BYOD DPA Addendum — sending email from the Controller's own domain

Part 1 — Data protection terms (Article 28 GDPR)

Article numbers in this addendum refer to the DPA as published at vantemo.com/dpa.

Purpose

This addendum supplements the Vantemo Data Processing Agreement (the "DPA") for Controllers who use the Bring Your Own Domain (BYOD) email feature. Under BYOD, the Controller sends email through the Services from a domain it controls (for example mail.myshop.com) instead of the platform subdomain <slug>.send.vantemo.com.

What BYOD changes is who controls the DNS zone and the From domain. It does not change who holds the email signing keys: in both setups AWS SES, as Vantemo's sub-processor, generates and holds the DKIM private key.

Terminology

"BYOD" in this addendum means Bring Your Own Domain: the Controller supplies its own domain as the sending identity. Vantemo uses Amazon SES Easy DKIM, in which AWS generates and holds the DKIM private key and the Controller publishes three CNAME records that point at AWS-hosted public keys. This is not the AWS "BYODKIM" mode, in which a customer generates a key itself and uploads the private key to SES.

Background: what BYOD changes

Key point: under BYOD the Controller publishes and maintains the DKIM records in its own DNS zone. Vantemo checks DKIM for each BYOD domain about every 6 hours (extra checks can run in between). After 3 failed checks in a row, the Controller's email keeps flowing, but from the same local part at <slug>.send.vantemo.com instead of the Controller's domain. This covers email that Vantemo composes and sends. Email that the Controller relays through Vantemo's SMTP service keeps its own From address and may not be delivered while DKIM is broken. After 3 passing checks in a row, sending from the Controller's domain resumes. Vantemo emails the address registered to the Controller's account on each change (Schedule C(6)).

Schedule A — Scope of Processing

Inbound email forwarding through Cloudflare Email Routing, where the Controller turns it on, is covered by the DPA and its sub-processor list, not by this addendum.

Schedule C — Processor Obligations (Vantemo)

Vantemo, as processor, will:

1. Provide the DNS records. When a BYOD domain is registered, show in the dashboard the three DKIM CNAME records, the mail-from records and the recommended DMARC record for the Controller to publish.
2. Monitor sending identities (best-effort). Vantemo runs two monitoring mechanisms. (a) A daily identity-health check takes a sample of up to 20 domains per day from the pool of verified sending domains and raises an internal alert to Vantemo when a sampled domain fails; because it is a sample, a given domain may not be checked on a given day. (b) Where AWS SES reports a deliverability finding for the domain that needs the Controller's action, Vantemo emails it to the account owner. The DKIM check and email in Schedule C(6) run in addition. The Controller should monitor its own sending and DNS records and not rely on these mechanisms as a substitute; primary responsibility for the DNS records stays with the Controller under Schedule B(1).
3. Isolation. Send each shop's email under a dedicated SES tenant and, where provisioned, a dedicated configuration set, so that the sending reputation of the BYOD domain is kept separate from other merchants on the platform.
4. Changes to DNS records. Vantemo does not change DNS records in a zone the Controller hosts itself. If the domain's zone is hosted in Vantemo's Cloudflare account, Vantemo writes and maintains there the records the shop needs, such as the storefront records and, where the Controller turns on forwarding, the email forwarding records.
5. Security of the email sub-processor's signing key. The DKIM private key is held by the email sub-processor identified in DPA Annex B under that sub-processor's own security controls. Vantemo has no access to the private key and cannot export it. If the email sub-processor identified in DPA Annex B changes, Vantemo will notify the Controller in accordance with the DPA's prior-notice clause for sub-processor changes (Article 5.2) before the change takes effect.
6. Degraded-DKIM fallback. The Controller instructs Vantemo to apply the following fallback. If 3 DKIM checks in a row fail for a BYOD domain, Vantemo keeps delivering the Controller's email from the same local part at <slug>.send.vantemo.com. While the fallback applies, those messages are authenticated under the platform subdomain's DMARC policy, not the Controller's. While the fallback applies, replies are addressed to the Reply-To address the Controller set. If none is set and the message would have come from the Controller's main domain, replies are addressed to that same address. For a sending subdomain that cannot receive mail, the Controller should set a Reply-To address. The fallback covers email that Vantemo composes and sends. Email that the Controller relays through Vantemo's SMTP service keeps its own From address and may not be delivered while DKIM is broken. After 3 DKIM checks in a row pass, Vantemo sends from the Controller's domain again. Vantemo notifies the email address registered to the Controller's account when the fallback starts and when it ends.

Acceptance

The Controller accepts this addendum when adding a BYOD domain in the Vantemo dashboard: the dialog summarises the main terms and links to this text. The addendum binds on that acceptance and supplements the DPA. This is the electronic form that Article 28(9) GDPR allows: "The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form."

