# Data processing agreement (DPA)

> Personal data processing agreement between the customer (controller) and Wunka (processor) for Couryo. Instructions, confidentiality, subprocessors, security, incidents, audits, international transfers and deletion.

This agreement ("DPA") is part of the [Terms of use](https://couryo.com/en/terms) and governs the personal data processing Wunka carries out on the customer's behalf when providing Couryo. It applies automatically to every account from the moment the Terms are accepted, and lasts for as long as customer data is processed. If this English version and the Portuguese version differ, the Portuguese version prevails.

## 1. Parties and roles

- **Customer:** whoever holds the Couryo account. The customer is the **controller** of the personal data of its recipients and contacts: it decides whom to email, what and why.
- **Wunka:** Wunka Consultoria e Digital Solutions LTDA, CNPJ 60.431.942/0001-56, Rua das Angélicas, 325, Canoas (RS), Brazil, ZIP 92025-770. Wunka is the **processor**: it processes data only to provide the service, following the customer's instructions.

For the customer's own account data (sign-up, billing, access), Wunka is the controller and the [Privacy policy](https://couryo.com/en/privacy) applies.

The terms "personal data", "data subject", "processing", "controller", "processor", "security incident" and "ANPD" have the meaning given by the Brazilian General Data Protection Law (Law 13,709/2018, LGPD). "Subprocessor" means a third party Wunka engages to process customer data.

## 2. Subject matter

Details are in Annex I. In short, Wunka stores, sends and logs the customer's emails, receives and logs delivery events, keeps the suppression list, contacts and templates, automatically checks content and links to prevent abuse, and runs the AI features the customer uses.

## 3. The controller's instructions

- The customer's instructions are the Terms, this DPA and whatever the customer configures and sends through the dashboard, the API, SMTP and MCP.
- Wunka processes data only according to those instructions, unless the law requires otherwise. In that case, it tells the customer first, if the law allows.
- If Wunka believes an instruction violates the LGPD or another law, it tells the customer and may decline to follow it.
- Wunka does not sell customer data, does not use it for its own marketing and does not use email content to train AI models. It may use aggregated, de-identified data to operate, protect and improve the service, such as measuring delivery rates per provider.

## 4. Customer obligations

The customer warrants that:

- it has a legal basis under the LGPD to process the data it sends to Couryo and to request each email;
- it has informed data subjects of what must be disclosed, including the use of a processor abroad;
- its instructions are lawful and follow the [Acceptable use and suspension policy](https://couryo.com/en/acceptable-use);
- it does not send sensitive personal data (such as health, religion or biometrics) or children's data through Couryo without need and without a specific legal basis.

## 5. Confidentiality

- Only Wunka staff who need customer data to provide the service, give support or investigate abuse have access to it, and all are bound by confidentiality.
- Internal access is role-based, requires two-step verification and is logged: every action and every display of an address or of content requires a reason and goes into the audit log.
- On staff screens, recipient addresses are masked.

## 6. Subprocessors

- The customer authorizes Wunka to use subprocessors to provide the service. The list by category is in Annex III. Customers can ask for the named list by email.
- Wunka requires every subprocessor, by contract, to meet data protection obligations at least equivalent to those in this DPA, and remains responsible to the customer for what they do.
- **30 days' notice of changes.** Before adding or replacing a subprocessor, Wunka emails accounts and updates this page at least 30 days in advance.
- **Right to object.** The customer may object, on reasonable data protection grounds, within those 30 days. The parties will look for a solution; if none is found, the customer may close the account with a prorated refund of what was paid and not used.
- In a security or service continuity emergency, a replacement may happen sooner, with immediate notice and the same right to object.

## 7. Security

Wunka maintains appropriate technical and organizational measures to protect data against unauthorized access, loss, alteration and leaks, described in Annex II, and reviews them as the service evolves.

## 8. Security incidents

- Wunka notifies the customer **within 48 hours** of confirming a security incident involving customer data.
- The notice includes, as far as already known: what happened, when, the affected data and data subjects (categories and approximate number), the risks, the measures taken and recommended, and a contact. Missing information is sent as soon as it is available.
- Wunka reasonably helps the customer make the notifications to the ANPD and to data subjects that are the controller's responsibility.
- Notice of an incident is not an admission of fault.

