Skip to content

Legal

Terms and conditions

Terms and Conditions of Website Use

 

1. Introduction

Welcome to Astonish Email.

This page tells you the terms on which you may use our website www.astonishemail.com, whether as registered user or guest. Please read carefully before use.

By using the site, you accept the terms and agree to obey them. If you don't accept them, please don't use the site.

 

2. Who We Are

www.astonishemail.com is operated by Astonish Email, a UK Limited company registered in England under company number 08605617.

Some important details about us:

Our registered office is at: Unit 4 Walworth Enterprise Centre, Andover, Hampshire, SP10 5AP

Our VAT number is: GB165918573

 

3. Use of the Site

You have permission for temporary use of the site, but we can withdraw or change our service at any time without telling you and without being legally responsible to you.

You must treat all identification codes, passwords and other security information as confidential. If we think you have failed to keep confidentiality, we are allowed to disable any security information (including your passwords and codes).

You agree to follow our acceptable use policy www.astonishemail.com/acceptable-use-policy

If you allow anyone else to use our site, you must make sure that they read these terms first, and that they follow them.

Only use the site as allowed by law and these terms. If you don't, we may suspend your usage, or stop it completely.

We frequently update the site and make changes to it, but we don't have to do this, and material on the site may be out-of-date. No material on the site is intended to contain advice, and you shouldn't rely on it. We exclude all legal responsibility and costs for reliance placed on the site by anyone.

We follow our privacy policy in handling information about you. You can read our policy at www.astonishemail.com/privacy-policy

You confirm that the information you give us is accurate.

 

4. Intellectual Property Rights

We are the owner or licensee of all intellectual property rights in the site (for example the copyright and any rights in the designs) and in any of the material posted on it. They are protected by copyright.

You are allowed to print one copy and download extracts of any page on the site for your personal reference, but not for commercial use without a licence from us. You must not alter anything, or use any illustrations, video, audio or photographs separately from the text that goes with them.

If you breach these terms, you lose your right to use our site, and must destroy or return any copies you have made.

 

5. Our Legal Responsibility to You

We do not guarantee the accuracy of material on our site. As far as legally possible, we exclude legal responsibility for the following:

Any loss to you arising from use of our site

Loss of income, profit, business, data, contracts, goodwill or savings.

We also exclude, as far as legally possible, all terms and warranties or promises implied by law or by statutes.

We don't exclude legal responsibility for death or personal injury owing to our negligence, or legal responsibility for fraud or fraudulent misrepresentation, or for anything else where exclusion is not allowed by the law.

 

6. Uploading to our Site

If you contact other users of our site or upload material to it, you must follow our acceptable use policy, which sets out standards for usage. You can read this policy at www.astonishemail.com/acceptable-use-policy. You agree to reimburse us for any costs or expenses we incur as a result of any breach of this term.

Material you upload to Astonish, such as your campaigns, images and contact lists, stays yours. You allow us to store, copy and process it only to provide the service to you, including sending your campaigns, and as the Data Processing Agreement below describes. If anyone else claims to own the material, or says that it breaches their rights, we may give them your identity where the law requires or allows it.

We won't be legally responsible to anybody for the accuracy of material that you upload to the site, and we can remove it at any time if we think it doesn't follow our acceptable use policy.

 

7. Computer Offences

If you do anything which is a criminal offence under a law called the Computer Misuse Act 1990, your right to use the site will end straightaway. We may report you to the relevant authorities and give them your identity.

Examples of computer misuse include introducing viruses, worms, Trojans and other technologically harmful or damaging material.

You mustn't try to get access to our site or server or any connected database or make any 'attack' on the site. We won't be legally responsible to you for any damage from viruses or other harmful material that you pick up via our site.

 

8. Links to Our Site

You are allowed to make a legal link to our website's homepage from your website if the content on your site meets the standards of our acceptable use policy. We can end this permission at any time.

You mustn't suggest any endorsement by us or association with us unless we agree in writing.

 

9. Links From Our Site

Links from our site to other sites are only for information. We don't accept responsibility for other sites or any loss you suffer from using them.

 

10. Variation

We change these terms from time to time and you must check them for changes because they are binding on you.

 

11. Applicable Law

11.1 The Parties will use their best efforts to negotiate in good faith and settle any dispute that may arise out of or relate to this Agreement or any breach of it.

11.2 If any such dispute cannot be settled amicably through ordinary negotiations between the Parties, or either or both is or are unwilling to engage in this process, either Party may propose to the other in writing that structured negotiations be entered into with the assistance of a fully accredited mediator before resorting to litigation.

11.3 If the Parties are unable to agree upon a mediator, or if the mediator agreed upon is unable or unwilling to act and an alternative mediator cannot be agreed, any party may within 14 days of the date of knowledge of either event apply to LawBite to appoint a mediator under the LawBite Mediation Procedure.

11.4 Within 14 days of the appointment of the mediator (either by mutual agreement of the Parties or by LawBite in accordance with their mediation procedure), the Parties will meet with the mediator to agree the procedure to be adopted for the mediation, unless otherwise agreed between the parties and the mediator.

11.5 All negotiations connected with the relevant dispute(s) will be conducted in confidence and without prejudice to the rights of the Parties in any further proceedings.

11.6 If the Parties agree on a resolution of the dispute at mediation, the agreement shall be reduced to writing and, once signed by the duly authorised representatives of both Parties, shall be final and binding on them.

