Maqetin processes your customers' personal data as your processor.

The data processing agreement and the privacy policy hold the terms. This page points to the clause for each topic.

Who decides.

Roles: For the personal data you send about your customers, you are the controller and Maqetin is your processor. (Clause 1)
Instructions: Maqetin processes personal data only on your documented instructions. (Clause 2)
Special categories: Maqetin is not designed for special categories of data, and customers agree not to send it. (Privacy policy)
Laws: The agreement follows the GDPR and the UK GDPR, and is governed by the laws of Ireland. (Clause 13)

Storage: Personal data is stored in the European Union. (Clause 9)
Transfers: When personal data moves out of the European Economic Area, the United Kingdom or any other jurisdiction whose law restricts transfers, Maqetin and its subprocessors use a transfer mechanism that data protection law accepts, such as an adequacy decision, the EU standard contractual clauses or the UK International Data Transfer Addendum. For every transfer out of the European Economic Area or the United Kingdom the standard contractual clauses apply, and where the recipient in the United States takes part in the EU-U.S. Data Privacy Framework, the transfer also relies on it. (Clause 9)
Subprocessors: Hetzner Online, Cloudflare and PostHog are listed in the agreement, and Maqetin emails you at least 30 days before the list changes. (Subprocessors)

Requests: You can find, export and delete any person's data through the API, and correct it with an identify call, so you can answer their requests yourself. (Clause 7)
Requests sent to Maqetin: A request that reaches Maqetin directly is passed to you without delay. (Clause 7)
Deletion: Deleted data remains in encrypted backups until they expire, within 35 days. (Clause 10)
When the service ends: When the terms of service end, you have 30 days to export your data. Maqetin then deletes it. (Clause 10)

Breach notice: If Maqetin becomes aware of a breach affecting your personal data, it tells you without undue delay, and within 48 hours, so you can meet your own 72-hour duty to report it. (Clause 8)
Audits: Maqetin gives you the information you reasonably need to show that it meets the agreement, including written answers to security questionnaires. (Clause 11)

Measures: Maqetin keeps every workspace's data separate, encrypts data in transit and backups, records every request staff make inside a workspace and keeps credentials in a secrets manager. (Security and privacy)