GDPR Compliance

1. Introduction

This GDPR Compliance page provides additional information about how MailBluster LLC, doing business as OneSuite ("OneSuite," "we," "us," or "our"), collects, uses, stores, shares, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This page applies to individuals located in the European Economic Area and, where applicable, individuals protected under the United Kingdom General Data Protection Regulation ("UK GDPR").

This page supplements our Privacy Policy, Terms of Use, Data Processing Terms, and Cookie Policy.

If there is a conflict between this page and our general Privacy Policy concerning the rights of individuals protected by the GDPR or UK GDPR, the provisions of this page will apply to the extent required by law.

2. Company information

The organization responsible for OneSuite is:

MailBluster LLC, doing business as OneSuite
2810 N Church Street
Wilmington, Delaware 19802
United States

Email: [email protected]
Website: onesuite.io

EU representative — Article 27

Farhan Mahbub
Universitätsstr. 1, App. 700-3
03046 Cottbus
Germany

Email: [email protected]

UK representative — UK GDPR Article 27

Sabah Sarwar
25 Langtry Court
Belfast, BT5 4DN
United Kingdom

Email: [email protected]

3. Our role under the GDPR

OneSuite may act as either a data controller or a data processor, depending on the context in which personal data is processed.

3.1 OneSuite as a data controller

OneSuite acts as a data controller when we determine why and how personal data is processed.

This includes personal data processed for:

• Creating and administering OneSuite accounts
• Managing subscriptions and billing
• Providing customer support
• Operating and securing our website and platform
• Communicating service-related information
• Conducting permitted analytics
• Sending marketing communications where permitted
• Meeting legal and regulatory obligations

3.2 OneSuite as a data processor

OneSuite acts as a data processor when a customer uses the platform to process personal data relating to its clients, contacts, leads, team members, contractors, or other individuals.

In those circumstances:

• The customer generally acts as the data controller
• OneSuite processes personal data on the customer's documented instructions
• The customer determines the purpose and legal basis for processing
• Our Data Processing Terms apply
• The customer is responsible for providing required privacy notices and obtaining any necessary consent

Individuals whose personal data has been entered into OneSuite by one of our customers should normally direct their privacy requests to that customer.

4. Personal data we process

Depending on how you interact with OneSuite, we may process the following categories of personal data.

4.1 Account and identity information

• Full name
• Email address
• Telephone number
• Postal or business address
• User and business identifiers
• Account preferences
• Hashed authentication credentials

4.2 Customer-provided information

Our customers may enter personal data into OneSuite through:

• CRM contacts and companies
• Leads and opportunities
• Client portals
• Projects and tasks
• Comments and communications
• Files and documents
• Proposals and contracts
• Invoices and payment records
• Time-tracking entries
• Custom fields
• Connected applications

Customers control the information they enter into their OneSuite accounts.

4.3 Email integration information

When you connect an email account, OneSuite may process:

• Connected account identifiers
• Sender and recipient addresses
• CC recipients
• Email subject lines
• Email body content
• Thread identifiers
• Sent and received timestamps
• Message direction and status
• Attachment metadata
• OAuth tokens

OneSuite does not collect your email account password.

Email attachment files are retrieved from the connected provider when requested. OneSuite stores attachment metadata such as the file name, type, size, and provider identifier.

4.4 Billing information

OneSuite may process:

• Billing name and address
• Transaction history
• Subscription details
• Stripe customer identifiers
• The last four digits of a payment card

Complete payment-card details are processed by the applicable payment provider and are not stored on OneSuite's servers.

4.5 Usage and technical information

We may automatically process:

• IP address
• Browser type and version
• Device and operating-system information
• Pages and features used
• Login and activity timestamps
• Interaction and performance information
• Security and diagnostic logs

4.6 Support and communication information

We may retain information contained in:

• Support tickets
• Support-chat conversations
• Emails sent to OneSuite
• Product feedback
• Demo and sales requests
• Other communications with our team

4.7 Where we obtain personal data

Most personal data comes directly from you or is entered into OneSuite by our customers.

We also receive personal data from other sources, including connected email and calendar accounts. When a user connects a mailbox or calendar, OneSuite receives information about senders, recipients, meeting organizers, and meeting attendees who may not be OneSuite users.

This information is processed on behalf of the customer who connected the account. That customer is responsible for establishing an appropriate legal basis and providing any required privacy notice to affected individuals.

5. Legal bases for processing

We process personal data using one or more of the legal bases established under Article 6 of the GDPR.

5.1 Performance of a contract — Article 6(1)(b)

We process personal data when it is necessary to enter into or perform a contract with you.

