Data Processing Agreement

Version 1.0 — Last updated: October 28, 2026

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service for the DMarcus service and is incorporated into them. It takes effect on the date you complete DMarcus registration and accept this Agreement. If you have questions, contact info@macdougallemail.com.

Between:

(1) The Customer — the person or organisation named in the DMarcus account registration (“Controller”); and

(2) Alan MacDougall, trading as MacDougall Email, Office 1879, 3 Fitzroy Place, 1/1, Sauchiehall Street, Glasgow, G3 7RH (“Processor”), registered with the Information Commissioner’s Office under registration number ZC277745.

Each a “party” and together the “parties”.

Effective date: the date on which the Controller completes DMarcus registration and accepts this Agreement.

1. Roles and scope

1.1 The Controller uses the DMarcus service (“Service”) to monitor email authentication for a domain it controls (the “Monitored Domain”). In doing so, the Controller determines the purposes and means of the processing of the report data described in Schedule 1, and acts as a controller.

1.2 The Processor processes that report data solely on the Controller’s behalf, and acts as a processor.

1.3 This Agreement applies to the processing of report data by the Processor in providing the Service. It does not apply to: (a) the Controller’s account contact details (name, email address, company name), which the Processor holds as a controller for the purposes of administering the account and providing the Service, in accordance with the Privacy Policy; or (b) any processing carried out by the Controller or by any third party engaged directly by the Controller.

1.4 The Processor shall not process report data for its own purposes, including for marketing, profiling, or product development, except where aggregated or anonymised so that it no longer constitutes personal data.

2. Processing details

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Schedule 1.

3. Processor obligations

The Processor shall:

3.1 Documented instructions — process report data only on the Controller’s documented instructions, including with regard to transfers of personal data to a third country, unless required to do otherwise by law (in which case it shall inform the Controller of the legal requirement before processing, unless prohibited from doing so by law). The Controller’s instructions comprise this Agreement, the Service documentation, and any written instruction given through the Service or by email. The Processor shall notify the Controller without undue delay if, in its opinion, an instruction infringes UK data protection law.

3.2 Confidentiality — ensure that persons authorised to process report data are subject to appropriate duties of confidentiality, whether contractual or statutory.

3.3 Security — implement the technical and organisational measures set out in Schedule 3, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32 UK GDPR.

3.4 Sub-processors — not engage any sub-processor without the Controller’s prior general written authorisation, and comply with clause 5.

3.5 Data subject rights — assist the Controller, by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests exercising a data subject’s rights under Chapter III UK GDPR. Given the nature of the Service, the Processor shall forward any request received directly to the Controller without responding to it, unless legally required to respond.

3.6 Assistance with compliance — assist the Controller in ensuring compliance with Articles 32 to 36 UK GDPR, taking into account the nature of processing and the information available to the Processor.

3.7 Breach notification — notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting report data, providing the information set out in Article 33(3) UK GDPR to the extent available, and cooperating with the Controller’s investigation and remediation. Notification to the Controller does not constitute an acknowledgement of fault or liability.

3.8 Deletion or return — at the Controller’s choice, delete or return all report data at the end of the provision of the Service, and delete existing copies unless storage is required by law.

3.9 Audit — make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it. The Processor shall meet reasonable audit costs where an audit reveals material non-compliance; otherwise the Controller shall bear the cost, and any audit shall be conducted with reasonable notice, during business hours, and in a manner that does not compromise the security or confidentiality of other customers’ data.

4. Controller obligations

4.1 The Controller warrants that it has a lawful basis for the processing, that it controls the Monitored Domain or is otherwise entitled to monitor it, and that its instructions to the Processor comply with UK data protection law.

4.2 The Controller is responsible for the accuracy of the information it supplies, including the Monitored Domain and the email address at which it receives Service communications.

5. Sub-processors

5.1 The Controller grants general written authorisation for the engagement of the sub-processors listed in Schedule 2.

5.2 The Processor shall give the Controller notice of any intended change concerning the addition or replacement of sub-processors, and thereby give the Controller the opportunity to object. Notice shall be given by email to the Controller’s registered address, or by publication on the Processor’s website with notice sent to the Controller, at least 30 days before the change takes effect.

5.3 If the Controller objects on reasonable data protection grounds, the parties shall discuss the objection in good faith. If no resolution is reached, the Controller may terminate the Service without penalty, and clause 3.8 shall apply.

5.4 Where a sub-processor fails to fulfil its data protection obligations, the Processor remains liable to the Controller for the performance of those obligations.

