Data Processing Addendum

Last updated 9 November 2026

This addendum forms part of the Terms of Service and applies together with the Privacy Policy. Words defined in the Terms have the same meaning here.

1. When this addendum applies

This Data Processing Addendum ("DPA") applies where Visolute Pty Ltd (ABN 23 703 325 240) trading as DMARCLoop ("DMARCLoop", "we") processes Personal Data on behalf of a Customer that is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection (together, "Data Protection Law"). It is incorporated into the Terms of Service for every such Customer, without a signature. A Customer that needs a countersigned copy can ask at contact at dmarcloop.com.

"Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Sub-processor" and "Personal Data Breach" have the meanings given in Data Protection Law. Where this DPA and the Terms conflict about the Processing of Personal Data, this DPA prevails.

2. Roles

For the Personal Data described in clause 3 the Customer is the Controller (or a Processor acting for its own clients, in the case of an MSP) and DMARCLoop is a Processor. The Customer instructs DMARCLoop to process it to provide the Service as the Terms describe. DMARCLoop is an independent Controller of Account Data it collects for its own purposes (account administration, billing, security and the analytics described in the Privacy Policy), and of data it holds in aggregated or de-identified form.

If the Customer is an MSP acting as a Processor for its clients, the Customer warrants that its clients have authorised the appointment of DMARCLoop as a Sub-processor on the terms of this DPA, and the Customer's instructions to DMARCLoop are taken to be its clients' instructions.

3. Details of the Processing

• Subject matter and purpose. Providing the DMARCLoop Service: receiving and analysing DMARC aggregate and failure reports, SMTP TLS reports and DNS data for the Customer's domains, publishing hosted DNS records, sending alerts, digests and exports, and providing support.
• Duration. The term of the Customer's account and the deletion period after it ends (clause 9).
• Nature. Collection, storage, parsing, aggregation, classification, display, export, transmission to recipients the Customer chooses, and deletion, by automated means.
• Categories of Data Subject. The Customer's staff and users of the Service; recipients and senders of mail to and from the Customer's domains, to the extent reports identify them; the Customer's clients' staff, for an MSP.
• Categories of Personal Data. Names and email addresses of the Customer's users and the people it configures as alert recipients; IP addresses, hostnames and sending domains that appear in DMARC aggregate reports; where the Customer enables failure (forensic) reports, the redacted metadata of individual messages that failed authentication (sending and receiving hosts, timestamps, authentication results, and the header fields the Customer chooses to keep, which may include email addresses and subject lines). No special categories of Personal Data are required by the Service and the Customer must not direct any to it knowingly.

4. DMARCLoop's obligations

DMARCLoop will:

• process Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's configuration of the Service, unless required to do otherwise by law, in which case DMARCLoop will tell the Customer before processing unless the law forbids it;
• tell the Customer at once if, in DMARCLoop's opinion, an instruction infringes Data Protection Law;
• ensure that everyone authorised to process Personal Data is bound by confidentiality obligations;
• implement the security measures in clause 5;
• engage Sub-processors only as clause 6 allows;
• assist the Customer, by appropriate technical and organisational measures and as far as possible, in responding to Data Subjects' requests (clause 7) and in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the Processing and the information available to DMARCLoop;
• delete or return Personal Data at the end of the Service as clause 9 describes; and
• make available the information needed to demonstrate compliance with this DPA, and allow for and contribute to audits as clause 10 describes.

5. Security

DMARCLoop maintains technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest by its infrastructure providers; access to production systems limited to named staff, with least privilege and two-factor authentication; tenant isolation enforced in the application's data layer for every query on Customer data; role-based access within the Customer's account, with failure reports restricted to roles the Customer chooses; an audit log of staff access to a Customer's account, visible to the Customer; hashed passwords, optional two-factor authentication, SSO and SCIM for Customer users; a strict Content Security Policy, rate limiting and signed webhooks; scheduled backups with a tested restore procedure; and PII redaction options for failure reports (subject, local parts and body). DMARCLoop may update these measures from time to time provided the overall level of protection is not reduced.

6. Sub-processors

The Customer gives DMARCLoop general authorisation to engage Sub-processors in the categories the Privacy Policy describes: hosting and infrastructure; content delivery and security; email delivery; payment processing; and product analytics. DMARCLoop will give the Customer the current list, with each Sub-processor's location, on request, and will tell account owners by email at least 30 days before adding or replacing a Sub-processor that processes Personal Data. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, either party may terminate the affected Service, and DMARCLoop will refund any fees prepaid for the period after termination. DMARCLoop imposes data protection obligations on each Sub-processor no less protective than this DPA and remains responsible for their performance.

7. Data Subject requests

The Service lets the Customer view, correct, export and delete the Personal Data it holds for its users and domains. If DMARCLoop receives a request from a Data Subject relating to Personal Data processed for the Customer, it will not respond except to direct the person to the Customer, and will tell the Customer promptly where the law allows.

8. Personal Data Breach

DMARCLoop will notify the Customer's account owners without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, with the information then available: the nature of the breach, the categories and approximate numbers of Data Subjects and records, the likely consequences, and the measures taken or proposed. DMARCLoop will update that notice as more becomes known. Notification is not an admission of fault.

9. Return and deletion

The Customer can export all its data from the Service at any time while its account is active and during the 30 days after it requests deletion. After an account is deleted or terminated, DMARCLoop deletes the Customer's Personal Data within the purge process the Terms describe, and deletes older report data in the ordinary operation of each plan's retention period, except for data it must keep under law, billing records, and backups, which are overwritten in the normal backup cycle and are not restored except to recover the Service.

10. Information and audits

On written request, no more than once a year unless Data Protection Law or a supervisory authority requires otherwise, DMARCLoop will answer the Customer's reasonable security and compliance questions and provide the documentation it holds about its measures and Sub-processors. Where that is not enough to demonstrate compliance, the Customer, or an independent auditor bound by confidentiality, may audit DMARCLoop's relevant records at a mutually agreed time, at the Customer's cost, in a way that does not disrupt the Service or expose other customers' data. DMARCLoop does not give access to its providers' facilities; their own certifications and audit reports stand in for it.

11. International transfers

DMARCLoop is in Australia, and its providers process data principally in the United States and the European Union. Where Data Protection Law restricts a transfer of Personal Data out of the EEA, the UK or Switzerland, the parties rely on the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two or Module Three as applicable), which are incorporated into this DPA with the Customer as data exporter and DMARCLoop as data importer, and for the UK on the Information Commissioner's International Data Transfer Addendum to them, and for Switzerland on the adaptations the Swiss Federal Data Protection and Information Commissioner requires. The details of the Processing in clause 3, the measures in clause 5 and the Sub-processors in clause 6 complete their annexes. Where a later adequacy decision or other lawful mechanism covers a transfer, it may be relied on instead.

12. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This DPA lasts for as long as DMARCLoop processes Personal Data for the Customer. DMARCLoop may update it to reflect changes in Data Protection Law or in the Service; changes that reduce the Customer's protection are notified as the Terms describe.

13. Contact

Data protection questions, Sub-processor lists and requests for a countersigned copy: contact at dmarcloop.com.