This may include:

• Creating and maintaining your account
• Providing access to OneSuite
• Delivering requested platform features
• Managing subscriptions
• Processing payments
• Providing technical and customer support
• Sending essential service communications
• Managing connected services and integrations

5.2 Legitimate interests — Article 6(1)(f)

We may process personal data when necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• Operating and improving OneSuite
• Understanding how features are used
• Maintaining service reliability
• Protecting accounts and platform infrastructure
• Detecting fraud, abuse, and unauthorized access
• Investigating security incidents
• Preventing misuse of the platform
• Responding to customer inquiries
• Maintaining appropriate business records
• Communicating relevant information to existing customers

Where required, we assess whether the processing is necessary, proportionate, and reasonably expected by the individual.

5.3 Legal obligations — Article 6(1)(c)

We may process personal data when necessary to comply with legal obligations, including:

• Tax and accounting requirements
• Record-retention requirements
• Regulatory obligations
• Lawful government requests
• Court orders and legal proceedings
• Fraud-prevention requirements
• Data-protection obligations

5.4 Consent — Article 6(1)(a)

We may rely on consent for activities such as:

• Placing non-essential cookies
• Processing optional information you voluntarily provide
• Enabling optional features where consent is required

You may withdraw your consent at any time.

Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

5.5 Protection of legal rights

Where permitted by law, we may process personal data where necessary to establish, exercise, or defend legal claims.

6. Data protection principles

OneSuite applies the following GDPR principles when processing personal data.

6.1 Lawfulness, fairness, and transparency

We process personal data using an appropriate legal basis and provide information about how it is used.

6.2 Purpose limitation

We collect personal data for specified, explicit, and legitimate purposes and do not use it in ways that are incompatible with those purposes.

6.3 Data minimization

We seek to process only the personal data reasonably necessary for the relevant purpose.

6.4 Accuracy

We take reasonable steps to keep personal data accurate and allow users to update incorrect or incomplete information.

6.5 Storage limitation

We retain personal data only for as long as it is needed for the relevant purpose, contractual requirements, or applicable law.

6.6 Integrity and confidentiality

We maintain technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.

6.7 Accountability

We maintain policies, contractual controls, security measures, and processing records designed to demonstrate compliance with our data-protection responsibilities.

7. Your GDPR rights

Subject to applicable conditions and exemptions, you may exercise the following rights.

7.1 Right of access — Article 15

You may request:

• Confirmation of whether we process your personal data
• A copy of the personal data we hold about you
• Information about the purposes of processing
• Information about recipients or categories of recipients
• The expected retention period
• Information about your applicable rights

7.2 Right to rectification — Article 16

You may ask us to correct inaccurate personal data or complete information that is incomplete.

You may also be able to update certain information directly through your OneSuite account.

7.3 Right to erasure — Article 17

You may request deletion of your personal data when:

• It is no longer necessary for the original purpose
• You withdraw consent and there is no other legal basis
• You successfully object to the processing
• The information has been processed unlawfully
• Deletion is required to comply with a legal obligation

The right to erasure is not absolute. We may retain information when necessary to comply with legal obligations, exercise legal rights, resolve disputes, prevent fraud, or enforce agreements.

7.4 Right to restriction — Article 18

You may request that we limit the processing of your personal data while:

• Its accuracy is being verified
• An objection is being considered
• The processing is unlawful, but you prefer restriction to deletion
• We no longer need the information, but you require it for a legal claim

7.5 Right to data portability — Article 20

Where processing is automated and based on consent or a contract, you may request eligible personal data in a structured, commonly used, and machine-readable format.

Where technically feasible and legally required, you may request that the information be transferred directly to another controller.

7.6 Right to object — Article 21

You may object to processing based on legitimate interests.

When you object, we will stop the relevant processing unless:

• We demonstrate compelling legitimate grounds that override your rights
• The processing is necessary for the establishment, exercise, or defence of legal claims

You may object to direct marketing at any time. When you do so, we will stop processing your personal data for that marketing purpose.

7.7 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

You may withdraw consent through the relevant cookie or feature settings or by contacting OneSuite.

7.8 Rights related to automated decision-making — Article 22

You have the right not to be subject to a decision based solely on automated processing, including profiling, when that decision produces legal effects or similarly significantly affects you, except where permitted by applicable law.

OneSuite does not use solely automated decision-making to suspend or terminate accounts or make other decisions that produce legal or similarly significant effects without appropriate human involvement.

7.9 Right to lodge a complaint

You may lodge a complaint with the data-protection authority in the EEA country where you:

• Normally live
• Work
• Believe a GDPR violation occurred

A list of European data-protection authorities is available through the European Data Protection Board.

If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office at ico.org.uk.

We encourage you to contact us first so that we have an opportunity to address your concern.

