GDPR & Data Protection

1. Roles

For your account data, AuthoriseMail is the data controller. For email lists you upload, you are the controller and AuthoriseMail is the processor acting on your documented instructions (see our DPA).

2. Lawful bases

We rely on contract performance, legitimate interests (security, service improvement), consent (marketing, optional cookies), and legal obligations, as detailed in the Privacy Policy.

3. Data subject rights

• Access, rectification, erasure, restriction, objection, and portability.
• Requests: email support@authorisemail.com with subject “Privacy request”. We verify identity and respond within 30 days.
• Self-serve: exports and account deletion controls are available in the dashboard.

4. Retention

We keep personal data only as long as needed for the purposes collected, plus statutory accounting periods. Uploaded verification data is deleted when you delete it or close your account, subject to backup cycles.

5. International transfers

Where data moves outside the EEA/UK, we use appropriate safeguards such as standard contractual clauses.

6. Subprocessors

We use vetted subprocessors for hosting, transactional email, authentication, and payments, bound by data-processing terms. A current list is available on request.

7. Breach & incident handling

We maintain an incident-response process. Where a personal-data breach creates risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected users without undue delay, as required by law.

8. Security measures

Encryption in transit, hashed credentials, least-privilege access, audit logs, and rate limiting. See the Security page. We do not claim certifications we have not obtained.