GDPR Compliance

MailGovern is deeply committed to data privacy and regulatory adherence.

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that establishes strict rules for how the personal data of European Union (EU) residents must be handled. At MailGovern, we act as both a Data Controller (for our own customers' data) and a Data Processor (for the email data we process on behalf of our enterprise clients).

1. Our Commitment to GDPR

We have built our platform architecture with "Privacy by Design" principles at its core. This ensures that GDPR compliance is not an afterthought, but a fundamental property of how we route and govern Microsoft Exchange and Google Workspace data.

2. Data Subject Rights

MailGovern fully supports the rights established under the GDPR for EU residents, including:

  • The Right to Access: You can request a copy of the personal data we hold about you.
  • The Right to Rectification: You can request that we correct inaccurate or incomplete data.
  • The Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data when it is no longer necessary for the purposes it was collected.
  • The Right to Restrict Processing: You can limit how we use your data under certain circumstances.
  • The Right to Data Portability: You can request your data in a structured, commonly used, and machine-readable format.

3. Data Processing Addendum (DPA)

For our enterprise and SaaS builder customers where MailGovern acts as a Data Processor, we offer a comprehensive Data Processing Addendum (DPA) that incorporates the Standard Contractual Clauses (SCCs) approved by the European Commission. This ensures lawful transfer of data outside the EEA.

Please contact your Account Executive to execute a DPA.

4. Sub-processors

To provide our robust governance services, MailGovern engages specific third-party sub-processors (e.g., cloud hosting providers). We ensure that all our sub-processors are subject to rigorous security and privacy assessments and are bound by contractual obligations that mirror those in our own DPAs.

5. Data Sovereignty & Localization

We understand that some organizations require strict data sovereignty. MailGovern offers On-Premise deployments and region-specific cloud deployments (e.g., EU-only Azure regions) to guarantee that your email metadata never leaves the designated jurisdiction.

6. Incident Response

In the unlikely event of a personal data breach, MailGovern has strict incident response protocols in place to notify our customers without undue delay (and within the 72-hour window required by GDPR), providing all necessary information to help you mitigate the situation.

7. Contact our DPO

If you have questions regarding our GDPR compliance or wish to exercise your data subject rights, please contact our Data Protection Officer at info@mailgovern.com.