8. How to exercise your rights

To submit a GDPR request, contact:

Email: [email protected]
Subject line: GDPR Request

Please include sufficient information to help us:

• Identify you
• Locate the relevant information
• Understand the right you wish to exercise
• Determine whether OneSuite is acting as the controller or processor

We may request additional information to verify your identity and protect your account against unauthorized requests.

We will generally respond without undue delay and within one month of receiving a valid request.

Where a request is complex or multiple requests have been submitted, the response period may be extended by up to two additional months. We will notify you of an extension and explain the reason.

There is normally no fee for exercising your rights. However, where permitted by the GDPR, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

When OneSuite processes information solely on behalf of a customer, we may refer the request to that customer or assist the customer in responding.

9. Data retention and deletion

We retain personal data only for as long as necessary to:

• Provide OneSuite services
• Maintain your account
• Complete transactions
• Meet contractual obligations
• Respond to support requests
• Protect the platform
• Resolve disputes
• Comply with legal requirements
• Exercise or defend legal claims

Our general retention practices include:

• Account data: Retained while the account remains active and deleted from active systems after account deletion
• Email integration data: Retained while the email account remains connected
• OAuth tokens: Retained while the relevant integration remains connected
• Payment and accounting records: Retained as required by applicable financial and legal requirements, typically for up to seven years
• Customer-controlled content: Retained according to the customer's instructions and account status

When an account is deleted, associated data is removed from active systems, except where retention is required by law or reasonably necessary to establish, exercise, or defend legal claims.

Data may persist in encrypted backups for a limited period after deletion from active systems. After that period, the backups are overwritten through OneSuite's normal backup-rotation cycle.

Our processing of customer-controlled personal data following account termination is also governed by our Data Processing Terms.

10. International data transfers

OneSuite primarily stores application data using Amazon Web Services infrastructure in the European Union, including the Ireland region.

Some approved service providers may process limited personal data outside the EEA, including in the United States.

Where personal data is transferred to a country that has not received an adequacy decision from the European Commission, OneSuite uses appropriate safeguards as required by applicable data-protection law.

These safeguards may include:

• European Commission-approved Standard Contractual Clauses
• Adequacy decisions
• The EU–U.S. Data Privacy Framework, where a United States service provider is certified
• The UK International Data Transfer Addendum for transfers subject to the UK GDPR
• Contractual data-protection requirements
• Encryption in transit and at rest
• Access controls and confidentiality obligations
• Transfer-risk assessments where required

Additional information about subprocessors and international transfers is provided in our Privacy Policy and Data Processing Terms.

11. Subprocessors

OneSuite uses selected third-party service providers to support platform operations.

Depending on the services and features used, these providers may include:

• Amazon Web Services for cloud infrastructure and hosting
• Amazon SES for transactional email delivery
• Mailgun for transactional email delivery
• Cloudflare for domain, network, proxy, security, and content-delivery services
• Stripe for subscription-payment processing
• Google Analytics for website analytics
• Crisp for customer-support communications
• Connected email, calendar, storage, scheduling, and payment providers selected by customers

When OneSuite acts as a data processor, subprocessors that process customer personal data are required to provide appropriate data-protection commitments.

OneSuite may update its subprocessors as the platform develops. Where required by our Data Processing Terms, customers will be informed of relevant changes and provided an opportunity to object on legitimate data-protection grounds.

12. Data security

OneSuite maintains technical and organizational measures designed to protect personal data.

These measures include, where applicable:

• Encryption of information at rest
• Encryption in transit using TLS 1.2 or higher
• Role-based access controls
• Access restricted to authorized personnel based on business need
• Audit logging and system monitoring
• Incident-response procedures
• Sanitization of logs to reduce unnecessary exposure of sensitive information

No method of transmission over the internet or electronic storage is completely secure, and OneSuite cannot guarantee absolute security.

OneSuite reviews its safeguards and updates them based on identified risks, operational requirements, and changes to its services.

13. Personal data breaches

OneSuite maintains procedures designed to identify, investigate, contain, document, and remediate suspected personal data breaches.

13.1 When OneSuite acts as a controller

Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, OneSuite will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where the breach is likely to result in a high risk to affected individuals, OneSuite will also notify those individuals without undue delay, unless an applicable exception applies.

13.2 When OneSuite acts as a processor

Where OneSuite becomes aware of a personal data breach affecting information processed on behalf of a customer, we will notify the affected customer without undue delay in accordance with our Data Processing Terms.

The customer, as controller, remains responsible for determining whether notification to a supervisory authority or affected individuals is required.

13.3 Breach records

OneSuite documents personal data breaches, including:

• The known facts surrounding the incident
• Its effects or potential effects
• Investigative actions
• Containment measures
• Remediation steps
• Notifications provided

14. Data protection by design and default

OneSuite considers data-protection principles when designing, developing, and operating the platform.

