Data Processing Addendum.
Last updated: October 8, 2026This Data Processing Addendum ("DPA") forms part of the Terms & Conditions between Floki Mail, Inc. ("Floki", "Processor") and the customer using Floki Mail ("Customer", "Controller"). It applies where Floki processes personal data on the Customer's behalf under the EU/UK GDPR, the CCPA or similar data protection laws ("Data Protection Laws").
1. Definitions
"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given in the Data Protection Laws. "Customer Data" means Personal Data that Floki processes on the Customer's behalf through the Service, including connected mailbox data.
2. Roles and scope
The Customer is the Controller and Floki is the Processor of Customer Data. The subject matter, duration, nature and purpose of processing, and the categories of data and Data Subjects, are set out in Annex 1.
3. Customer instructions
Floki processes Customer Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service are those instructions. Floki will tell the Customer if it believes an instruction breaks Data Protection Laws.
4. Confidentiality
Floki ensures that anyone authorised to process Customer Data is bound by confidentiality. Floki staff have no access to the content of connected mailboxes.
5. Security
Floki maintains the technical and organisational measures described in Annex 2. They are designed to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
6. Subprocessors
The Customer authorises Floki to engage the subprocessors listed in section 1 of the Subprocessors page. Floki imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors' performance. Floki gives at least 30 days' notice before adding or replacing a subprocessor. If the Customer objects on reasonable data protection grounds, the parties will discuss it in good faith. If they cannot resolve the objection, the Customer may terminate the affected Service.
7. AI providers selected by the Customer
Where the Customer or its users connect an AI provider using their own API key, the Customer directs Floki to send that provider the content needed for each AI request the user makes. That provider acts under its own agreement with the Customer or user and is not a subprocessor of Floki. Floki is not responsible for that provider's processing.
8. Data Subject requests
Floki will help the Customer respond to Data Subject requests, taking into account the nature of the processing. If Floki receives a request directly, it will pass it to the Customer and will not respond except on the Customer's instruction.
9. Personal Data Breaches
Floki will notify the Customer without undue delay, and no later than 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice will include the information the Customer reasonably needs to meet its own notification obligations.
10. Assistance
Floki will provide reasonable help with data protection impact assessments and consultations with supervisory authorities about the Service.
11. Deletion and return
When a mailbox is disconnected or the Service ends, Floki deletes the associated Customer Data within 30 days, unless law requires longer retention. Before that, the Customer may export its data using the Service's export functions.
12. Audits
On written request, and no more than once a year, Floki will provide information reasonably needed to demonstrate compliance with this DPA, including available security assessment reports. Any further audit must be agreed in advance, at the Customer's cost, and subject to confidentiality.
13. International transfers
Where Customer Data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum. Those are incorporated into this DPA by reference.
14. General
Liability under this DPA is subject to the limitations in the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails. This DPA ends when Floki stops processing Customer Data.
Annex 1: Details of processing
- Subject matter: provision of the Floki Mail email client and its AI features.
- Duration: the term of the Customer's subscription, plus the deletion period in section 11.
- Nature and purpose: connecting to mailboxes over IMAP/SMTP, including through OAuth for Google and Microsoft accounts; syncing, displaying, searching, organising, sending and deleting email at the user's direction; transmitting content to user-selected AI providers on request.
- Data Subjects: the Customer's users, and the people whose details appear in their email (senders, recipients, contacts).
- Categories of data: names, email addresses, message content and attachments, metadata, contact details, account and usage data. Email content may incidentally contain special-category data. Floki does not intentionally process such data.
Annex 2: Security measures
- Credentials and OAuth refresh tokens encrypted at rest with AES-256-GCM.
- TLS for all connections, including to mail servers and AI providers.
- Production access restricted to authorised personnel and logged.
- Logical separation of customer data, plus dedicated instances where contracted.
- Users can revoke mailbox access at any time.
- Daily encrypted backups, stored separately from production.
- Multi-factor authentication on all administrative accounts.
- Uptime and security monitoring of production systems.
- Regular dependency and vulnerability updates.