Data privacy policy

Last updated: November 10, 2026  ·  Complements our Privacy Policy

1. Scope and roles

This Data Privacy Policy supplements the Privacy Policy and describes how Markt OS handles personal data in the specific context of a multi-tenant platform, and how data protection obligations are allocated between Markt OS, its agency customers, and the end-clients those agencies serve.

• Controller — you (the agency/officer) determine the purposes of processing for the content and data you manage within your workspace(s). In most processing, you act as the data controller.
• Processor — Markt OS processes personal data on your behalf solely to provide the Service and on your documented instructions.

2. Categories of data subjects and data

The Service may process personal data relating to:

• Your team members (name, email, role, activity);
• Your clients and end-consumers whose data appears in content, comments, or analytics you import;
• Visitors to pages and landing assets you publish.

3. Lawful basis and instructions

You are responsible for ensuring you have a lawful basis to process the personal data you submit. By using the Service, you instruct Markt OS to process such data for the purpose of providing, securing and supporting the Service. We will not use your data for any purpose other than providing the Service, unless required by law.

4. Data protection measures

• Encryption — data encrypted in transit (TLS 1.2+) and sensitive fields (API keys, tokens, credentials) encrypted at rest with AES-256.
• Access control — role-based access implemented on the principle of least privilege; multi-factor authentication for administrators.
• Tenant isolation — logical separation of each organisation's workspace and data.
• Logging & audit — immutable audit trail of security-relevant events.
• Backups — regular encrypted backups with controlled restoration.

5. Sub-processors

We may use sub-processors (hosting, payments, email, AI providers) to deliver the Service. We maintain an up-to-date list upon request and require sub-processors to meet data-protection standards commensurate with this policy. Where an AI provider is used to process your content, processing is limited to the specific request and subject to that provider's data terms.

6. Data subject requests

If we receive a request from a data subject (access, rectification, erasure, portability, objection), we will notify you where feasible and assist you in responding, as required by applicable law. You are responsible for handling such requests for data you control.

7. Data breach notification

In the event of a personal data breach, we will notify affected customers without undue delay and, where required, the relevant supervisory authority, in accordance with applicable law.

8. Region-specific notices

• EEA/UK (GDPR) — we act as processor; a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses is available on request for cross-border transfers.
• California (CCPA/CPRA) — we do not "sell" or "share" personal information as defined by California law; California residents have rights to access, delete, and request correction of their data.
• Kenya (DPA 2019) — registration and processing comply with the Data Protection Act; data subjects may lodge complaints with the Office of the Data Protection Commissioner.
• Other jurisdictions — we apply substantially similar safeguards globally and adapt to local requirements as applicable.

9. Contact

For data-privacy enquiries, data subject requests, or to request our DPA, contact support@markt.app.