Data processing addendum

Roles

For personal data that you collect through your cards, such as leads, and for the contact details you place on cards, you are the controller (or the business) and Hello Marketing is your processor (or service provider). Resellers are controllers of their own customer data and processors for their customers, and we act as their sub-processor.

What we process, and why

• Subject matter: running your cards, lead capture, analytics and exports.
• Types of data: names, contact details, messages, job and company information, and usage events.
• People: you and your team, your customers, and the visitors who view or submit a form on your cards.
• Duration: while your account is open, plus the deletion period below.

Our commitments

• We process personal data only on your documented instructions, which are these terms and your use of the product, unless the law requires otherwise.
• People on our team who can access the data are bound by confidentiality.
• We use technical and organisational security measures described on our Security page, including encryption in transit and access controls on the database.
• We help you respond to requests from individuals, for example through lead export and deletion features, and by contacting us.
• We tell you without undue delay if we become aware of a breach of personal data that affects you.
• We help with your data protection assessments and with consulting regulators where reasonably needed.

Sub-processors

You authorise us to use the sub-processors below. We will update this page before adding or replacing one, and you may object on reasonable data protection grounds by contacting us; if we cannot resolve it, you may close your account.

• Supabase, Inc.: database, authentication and file storage. Location: Mumbai, India.
• Vercel Inc.: website hosting and content delivery. Location: United States and a global network.
• Payment, email delivery and support providers: will be added here before they process your data.

International transfers

Data may be processed in India and the United States. Where the law requires a transfer mechanism, such as the EU Standard Contractual Clauses or the UK addendum, they are incorporated by reference into this addendum for transfers from the EU, the UK or Switzerland, with you as exporter and us as importer.

Return and deletion

You can export leads and delete cards and your account at any time. After your account ends we delete personal data processed for you within 30 days, except where the law requires us to keep it, and backups are overwritten on their normal cycle.

Audits

On reasonable written request, and no more than once a year, we will give you information needed to show we meet this addendum. If that is not enough, we will agree a reasonable way of auditing that protects other customers' data.

Contact

For data protection questions, contact Hello Marketing through our contact page with the topic “Legal, privacy or grievance”.