11.7 If the Parties fail to resolve the dispute(s) within 60 days (or such longer term as may be agreed between the Parties) of the mediator being appointed, or if either Party withdraws from the mediation procedure, then either Party may exercise any right to seek a remedy through arbitration by an arbitrator to be appointed by LawBite under the Rules of the LawBite Arbitration Scheme.

11.8 Any dispute shall not affect the Parties' ongoing obligations under the Agreement.

11.9 The English courts have the only right to hear claims related to our site, and all disputes are governed by English law.

 

12. Contact Us

Please email us at info@astonishemail.com to contact us about any issues. For questions about personal data, email privacy@astonishemail.com.

 

Data Processing Agreement

Last updated: October 2026

This Data Processing Agreement ("DPA") applies when you use the Astonish service to process personal data, such as the contacts you email. It forms part of the agreement between you ("Customer") and Astonish Email Ltd ("Astonish", "we", "us") under which you use the service. That agreement is made up of these terms, our Acceptable Use Policy and the plan or pay-as-you-go terms you accept when you sign up or buy credits (together, the "Agreement"). If this DPA conflicts with the rest of the Agreement on personal data, this DPA wins.

 

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where it applies to you, the EU GDPR. "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the UK GDPR. "Customer Personal Data" means Personal Data that we process for you through the service.

 

2. Roles

You are the Controller of Customer Personal Data and we are your Processor. Annex 1 describes the processing.

 

3. Your responsibilities

You are responsible for having a lawful basis for the Customer Personal Data you load into Astonish and for the emails you send with it, including the consent that the Privacy and Electronic Communications Regulations require for marketing emails. You must not load special category data (such as health data) unless you have a lawful basis to process it and it is necessary for your campaigns.

 

4. Our obligations

4.1 Instructions. We process Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we will tell you first, unless the law forbids it. The Agreement and the way you use the service's features are your instructions. We will tell you if we think an instruction breaks Data Protection Law.

4.2 Confidentiality. Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality.

4.3 Security. We maintain the measures in Annex 2. We may improve them, but we will not reduce the overall level of protection.

4.4 Sub-processors. You give us general authorisation to use sub-processors. The current list is available on request from privacy@astonishemail.com. Before we add or replace a sub-processor, we will email the account owner, and you may object on reasonable data protection grounds. If we cannot meet your objection, you may close your account. Each sub-processor is bound by data protection terms that give at least the protection this DPA requires, and we remain responsible to you for its work.

4.5 Data Subject requests. The service lets you find, export, correct and delete contacts. If you need more help answering a request from a Data Subject, we will give reasonable assistance. If we receive a request about Customer Personal Data directly, we will pass it to you.

4.6 Personal Data Breaches. We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. We will tell you what we know about it, and update you as we learn more, so that you can meet your own obligations.

4.7 Other assistance. Taking into account the nature of the processing and the information available to us, we will give reasonable help with your security, breach-notification and data protection impact assessment obligations.

4.8 Deletion. You can export your contacts at any time. When you close your account, we delete Customer Personal Data within 30 days of your written request, unless the law requires us to keep it. Copies in our backups expire within 14 days after that.

4.9 Information and audits. We will make available the information you reasonably need to show that we meet this DPA. You may audit our compliance once a year, using an independent auditor bound by confidentiality, on 30 days' notice and at your own cost. You may audit more often where a supervisory authority requires it or after a Personal Data Breach.

 

5. Transfers outside the UK

We process Customer Personal Data mainly in Germany and Ireland, which the UK recognises as adequate. Some sub-processors are in the United States. For those, we rely on the UK–US data bridge where the sub-processor is certified under it. Otherwise, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in its terms.

 

6. Liability and term

Each party's liability under this DPA is subject to the limits in the Agreement, except where the law does not allow those limits. This DPA lasts for as long as we process Customer Personal Data.

 

Annex 1: Details of the processing

Subject matter and purpose: providing the Astonish service: storing your contact lists, building and sending your email campaigns and landing pages, and reporting on them.

Duration: while you use the service, then until deletion under clause 4.8.

Nature of the processing: collection, storage, organisation, sending emails, recording delivery, open and click events, analysis for your reports, automated checks for spam and fraud, and, when you use them, AI writing features.

Data Subjects: your contacts and email recipients, people who submit forms on your landing pages, and your own staff who use the service.

Types of Personal Data: contact details (such as email address, name and company), any custom fields you add, subscription status and preferences, landing page form submissions, and engagement data (delivery, opens and clicks, with the IP address and browser of a click).

Special category data: none is intended (see clause 3).

Sub-processor categories: hosting (Germany), file storage (Ireland), email delivery (United States), network and security (United States), AI model provider (United States), error monitoring (United States), and the deliverability test server (Mail Deliveri).

 

Annex 2: Security measures

  • The service runs on dedicated servers in a data centre in Germany. Their disks are mirrored, so one disk failing does not lose data.
  • We back up the database every day to separate storage and keep each backup for 14 days.
  • Every page, login and API call uses HTTPS. Landing pages have their own certificates.
  • Passwords are stored only as salted one-way hashes, and must be at least 8 characters.
  • The API is accessed with a per-account API key.
  • Our servers accept website traffic only through our network and security provider. Administrative access goes over a private network, with key-based login.
  • Sign-in and public forms are rate-limited. Automated checks look for spam and fraud in campaigns.
  • We scan our code for security issues with automated tools.
  • Only staff who need it for support and operations can see Customer Personal Data.
  • Application errors are reported to us as they happen.
  • If we become aware of unauthorised access to Customer Personal Data, we will notify affected customers, describe what we are doing about it, and keep them updated.