Data Processing Addendum

This English translation is provided for convenience. If it differs from the Hungarian version, the Hungarian text prevails.

Service provider and data controller

Trackie.io Kft.
Registered office: 1025 Budapest, Ruthén út 28.
Tax number: 28963271-2-41
Company registration number: 01-09-377556
Registering authority: Company Registry Court of the Metropolitan Court of Budapest
Customer support and privacy requests: support@maildeck.pro

Appointment and scope

The company accepting the Terms is the controller, and the provider is the processor for personal data processed on the customer's instructions. The customer selects and checks the lawfulness of target countries, recipients and campaigns; the application's country list does not replace this assessment. The appointment lasts for the service relationship and the subsequent return or deletion process. It covers discovering, storing, organising, importing and exporting contacts, delivering emails and handling unsubscribe requests. Data subjects are contacts and recipients. Data may include names, business contact details, source pages, campaign content, delivery data and unsubscribe data. Uploading special-category or criminal-offence data is not permitted.

Instructions and protection

Actions performed by the customer in the application and verifiable written requests are documented instructions. The processor processes data only according to those instructions and transfers them to a third country only under an appropriate instruction and lawful safeguard. Where the law requires different processing, the processor informs the customer in advance unless the law prohibits it. The processor promptly alerts the customer if it considers an instruction unlawful.

People with access to the data are bound by confidentiality. The processor applies security appropriate to the risk and regularly assesses its effectiveness. The applicable technical and organisational measures are: The application stores password verification values, uses HttpOnly session cookies and enforces workspace-level authorisation. Under the deployment configuration, MongoDB is accessible only on an internal container network. SMTP connections require TLS protection. The provider must limit and regularly review access according to operational need, ensure confidentiality obligations for its personnel and subprocessors, and maintain documented backup, recovery and incident-response procedures. The 90-day maximum in the retention schedule applies to the phasing out of backups.

Subprocessors

The customer grants general authorisation for the use of the published subprocessors: Hetzner Online GmbH (Germany; hosting and database infrastructure in Helsinki, Finland): storage of account data, contacts, campaigns and sessions. Elastic Email Inc. (Canada; SMTP email delivery): sender details, recipient email address, email content and delivery data. The provider's public security information identifies data centres in the EU, the United States and Canada. OpenAI API processes target-market descriptions and search terms for the built-in discovery service. Customers may configure their own SMTP provider. Revolut's hosted payment service processes payments under its own terms.

The provider gives advance notice of a new or replacement subprocessor so the customer may object before the change. The provider imposes the same data-protection obligations on its subprocessor and remains responsible for its performance. The customer is responsible for the terms of external services contracted directly through its own account.

Assistance, incidents and audits

The processor assists with data subject requests, security obligations, impact assessments and consultations with authorities. It notifies the customer of a personal-data breach without undue delay after becoming aware of it and provides the available facts, likely consequences and measures. It supplies information demonstrating compliance and permits audits by the customer or its appointed auditor, including inspections.

End of the appointment

At the end of the service, the processor returns or deletes the data at the customer's choice and deletes copies unless retention is required by law. Performance and the phasing out of backups are documented under the published retention schedule: Account, contact, campaign and delivery data are processed for the duration of the service relationship. On termination, the data are returned or deleted at the customer's choice, with final deletion completed within 30 days. Data are phased out of backups within 90 days; earlier deletions are reapplied after a restore. Contractual evidence and accepted document copies are retained for 5 years after the end of the relationship, and accounting records for at least 8 years. Evidence required for an ongoing legal claim may be retained until the dispute is resolved, subject to individual review. A session remains valid for no more than 30 days and is revoked on sign-out. The minimum data required to honour unsubscribe suppression are retained during the service relationship, then handed to the customer and deleted on termination. Deletion and data requests may be initiated at support@maildeck.pro and are carried out through support.

This document can be saved or printed from your browser.