Version: 1.0
Effective Date: October 9, 2026
This Data Processing Agreement ("DPA") is entered into between:
Data Processor:
DMARC Viewer ApS
VAT No.: DK46747755
Denmark
Email: legal@dmarcviewer.com
and
Data Controller:
The customer or organization using DMARCViewer that determines the purposes and means of processing personal data through the Service ("Customer").
This DPA forms part of the contractual agreement between the parties, including the DMARCViewer Terms and Conditions.
It applies where DMARC Viewer ApS processes personal data on behalf of the Customer in connection with the Service.
This DPA is intended to satisfy Article 28(3) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
2.1. The Customer acts as Data Controller and determines the purposes and lawful basis of processing personal data submitted to or collected through the Service.
2.2. DMARC Viewer ApS acts as Data Processor when processing personal data contained in Customer DMARC reports, domain configurations, and related Customer-controlled information.
2.3. DMARC Viewer ApS acts as an independent Data Controller for its own account administration, billing, business communications, security administration, and legal compliance activities, as further described in its Privacy Policy.
2.4. Each party shall comply with its respective obligations under applicable data protection legislation.
3.1. DMARC Viewer ApS shall process Customer personal data only on documented instructions from the Customer.
3.2. Documented instructions include this DPA, the Terms and Conditions, the Customer's configuration of the Service, and lawful instructions submitted through authorized support channels.
3.3. Processing shall be limited to what is necessary for providing, maintaining, securing, and supporting the Service.
3.4. DMARC Viewer ApS shall not sell Customer personal data or use it for independent advertising, marketing, or profiling.
3.5. If DMARC Viewer ApS considers an instruction to infringe applicable data protection law, it shall promptly inform the Customer, unless prohibited by law.
3.6. Processing required by applicable EU or Member State law may be carried out without Customer instructions, provided the Customer is informed beforehand unless legally prohibited.
Processing activities may include:
The Service processes information for email authentication analysis and associated security purposes.
Depending on the reports and information submitted, processing may include:
Forensic reports may contain confidential information or special categories of personal data under Article 9 GDPR.
DMARC Viewer ApS does not require Customers to submit special-category data and shall process any such data only where received under lawful Customer instructions.
Personal data may concern:
The Customer shall:
7.1. Establish and maintain an appropriate lawful basis for processing personal data.
7.2. Provide privacy information to data subjects where required.
7.3. Ensure that domains, reporting destinations, and email addresses are configured with appropriate authorization.
7.4. Ensure that submitted reports and personal data have been lawfully obtained.
7.5. Assess the necessity and proportionality of processing forensic reports.
7.6. Avoid submitting unnecessary personal data.
7.7. Respond to data subject requests in its capacity as Data Controller.
7.8. Ensure that its instructions comply with applicable law.
7.9. Determine whether a Data Protection Impact Assessment is required.
8.1. DMARC Viewer ApS shall ensure that persons authorized to process Customer personal data are bound by appropriate contractual or statutory confidentiality obligations.
8.2. Access shall be limited to authorized persons requiring access for legitimate operational purposes.
8.3. Confidentiality obligations shall continue after termination of employment, engagement, or the contractual relationship, as applicable.
9.1. DMARC Viewer ApS shall implement appropriate technical and organizational measures in accordance with Article 32 GDPR, considering the nature, scope, context, and risks of processing.
9.2. Such measures shall include, where appropriate:
9.3. The specific measures implemented shall be proportionate to the risks and shall be documented in the Company's security procedures.
9.4. DMARC Viewer ApS may update security measures provided that the overall level of protection is not materially reduced.
9.5. DMARC Viewer ApS does not guarantee that any information system is completely immune to security incidents.
10.1. DMARC Viewer ApS shall notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Customer.
10.2. The notification shall include, to the extent available:
10.3. Where information is unavailable initially, it may be supplied in phases without undue further delay.
10.4. DMARC Viewer ApS shall reasonably assist the Customer in fulfilling applicable breach notification obligations under Articles 33 and 34 GDPR.
10.5. The Customer remains responsible for determining whether notification to supervisory authorities or affected individuals is required, except where DMARC Viewer ApS has separate legal obligations.
11.1. The Customer grants general written authorization for DMARC Viewer ApS to engage subprocessors necessary to operate the Service, subject to this section.
11.2. Providers identified in the Terms and Conditions include:
These providers are not automatically classified as subprocessors for every service they supply. Only providers actually processing Customer personal data on behalf of DMARC Viewer ApS are subprocessors under this DPA.
11.3. DMARC Viewer ApS shall maintain an accurate, accessible list of its actual subprocessors, their processing functions, and relevant processing locations.
11.4. The Company shall provide at least 30 days' advance notice of intended additions or replacements of subprocessors, except where urgent changes are necessary to address security or legal risks.
11.5. Customers may submit a reasoned objection on data protection grounds within 14 days of receiving notice.
11.6. The parties shall attempt to resolve objections in good faith. Where no reasonable solution is available, the Customer may terminate the affected Service without penalty for future service periods and receive any refund required by applicable law or the applicable contractual terms.
11.7. DMARC Viewer ApS shall impose appropriate written data protection obligations on subprocessors, providing protection substantially equivalent to this DPA as required by Article 28 GDPR.
