Data Processing Agreement

This data processing agreement is an appendix to the General Terms and Conditions and automatically takes effect when you accept them. You do not need to sign it separately. If you would still like a signed copy containing your company details, you can request one via mail@marketingmanagers.be.

1. Parties and roles

Data controller — you, the Customer. You determine why and how the personal data that you bring into our services is processed.

Processor — Matixs, , VAT . We process that data solely on your instructions.

This agreement does not apply to the data for which we ourselves are the controller — your account details, your billing information, your support requests. The Privacy Policy applies to that data.

2. Subject matter, duration and nature of the processing

Subject matter — the provision of the services to which you have a subscription.

Duration — for as long as your agreement with us runs, plus the retention periods set out in point 9.

Nature and purpose — storage, consultation, structuring, display, transmission and deletion of personal data, to the extent necessary to perform the functions you have chosen.

Categories of data subjects — depending on the services you use: your contacts and email recipients, visitors of websites we built for you, individuals registering for your events, customers who leave reviews, users of your social channels, individuals scanning a QR code or short link of yours, and your own employees to whom you have granted access.

Categories of data — identification data, contact data, professional data, communication content, behavioural and usage data, and any other data that you yourself decide to enter.

We expressly ask you not to enter any special categories of personal data within the meaning of Article 9 GDPR into our services — health data, data concerning political, religious or sexual beliefs, biometric data — nor data relating to criminal convictions. If you do so anyway, this is done at your own responsibility, and it is for you to assess whether our measures are sufficient for that purpose.

3. Your obligations

You warrant that:

you have a valid legal basis for the data you place with us;
you have correctly informed the data subjects, including about the fact that we act as processor;
your instructions to us are lawful;
the data you provide is accurate and not excessive.

4. Our obligations

We process the data solely in accordance with your documented instructions. Your use of the services and your settings therein constitute such instructions. If Union law or Belgian law requires us to carry out processing beyond this, we will notify you in advance, unless such notification is legally prohibited.

If we believe that an instruction from you infringes the GDPR, we will inform you accordingly.

We ensure that anyone with access to the data at our organisation is bound by confidentiality.

5. Security

We take appropriate technical and organisational measures, including:

encryption of data in transit (TLS) and encrypted storage of tokens, keys and passwords;
access based on roles and the need-to-know principle, with two-factor authentication for administrator access;
separation of environments, so that testing never takes place on production data;
logging, monitoring and detection of anomalous behaviour;
daily, encrypted backups within the European Union, with recovery procedures;
periodic evaluation of these measures.

The Security Policy elaborates on this further. We may adjust these measures provided that the level of protection does not decrease as a result.

6. Sub-processors

You give us a general authorisation to engage sub-processors. The current list is available at https://app.marketingmanagers.be/legal/subprocessors, stating the purpose and location of establishment for each party.

We impose the same obligations on every sub-processor as those that apply here, and we remain liable to you for their actions.

If we add or replace a sub-processor, we will announce this at least thirty days in advance. If you have a reasonable, data-protection-based objection, let us know within that period. If we cannot find a solution together, you may terminate the service concerned effective on the date the change takes effect, with reimbursement of the unused portion.

7. Transfers outside the EEA

Our production environment is located in the European Union. Where a sub-processor processes data outside the EEA, we rely on an adequacy decision of the European Commission or on the standard contractual clauses, supplemented by appropriate additional measures. Which party falls under which regime is stated in the sub-processor list.

8. Assistance

We assist you, in proportion to the nature of the processing and with the information available to us:

in responding to requests from data subjects — access, rectification, erasure, restriction, portability, objection. If we receive such a request directly, we will refer the data subject to you and notify you accordingly;
in carrying out a data protection impact assessment and in prior consultation with the supervisory authority;
in complying with your security and notification obligations.

For assistance that significantly exceeds the ordinary scope of our services, we may charge a reasonable fee. We will notify you of this in advance.

9. Data breaches

If a personal data breach is identified at our organisation, we will notify you without undue delay and no later than within forty-eight hours of becoming aware of it, providing the information available to us at that time: the nature of the breach, the categories and numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. If information is not yet available, we will provide it in phases.

Notification to the supervisory authority and, where necessary, to the data subjects is your responsibility as controller. We will support you in this.

10. Retention and deletion after termination

After the end of your agreement, your data will remain available for thirty days so that you can export it. After that, we will delete it from the production environment.

Backups that still contain the data expire according to their own rotation schedule and will be overwritten no later than ninety days after termination. Our obligations under this agreement continue to apply during that period.

We retain longer what we are legally required to retain, such as billing data.

11. Audit

Upon request, we will make available to you the information necessary to demonstrate compliance with this agreement.

If you wish to have an audit carried out, you must announce this at least thirty days in advance. The audit will take place during office hours, must not disrupt our service provision, may take place at most once per calendar year except following an incident or at the request of a supervisory authority, and the auditor must be bound by confidentiality. You bear the costs, unless the audit reveals a material shortcoming on our part.

12. Liability and final provisions

The liability arrangements set out in the General Terms and Conditions also apply to this agreement, to the extent permitted by Article 82 GDPR.

In the event of a conflict between this data processing agreement and the General Terms and Conditions, this data processing agreement shall prevail, but only with regard to the processing of personal data in our role as processor.

This agreement is governed by Belgian law.