Data processing agreement for your email sending through 2Mail

A data processing agreement (DPA) is the contract the GDPR (Article 28) requires as soon as another party processes personal data on your behalf. When you send email through 2Mail, JAAN bv processes the addresses and the content of your messages on your instructions: you are the controller, JAAN bv is the processor. The 2Mail data processing agreement puts that division of roles and the accompanying commitments in writing, and it is available on request.

This page explains what the agreement covers, how to request it and what remains for you to arrange yourself. The page is an explanation; only the signed agreement is binding.

What a data processing agreement is and why you need one

Every email you send contains personal data: at least an email address, often a name, an order number or an invoice amount. As soon as that data passes through another company's service, that company is a processor under the GDPR. Article 28 then requires a written agreement that sets out what the processor may do with the data, how it protects it and what happens when the relationship ends.

That applies to a web shop sending order confirmations just as much as to an association with a monthly newsletter. Without a data processing agreement you cannot show, during an audit or after a complaint, that you engaged your processor properly — and that failing is yours as controller, not the processor's.

You: the controller

You decide why and to whom you send, which data goes in and how long you keep your lists. You provide the legal basis (consent or a customer relationship) and answer requests from data subjects.

JAAN bv: the processor

JAAN bv processes the data solely to send, deliver and log your email and to show the statistics you see in the dashboard. Never for its own purposes, and only on your instructions.

What the 2Mail data processing agreement covers

The agreement follows the structure Article 28 GDPR prescribes. These are its eight parts, in plain language.

1

Subject matter and duration

The processing covers sending email through the SMTP relay, the API and campaign management, for the term of your 2Mail subscription.

2

Nature and purpose

Sending, delivering, logging deliveries and bounces, and keeping open and click statistics — solely so you can follow up on your sending.

3

Categories of data and data subjects

Email addresses, names and the content of your messages; data subjects are your customers, subscribers, members or users. You add whatever applies to your own situation.

4

Security measures

Processing on JAAN bv's own servers in Belgium, encrypted connections (TLS), separate access per application and 24/7 monitoring. The full list is an annex to the agreement.

5

Sub-processors

A new sub-processor is only engaged after notifying you, so that you can object. The current list forms part of the agreement.

6

Assistance with requests and breaches

For a data subject request or a data breach, JAAN bv provides the information you need to respond within the statutory deadline. A breach is reported to you without undue delay.

7

Return or deletion at the end

At the end of the agreement your data is returned or deleted, at your choice, except where a legal retention obligation applies. The retention period for logs is set out in the agreement.

8

Audit

You have the right to verify compliance and JAAN bv cooperates with that, in a way that does not disrupt the service to other customers.

How to request the data processing agreement

Four steps, no legal department required. Allow a few working days between the request and the signed copy.

1

Request it through the contact form

State your company name, VAT number and the email address of the person authorised to sign. Not a customer yet? Say so: you may read the text beforehand.

2

You receive the agreement by email

You get the text with its annexes (security measures and sub-processors) as a document. Pay particular attention to the categories of data and add whatever is specific to your organisation.

3

Ask your questions before you sign

Unsure what a clause means for you? Call +32 9 328 03 83 or reply to the email. Adjustments are open for discussion as long as they respect the core of Article 28.

4

Sign and keep your copy

Sign, return, and file the copy signed by both parties with your record of processing activities. In an audit, that is the document you will be asked for.

Start the request

What remains for you to arrange

A data processing agreement covers the processor. These points remain your responsibility as controller — and you need them to complete the agreement correctly.

1 Record of processing activities: list email sending through 2Mail (JAAN bv, Belgium) as a processing activity, with purpose, categories and retention period.
2 Legal basis per mail type: transactional email rests on the contract with your customer, a newsletter on consent or an existing customer relationship. Keep the proof of opt-in.
3 Retention period for your lists: decide how long you keep an address after an unsubscribe or the last purchase, and delete whatever exceeds that period.
4 Duty to inform: state in your privacy notice that you use a processor in Belgium for email sending.
5 Access within your organisation: give every application and every colleague their own SMTP login or API key, so you can revoke access individually.

Unsure which legal basis applies to a particular mailing? That question is for your DPO or legal adviser. JAAN bv can explain how the platform works, but does not rule on your processing.

Why this stays short at 2Mail

Because sending, storage, logging and support all sit with JAAN bv itself, on its own servers in Belgium, the chain stays short: one processor, one country, one point of contact. That makes the agreement shorter and your record of processing activities easier to keep.

Request the data processing agreement Read about the European platform How the SMTP relay works

Frequently asked questions

Yes. An invoice contains personal data too: a name, an email address, often a postal address and an amount. As soon as another party sends that data on your behalf, Article 28 GDPR requires a written agreement — regardless of the type of mail or the volume.
You are the controller: you decide why you send, to whom and with which data. JAAN bv is the processor and processes that data solely to send, deliver and log your email, on your instructions.
No. It is part of the service and available on request, also before you become a customer, so that you can review it before you decide.
Sending, storage, logging and support are handled by JAAN bv itself, on its own servers in Belgium. Where another party is nevertheless involved, it is listed in the annex to the agreement, and a new sub-processor is only engaged after notifying you.
At your choice it is returned or deleted, except where a legal retention obligation applies. The exact periods for logs and statistics are set out in the agreement.
JAAN bv reports the incident to you without undue delay, with the information on nature, scope and affected data you need to inform the supervisory authority yourself within the deadline the GDPR sets and, where required, the data subjects.
Call us
Send an email