DPIA — SMTP relay (email)
Provider: as configured via SMTP_HOST env; typically the
platform's own or a local relay
Contract owner: ZFA InsureLink (data controller)
DPIA owner: DPO
Last review: 2026-07-16
What data is transferred
| Field | Purpose | Retention at relay |
|---|---|---|
| Recipient email address | Email routing | Depends on relay; typically transit-only |
| Message subject + body | Message content | Transit-only unless relay archives |
| From address / branding | Sender identification | Persistent |
Where the data goes
Depends on the relay. Uganda-hosted SMTP (e.g. on ZFA's own MTA) is not a cross-border transfer; a foreign relay (e.g. SendGrid US, Mailgun US, AWS SES) is.
Set NOTIFICATION_EMAIL_CROSS_BORDER=true in the environment when
the configured SMTP endpoint terminates outside Uganda — that flips
the dispatch service into the DPPA §16 consent-gate path for email
too, with transferKind email_smtp.
Legal basis
- Local relay (default): DPPA §13(a) contract performance — email is a necessary part of the InsureLink service.
- Foreign relay:
DataTransferConsent(transferKind=email_smtp) for non-transactional categories.
Safeguards
- STARTTLS enforced by the SMTP provider (dependent on relay configuration).
- SMTP credentials via
SMTP_USER/SMTP_PASSWORDenv; rotated per platform-secrets schedule. - No inbound webhooks — email bounces are captured only via provider-specific integration (not yet wired).
Data-subject rights routing
Same as SMS/WhatsApp DPIAs. Email-body scrub uses the same
AES-256-GCM at-rest encryption on Notification.body.
Residual risks
- Bounce handling — a hard bounce currently does not flip the
user's preference. Ops receives bounce reports out of band. Future
Phase 4 integration: SendGrid Events Webhook (or Postmark
equivalent) → NotificationDeliveryLog.deliveryOutcome=
bounced. - Email archival — Google Workspace / Microsoft 365 mailboxes on the recipient side keep messages indefinitely under the user's control. Out of ZFA's scope.
Review cadence
Annual, or on relay change.