Our practices include:

• Limiting collection to information relevant to platform functionality
• Restricting access based on user roles and permissions
• Allowing connected services to be disconnected
• Supporting data correction and deletion
• Separating customer workspaces
• Applying secure development and access-management practices
• Reviewing the privacy implications of new features and integrations
• Using privacy-protective settings where reasonably appropriate

Customers remain responsible for configuring their own OneSuite workspaces, roles, integrations, custom fields, client portals, and workflows in accordance with their data-protection obligations.

15. Specific processing activities

15.1 Account administration

• Purpose: Create, secure, and manage OneSuite accounts
• Legal basis: Contract performance and legitimate interests
• Data involved: Identity, contact, authentication, account, and usage information

15.2 Platform service delivery

• Purpose: Provide CRM, client portal, project management, document, invoicing, time-tracking, communication, and related features
• Legal basis: Contract performance
• Data involved: Account information and customer-provided content

15.3 Email integrations

• Purpose: Synchronize, display, send, receive, and associate email communications with CRM records
• Legal basis: Contract performance and user instructions
• Data involved: Email metadata, message content, connected-account identifiers, and OAuth tokens

Users can revoke access by disconnecting the integration in OneSuite or through the connected provider.

15.4 Payment processing

• Purpose: Process subscription payments and maintain billing records
• Legal basis: Contract performance and legal obligations
• Data involved: Billing information, transaction records, subscription information, and limited card information

Complete card information is processed by the applicable payment provider.

15.5 Customer support

• Purpose: Respond to requests, diagnose issues, and improve support
• Legal basis: Contract performance and legitimate interests
• Data involved: Account details, communications, technical information, and issue descriptions

15.6 Analytics and service improvement

• Purpose: Understand website and platform usage, improve features, and maintain performance
• Legal basis: Consent for cookie-based analytics in the EEA and UK; legitimate interests for aggregated product usage analysis
• Data involved: Usage activity, feature interactions, device information, and anonymized or limited IP information

15.7 Security and fraud prevention

• Purpose: Protect accounts, users, infrastructure, and the integrity of the service
• Legal basis: Legitimate interests and legal obligations
• Data involved: Authentication activity, IP addresses, device information, audit logs, and account activity

15.8 Marketing communications

• Purpose: Send product news, educational material, offers, and information about OneSuite products and services
• Legal basis: Legitimate interests in communicating with existing customers about our products and services
• Data involved: Name, email address, customer relationship, account information, and communication preferences

When you create a OneSuite account, we may add you to our product mailing list on the basis of our legitimate interest in communicating with customers about the service you signed up for.

You can opt out at any time using the unsubscribe link in any message, and we will stop sending marketing communications.

16. Cookies and tracking technologies

OneSuite uses cookies and similar technologies for purposes that may include:

• Authentication
• Session management
• Security
• Remembering user preferences
• Website analytics
• Measuring marketing performance
• Delivering relevant communications or advertising

Essential cookies are required for the website and platform to function.

In the EEA and United Kingdom, cookie-based analytics and marketing technologies are used only after obtaining consent where required by applicable law.

Users can accept, reject, or manage non-essential cookies through OneSuite's cookie-consent tools.

Additional information is available in our Cookie Policy.

17. Children's personal data

OneSuite is a business platform and is not intended for children under 16.

We do not knowingly collect personal data directly from children under 16.

If we learn that a child has provided personal data without appropriate authorization, we will take reasonable steps to delete it.

Customers must not use OneSuite to collect or process children's personal data unless they have an appropriate legal basis and comply with all applicable requirements.

18. Data protection contact

For GDPR questions, privacy concerns, complaints, or requests to exercise your rights, contact:

Syed Rezwanul Haque
Founder of OneSuite

Email: [email protected]
Subject line: GDPR Request

MailBluster LLC, doing business as OneSuite
2810 N Church Street
Wilmington, Delaware 19802
United States

EU representative — Article 27

Farhan Mahbub
Universitätsstr. 1, App. 700-3
03046 Cottbus
Germany

Email: [email protected]

UK representative — UK GDPR Article 27

Sabah Sarwar
25 Langtry Court
Belfast, BT5 4DN
United Kingdom

Email: [email protected]

19. Changes to this page

We may update this GDPR Compliance page to reflect changes to:

• Applicable laws and regulatory guidance
• OneSuite's products and features
• Our processing activities
• Security measures
• Service providers and subprocessors
• International transfer arrangements
• Our Privacy Policy or Data Processing Terms

When this page is updated, we will revise the "Last updated" date.

Where required, material changes may also be communicated through email, the OneSuite platform, or another appropriate notice.

This page is provided for general information and does not constitute legal advice.