Privacy Policy
This policy explains which personal data Matixs processes, why, for how long, and what rights you have. It applies to all our services and websites.
Matixs — — VAT — mail@marketingmanagers.be
1. Two roles, and why that difference matters
We process personal data in two different capacities.
As data controller for the data of our own customers and website visitors: your account details, your billing information, your support requests, and the statistics of our own sites. For that processing, we determine the purpose ourselves, and this policy applies directly to that processing.
As data processor for the data you bring into our services: your contact list, the visitors of the website we built for you, the people registering for your event, the reviews you collect. There, you determine the purpose and we are merely the executor. The arrangements for this are set out in the Data Processing Agreement. If you receive an email from one of our customers and want to know why, please contact that customer, not us.
2. What data we collect
Data you provide yourself — name, email address, phone number, company name, address, VAT number, and what you write to us in a support message.
Data generated through your use — which features you use, when you log in, which actions you perform, and the settings you save.
Technical data — IP address, browser type and version, operating system, referring page, time of your visit, and error messages. These are stored in our server and access logs.
Payment data — amount, date, subscription type, and invoice details. We never see your card number: that goes directly to Stripe.
Data from integrations you set up — see point 7.
Customer content — everything you place in the service. If this contains personal data, we process it as a processor (see point 1). If you send newsletters with Sendmanagers, we also record for each subscriber whether a message was opened and clicked; what exactly we record in this regard is set out in the appendix Privacy — Sendmanagers. If you create a dynamic QR code or short link, we record for each scan the time, the type of device, and the origin at city and country level, derived from the IP address; this processing takes place on our own servers and the statistics you see do not contain IP addresses.
Free trial page — if you request a free trial page on our website, we store your email address, the address of the website you enter and an irreversible fingerprint (hash) of your IP address (never the IP address itself). We fetch the public content of that website and have AI turn it into a new page. We use your email address to send you the link to your page, and the IP fingerprint only to limit abuse.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and delivering the service | Performance of the contract |
| Billing and accounting | Legal obligation |
| Support and communication about the service | Performance of the contract |
| Security, fraud prevention, and misuse detection | Legitimate interest |
| Improvement of our products, troubleshooting | Legitimate interest |
| Newsletters and commercial messages | Consent, or legitimate interest for existing customers |
| Cookies that are not strictly necessary | Consent |
| Creating a free trial page and emailing you the link | At your request, before any contract |
Where we rely on a legitimate interest, we have weighed whether your interests or fundamental rights do not outweigh it. You can object to such processing (see point 9).
4. Automated decision-making
We do not make decisions with legal effects for you based solely on automated processing, and we do not engage in profiling in that sense.
Some features use AI to generate suggestions — texts, translations, recommendations. These suggestions are tools: you decide what to do with them. We do not use your content to train third-party AI models, and our AI providers are contractually prohibited from doing so as well.
5. How long we retain data
| Category | Retention period |
|---|---|
| Account and profile data | For as long as your account is active, and up to 30 days after termination |
| Invoices, payments, and accounting | 7 years after the calendar year of the transaction (art. III.86 Belgian Economic Law Code) |
| Server and access logs | Maximum 12 months, for security and troubleshooting purposes |
| Support communication | 3 years after the last interaction |
| Newsletter subscriptions | Until you unsubscribe; we retain proof of consent in accordance with legal retention periods |
| OAuth tokens of connected services | Deleted immediately upon disconnection or account deletion |
| Customer content | For as long as you keep it; deleted 30 days after account termination |
| Free trial page | The page 7 days; your email address, the website address and the IP fingerprint 90 days. If you create an account, the page becomes customer content |
| Cookies | See the Cookie Policy |
After this period, we delete or anonymize the data. We may retain data longer when required by law or when a dispute is ongoing.
6. Who we share data with
We do not sell your data and do not use it for third-party advertising.
We do engage service providers who process data on our behalf. Who they are, for what purpose, and where they host, is set out in the always up-to-date list of Subprocessors. We have a data processing agreement with each of them.
In addition, we share data when required to do so by law, when necessary to defend our rights, or in the context of a merger or acquisition — in the latter case, we will notify you in advance.
7. Integrations you set up with external services
These integrations are only established because you activate them yourself via an OAuth consent screen. We only process data from accounts, pages, or profiles of which you yourself are the administrator. You can disconnect any integration at any time; we then delete the tokens immediately.
We use this data solely to provide the service to you. We do not sell it, do not share it with third parties, do not combine it with data from other customers, and do not use it for advertising or profiling.
Meta — Facebook and Instagram (Graph API). Permissions: pages_show_list, pages_manage_posts, pages_read_engagement, pages_manage_engagement, pages_read_user_content, read_insights, business_management, public_profile, and for Instagram Business instagram_basic, instagram_content_publish, instagram_manage_insights. We receive: page ID and name, Instagram account ID and username, encrypted access tokens, posted content and metadata, engagement statistics, and publicly visible profile information in interactions. We comply with the Meta Platform Terms and Developer Policies. At the request of Meta or the end user, we delete all data obtained via this API within 30 days.
LinkedIn — Community Management API. We process the identification and public metadata of the connected Company Page, the content of scheduled and published posts, and aggregated engagement statistics.
Google. See the separate appendix Integrations with Google Services, which describes the scopes and the Limited Use commitment in detail.
Microsoft. For the Outlook add-in, the appendix Privacy — Mailmanagers Outlook Add-in applies.
8. Where your data is located
Our servers are located in the European Union (Germany, at Hetzner).
Some of our service providers are established outside the European Economic Area or may process data outside it. In those cases, we rely on an adequacy decision of the European Commission or on the standard contractual clauses, supplemented with appropriate additional measures. Which supplier falls under which regime is set out in the list of Subprocessors.
9. Your rights
You have the right to:
- request access to the data we process about you;
- have it corrected when it is inaccurate or incomplete;
- have it erased, insofar as we do not have a legal retention obligation;
- have the processing restricted;
- object to processing based on a legitimate interest, and always to direct marketing;
- receive your data in a readable format or have it transferred;
- withdraw your consent, without affecting what took place before the withdrawal.
You can submit a request via mail@marketingmanagers.be. We will respond within thirty days. In the case of a complex request, we may extend this period; we will inform you accordingly. To avoid providing data to the wrong person, we may ask you to prove your identity.
If you are not satisfied with how we handle your request, you can file a complaint with the Data Protection Authority, Drukpersstraat 35, 1000 Brussels — contact@apd-gba.be.
10. Security
We take appropriate technical and organizational measures: encrypted traffic (TLS), encrypted storage of tokens and keys, access based on roles and the necessity principle, two-factor authentication, bot detection, logging and monitoring, and regular backups. The precise details of how we implement this are set out in the Security Policy.
No system is completely secure. If you discover a vulnerability, please report it via mail@marketingmanagers.be; we treat such reports confidentially and take no action against anyone reporting in good faith.
In the event of a data breach posing a risk to data subjects, we will report it to the Data Protection Authority within 72 hours of becoming aware of it, and in the case of a high risk, also directly to the data subjects.
11. Children
Our services are aimed at professional users and are not intended for persons under the age of sixteen. We do not knowingly collect data from children. If we discover that we have, we will delete it.
12. Data protection — contact
Questions about this policy or about the processing of your data: mail@marketingmanagers.be.
13. Changes
We may amend this policy. Each version remains available for consultation with its effective date at https://app.marketingmanagers.be/legal. In the event of a material change, we will notify you in advance.