Skip to content

Data Processing Agreement

Last updated: 19 October 2026

1. What this is

This Data Processing Agreement (the "DPA") is between CKR Digital Limited, trading as SplashSend (the "Processor", "we"), and you, the customer (the "Controller"), and forms part of our Terms of Service. We are registered with the Information Commissioner's Office under registration number ZC248757.

This DPA applies whenever we process personal data about the people on your list, or anyone else whose details you put into SplashSend, on your behalf. Where it conflicts with the Terms on a data protection matter, this DPA wins.

2. Definitions

"Personal data", "processing", "controller", "processor", "data subject", "sub-processor" and "personal data breach" mean what they mean in the UK GDPR and the EU GDPR (Regulation (EU) 2016/679). "Data protection law" means those regulations, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, and any equivalent law that applies to the processing.

3. The processing

  • Subject matter: the email marketing service described in the Terms.
  • Duration: for as long as you have an account, plus the deletion period in section 13.
  • Nature and purpose: storing your list and the details you add to it; sending the emails you compose, schedule or let Cruise write; running the automations you set up; recording delivery, opens, clicks, bounces, complaints, unsubscribes and form answers; showing you reports; checking that accounts follow the Terms; and, where you use them, the AI features that write, design and review emails from material you provide.
  • Categories of data subjects: the people on your list and your customers; visitors to your website who submit a form or, if you install our script, are recognised from one of your emails; and, where you connect Shopify, your store's customers.
  • Types of personal data: names, email and postal addresses, the details you choose to hold, consent records (time, method, source address), engagement events with browser details, the products a person views on your website where you use our tracking script, form answers (which may include ratings and free text), and, from a connected store, order history, abandoned checkouts, tags, language, phone numbers and texting consent.
  • Special category data: none is required by the service. If you choose to collect it through a form, you are responsible for having a lawful basis to do so.

4. Your instructions

We process personal data only on your documented instructions, which are: the Terms, this DPA, and what you do in the product (importing people, sending, scheduling, switching Cruise or an automation on, connecting a store, switching a data set on for Cruise to read). When you give another app or an AI assistant one of your API keys, or set up a webhook, the data you allow it to see goes to that app on your instruction; that app's provider is yours, not our sub-processor. Two instructions need stating because they run without a click from you: you instruct us to close and delete a dormant account on the schedule in the Terms and section 13 below, and, where you use the AI features, to send the material those features need to our AI sub-processor. If we believe an instruction breaks data protection law we will tell you before acting on it.

5. Our obligations

We will:

  • process personal data only as instructed, and never for our own purposes;
  • make sure everyone with access to it is bound by confidentiality;
  • keep the security measures in section 8 in place and improve them as the risk changes;
  • help you respond to data subject requests and meet your own obligations, as set out in sections 9, 10 and 11;
  • delete or return personal data at the end, as set out in section 13;
  • keep a record of the processing we carry out for you and make available what you need to show that this DPA is being followed.

6. Sub-processors

You authorise us to use these sub-processors. Each is bound by a written contract that imposes data protection duties at least as protective as this DPA, and we remain responsible to you for what they do.

  • Railway Corporation: application hosting and the database. All personal data in the service. EU (Netherlands).
  • SMTP2GO: email delivery for the emails you send and the emails we send you. Recipient addresses and email content. EU.
  • Amazon Web Services: backup email delivery (SES, London). Recipient addresses and email content.
  • Cloudflare: image hosting and delivery, inbound email routing for replies and support mail, bot protection, DNS, rendering of email previews, storage of the nightly database backups (R2), and counting visits to our website and app (Web Analytics). Uploaded pictures; the content of emails sent to our addresses; visitor browser signals on our forms; the address of each page viewed, without cookies; backup copies of the database, stored in Western Europe and deleted after 30 days. Global.
  • Anthropic: the AI models behind writing and design help, Cruise, the reviewer crew and check-in replies. The material for the job in hand: brand text, product details and pictures, your photographs and notes, check-in replies, and the words of an email being written or reviewed; your list is never sent. United States.
  • Stripe: billing for your account. Your name, email address and payment details (not those of the people on your list). United States and EU.
  • Sentry: error reports and timing measurements. Technical details of a failure or a slow request to our servers, which can include an account id and the page. EU (Germany).
  • Pexels: stock photo search. The search words only. United States.

Services that receive no personal data are not listed: public weather, holiday and place data, and the font files a browser fetches from Google when a form or the image editor uses a Google typeface.

Changes. We will update this page and email account holders at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the agreement before the change takes effect and export your data first.

7. International transfers

Our application and database are in the EU, which the United Kingdom recognises as adequate. Where a sub-processor is in the United States or serves from around the world (Anthropic, Stripe, Pexels, Cloudflare) we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with an assessment of the transfer. For customers established in the EU the EU Standard Contractual Clauses apply in the same way.

8. Security

We keep in place measures appropriate to the risk, including: encryption of all data in transit (TLS); storage with providers that encrypt at rest; per-account isolation enforced in every database query, so one customer's data is never reachable from another's account; access to systems limited to named staff, with secrets held in the hosting platform's environment store and never in code; nightly backups; error monitoring; rate limits, bot protection and abuse detection on public endpoints; signed tokens on every unsubscribe, preference and form link; and deletion routines that remove a person's or an account's data from every table that copies it.

9. Data subject requests

You can answer most requests yourself with the product: a person's full record and history on their page in People, a per-person export in a structured format, editing of their details, unsubscribing or suppressing them, and deleting them. If a data subject contacts us directly we will pass the request to you within five working days and not answer it ourselves unless you ask us to or the law requires it. We will help you respond within the time the law allows.

10. Personal data breaches

If we become aware of a personal data breach affecting your data we will tell you without undue delay, and in any case within 72 hours, describing what happened, the categories and approximate number of people and records affected, the likely consequences, what we have done and what we suggest you do. We will keep you informed as we learn more and help you with any notification you have to make.

11. Impact assessments

Where you need it for a data protection impact assessment or a consultation with a supervisory authority about your use of SplashSend, we will provide the information we hold about our processing and security.

12. Audits

We will provide the information you reasonably need to check that this DPA is being followed. If that is not enough, you may audit us once in any 12-month period, on at least 30 days' written notice, during working hours, at your cost, under confidentiality, and without disrupting the service; where a supervisory authority requires it, sooner. We may satisfy an audit with a written report or an independent assessment where one exists.

13. Return and deletion

You can export your list and each person's record at any time from the product. When you close your account it is scheduled for deletion 30 days later and can be restored during those 30 days; after that everything in it is permanently deleted, unless the law requires us to keep a record, in which case we keep only that and process it for nothing else. A dormant account is closed on the schedule set out in the Terms, with a warning and a further 30 days' notice by email before deletion. Deleted data can remain in a backup for up to 30 days afterwards; backups are used only to restore the service.

14. Liability

Liability under this DPA is subject to the limits in the Terms, save that nothing limits either party's liability for anything that data protection law does not allow to be limited.

15. Contact

Questions about this DPA, a data subject request, or a suspected breach: hello@splashsend.com.