Roles

Customer is the controller (or a processor acting for its own controllers) of the personal data it connects to emlOPS. EVKii is Customer's processor and processes that data only as described here and in Customer's documented instructions.

Subject matter, nature, and purpose

Processing of email and related data from mailboxes Customer connects, in order to synchronize, organise, summarize, and draft replies; to hold and release outbound mail on Customer's instruction, under a sending policy Customer approved, or through automatic replies Customer switched on; to run rules Customer configures; and to expose organised data to agents Customer authorizes through the agent dock. Processing lasts for the term of the Agreement plus the deletion periods in the Privacy Policy.

Data subjects and categories

Data subjects: Customer's users and the people they correspond with. Categories: names, email addresses, message headers and content, attachment metadata, contact details that appear in mail, and usage and security logs. Special categories may appear in mail content only to the extent Customer's correspondents include them; EVKii does not seek them out.

Instructions

Customer's use of the Service, including the features, automatic replies, sending policies, agents, and settings it chooses, constitutes its documented instructions. EVKii will process personal data only on those instructions, including with regard to transfers, unless required by law, in which case EVKii will inform Customer before processing unless the law prohibits it. EVKii will tell Customer if an instruction appears to infringe applicable data protection law.

Customer's obligations

Customer is responsible for the lawfulness of the personal data it connects and of its instructions, for establishing a lawful basis for processing, including any automated sending it switches on, for providing any notice and obtaining any consent owed to data subjects, and for keeping its own copies of its data.

Confidentiality

EVKii ensures that persons authorized to process personal data are bound by confidentiality obligations. Human access to mail content is limited to security, support requested by Customer, and legal compliance, and is logged.

Security

EVKii implements appropriate technical and organizational measures, including encryption in transit and at rest, encrypted storage of provider credentials, tenant isolation enforced in the database, an audit ledger, per-mailbox and per-key ceilings on agent access, outbound mail held before release, least-privilege administrative access with multi-factor authentication, and vulnerability management. A current description is available on the Security page.

Subprocessors

Customer authorizes EVKii to engage the subprocessors listed in the Privacy Policy, currently: Supabase (database, authentication, storage, and serverless functions; United States); Vercel (web application and marketing site hosting; United States); Cloudflare (edge security and content delivery); Stripe (billing and payments; sees your billing details, never your mail); OpenAI (managed AI classification, summaries, drafts, and the self-check on automatic replies; the minimum context for the request, under API terms that prohibit training on it); Composio (connections to applications you link, including any Outlook mailbox you connect through Composio and the app actions you run from a conversation; United States); The mail provider you connect (Google and Microsoft today, others as they are enabled), which stores your mailbox and receives the actions you approve or switch on.

EVKii will give at least thirty days' notice on the Privacy Policy page before adding a subprocessor that processes mail content, and Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected service for a pro-rated refund of prepaid fees, which is Customer's sole remedy. EVKii remains responsible for its subprocessors' performance, subject to the limitations in the Terms of Service.

Data subject requests

EVKii will assist Customer, by appropriate technical and organizational measures and taking into account the nature of the processing, in responding to requests from data subjects. Export and deletion are available to Customer directly in the Service; EVKii will forward any request it receives directly to Customer without responding, unless the law requires otherwise.

Personal data breach

EVKii will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, and where feasible within seventy-two hours, with the information reasonably available at the time and updates as the investigation proceeds. Notification is not an acknowledgment of fault or liability.

Deletion and return

Customer may export its data at any time. Within thirty days after termination, or on Customer's deletion request, EVKii deletes Customer's personal data as described in the Privacy Policy, with backups aging out within a further thirty days, unless retention is required by law.

Audits

EVKii will make available the information necessary to demonstrate compliance, including responses to reasonable security questionnaires and available third-party reports, no more than once a year unless a breach or a supervisory authority requires otherwise. Where those are insufficient, Customer may conduct an audit on thirty days' notice, during business hours, at Customer's cost, under confidentiality, without unreasonably disrupting EVKii's operations.

International transfers

EVKii processes data in the United States. For transfers of personal data subject to the GDPR or UK GDPR, the parties incorporate the EU Standard Contractual Clauses (Module Two, controller to processor, or Module Three where Customer is a processor) and the UK International Data Transfer Addendum by reference, with Customer as data exporter and EVKii as data importer, governed by the law of Ireland for the Clauses and England and Wales for the Addendum. Where EVKii is certified under the EU-US Data Privacy Framework, that certification applies in addition.

Liability and precedence

Each party's liability arising out of or related to this Addendum, whether in contract, tort, or otherwise, is subject to the exclusions and limitations of liability in the Terms of Service, and any reference to a party's liability means its aggregate liability under the Terms of Service and this Addendum together. If this Addendum conflicts with the Terms of Service, this Addendum prevails for the processing of personal data; the Standard Contractual Clauses prevail over everything to the extent they apply.

Contact

Data protection inquiries: info@emlops.com. EVKii, Inc., 7040 Avenida Encinas #104-441, Carlsbad, CA 92011.