GDPR & Data Processing Agreement

The General Data Protection Regulation (EU 2016/679) governs the processing of personal data of people in the EU/EEA, strengthening the rights of data subjects and the obligations of those who process data.

When you send campaigns through Linkato, you are the controller of your contacts’ data and Linkato acts as a processor, processing it under your documented instructions. For your account data, Linkato is the controller (see Privacy).

• Appropriate technical and organizational security measures.
• Tools to manage consent, unsubscribe and data-subject rights.
• Prompt notification of any data breach affecting us.
• Transparency about sub-processors and international transfers.

• Identify a valid legal basis for each send (usually consent).
• Provide a clear privacy notice to your contacts.
• Collect and keep proof of consent.
• Honor access, rectification and erasure requests promptly.
• Enter into this DPA and, where needed, the Standard Contractual Clauses.

The subject matter is the provision of the Linkato service; the duration matches the contract. Nature and purpose: sending, storing and processing the Customer’s communications and contacts.

• Data subjects: the contacts/subscribers in the Customer’s lists.
• Data categories: identifying and contact data, custom fields defined by the Customer, engagement data (opens, clicks).
• No special categories of data are processed unless the Customer instructs otherwise with an appropriate legal basis.

Linkato processes data only on the Customer’s documented instructions, ensures confidentiality of authorized staff, applies appropriate security measures, and assists the Customer with data-subject and authority obligations. The Customer warrants the lawfulness of the data and instructions.

The Customer authorizes the use of sub-processors. We keep an up-to-date list and will inform the Customer of material changes, allowing objection on reasonable grounds. The indicative list is set out in the Privacy Policy.

Any transfers outside the EEA take place with appropriate safeguards (Standard Contractual Clauses or recognized frameworks). On request we provide information about the safeguards applied.

Upon reasonable request we make available the information needed to demonstrate compliance. At the end of the contract we delete or return the data processed on the Customer’s behalf, subject to legal retention obligations.

For the DPA or GDPR questions: privacy@linkato.ai — AMAZ ONLINE SRLS, Via Raffaello Sanzio 23, 62027 San Severino Marche (MC), Italy.