1. In the event the Services require transfer of Personal Data outside the EEA, the transfer will be subject to a lawful Transfer Mechanism in accordance with the following order of precedence:
9.1.1. an adequacy decision by the European Commission under Art. 45 GDPR;
9.1.2. the applicable Standard Contractual Clauses as set forth in Section 10; or
9.1.3. other applicable data Transfer Mechanisms permitted under Data Protection Law.
10. Standard Contractual Clauses
10.1. The parties agree that the 2021 Standard Contractual Clauses for international transfers as published and available at https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en will apply to personal data that is transferred via the Services from the European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the European Economic Area or Switzerland that is not recognised by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data.
10.1.1. Module Two (Controller to Processor) of the 2021 Standard Contractual Clauses will apply where Client is a controller and SendStreak is processing Personal Data on Client’s behalf.
10.1.2. Module Three (Processor to Processor) of the 2021 Standard Contractual Clauses will apply where Client is a processor and SendStreak is processing Personal Data as a sub-processor.
10.2. For each Module, where applicable:
10.2.1. Data Exporter: Client.
10.2.2. Contact details: The email address(es) designated by Client in Client’s account via its notification preferences.
10.2.3. Data Exporter Role: The Data Exporter’s role is set forth in this Agreement.
10.2.4. Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, as of the Effective Date of the Agreement.
10.2.5. Data Importer: SendStreak.
10.2.6. Contact details: SendStreak Support Team - Contact Us
10.2.7. Data Importer Role: The Data Importer’s role is set forth in this Agreement.
10.2.8. Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.
10.3. The categories of data subjects, types of personal data, processing purposes, and retention periods are described in Annex 1 of this Agreement.
10.4. The frequency of the transfer is a continuous basis for the duration of the Agreement.
10.5. The Supervisory Authority shall be the Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH).
10.6. For transfers to sub-processors, the subject matter, nature, and duration of the processing are as described in our Sub-processor List.
10.7. The Technical and Organisational Measures serve as Annex II of the Standard Contractual Clauses.
10.8. Conflict. To the extent there is any conflict between the Standard Contractual Clauses, and any other terms in this Agreement, or the Privacy Policy, the provisions of the Standard Contractual Clauses will prevail.
11. Indemnity
Notwithstanding any provisions of the relevant Services agreement to the contrary, Processor shall and hereby agrees to indemnify Client and Instructing Parties and their officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or wilful breach by Processor of these Terms.
12. Miscellaneous
12.1. Clause and other headings in these Terms are for convenience only and shall not affect the meaning or interpretation of these Terms.
12.2. To the extent of any conflict, these Terms shall prevail over any Services agreement or other agreement.
12.3. Nothing in these Terms will exclude or limit the liability of either party which cannot be limited or excluded by applicable law. Subject to the foregoing sentence, (i) these Terms, including any appendices, constitutes the entire agreement between the parties pertaining to the subject matter hereof and supersedes all prior agreements, understandings, negotiations and discussions of the parties relating to its subject matter; and (ii) in relation to the subject matter of these Terms neither party has relied on, and neither party will have any right or remedy based on, any statement, representation or warranty, whether made negligently or innocently, except those expressly set out in these Terms.
12.4. Client shall agree any amendment to these Terms that may be required from time to time for us and Instructing Parties to comply with any amended Data Protection Laws.
12.5. All notices of termination or breach must be in English, in writing and addressed to the other party’s primary contact person or legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the date of posting by recorded delivery or registered post.
12.6. The provisions of these Terms are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of these Terms shall remain in full force and effect.
12.7. These Terms are governed by the laws of Hungary and the parties submit to the exclusive jurisdiction of the courts of Hungary in relation to any dispute (contractual or non-contractual) concerning these Terms save that either party may apply to any court for an injunction or other relief to protect its property or confidential information.
Annex 1 - Description of Processing
Categories of Data Subjects
- Account holders (customers of SendStreak)
- Customers’ contacts (email recipients and other individuals whose data is processed through the Services)
Types of Personal Data Processed
- Contact information: name, email address
- Technical data: IP address, browser/device information
- Email content and metadata: subject lines, message bodies, attachments, timestamps
- Delivery and engagement data: open, click, bounce, and unsubscribe tracking events
- API credentials: API keys and authentication tokens
- Billing contact information: name, email address, billing address (payment details are processed directly by Paddle as Merchant of Record and are not stored by SendStreak)
Processing Purposes
- Email delivery and routing on behalf of the Client
- Template rendering and personalisation
- Retry and queue management for reliable delivery
- Delivery analytics and engagement tracking
- Automation execution (triggered email workflows)
- Account administration and customer support
Duration of Processing
Personal Data is processed for the duration of the service agreement between SendStreak and the Client, plus any applicable retention periods as described in our Data Retention Policy.