GDPR & Data Processing Agreement

Overview

Apifon S.A. is fully committed to compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page outlines our data processing practices and serves as a reference for our Data Processing Agreement (DPA).

Our Role

When you use wemail to send transactional or marketing emails, Apifon acts as a Data Processor on your behalf. You remain the Data Controller responsible for determining the purposes and means of processing your customers' personal data.

Data Processing Agreement

Our standard DPA is automatically included in your service agreement when you sign up for wemail. It covers:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data processed
• Categories of data subjects
• Obligations and rights of the Controller
• Sub-processor management and notification
• Data breach notification procedures (72-hour SLA)
• Data deletion and return upon termination

Technical & Organizational Measures

Infrastructure Security

All data is processed and stored within the European Union. Our cloud infrastructure providers are independently SOC 2 Type II audited, and our own controls follow the SOC 2 Trust Services Criteria.

Encryption

Data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256. API keys are hashed using bcrypt.

Access Control

Role-based access control (RBAC) with principle of least privilege. Multi-factor authentication required for all staff access. Audit logging of all data access.

Data Minimization

We only process data strictly necessary for service delivery. Email content is not stored beyond the delivery pipeline unless explicitly configured by the customer.

Sub-Processors

We maintain a list of sub-processors and notify customers of changes. Current sub-processors include:

• Microsoft Azure — Cloud hosting & database (EU)
• Amazon Web Services (AWS) — Email delivery (EU)
• Stripe — Payment processing
• Anthropic — AI features (no customer PII shared)

Data Subject Rights

We support you in fulfilling data subject requests (access, rectification, erasure, portability, restriction, objection). Our API provides endpoints for data export and deletion to help you comply with GDPR obligations.

Breach Notification

In the event of a personal data breach, we will notify you without undue delay and within 72 hours of becoming aware of the breach, providing all information required under Article 33 of the GDPR.

International Transfers

All processing occurs within the EU/EEA. Where transfers outside the EEA are necessary (e.g., for specific sub-processors), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

Contact

Data Protection Officer: dpo@wemail.io

For a signed copy of our DPA, contact info@wemail.io. Customers on eligible plans (see the plan comparison) may also request custom DPA terms through the same address.

Apifon S.A., 27 Georgikis Scholis str., 57001 Thessaloniki, Greece