Data Processing Addendum (GDPR)

Scope

This Data Processing Addendum ("DPA") forms part of the ReplyDak Terms of Service between you (the "Customer", controller) and Surge Software Solutions Private Limited ("we", processor) whenever we process personal data on your behalf that is subject to the EU GDPR, the UK GDPR or the Swiss FADP. It applies automatically; no signature is needed. If you need a countersigned copy, write to support@replydak.com.

What we process for you

Subject matter: providing sending domains, DNS, mailboxes and warmup. Categories of data: names and email addresses of your staff who send (mailbox personas), your account contacts, and message metadata needed for warmup and health monitoring. We do not process your prospect lists or campaign contents: those live in your own sequencer. Duration: the term of your subscription plus the deletion period below.

Our commitments (GDPR Art. 28)

We process personal data only on your documented instructions (these terms and your use of the product), unless the law requires otherwise, in which case we tell you first where allowed.

Everyone with access is bound by confidentiality.

We apply appropriate technical and organisational measures: encryption in transit (TLS) and of mailbox passwords at rest, least-privilege access to production, separate development data, and point-in-time database backups.

We help you respond to data-subject requests and with security, breach-notification and impact assessments, as far as our role allows.

We notify you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data.

At the end of the service we delete your personal data within 30 days (mailboxes and DNS) unless you export it first, except records we must keep by law (e.g. invoices).

We make available the information needed to demonstrate compliance and allow reasonable audits, normally by written questionnaire.

Sub-processors

You authorise the following sub-processors. We give at least 14 days' notice of changes on this page; you may object by email and, if we can't resolve it, cancel without penalty.

Vercel Inc. (USA): hosting. Neon Inc. (USA, AWS us-east-1): database. Cloudflare Inc. (USA/global): DNS. Google LLC (USA/global): Google Workspace mailboxes and sign-in. Microsoft Corp. (USA/global): Microsoft 365 mailboxes, when used. Namecheap Inc. (USA) and Hostinger (Lithuania): domain registration. Razorpay Software Pvt Ltd (India) and PayPal (Europe) S.à r.l. (Luxembourg): payments, when used.

International transfers

We are based in India and our sub-processors are mainly in the United States. Transfers of EU/EEA personal data are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2 controller-to-processor, and Module 3 for onward transfers), which are incorporated into this DPA by reference, with the UK International Data Transfer Addendum for UK data. Where a sub-processor is certified under the EU-US Data Privacy Framework, that certification also applies.

Order of precedence and law

If this DPA conflicts with the Terms of Service on personal data, this DPA prevails. For the Standard Contractual Clauses, the governing law and courts are those of Ireland.

Updates

Last updated 16 October 2026.