Data processing agreement

Last updated: 29 September 2026

1. Parties and scope

This agreement is between Optima Online Solutions Ltd (company number 13395947, Horley Green House, Halifax, HX3 6AS) (“we”, the processor) and the business that has an Optima Mail Guard account (“you”, the controller). It forms part of our terms of service and applies whenever we process personal data contained in the mailboxes you connect. It is intended to meet the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018. If this agreement and the terms conflict on data protection, this agreement takes priority.

2. Details of the processing

• Subject matter and purpose: checking new email arriving in your connected mailboxes and moving unwanted email into a folder in your own mailbox, so you can review it, together with the dashboard, rules and statistics that go with that.
• Nature of the processing: automated reading of each new message once, automated classification, moving messages between folders in your mailbox, and recording the outcome. Email content is processed in memory and is not stored.
• Duration: for as long as you have a mailbox connected, and until deletion under section 10.
• Types of personal data: names, email addresses and any other personal data contained in the headers or content of email sent to your connected mailboxes.
• Categories of data subjects: people who send email to your connected mailboxes, people named in that email, and your own staff who use those mailboxes.
• Special category data: we do not intend to process it, but it may appear in email you receive. It is handled in the same way as all other content: checked automatically and not stored.

3. Your instructions

We process this personal data only on your documented instructions. Your instructions are these terms, this agreement and the settings you choose in your dashboard (for example connected mailboxes, rules, sensitivity and retention). If we are required by law to process it otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction infringes data protection law.

4. Confidentiality

Checking is fully automated and no person at Optima reads your email. Anyone we authorise to access systems that process your data is bound by a duty of confidentiality, and access is limited to what is needed to run and support the service.

5. Security

We maintain appropriate technical and organisational measures, including:

• encryption of data in transit and at rest;
• mailbox login details and access tokens encrypted so that only our isolated mail-processing service can use them, never written to logs, and deleted immediately when a mailbox is disconnected;
• email content never stored, and personal details such as email addresses, phone numbers and links masked before any automated assessment;
• strict separation between customer accounts enforced in the database itself;
• least-privilege access for our own systems and staff, two-factor authentication available on every account, and security logging without email content;
• a fail-safe design: if anything goes wrong, email is simply left in the inbox.

6. Sub-processors

You give us general authorisation to use sub-processors to provide the service. The categories we use are listed in our privacy policy, and a list of named sub-processors is available on request from privacy@optimamailguard.co.uk. We impose data protection obligations on each sub-processor that are no less protective than this agreement, and we remain responsible for their performance. We will give you at least 14 days' notice of any new sub-processor by email or in your dashboard; if you object on reasonable data protection grounds and we cannot address your objection, you may close your account and receive a pro-rata refund of any prepaid subscription.

7. International transfers

We choose UK and EU data regions where our providers offer them. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Assistance

Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures and at your reasonable request, to respond to requests from data subjects exercising their rights, and to meet your obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner. Because we do not store email content, many requests can be met directly from your own mailbox. If we receive a request directly from one of your data subjects, we will pass it to you and will not respond ourselves except on your instructions.

9. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data. We will give you the information reasonably available to us to help you meet your own obligations, and take reasonable steps to contain and remedy the breach.

10. Deletion at the end

When you disconnect a mailbox, its login details are deleted immediately. When you close your account, we delete the personal data we hold for you, except billing records we must keep by law. Per-message classification records are deleted after at most 120 days in any case. As we never store email content, there is no email content to return; your email remains in your own mailbox.

11. Information and audits

We will make available the information reasonably necessary to show that we meet this agreement, including answers to reasonable security questionnaires. Where that is not enough, you may carry out an audit, or have an independent auditor do so, once a year on at least 30 days' written notice, during business hours, at your own cost and subject to confidentiality.

12. General

This agreement lasts for as long as we process personal data on your behalf. Liability under it is subject to the limits in our terms of service. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Questions: privacy@optimamailguard.co.uk.