## 9. Assistance to the controller

- **Data subject requests:** the dashboard and the API let the customer look up, correct and delete contacts, delete messages and add addresses to the suppression list. If Wunka receives a data subject request about customer data, it forwards it to the customer within 5 business days and does not answer on the customer's behalf, unless instructed.
- **Impact assessments and ANPD inquiries:** Wunka provides the reasonable information about the processing that the customer needs.

## 10. Reasonable audits

- Wunka provides, on request, the information needed to show compliance with this DPA, such as descriptions of its security measures and answers to questionnaires.
- If that is not enough, the customer may carry out an audit once a year, with 30 days' notice, during business hours, without access to other customers' data, under confidentiality and at the customer's expense. Audits are carried out first through documents and remote meetings.
- An additional audit is possible after an incident affecting the customer or when the ANPD requires it.

## 11. International transfers

- Couryo's servers and subprocessors are **outside Brazil**, mainly in the United States. By using the service, the customer authorizes the transfer of data to those countries.
- For these transfers, Wunka uses the mechanisms in article 33 of the LGPD: the **standard contractual clauses approved by the ANPD** (ANPD Resolution CD/ANPD No. 19/2024), which apply between the customer and Wunka by virtue of this DPA, and equivalent contractual guarantees with subprocessors.
- If the ANPD changes the rules or a mechanism stops being valid, Wunka adopts another valid mechanism and tells the customer.
- Enterprise customers may sign the standard clauses as a separate instrument.

## 12. Return and deletion at the end

- While the account is active, the customer can copy and delete its data through the dashboard and the API at any time.
- After termination, the customer keeps read access for 30 days to copy the data, except in fraud or where the law prevents it.
- Wunka then deletes the customer's data within 30 days. Backups are overwritten within 30 days after that.
- Wunka may keep what the law requires, for the legal period, without using that data for any other purpose.
- On request, Wunka confirms the deletion in writing.

## 13. Liability and precedence

- Each party is liable for the damage it causes, under articles 42 to 45 of the LGPD. The liability limits in the Terms apply to the extent the law allows.
- On data protection matters, this DPA prevails over the Terms. A signed Enterprise DPA prevails over this one where it differs.

## 14. Contact

Data protection officer (DPO): **Kelvin Batista Biffi Leote**, [privacidade@couryo.com](mailto:privacidade@couryo.com).

## Annex I: processing details

| Item | Description |
|---|---|
| Data subjects | recipients of the customer's emails, stored contacts, users of the customer's products |
| Data | email address, name and the attributes the customer stores, message content, subject, attachments and headers, delivery events with the receiving server's response; with tracking on, date, time, IP address and browser of opens and clicks |
| Nature | storage, sending, event logging, suppression, automated checks of content and links to prevent abuse, AI features triggered by the customer |
| Purpose | provide the contracted service and protect sending reputation |
| Duration | while the account exists, following the plan's log retention (7 days on Free, 30 on Pro, 90 on Scale and 365 on Enterprise) and section 12 |

## Annex II: security measures

- Encryption in transit (TLS) on the website, dashboard, API, SMTP and webhooks; signed webhooks.
- API keys stored only as hashes; two-step verification secrets encrypted.
- Two-step verification for customers, mandatory for staff; role-based internal access and an audit log.
- Recipient addresses masked on staff screens; technical error data without content or email addresses.
- Servers with key-only access, a firewall, automatic blocking of intrusion attempts and automatic security updates.
- Sending reputation isolated per account and limits per trust level.
- Daily backups stored off the main server, with periodic restore tests.
- Retention limited by plan, with automatic cleanup every night.

## Annex III: subprocessors by category

| Category | What for | Where |
|---|---|---|
| Cloud infrastructure in the US | servers for the website, dashboard, API, database and error monitoring | United States |
| Email sending engine | deliver messages and return delivery events | United States |
| Backup storage | keep the daily database copy | outside Brazil |
| DNS and network security | resolve Couryo's names and publish DNS records at the customer's request | global network, outside Brazil |
| Payment processor | account billing (receives no recipient data) | United States and Brazil |
| AI model provider | content checks to prevent abuse and AI features triggered by the customer | United States and other countries |
| Error monitoring | technical error logging, run on Couryo's own infrastructure, without content or email addresses | United States |