Only the organization owner or an admin can accept. The person who accepts confirms that they are authorised to accept this addendum for the Controller. For each acceptance, Vantemo records the addendum version, a SHA-256 fingerprint of this public text, the time, the accepting user and the IP address. This evidence is kept in an acceptance audit record while the shop exists and for 3 years after the shop is deleted. The IP address in the acceptance record is deleted 12 months after acceptance.

Each new version of this addendum needs a new acceptance before another BYOD domain can be added. Vantemo's systems refuse BYOD onboarding when the feature is switched off or when the deployed addendum version does not match the version presented for acceptance.

Survival

Personal data processed under this addendum is deleted or returned as set out in DPA Article 9 (Art. 28(3)(g) GDPR), which survives termination under DPA Article 12.3.

Separately, when a BYOD domain is removed, Vantemo deletes the domain's AWS SES identity; if the automatic deletion fails, Vantemo is alerted and completes it. Vantemo does not store the domain's DKIM tokens. It keeps an email audit-log record of the domain's registration and removal for the email audit-log retention period in DPA Annex C.5 (12 months). The first sentence of Schedule C(4) continues to apply after the BYOD relationship ends.

Part 2 — Own-domain feature terms

Schedule B — Controller Obligations

The obligations in this Schedule B are Controller obligations under DPA Article 3. The Controller must:

1. Maintain DNS records. Publish and maintain in its DNS zone the three DKIM CNAME records and the mail-from records (MX and SPF) shown in the Vantemo dashboard. If the DKIM records stop resolving, the fallback in Schedule C(6) applies until they are restored.
2. Choose a DMARC policy. The dashboard shows a recommended DMARC record (p=quarantine, aggregate reports to [email protected]). RFC 9989 recommends starting at p=none with aggregate reports and considering p=quarantine or p=reject once reports show all mail from the domain is aligned; the dashboard's recommended record is the target policy. Publishing it is optional, and the Controller may send its reports to its own address instead. Where the receiving server honours the record, Vantemo receives DMARC aggregate reports for the domain; they contain sending-source IP addresses and message counts, and no end-customer data.
3. Lawful basis for marketing. For marketing email sent from the BYOD domain, the Controller warrants a valid lawful basis under the law of each recipient's country, including Art. 6 GDPR and the national rules that transpose Art. 13 of Directive 2002/58/EC. Under Art. 13(5) of that Directive, its consent rule applies to subscribers who are natural persons. For them, the Controller needs prior consent or the existing-customer exception. The existing-customer exception applies only when all three of the following hold: the contact details were obtained from the Controller's own customer in the context of a sale; the message markets the Controller's own similar products or services; and the customer was given a clear and distinct opportunity to object, free of charge and in an easy manner, when the details were collected and in every message. Where the subscriber of the email account is a legal person, national law decides. Some countries allow such email without prior consent if every message offers a clear, free and easy way to opt out (for example Lithuania since 22 April 2026). Whether a subscriber is a natural or a legal person depends on its legal status under its own national law. The GDPR still applies to the work address of a named employee. The Controller keeps per-recipient records of the basis it relies on. Vantemo keeps no per-recipient consent records.
4. Notice before a domain transfer. If the Controller plans to transfer the BYOD domain, or the DNS zone it sits in, to a third party, the Controller must notify Vantemo at [email protected] before the transfer. After a transfer, the new owner could receive bounce and reply traffic that carries end-customer email addresses. The Controller can also remove the domain in the dashboard once no sender address the shop needs still depends on it (the dashboard asks the Controller to move those addresses to another verified domain first); removal deletes the domain's AWS SES identity, and if the automatic deletion fails, Vantemo is alerted and completes it. On receipt of a transfer notice, Vantemo removes the domain within 24 hours and confirms by email, after moving any sender address that still depends on it to the Controller's platform sending domain <slug>.send.vantemo.com. Vantemo notifies the Controller without undue delay and in any event within 48 hours after becoming aware of a personal data breach, as set out in DPA Article 7.1 (Art. 33(2) GDPR). Deciding whether to notify the supervisory authority and data subjects, and doing so where Art. 33(1) and 34 GDPR require it, remains the Controller's obligation, with Vantemo's assistance under Art. 28(3)(f) GDPR.
5. Anti-spam and direct-marketing law. The Controller is responsible, under the anti-spam and direct-marketing laws that apply to its recipients (including the national laws transposing Directive 2002/58/EC, the US CAN-SPAM Act, Canada's CASL and the UK PECR), for: a lawful basis for each marketing message; accurate header information and subject lines that do not mislead; identifying marketing messages as advertisements where the law requires it; and honouring opt-out requests and keeping the opt-out working for the period the applicable law sets. Independently of which law applies, the Controller shall include its physical postal address in marketing messages. Vantemo supplies the technical opt-out link and the suppression list. Schedule B(6) applies to a breach of this clause.
6. Indemnity. The Controller indemnifies Vantemo against claims, losses, costs and, where the law allows, fines that arise from the Controller's breach of this Schedule B, including the postal-address duty in Schedule B(5). This indemnity is in addition to, not instead of, the indemnities in the DPA.