Business Data Processing Addendum
Last updated: 14 October 2026
This page describes the data processing terms Vexen Labs intends to use when it processes personal data for a business customer. It is informational and does not itself execute or replace a signed customer agreement.
Roles and scope
For a customer’s business mailbox data, the customer generally determines the purposes and means of processing and acts as controller; Vexen Labs processes that data to provide the hosted email service and acts as processor where applicable. The customer remains responsible for its instructions, notices, lawful basis, and user permissions. The parties should confirm their roles for each use case in a written agreement.
Processing details
Subject matter: hosted email, account, contact, and campaign-related services. Duration: the term of the service plus limited retention for security, legal, backup, and recovery needs. Nature and purpose: storing, organizing, displaying, transmitting, and supporting email and account data. Data subjects may include customer personnel, account holders, and correspondents; data may include identifiers, contact information, message content, attachments, and service records.
Processor commitments
Where data protection law requires a processor agreement, the detailed commitments should be set out in a mutually accepted written DPA. The intended terms include processing only on documented customer instructions, confidentiality commitments for authorized personnel, reasonable technical and organizational safeguards, assistance with applicable data subject requests and compliance duties, and notice of a personal data breach without undue delay after confirmation.
Subprocessors and transfers
Vexen Labs may use hosting and email infrastructure providers to deliver the service. Current provider identities, hosting region, transfer locations, and applicable transfer safeguards should be confirmed with support before regulated or region-restricted data is submitted. The current product does not publish a verified subprocessor list or hosting region.
End of service and contact
At the end of service, data return or deletion should be handled according to the customer agreement and any applicable retention obligations. Backup deletion timing is not currently published. To request a DPA, subprocessor details, or a security review, contact support@vexenlabs.com.
GDPR and other laws
Where the GDPR, UK GDPR, or another data protection law applies, customers and Vexen Labs should document their respective roles and satisfy the applicable requirements through a signed agreement and appropriate transfer terms. This page is not legal advice and does not establish that a customer or the service is compliant with any particular law.