5.5 The Processor shall impose data protection terms on each sub-processor that provide at least the same level of protection as this Agreement, in accordance with Article 28(4) UK GDPR.

6. International transfers

6.1 The Processor’s infrastructure is operated by Cloudflare, Inc., which processes data across a global network. Where processing involves a restricted transfer, the Processor shall ensure that a valid transfer mechanism applies, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy finding.

6.2 The Processor shall provide the Controller with information about the transfer mechanism relied upon on request.

7. Liability

7.1 Each party’s liability under this Agreement is subject to the limitation of liability provisions in the Terms of Service, save that nothing in this Agreement limits liability that cannot be limited by law, including liability arising from a breach of Article 82 UK GDPR.

7.2 The Processor is liable to the Controller for damage caused by processing only where it has not complied with obligations under UK GDPR specifically directed to processors, or where it has acted outside or contrary to the Controller’s lawful instructions.

8. Term and termination

8.1 This Agreement takes effect on the effective date and continues until the Service is terminated or the Controller’s account is deleted.

8.2 Termination of this Agreement does not relieve either party of obligations that by their nature survive, including confidentiality and clause 3.8.

9. General

9.1 This Agreement is governed by the laws of Scotland, and the parties submit to the exclusive jurisdiction of the Scottish courts.

9.2 This Agreement forms part of, and is incorporated into, the Terms of Service. In the event of conflict on data protection matters, this Agreement prevails.

9.3 Variations shall be notified to the Controller in accordance with clause 5.2 and shall take effect 30 days after notice, unless the Controller objects.

Schedule 1 — Details of processing

Subject matter: monitoring of email authentication for the Monitored Domain, and delivery of periodic plain-language reports to the Controller.

Duration: the term of the Controller’s DMarcus account.

Nature and purpose: receipt of aggregate DMARC reports sent by mailbox providers and other reporters to an address designated for the Controller; parsing and validation of those reports; aggregation and storage of the resulting statistics; computation and delivery of a weekly summary to the Controller; and deletion of the data on the schedule set out below.

Types of personal data: within aggregate DMARC reports — source IP addresses of sending hosts; sending and aligned domain names (envelope-from and header-from); message counts; DKIM, SPF and DMARC pass/fail results; reporter organisation; reporting date ranges. Aggregate reports do not contain message content, subject lines, or recipient addresses. Original inbound report messages are retained to support re-processing and dispute resolution, and are deleted with the account at the end of its life.

Categories of data subjects: individuals associated with sending hosts identified in the reports, and individuals associated with the Controller’s correspondence where such addresses appear in report metadata.

Retention: report data is retained for the period necessary to produce the Controller’s weekly reports and to maintain the monitoring history, and is deleted on the following schedule: unverified registrations after 30 days; failed or unparseable reports after 7 days; and all data associated with a deactivated account 30 days after deactivation. Original inbound report messages that fail processing are deleted after 7 days. Data is deleted through the Processor’s GDPR deletion process, which completes within 7 days of a verified request.

Special category data: none.

Schedule 2 — Approved sub-processors

Schedule 3 — Technical and organisational measures

• Encryption in transit — all Service traffic is served over TLS. Inbound report email is received over TLS where offered by the sender.
• Encryption at rest — data is stored in Cloudflare’s D1 and KV services, which encrypt data at rest. All durable storage uses services restricted to EU jurisdiction.
• Access control — administrative access to production systems is restricted to the Processor, protected by multi-factor authentication, and authenticated by token for automated interfaces.
• Isolation — each Controller’s report data is stored against a unique, unguessable identifier. Report data is validated against the Controller’s registered Monitored Domain before storage, so that reports relating to other domains are rejected.
• Integrity controls — cryptographic hashing prevents duplicate ingestion; unique constraints prevent replay duplication.
• Deletion — automated daily deletion routines enforce the retention schedule in Schedule 1, with cascade deletion across all related records.
• Monitoring — production systems retain invocation logs for the purposes of fault diagnosis and security monitoring.
• Minimisation — only aggregate report data is parsed and analysed. Forensic (ruf) reports are neither requested nor parsed, and never contribute to any analysis or statistic. Inbound messages that do not conform to the aggregate report format are retained in encrypted storage for up to 7 days for diagnostic purposes and then automatically deleted.

Contact

Questions about this Agreement: info@macdougallemail.com

MacDougall Email (ICO registration: ZC277745)
Office 1879
3 Fitzroy Place, 1/1
Sauchiehall Street
Glasgow, G3 7RH

Terms of Service · Privacy Policy · Contact Form