Questo documento è disponibile in inglese (versione vincolante) e in olandese. English · Nederlands
Visitors can leave their details on your card. You're the controller of that data and we're the processor. This agreement comes with your subscription and covers what the GDPR, the UK GDPR and the UAE PDPL require. This English text is the binding version.
1. Parties and subject
You (the customer, as controller) and MP Agency, registered in Dubai, United Arab Emirates (as processor). On your behalf we process the contact details visitors leave on your card and your card's statistics, only to provide the service and for as long as your subscription runs or your free card exists.
2. Data and data subjects
Data subjects: visitors to your card. Data: name, email, phone, company, note and time of consent. Also usage data without an ID or IP address: date and time, how the visitor arrived, country and city, device type and operating system, and which button was tapped.
3. Our obligations
We only process on your instructions, as set out in the terms and this agreement, and never for our own purposes. We keep the data confidential and only let staff near it who need it for their work and are bound to confidentiality.
We secure the data appropriately: encrypted connections, per-customer access rules in the database and an admin that re-checks every action. We help you with data subject requests (access, correction, deletion, export) and with a data protection impact assessment if you have to do one.
We report a data breach affecting this data to you within 48 hours of discovering it, with what we know and what we're doing.
4. Sub-processors and transfers
Of the parties in section 6 of the privacy policy, three touch this data: Supabase (database and storage, Frankfurt, EU), Vercel (hosting, US, worldwide network) and Resend (email alerts about new contacts, US). We announce new sub-processors by email at least thirty days in advance; you can object and then cancel.
If you switch on a webhook or a connection to your CRM in Settings, we send new contacts, on your instruction, to the service you choose. That service isn't our sub-processor but a recipient you appoint; you make your own arrangements with it.
MP Agency is based in the UAE and works with the data from there. The UAE has no adequacy decision from the EU or the UK. If you're established in the EU, the European Commission's standard contractual clauses (Decision 2021/914, module two: controller to processor) form part of this agreement, with you as data exporter and MP Agency as importer. If you're established in the UK, the ICO's International Data Transfer Addendum applies as well. In case of conflict, those clauses prevail.
Vercel and Resend are covered by the EU-US Data Privacy Framework or by the standard contractual clauses in their data processing agreement with us. If you're established in the UAE, this agreement is the processor contract the PDPL requires.
5. End
When your subscription ends, we pause your card. Six months later we delete the card with its contacts and statistics. If you delete your account yourself, everything is gone straight away. Until then you can download your contacts as CSV. After that we keep nothing, except what the law obliges us to keep.
6. Audit
On request we give you the information needed to show we keep to this agreement. If that isn't enough, you, or an independent auditor on your behalf, may audit us at most once a year, by appointment and at your own cost.
7. Liability and term
Section 15 of the terms applies to liability, except where the standard contractual clauses say otherwise. This agreement runs for as long as your subscription runs and for as long as we still keep data for you after that.