Data processing terms

These terms apply where you use ListCheckup to process personal data and we act as processor on your behalf under Article 28 GDPR. A countersigned data processing agreement is available on request from hello@listcheckup.com.

Roles

You are the controller of the email addresses you submit. ListCheckup is the processor. You are responsible for having a lawful basis to process those addresses and for the accuracy of the instructions you give us.

Subject matter and duration

Processing consists of verifying whether submitted email addresses are deliverable, for as long as your account is active plus the retention period you configure.

Nature and purpose

• Parsing and normalising the address.
• Resolving the domain's mail servers.
• Contacting those mail servers to establish whether the mailbox is accepted.
• Storing the result so repeat checks need not contact the mail server again.
• Returning results to you and deleting them per your retention setting.

Categories of data and data subjects

Data: email addresses, and any optional identifiers you choose to include in an upload for your own reconciliation. Data subjects: the individuals or organisations to whom those addresses belong, typically your customers, subscribers, or contacts.

Do not submit special category data. The Service has no need for it and provides no safeguards appropriate to it.

Our obligations

• Process personal data only on your documented instructions.
• Ensure personnel with access are bound by confidentiality.
• Apply the technical and organisational measures set out below.
• Assist you with data subject requests and with security or breach obligations.
• Notify you without undue delay after becoming aware of a personal data breach.
• Delete or return personal data at the end of the engagement, on request.
• Make available information necessary to demonstrate compliance.

Security measures

• TLS in transit; access to production restricted to key-based authentication.
• Credentials stored only as hashes.
• Segregation of customer data by account.
• Automatic deletion of uploads on the configured retention schedule.
• Logging designed to exclude submitted addresses from web server access logs.

Sub-processors

The sub-processors listed in the Privacy Policy are authorised. We will give notice before engaging a new sub-processor that handles submitted addresses, and you may object on reasonable data protection grounds.

International transfers

Verification requires contacting the recipient's mail server, which may be located outside the EEA. This disclosure is limited to the address being verified and is inherent to the service you have instructed us to perform. Storage and processing by us take place within the European Union.

Deletion

You can delete uploads and results at any time from the application. On account closure, all submitted addresses and results are deleted within 30 days unless retention is required by law.