Data Processing Agreement
Last updated: 5 November 2026
This Data Processing Agreement ("DPA") forms part of our Terms of Service. It applies whenever you ("Customer") send personal data to the validateemail.io API, and meets the requirements of Article 28 of the UK GDPR and the EU GDPR. You don't need to sign anything: it takes effect when you accept the Terms. If you need a countersigned copy, email legal@validateemail.io.
1. Roles
You're the controller of the personal data you submit, and we (the UK sole trader who operates validateemail.io; see our company information page) are your processor. The details of the processing are set out in Annex 1.
2. Our obligations
We will:
- process the personal data only on your documented instructions, which are these Terms and your use of the API, unless the law requires otherwise. If that happens, we'll tell you first unless the law forbids it.
- tell you if we think an instruction breaks data protection law
- make sure anyone authorised to process the data is bound by confidentiality
- apply the technical and organisational security measures in Annex 2
- help you, taking into account the nature of the processing, to respond to requests from people exercising their data protection rights
- help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation
- tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations
- delete the data when processing ends, as described in Annex 1, unless the law requires us to keep it
- make available the information you reasonably need to show compliance with this DPA, and allow audits as set out in section 5
3. Sub-processors
You give us general authorisation to use sub-processors to provide the Service. We currently use a hosting and infrastructure provider for compute, storage, request logs and bot protection. The current list of sub-processors is available on request from legal@validateemail.io. We'll give you at least 30 days' notice, by email or on this page, before adding or replacing a sub-processor. You can object on reasonable data protection grounds. If we can't resolve the objection, you can stop using the Service and we'll refund any prepaid fees for the unused period. We impose data protection terms on every sub-processor that are at least as protective as this DPA, and we remain responsible for their work.
4. International transfers
Our sub-processors may process data outside the UK and the European Economic Area. Where a transfer isn't covered by an adequacy decision, it's protected by the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism.
5. Audits
On request, we'll answer reasonable written questions about our processing and provide relevant documentation. If that isn't enough to show compliance, you may audit our processing, once a year, at your own cost, with at least 30 days' notice, during business hours, and under appropriate confidentiality. An audit may also take place if a supervisory authority requires it or after a personal data breach.
6. Liability and precedence
Liability under this DPA is subject to the limits in the Terms of Service, except where the law doesn't allow them. If this DPA conflicts with the Terms, this DPA takes precedence for anything about personal data.
Annex 1: Details of processing
| Subject matter | Validating email addresses submitted to the API |
|---|---|
| Duration | For as long as you use the Service |
| Nature and purpose | Receiving email addresses, checking their syntax, domain, mail servers and risk signals, returning the results to you and caching them briefly to answer repeat requests faster |
| Types of personal data | Email addresses, and the validation results about them |
| Data subjects | People whose email addresses you submit, such as your users, customers, leads or contacts |
| Special category data | None. Don't submit special category data. |
| Retention and deletion | Cached results are deleted automatically within 7 days of the request (domain results within 24 hours). Request logs, which can include the submitted address, are deleted within 7 days. Aggregate statistics we keep contain no email addresses. |
Annex 2: Security measures
- Encryption in transit: the website and API are served over HTTPS only, with HTTP Strict Transport Security.
- Encryption at rest: data is stored on infrastructure that encrypts it at rest.
- Credentials: API keys are stored only as one-way SHA-256 hashes, and administrative access uses a separate secret that's compared in constant time and rate-limited against guessing.
- Data minimisation: only the submitted address and its result are processed, and cached results expire automatically as described in Annex 1.
- Application security: a strict Content Security Policy, clickjacking protection, request size limits, per-key quotas and per-IP rate limits, and bot protection on public forms.
- Access control: access to production systems and data is limited to the operator.
- Resilience: request handling runs on a distributed edge computing network.
- Vulnerability handling: we publish a security policy for reporting issues, and fix confirmed vulnerabilities promptly.