Data Processing Terms

These terms apply when your plnk page collects emails with the sign-up form. For that list, you are the controller (you decide why and how it’s used) and plnk is your processor (we store it for you). They are part of our Terms of Service and meet the requirements of Article 28 of the GDPR. If they conflict with the Terms, these terms win for subscriber data. Visit analytics are different: plnk decides how they work, so plnk is responsible for them, as explained in our Privacy Policy.

1. What we process

• Whose data: visitors who sign up on your page.
• Which data: their email address, when they signed up, and which page they used.
• What we do with it: store it, show it to you in your dashboard, and let you export or delete it.
• For how long: while your account exists, or until you delete the entries.

2. Only on your instructions

We process subscriber data only to provide this service to you: these terms and what you do in your dashboard are your instructions. We don’t use the list for anything else, don’t email your subscribers, and never sell it. If the law requires us to do something else with it, we tell you first unless the law forbids that. If we think an instruction breaks data protection law, we tell you.

3. Confidentiality and security

Only the person who runs plnk can access the data, and only when needed to run or support the service; anyone helping in future will be bound by confidentiality. The data travels over encrypted connections and is kept on our providers’ secured, monitored systems, with access limited and backups that roll over.

4. Sub-processors

You agree we can use these providers for subscriber data, each under a data processing agreement with the same protections as these terms:

We’ll update this list at least 14 days before adding or replacing a provider. If you object, tell us; if we can’t address it, you can export your list and close your account. Where a provider is a US company, transfers are covered by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. Helping you

• Subscriber requests: you can find, export and delete any subscriber yourself in your dashboard. If a subscriber contacts us directly, we pass it on to you.
• Breaches: if a breach affects your subscribers’ data, we tell you without undue delay, and within 48 hours of finding out, with what we know, so you can meet your own 72-hour duty.
• Compliance: we answer your reasonable questions about how we protect the data and help with any assessment you need to do. Audits beyond that are possible with reasonable notice, at your cost, at most once a year.

6. When it ends

When you delete your account, we delete your subscriber lists; copies in backups are gone within about 30 days. Export your list first if you want to keep it.

7. Your part

You’re responsible for having a lawful reason to collect and use the emails (usually the subscriber’s consent), for telling subscribers who you are and how you’ll use their email, for only emailing people who signed up, and for honouring unsubscribes.

8. Contact

Questions about these terms? Email hello@plnk.bio.