GDPR & Data Processing

1. Overview

This page outlines how Markt complies with the General Data Protection Regulation (GDPR) and serves as the Data Processing Agreement (DPA) between you (the "Data Controller") and Markt (the "Data Processor").

When you use Markt to send emails to your contacts, you are the Data Controller who determines the purposes and means of processing personal data. Markt acts as a Data Processor, processing data only as instructed by you.

2. Scope of Processing

2.1 Categories of Data Subjects

• Your email recipients and contacts
• Your team members and account users

2.2 Types of Personal Data Processed

• Email addresses
• Names (first and last)
• Custom contact fields you define
• Email engagement data (opens, clicks, bounces)
• IP addresses and user agent strings (for tracking)
• Unsubscribe and suppression records

2.3 Purpose of Processing

We process personal data solely to provide the email marketing services you have requested: sending campaigns, tracking engagement, managing contacts, processing webhooks, and maintaining suppression lists.

3. Your Obligations as Data Controller

As the Data Controller, you are responsible for:

• Ensuring you have a valid legal basis for processing contact data (consent, legitimate interest, etc.)
• Providing appropriate privacy notices to your contacts
• Honoring unsubscribe and data deletion requests from your contacts
• Ensuring contact data you upload is collected lawfully
• Not uploading data of individuals under 16 without parental consent

4. Our Obligations as Data Processor

Markt commits to:

• Process personal data only on your documented instructions
• Ensure personnel with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist you in responding to data subject requests (access, rectification, deletion, portability)
• Notify you of personal data breaches without undue delay (within 72 hours)
• Delete or return all personal data upon termination of the service, at your choice
• Make available information necessary to demonstrate compliance

5. Sub-processors

We use the following categories of sub-processors to deliver the Service:

We will notify you before adding or replacing sub-processors. You may object to a new sub-processor within 14 days of notification.

6. Security Measures

We implement the following measures to protect personal data:

• Encryption in transit: All connections use TLS 1.2 or higher
• Encryption at rest: Sensitive data encrypted with AES-256
• Access control: Role-based permissions, team-scoped data isolation
• Webhook security: HMAC-SHA256 signed payloads
• API security: Sanctum token authentication with rate limiting
• Monitoring: Automated detection of unauthorized access attempts
• Backups: Encrypted daily backups with point-in-time recovery

7. International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Data transfer impact assessments where required

8. Data Subject Rights

We provide tools to help you fulfill data subject requests:

• Right of access: Export contact data via the dashboard or API
• Right to rectification: Edit contact records at any time
• Right to erasure: Delete contacts individually or in bulk; data is removed within 30 days
• Right to data portability: Export data in CSV or JSON format
• Right to object: Contacts can unsubscribe via every email's unsubscribe link

9. Data Breach Notification

In the event of a personal data breach that affects your data:

• We will notify you within 72 hours of becoming aware
• Notification will include: nature of the breach, categories of data affected, approximate number of records, likely consequences, and measures taken
• We will cooperate fully with your investigation and regulatory reporting obligations

10. Data Retention and Deletion

• Contact data is retained as long as your account is active
• Campaign logs and analytics are retained for 12 months
• Upon account deletion, all personal data is removed within 30 days
• Encrypted backups containing your data are purged within 90 days

11. Audits

You may request information to verify our compliance with this DPA. We will provide reasonable assistance and access to information necessary for audits, subject to confidentiality obligations and reasonable advance notice.

12. Contact

For GDPR or DPA-related inquiries, contact our data protection team at [email protected].