Data Processing Agreement

Last updated October 4, 2026.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between HeyNews LLC ("Processor", "we") and the customer who uses Newsletter Hosting ("Controller", "you"). It applies when we process personal data on your behalf, and it meets Article 28 of the EU and UK GDPR.

1. Subject, duration, nature and purpose

We process your subscribers' personal data to host your publication and send its email, for as long as you use Newsletter Hosting and until we delete the data under section 9.

2. Data and data subjects

Data subjects: your subscribers and members, people who sign up to or visit your publication, and your staff who use its admin. Personal data: email address, name, subscription source and time, consent records, email delivery events (sent, delivered, bounced, complained, opened and clicked), the IP address and browser details recorded with opens, clicks and site visits, approximate location derived from the IP address, and address verification results. You must not send us special categories of personal data.

3. Your instructions

We process personal data only on your documented instructions, including with regard to transfers to a third country, unless the law requires otherwise. If so, we will tell you before processing unless the law forbids it. Your use of Newsletter Hosting and its settings are your instructions. We will tell you if we think an instruction breaks the law.

4. Confidentiality

Everyone we authorize to process the personal data is bound by confidentiality.

5. Security

We take the technical and organizational measures Article 32 requires, including encryption in transit, access limited to the people who need it, and logs of sending activity.

6. Sub-processors

You give us general authorization to use the sub-processors listed under "Newsletter Hosting" at heynews.co/subprocessors. We will tell you about any new or replacement sub-processor at least 14 days before it starts, by email and by updating that page. You may object on reasonable data protection grounds within that time. If we cannot resolve your objection, you may end Newsletter Hosting and we will refund any prepaid fees for the unused period, despite our Refund Policy. We bind every sub-processor to data protection terms no less protective than this DPA, and we remain responsible to you for its work.

7. Helping you

Taking into account the nature of the processing, we will help you respond to requests from data subjects exercising their rights, and help you meet your obligations under Articles 32 to 36, including security, breach notification, data protection impact assessments and prior consultation.

8. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your data. We will give you what we know about its nature, the data and data subjects affected, its likely consequences, and what we are doing about it, and send more as we learn it.

9. Deletion and return

When Newsletter Hosting ends, you can ask us to return your personal data within 30 days. We then delete it within a further 30 days, unless the law requires us to keep it.

10. Audits

We will make available the information needed to show we comply with Article 28, and allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach or a regulator requires more.

11. Transfers

We and our sub-processors process personal data in the United States and in the other countries listed at heynews.co/subprocessors. Where the GDPR applies to a transfer, the Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you are yourself a processor) are incorporated into this DPA by reference, with the UK Addendum for UK data. We send personal data to a sub-processor in a country without an adequacy decision only under the Standard Contractual Clauses or another safeguard under Article 46.

12. Order of precedence

If this DPA and the Terms of Service conflict on data protection, this DPA applies.

13. Changes

We may update this DPA. We will email you about a material change at least 30 days before it takes effect, unless the law requires a faster change.

HeyNews LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. privacy@heynews.co