Mailgun: DPA, subprocessors and data location

Where to find the Mailgun DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: transactional email delivery. The table is the short version; the sections below add detail.

Mailgun at a glance

Notes on Mailgun

Mailgun's own DPA page is the former Sinch Email DPA, last revised 16 January 2023, and it points to the current Sinch DPA (version 8, released 29 October 2025). The current DPA never names Mailgun and does not say how it is accepted.

The DPA gives 30 days' notice of a new sub-processor and 10 business days to object (section 13(b)). The list is shared across Sinch services, and the Google row says Mailgun is hosted in the EU (Germany and Belgium) for EU customers and in the USA for US customers.

Section 3(a)(iv) makes Sinch an independent controller for communication services, which sits next to the processor role in section 4(a).

Mailgun DPA: where to find it and how it is accepted

Read the DPA on sinch.com. The DPA forms part of the Principal Agreement. The page does not describe a signing or click-through step. Version 8, released 29 October 2025. The DPA does not name Mailgun. Mailgun's own DPA page (mailgun.com/legal/dpa) is the former Sinch Email DPA, last revised 16 January 2023, and points to the newer one at sinch.com..

Not stated in the source we checked (2026-10-17).

The DPA applies to the Services under the Principal Agreement (section 1.f) and does not list plans or name Mailgun.

Mailgun subprocessors: the list and how change notices reach you

Mailgun's subprocessor list.

How changes are announced: Update to the Sinch sub-processor page; notification by subscription (mechanism not readable).

Notice before a new subprocessor starts: 30 days.

Section 13(b): provided you subscribe through the mechanism on the sub-processor page, Sinch notifies you thirty (30) days in advance of adding or replacing a sub-processor. Annex 1 paragraph 3 (SCC clause 9(a)) also states at least thirty (30) days' advance written notice of intended changes to the list.

If the objection is not resolved within a reasonable period, either party may terminate the Principal Agreement for cause (section 13(b)).

Where Mailgun stores data

• EU (Germany and Belgium) for EU customers
• USA for US customers

On Sinch's sub-processor page, the Google LLC row says its cloud datacenters host Mailgun in the EU (Germany and Belgium) for EU customers and in the USA for US customers. The DPA itself names no locations; section 12 describes intra-group transfers as necessary to provide the Services globally. The page does not say how a customer is assigned to a region.

How Mailgun moves data outside the EU and UK

• SCCs (Modules 2 and 3)
• UK Addendum
• DPF and UK Extension (listed for Sinch Email)

Section 12 and Annex 1: EU SCCs with Modules 2 and 3, Swedish law and courts, and the UK Addendum. Section 12(d)(2) lists the EU-US DPF and UK Extension for "Sinch Email" only. The DPA names no Swiss-specific mechanism.

Is Mailgun a processor or a controller?

Both: processor for some data, controller for other data.

Section 4(a): Sinch is a processor, or a sub-processor where you are a processor. Section 3(a)(iv): for communication services Sinch acts as an independent controller. The DPA does not say whether Mailgun email falls under that carve-out.

Is Mailgun GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Mailgun's own documents say:

• A DPA is published: The DPA forms part of the Principal Agreement. The page does not describe a signing or click-through step. Version 8, released 29 October 2025. The DPA does not name Mailgun. Mailgun's own DPA page (mailgun.com/legal/dpa) is the former Sinch Email DPA, last revised 16 January 2023, and points to the newer one at sinch.com.
• A subprocessor list is published.
• Notice of new subprocessors: 30 days. Section 13(b): provided you subscribe through the mechanism on the sub-processor page, Sinch notifies you thirty (30) days in advance of adding or replacing a sub-processor. Annex 1 paragraph 3 (SCC clause 9(a)) also states at least thirty (30) days' advance written notice of intended changes to the list.
• Transfer mechanisms named: SCCs (Modules 2 and 3), UK Addendum, DPF and UK Extension (listed for Sinch Email).
• Data locations named: EU (Germany and Belgium) for EU customers, USA for US customers.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Mailgun to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Mailgun, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Mailgun | Transactional email delivery | EU (Germany and Belgium) for EU customers; USA for US customers | SCCs (Modules 2 and 3); UK Addendum; DPF and UK Extension (listed for Sinch Email) | [DPA](https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/) | [Subprocessors](https://sinch.com/legal/data-protection-agreement-sub-processors/) |

Add to my list

If you add or replace Mailgun: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

Mailgun states 30 days of notice before it adds a subprocessor. Section 13(b): provided you subscribe through the mechanism on the sub-processor page, Sinch notifies you thirty (30) days in advance of adding or replacing a sub-processor. Annex 1 paragraph 3 (SCC clause 9(a)) also states at least thirty (30) days' advance written notice of intended changes to the list. If your own customers were promised a longer notice, you have a gap to plan for.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Sinch's DPA (version 8, 29 October 2025) and sub-processor page. Mailgun's own DPA page is the former 2023 version.

2026-10-17

Re-checked section 13(b), Annex 1 and the sub-processor list against the full text. Clarified that the section 13(b) notice is tied to subscribing.

Related vendors

• Email delivery
• SendGrid Transactional email delivery
• Resend Transactional email delivery
• Brevo Email and SMS marketing and transactional messaging
• All vendors

Sources and method

• https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/ checked 2026-10-17
• https://sinch.com/legal/data-protection-agreement-sub-processors/ checked 2026-10-17

Facts come from Mailgun's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.mailgun.com.