11.8. DMARC Viewer ApS remains responsible to the Customer for its subprocessors' performance of their data protection obligations, as required by GDPR Article 28(4).
12.1. Personal data shall not be transferred outside the European Economic Area ("EEA") unless a lawful transfer mechanism applies.
12.2. Where applicable, transfers may rely on:
12.3. Where required, DMARC Viewer ApS shall implement supplementary safeguards and conduct appropriate transfer assessments.
12.4. The use of an EEA-based infrastructure provider does not, by itself, establish that all access or processing occurs exclusively within the EEA.
12.5. The Company shall provide information reasonably necessary for the Customer to assess relevant international transfers.
13.1. Taking into account the nature of processing, DMARC Viewer ApS shall assist the Customer through appropriate technical and organizational measures in responding to requests concerning:
13.2. Requests received directly from data subjects concerning Customer-controlled data shall ordinarily be referred to the relevant Customer, where identifiable and legally permitted.
13.3. DMARC Viewer ApS shall not independently determine the legal merits of requests concerning Customer-controlled data unless required by law.
DMARC Viewer ApS shall provide reasonable assistance to the Customer regarding:
Assistance shall take into account the nature of the processing and information available to DMARC Viewer ApS.
15.1. DMARC Viewer ApS shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.
15.2. The Customer may request relevant documentation, security information, or independent audit reports where available.
15.3. Where reasonably necessary, DMARC Viewer ApS shall allow and contribute to audits or inspections conducted by the Customer or an independent auditor mandated by the Customer.
15.4. Audits shall be subject to reasonable advance notice, confidentiality requirements, security safeguards, and measures protecting other customers' information.
15.5. Audit arrangements shall not restrict the Customer's mandatory rights under Article 28 GDPR.
16.1. Customer personal data shall be retained only for the period necessary to provide the Service and fulfil documented instructions, subject to applicable legal obligations.
16.2. The applicable retention periods for RUA reports, RUF reports, historical statistics, configurations, and backups shall be documented in the published Privacy Policy or a referenced retention schedule.
16.3. Upon termination of processing services, DMARC Viewer ApS shall, at the Customer's choice, delete or return personal data processed on the Customer's behalf and delete existing copies, unless EU or Member State law requires continued storage.
16.4. Data in backups may remain until securely overwritten under the documented backup retention schedule. Such data shall remain protected and shall not be restored for ordinary operational use except where necessary for recovery or legal compliance.
16.5. Where immediate deletion from backups is technically impracticable, the Company shall ensure that the data remains appropriately protected and is deleted according to the documented schedule.
16.6. DMARC Viewer ApS shall provide reasonable confirmation of deletion upon request.
17.1. The Customer acknowledges that RUF reports may contain substantially more personal or confidential information than aggregate RUA reports.
17.2. The Customer is responsible for assessing whether enabling RUF reporting is lawful, necessary, and proportionate.
17.3. DMARC Viewer ApS shall process RUF data only for authorized Service purposes.
17.4. RUF data shall not be used for independent advertising, unrelated profiling, or unrelated commercial exploitation.
17.5. Access to RUF information shall be restricted according to its sensitivity.
18.1. This DPA becomes effective when the Customer enters into the applicable agreement and DMARC Viewer ApS begins processing personal data on its behalf.
18.2. It remains effective for as long as such processing continues.
18.3. Termination of the underlying Service agreement shall trigger the return and deletion obligations in Section 16.
18.4. Obligations that by their nature survive termination shall remain applicable.
In the event of conflict between this DPA and the Terms and Conditions regarding processing of personal data on behalf of the Customer, this DPA shall prevail.
Mandatory data protection legislation shall prevail over conflicting contractual provisions.
This DPA shall be governed by Danish law, without prejudice to mandatory provisions of the GDPR and other applicable EU legislation.
This DPA may be concluded electronically as part of the Customer's acceptance of the applicable Terms and Conditions.
Electronic acceptance shall constitute agreement to this DPA where the accepting person has authority to bind the Customer.
No separate handwritten signature is required where electronic conclusion is legally valid.
DMARC Viewer ApS
VAT No.: DK46747755
Denmark
Legal inquiries: legal@dmarcviewer.com
Support: support@dmarcviewer.com
Website: https://dmarcviewer.com
Annex A — Description of Processing
Subject matter: Processing of Customer-controlled email authentication and DMARC reporting data.
Duration: For the duration of the Service agreement and applicable deletion period.
Nature of processing: Collection, receipt, storage, parsing, analysis, retrieval, transmission, display, and deletion.
Purposes: Email authentication analysis, reporting, diagnostics, security recommendations, notifications, and authorized support.
Data subjects: Customer personnel, senders, recipients, and other identifiable individuals appearing in reports.
Personal data: Email addresses, IP addresses, identifiers, email metadata, authentication information, and potentially message content in RUF reports.
Sensitive data: Not intentionally required, but may be incidentally included in forensic reports.
Controller rights and obligations: As specified in this DPA and applicable data protection law.
Annex B — Security Measures
The security measures shall be those described in Section 9 and in the Company's maintained technical and organizational security documentation.
Annex C — Subprocessors and Transfers
The Company's current subprocessor register shall identify each actual subprocessor, its function, processing location, and applicable international transfer mechanism. The register must be made available to Customers and maintained in accordance with Section 11.