How Maqetin processes the personal data of your customers on your behalf. This agreement forms part of our terms of service and applies automatically to every workspace. If you need a countersigned copy, ask us.
1.1For the personal data you send to Maqetin about your customers, prospects and visitors, you are the controller and Maqetin is your processor.
1.2"Data protection law" means every law on personal data that applies to the processing under this agreement, including, where each applies, the General Data Protection Regulation (EU) 2016/679, the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act.
2.1We process personal data only on your documented instructions. Those instructions are this agreement, the terms of service, and what you set up in Maqetin: the events you send and the segments and journeys you build. We may also produce statistics about how Maqetin performs, as the terms of service allow, so long as they identify no customer and no person.
2.2If the law requires us to process data in another way, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.
| Purpose | Recording what your customers do in your apps, keeping a profile for each, and sending the messages you set up |
| People | Your customers, prospects, and visitors to your websites and apps |
| Personal data | Identifiers, contact details, traits you send, events and their details, device context, marketing-email choices and message records |
| Special categories | None. You agree not to send them |
| How often | Continuously, while your workspace is active |
| Duration | For as long as the terms of service are in force, then until deletion under clause 10 |
4.1Everyone at Maqetin who can access your personal data is bound by a duty of confidentiality, and has access only where their work requires it.
4.2Our staff can act in a workspace for up to 30 minutes at a time, only to support you or keep Maqetin secure and only with a stated reason, with the access of the workspace owner: reading, editing templates and journeys, sending test mail and deleting contacts. They can do this in a suspended workspace too. They cannot create or revoke an API key or an invite while they do. Every request they make is recorded: who made it, which workspace, the method, the route, the request id, the ids in the path and the status, and never the URL's query string or a body.
5.1We keep technical and organisational measures in place that are appropriate to the risk, including:
5.2We may improve these measures over time, but we will not reduce the overall level of protection. Our security page describes the separation, the staff record and the API keys in more detail.
6.1You authorise us to use these subprocessors:
| Subprocessor | What it does | Where |
|---|---|---|
| Hetzner Online | Servers and databases | European Union |
| Cloudflare | Network edge, link redirects, click tracking, file storage | Global network |
| PostHog | Error tracking for our services | United States |
6.2Each subprocessor is bound by a written contract with data protection terms at least as strong as this agreement, and we remain responsible for its work.
6.3We will tell you by email at least 30 days before we add or replace a subprocessor. If you object on reasonable data protection grounds, we will work with you to find a solution, and if we cannot, you may end the affected service without penalty.
7.1Maqetin lets you find, export and delete any person's data through the API, and correct it with an identify call, so you can answer their requests yourself. If a request reaches us directly, we pass it to you without delay and do not answer it ourselves unless you ask us to.
7.2We give you the information you reasonably need for data protection impact assessments and for consultations with a regulator.
8.1If we become aware of a breach affecting your personal data, we will tell you without undue delay, and within 48 hours, so you can meet your own 72-hour duty to report it.
8.2We will tell you what happened, the data and people affected, the likely consequences, and what we have done and will do about it, and we will keep you updated as we learn more.
9.1We store personal data in the European Union. When personal data moves out of the European Economic Area, the United Kingdom or any other jurisdiction whose law restricts transfers, we and our subprocessors use a transfer mechanism that data protection law accepts, such as an adequacy decision, the EU standard contractual clauses or the UK International Data Transfer Addendum.
10.1When the terms of service end, you have 30 days to export your data. We then delete it from our databases. Copies in message queues expire within 14 days and in backups within 35 days.
10.2Deleted data remains in encrypted backups until they expire, within 35 days, and is not restored from them except to recover from a disaster, and then we delete again what the customer deleted.
10.3Apart from what this clause and the privacy policy say, we keep data longer only where the law requires us to, and only for as long as it requires.
11.1We will give you the information you reasonably need to show that we meet this agreement, including written answers to security questionnaires.
11.2If that is not enough, you may audit our compliance once a year, with at least 30 days' notice, during business hours, at your own cost, and under a confidentiality agreement. A regulator may audit whenever the law allows.
12.1If this agreement and the terms of service conflict on the processing of personal data, this agreement takes priority.
13.1This agreement, and any dispute or claim about the processing of personal data under it, is governed by the laws of Ireland.
13.2The courts of Ireland have exclusive jurisdiction over disputes under this agreement.
13.3Where the EU standard contractual clauses apply to a transfer, they are also governed by the laws of Ireland, and disputes under them go to the courts of Ireland. A person whose data is processed may still bring a claim in the courts of the EU country where they live, as those clauses allow.
13.4Where the UK International Data Transfer Addendum applies, it is governed by the laws of England and Wales, as the addendum requires.
13.5For everything under this agreement, this section applies instead of the law and disputes section of the terms of service.
| Version | In effect from | What changed |
|---|---|---|
| 1.0 | 18 October 2026 | First published. |