Data Processing Addendum
Last updated: September 28, 2026
This addendum supplements Duva's Terms of Service and Privacy Policy. It sets out how Duva processes, on behalf of its customers, the personal information of the recipients of their emails. In case of conflict, this addendum takes precedence over the terms and the privacy policy for matters specifically concerning this processing.
The French version is the authoritative one.
1. Scope
This addendum applies as soon as you use Duva to send an email to a recipient whose personal information Duva thereby processes on your behalf (section 2 of the Privacy Policy). It is part of the agreement between you and 9573-4562 Québec inc. ("Duva", "we", "us").
2. Roles of the parties
For your recipients' personal information, you are the controller: you decide the recipients, the content and the reasons for writing, and you are responsible for having obtained the necessary consents or having a valid legal basis. Duva acts as your processor: we process this information only on your behalf, for the purposes described below, and never for our own purposes.
3. Nature and purpose of the processing
Duva processes your recipients' information to send your emails, track their delivery, manage bounces and complaints, maintain your suppression lists and, if you enabled it, track opens and clicks. Details are described in section 3 ("Sending") of the Privacy Policy.
4. Categories of information
Recipient addresses, email content and attachments (kept for 30 days), subject, tags and metadata you add, delivery events and technical responses from recipients' servers, and, if tracking is enabled, the fact and time of an open or click. Duva does not process any particular category of sensitive information (health, financial data) except what you choose to include in your email content, at your own risk (see section 4 of the Terms of Service).
5. Duration of processing
For as long as your Duva account exists, then according to the retention periods in section 8 of the Privacy Policy.
6. Duva's obligations
We process this information only for the purposes described in section 3, on your instructions as they reach us through the API, the dashboard or a written agreement; we never use it for our own purposes, never sell it and do no profiling with it; we limit our staff's access to what their duties require (section 6 of the Privacy Policy); and we notify you if an instruction you give us appears to us to be unlawful.
7. Security
The applicable security measures are those described in section 9 of the Privacy Policy (encrypted connections, mandatory second factor, secrets encrypted or kept as fingerprints, logged access).
8. Subsequent processors
We use the processors named in section 6 of the Privacy Policy (OVHcloud, Cloudflare, Stripe) for hosting, traffic protection and payment. We choose processors that contractually commit to protecting information at a level equivalent to this addendum, and we notify you by email or in the dashboard at least 30 days before adding a new processor that would have access to your email content or your recipients' information.
9. Incident notice
If a confidentiality incident affects your recipients' information, we notify you without undue delay, and no later than 72 hours after becoming aware of it, with what we then know of its nature, the information affected and the measures taken. This notice is in addition to any the law may require us to give directly to affected individuals or to the Commission d'accès à l'information du Québec (section 9 of the Privacy Policy).
10. Assistance and cooperation
We provide reasonable assistance so you can respond to a request from a recipient exercising a statutory right against you, and for any privacy impact assessment you must produce in connection with your use of Duva.
11. Right to audit
On written request and with reasonable notice, we provide you with the documentation needed to demonstrate compliance with this addendum, in particular a summary of our security measures. An on-site or independent third-party audit may be agreed in writing, at your expense, outside hours that would harm the service and without access to another customer's content or information.
12. Communications and transfers outside Québec
Our servers and backups are in Canada. Traffic to our applications passes through Cloudflare's network, which may process information outside Québec, notably in the United States; Stripe may do the same for billing. These transfers are described in section 7 of the Privacy Policy, which also applies to your recipients' information.
13. Return or destruction of data at the end of the contract
When your account ends, your recipients' information is destroyed or anonymized according to the periods in section 8 of the Privacy Policy, generally within 30 days of closure, except what the law requires us to keep. Export what you need before closure: we are not required to return this information to you afterwards.
14. Order of precedence
In case of conflict specifically concerning the processing of your recipients' personal information, this addendum takes precedence over the Terms of Service and the Privacy Policy. For everything else, the Terms of Service and the Privacy Policy apply as usual, including their limitation of liability (section 11 of the Terms) and governing law (section 14 of the Terms).
15. Contact us
For any question about this addendum: [email protected].